htmx
htmx copied to clipboard
Rollup warns that HTMX calls eval() which is unsafe
Hey, thanks for making this fantastic library.
Just one thing: When I use Rollup to bundle HTMX, it gives me the following error message:
Use of eval in "../../../node_modules/htmx.org/dist/htmx.min.js" is
strongly discouraged as it poses security risks and may cause
issues with minification.
Can eval() somehow be removed?
What if the script compiles a safe version of htmx where all eval instructions are simply commented?
Then if you are using the allowEval false, you could import the safe version without warnings and knowing that no code could be executed by error with this library.
But maybe it is a very naive suggestion from not understanding the internals of htmx.
I think this could be a nice way to offer a solution for comments like this one: https://github.com/bigskysoftware/htmx/discussions/2112#discussioncomment-8193764
With which I somehow agree.