Zod 4 under a strict CSP: jitless to stop securitypolicyviolation reports (CurlShot)

[SergiuPogor]

A small Zod 4 tip from production, in case someone else sees the same console noise.

Symptom. On CurlShot (a screenshot API; the site is Next.js), the production Content-Security-Policy has no 'unsafe-eval'. Zod 4 compiles a fast object parser with new Function and first probes whether eval is allowed. The probe is blocked and the error is swallowed, so parsing works, but the browser still fires a securitypolicyviolation (and CSP reports) on every page that parses a schema.

Fix. Turn on jitless once, before the first schema is parsed:

// src/lib/zod-config.ts — import for its side effect
import { config } from 'zod/v4/core'

config({ jitless: true })

jitless skips both the probe and the compiled path. Two details that mattered for us:

• Import order. It must run before any schema parses, so the module is imported from the client instrumentation entry (instrumentation-client.ts), the root client provider, the server instrumentation.ts, and the schema entry points.
• Bundle size. Importing config from zod/v4/core (the module that owns the config object Zod reads) keeps this file to a few hundred bytes in the shared client chunk, instead of pulling the whole schema library into every page.

Since then there are no CSP violations from Zod. Thanks for Zod 4 and for making this a one-line option.