Is unsafe-eval in manifest.json needed?

[aguynamedben]

Thank you for making this boilerplate available. It's been very helpful.

We submitted an extension based on this repo to Microsoft Edge, and we got this recommendation in our feedback:

Why is unsafe-eval needed in manifest.json? I can't see why it's needed here. There are no eval()s in the codebase.

[aguynamedben]

Location of unsafe-eval:

chrome-extension-webpack-boilerplate/src/manifest.json

Line 15 in d764ce1

"content_security_policy": "script-src 'self' 'unsafe-eval'; object-src 'self'"

[hexgnu]

When you run yarn build using NODE_ENV=development it will package it up using an eval in webpack. If you try NODE_ENV=production yarn build and remove the unsafe eval it should actually work as expected.

[jcnventura]

The unsafe-eval needs to be removed in 2022, since Chrome will stop accepting Manifest V2 extensions, and V3 extensions are not allowed to use unsafe-eval in the content_security_policy.