Not compatible with strict CSP due to `new Function(..)` in property-expr

Hi, I just wanted to highlight that this library doesn’t work with content security policies where unsafe-eval is not allowed. This is because the property-expr module compiles functions for property access. See https://github.com/jquense/expr/issues/1 by @harriha.

I suppose the function compilation gives a performance boost, but for me it’s more important to have as strict a CSP as possible. I’m not sure whether this should be fixed in https://github.com/jquense/expr/ or whether that dependency should be dropped from yup itself.

[ctretyak]

It generates too much reports. We need solution or merge this PR

[novemberborn]

Cool, I hear ya 😄

Unfortunately I’m leaving this project tomorrow, so until I need to use yup next I won’t have the time to work on this either. But I’m glad we’re clear on an approach so that somebody can pick this up.

Thanks for yup!