CSP violation if 'unsafe-eval' not allowed

[dndrsn]

Expected Behavior

JavaScript eval not to be required.

Actual Behavior

CSP violation error if CSP is not set to allow unsafe-eval. This issue was introduced in version 10.9.0. Version 10.8.10 works as expected without any issue.

Possible Solution

Remove/refactor change introduced in version 10.9.0 which uses eval.

Steps to Reproduce

Create webpage with any CSP that does not allow unsafe-eval. Load page in browser.

This same issue occurred previously -- #1881

[bmerigan]

Yep, we are rolling back the version we use due to this.

[josephm0017]

We're also facing the same issue and it's severely impacting us.

• Are there any updates?
• Will it be resolved soon?

Can you please advise.

[bmerigan]

Tagging @veu to ensure developers are aware of this, not to be pushy but because there's no indication that this is known.
We're locked at 10.8.10 until this is resolved.