Nivo doesn't work with CSP policy unsafe-eval

First of all: thanks for a great package!

See this as a bug/feature request/friendly reminder for future versions.

Nivo’s dependency react-spring/core has an unsafe eval (https://github.com/pmndrs/react-spring/issues/1423) that causes pages with nivo to not render.

Describe/explain the bug When rendering nivo charts, exception is thrown if CSP policy unsafe-eval isn’t allowed.

To Reproduce

Steps to reproduce the behavior:

1. Create a simple React project with nivo newer than 65
2. Create a server that sets sensible CSP defaults:

const express = require('express');
const helmet = require('helmet');

const server = express();

server.use(compression());
server.use(
    helmet({
        contentSecurityPolicy: {
            directives: {
                ...helmet.contentSecurityPolicy.getDefaultDirectives(),
            },
        },
    })
);

server.use('/public', express.static('public'));

server.listen(port, function () {
    console.log('Listening on port ' + port);
});

Expected behavior Server should be able to render the page.

Actual behavior

Server won’t send the bundled files.

Screenshots

Additional context

Perhaps downgrade to a version of @react-spring/core before this issue was introduced - or keep this as a reminder to update once https://github.com/pmndrs/react-spring/issues/1423 is resolved. Nivo v. 65 works fine, so I’ll keep to that for now.

[eranelbaz]

Hey! We are using nivo to render graphs in our application, and we encounter this problem daily and it affect our users…

can you guys release version of nivo that include this pull request? Thanks!

@wyze

[wyze]

I’ll shoot for next week after I return from vacation.