[graphiql] generated bundles of graphiql is incompatible with strict CSP

[simhnna]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

The top level readme in the repo states:

codemirror-graphql and the graphiql browser bundle use the .browserslistrc, which targets modern browsers to keep bundle size small and keep the language services performant where async/await is used, and especially to avoid the requirement of regenerator-runtime or special babel configuration.

But in fact regenerator-runtime is used here

If I run build-bundles in graphiql the generated graphiql.min.js file includes regenerator-runtime and actually differs from the version served here https://graphiql-test.netlify.app/ (the hosted version uses a newer build of regenerator-runtime which doesn't have this issue)

The easiest solution would be to remove regenerator-runtime by just removing the one line.

regenerator-runtime was updated recently to fix the issue facebook/regenerator@cc0cde9

If the lib should be kept, we could update regenerator-runtime to 0.14.8 or make sure that strict mode is not used

Expected Behavior

No response

Steps To Reproduce

No response

Module pattern

• graphiql-umd
• graphiql-esm
• graphiql-commonjs

Environment

No response

Anything else?

No response

[acao]

first of all, we need to replace webpack with vite or use webpack 5 at least, there are two PRs outstanding attempting to do this. but I did not realise that regenerator runtime was re-added, that hasn't been needed for a while since we dropped IE support a few years ago

[jonathanawesome]

Looks like regenerator-runtime was re-added to support graphiql-plugin-explorer.

As far as I can tell, there isn't a way to package regenerator-runtime with the vite library build for graphiql-plugin-explorer. There's a vite plugin for this, @vitejs/plugin-legacy, but it doesn't run in library mode.

Update: I tested a locally built version of graphiql.min.js that doesn't include regenerator-runtime with the graphiql-plugin-explorer/examples/index.html file and the plugin seems to work without it. @thomasheyenbrock I may be missing something important...do you remember why we've re-added regenerator-runtime to the cdn.ts file?

[thomasheyenbrock]

Looks like regenerator-runtime was re-added to support graphiql-plugin-explorer.

It was in cdn.ts already before that, the commit blamed by git did only reorder imports, see here: https://github.com/graphql/graphiql/pull/2715/files#diff-bbf2e336517679d4c3102227c21f5e33b354a5518d9844c6302f2b2bcf4b542f

In fact, regenerator-runtime has been in there since I started working on this repo in May 🤨

[jonathanawesome]

@thomasheyenbrock thanks for the clarification!

Found it.

Lil' tiny PR in (#2939) with the removal.