We are actively developing an angular.io application, which, for historical reason, does not use angular-cli. Instead, builds were done via webpack and @ngtools/webpack.
We also enabled CSP on production server to disallow unsafe eval.
However, AOT build violates unsafe eval, by invoking createNamedArrayType method. What is more infuriating is the comment in the file clearly states
/**
* THIS FILE CONTAINS CODE WHICH SHOULD BE TREE SHAKEN AND NEVER CALLED FROM PRODUCTION CODE!!!
*/
I would have thought AOT build (by setting mode: production in webpack configuration) would automatically set the flags to allow the methods to be tree shaken, but clearly I was wrong.
After much digging, the interim solution seems to be using webpack define plugin to set ngDevMode to false, and include terser-webpack-plugin in webpack configuration optimization.minimizer
- Previous: Protractor Strangies
- Next: Angular 9 AOT build suddenly breaks