Rollupjs build complains about the use of eval in this library.

[siva-I]

(!) Use of eval is strongly discouraged
https://github.com/rollup/rollup/wiki/Troubleshooting#avoiding-eval
node_modules/js-sha256/src/sha256.js
84:
85: var nodeWrap = function (method, is224) {
86: var crypto = eval("require('crypto')");
^
87: var Buffer = eval("require('buffer').Buffer");
88: var algorithm = is224 ? 'sha224' : 'sha256';
...and 1 other occurrence
created dist/transactionmgmt.dev.js in 4.7s

[2018-06-21 10:33:00] waiting for changes...

[emn178]

This is because emn178/js-md5#8
And I found it won't polyfill unused code in this way.

[gmiklich]

Can it be changed to a dynamic import or anything along those lines to avoid the use of eval()?

[lmm-git]

Even more, this prevents us from not using 'unsafe-eval' in our Content Security Policy. Any chance that this one get fixed?

[ivands]

It also breaks in vitejs. We need a fix.

[hansottowirtz]

As a fix, you can replace the eval strings in the library during build.
In rollup.config.js:

import replace from "rollup-plugin-re";

export default {
  ...,
  plugins: [
    replace({
      patterns: [
        {
          match: /js-sha256/,
          test: `eval("require('crypto')")`,
          replace: `require('crypto')`
        },
        {
          match: /js-sha256/,
          test: `eval("require('buffer').Buffer")`,
          replace: `require('buffer').Buffer`
        }
      ],
    }),
  ]
}

[juhoha]

An alternative to suppress warnings in vite.config.js:

export default defineConfig({
  build: {
    rollupOptions: {
      onwarn: ({ loc }) => {
        if (loc?.file?.match(/js-sha256\/src\/sha256.js$/))
            return;
      } 
  }
});

[emn178]

remove eval in v0.10.0