Published JS requires unsafe-eval

[jamesarosen]

The published JS includes lines that look like

require.register("darsain-event/index.js", Function("exports, require, module",
"'use strict';\n\
\n\
/**\n\
...

This is valid JavaScript, but violates a Content Security Policy unless the site allows unsafe-eval (which is strongly recommended against).

Would it be possible to rebuild with non-stringified dependencies?

[adam-knights]

@darsain any chance of an update on this or whether we should look at fixing this ourselves?

[darsain]

The issue here is that the current distribution files are configured to be build with sourcemaps included. That's why its all evaled. It's the easiest way how to get sourcemaps in.

I've described the situation of this and all of my other projects here: https://github.com/darsain/tooltip/issues/28#issuecomment-201911404

As it says in that comment, I never intended these dist files to be used in production. The quickest way for you how to get un-evaled version is to grab the minified distribution file, which doesn't inlude sourcemaps.