changelog.d/5070-spa-csp-no-unsafe-eval.md

Rama main · réplica de lectura del repositorio original.

- **The web app no longer needs `unsafe-eval` in its Content Security Policy (#5053).** Zod runs in `jitless` mode, set before any route chunk builds a schema, so its `new Function` probe stops reporting a violation on every page. WebAssembly keeps `wasm-unsafe-eval`.