You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The supporting JS code for DYNAMIC_EXECUTION currently uses a direct eval, which gives the eval-ed code access to names in the scope it is called from, as bundlers (Rollup, esbuild, and so on) cannot analyze such accesses, they emit a warning and might have to resort to performing less tree shaking.
Using an indirect eval ((0, eval)) avoids this, and if possible, should be preferred.
Of course, using eval at all is a problem with a CSP, though I think it might be possible to workaround that by injecting dynamic script tags with a nonce instead of using eval to allow running without unsafe-eval. But that's another issue.
The text was updated successfully, but these errors were encountered:
The supporting JS code for
DYNAMIC_EXECUTION
currently uses a directeval
, which gives the eval-ed code access to names in the scope it is called from, as bundlers (Rollup, esbuild, and so on) cannot analyze such accesses, they emit a warning and might have to resort to performing less tree shaking.Using an indirect
eval
((0, eval)
) avoids this, and if possible, should be preferred.Of course, using
eval
at all is a problem with a CSP, though I think it might be possible to workaround that by injecting dynamic script tags with a nonce instead of using eval to allow running withoutunsafe-eval
. But that's another issue.The text was updated successfully, but these errors were encountered: