Uncaught Error: EvalError: Code generation from strings disallowed for this context

[tylerscave]

I am attempting to deploy our project through Shopify Oxygen with GitHub Actions and am getting the following error from the @builder.io/react package due to the use of eval...

Uncaught Error: EvalError: Code generation from strings disallowed for this context

Here is the full error for completeness:

🛠️ Building the application... 
yarn run v1.22.19
$ shopify hydrogen build
[STARTED] Building client code
Use of eval is strongly discouraged, as it poses security risks and may cause issues with minification
Use of eval is strongly discouraged, as it poses security risks and may cause issues with minification
Use of eval is strongly discouraged, as it poses security risks and may cause issues with minification
Use of eval is strongly discouraged, as it poses security risks and may cause issues with minification
[TITLE] Built client code
[SUCCESS] Built client code
[STARTED] Building worker code
Use of eval is strongly discouraged, as it poses security risks and may cause issues with minification
Use of eval is strongly discouraged, as it poses security risks and may cause issues with minification
Use of eval is strongly discouraged, as it poses security risks and may cause issues with minification
Use of eval is strongly discouraged, as it poses security risks and may cause issues with minification
[TITLE] Built worker code
[SUCCESS] Built worker code
Done in 22.01s.
✅ Done in 22.16s.

🚀 Uploading deployment files... 
🛑 InvalidScriptError: retrying will not succeed. The following error must be actioned:

Uncaught Error: EvalError: Code generation from strings disallowed for this context
  at worker.mjs:2203:68269
Error: Process completed with exit code 1.

[teleaziz]

Hi @tylerscave thanks for flagging this issue,

• what SDK version are you seeing this error on?
• Does this error happen only when deploying or are you able to see it locally?

Any reproduction steps you can provide will help us fix this sooner

[tylerscave]

I've experienced it in version 2.0.2 and in the latest (2.0.9)

The error only happens when deploying, but the warnings for Use of eval is strongly discouraged... can be observed when building locally as well (ie npm run build).

To reproduce this, I think all that would be needed is to connect the Hydrogen app within Shopify. This should generate a PR on GitHub when you connect the git repo and should kick off the GitHub Action for deploying.

Some docs for deploying with Oxygen can be found here: https://shopify.dev/custom-storefronts/oxygen/getting-started

Thanks for any help on this 🙏

[teleaziz]

I'm still investigating the root cause of this issue but it looks like it was introduced in 2.0.9 of the sdk, as a workaround please use the 2.0.7 one until we release a newer version :

yarn add @builder.io/react@2.0.7

[tylerscave]

@teleaziz I downgraded to 2.0.7 and am still having the same issue...

I also pulled down a fresh copy of what is currently in this repo and tried to build locally, and am seeing the same Use of eval is strongly discouraged, as it poses security risks and may cause issues with minification warnings, so I suspect this wouldn't successfully deploy as is either...

[teleaziz]

@tylerscave strange, afaict that warning should not block the build and deployment, I was able to build and deploy successfully by cloning the code on this repo, you can see it running here

[teleaziz]

@tylerscave this warning will be addressed along with the build error in the next release of the sdk

[teleaziz]

For more context:

• we are not eval-ing arbtirary code. we are doing eval('require') to see if require is available, in a way that vite/rollup/webpack won’t strip out

• we wrap that in a try catch, to capture if eval is not available, that tells us important information about the environment. in this case it will catch and know that we are in this environment, but we can’t currently circumvent those logs

• we agree those warnings are not what we want, and are working on an approach that would remove those from happening

[tylerscave]

@teleaziz Happy to hear that the template can be deployed with Oxygen (I can't access the running demo because I think its set to private btw)... I will mess with some of my package versions in order to try to replicate what is happening in the template. Also, I noticed you guys added a post-install.js that we do not have; could this be related, and should we add it? Any context on why that was needed would also be appreciated.

Also, thanks for the context on the eval errors, and we will be anxiously awaiting the next release 👍.

Lastly, if possible, can you please upload your Oxygen deployment workflow (maybe Im missing something there) 🙏

[tylerscave]

Just a quick update FWIW

• Test 1: Refactored to match all package versions with the template - Same Error
• Test 2: Added post-install.js and associated script in package.json - Same Error
• Test 3: Pulled out all of the Builder.io code and uninstalled the @builder.io/react package - Success - Build completes without any errors or warnings and the project is successfully deployed (obviously without builder content).

I'm baffled about how you were successfully able to deploy with the @builder.io/react package installed and why I can't 🤔

[ryanmcdonnell]

I was experiencing the same error message when deploying to Vercel. Dropping back to @builder.io/react@2.0.8 solved the issue.

Correction: This just trades one issue for another. With v2.0.8, running into other errors. Dropping back further to v2.0.7 seems to work, but still throws some non-blocking exceptions in the console.

[steve8708]

thanks for reporting all - @teleaziz is actively investigating, will report back shortly

[teleaziz]

Hi all, thanks for your patience, we released a new patch version of the SDK @builder.io/react@2.0.10 that fixes the exception in the issue above, we're still working on the warnings above.

@tylerscave oh I realized now that preview links are private on hydrogen, apologies, this is a public link

Also for q on the post-install script, emotion is not playing well with hydrogen/vite, their browser bundle is getting muddled with the server one, this is a monkey patch to remove browser entries in their package.json, more in this issue emotion-js/emotion#1246

[teleaziz]

@tylerscave the code is pushed here:
https://github.com/teleaziz-demos/hydrogen-modern-human
And deployments logs are here:
https://github.com/teleaziz-demos/hydrogen-modern-human/actions/runs/3201340472

[steve8708]

a couple additional updates

• our v2 react SDK (currently in beta) no longer uses emotion so when that is ready post-install.js will no longer be needed
• you may still see some console warnings, but that will be cleaned up very soon as well

[tylerscave]

Yay, deployment worked and so far the Builder content looks great!!! 🎉🥳

@teleaziz thank you so much for your work on this and for the quick turnaround!