Next.js use of globalThis causes CSP false positives without unsafe-eval

[mitchellrj]

Describe the bug

The solution to #3067 (#2015 ) first tries the approach that would be blocked by CSP, then falls back to an approach that is not blocked.

This causes a large number of false positive CSP reports to be generated, even when there is no threat and no impact to functionality.

Could the solution not try the safer version first, then the unsafe version if that fails? Or repurpose / adopt the work done in #3179 ?

Reproduction

N/A

Used Package Manager

npm

System Info

N/A

Validations

• Read the docs.
• Read the common issues list.
• Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
• Make sure this is a Module federation issue and not a framework-specific issue.
• The provided reproduction is a minimal reproducible example of the bug.

[ScriptedAlchemy]

Send a PR and we can release a canary to try - next rewrites global references to webpack_require.g which causes problems - so usually i need a solution that the parser cannot see and change.