Is there a way to pass nonce to bypass CSP with devtools script?

[uladzimirdev]

I need to add nonce to the script somehow

[thheller]

Need more information to understand what you are asking. shadow-cljs doesn't generate any script tags or inline styles, so I'm not sure what is going on there.

[thheller]

What is doing the live reloading? shadow-cljs or webpack? Looks like you are using a :npm-module build? To build what exactly? I still do not quite understand what you are doing.

[uladzimirdev]

sorry, we add event listener and webpack is doing live-reloading. we're using npm module

here is the problematic line https://github.com/metabase/metabase/blob/master/src/metabase/util/devtools.cljc#L7

[thheller]

When you are using webpack to do the reloading, then you do not really need the shadow-cljs devtools. Unless you are still using the REPL? You could otherwise set :devtools {:enabled false} in the build config, but that manual require then needs to be removed. Unsure why it is there in the first place.

I can see about removing that inline style thing. Didn't even know it tried to do that. It is from some very very old code that I haven't looked at in a decade probably.

[thheller]

Try 2.28.12. That reference is gone.

[uladzimirdev]

Thanks! I've tried 2.28.12, but the message still exists.

It worked! thank you very much 🎉

UPD I needed to update deps.edn as well, sorry for confusion!

Regarding why it's done like this, I'll investigate further. In perfect world I'd love to build ESM as well, so I'll investigate further