Patch Changes
-
Fix
importShim()throwingCannot destructure property 'l'under a Content Security Policy without'unsafe-eval'when a module has both a static import and a dynamicimport()(#12059)Modules are now parsed with the asm.js build of
es-module-lexer(es-module-lexer/minimal/js), the build ES Module Shims uses. The default build decodes import specifiers witheval, so a CSP without'unsafe-eval'silently dropped every static import from the module graph. The asm.js build needs neither'unsafe-eval'nor'wasm-unsafe-eval'.