Content Security Policy issue delivered in report-only mode

[michael-picard]

Hello,
The below example used to work perfectly fine 2 weeks ago last time I worked on it.
The error thrown is from the iframe src response headers injected by apis.google.com/js/api.js.

Is there something wrong on my end?

<script src="https://apis.google.com/js/api.js"></script>
<script>
    gapi.load('client', function () {
        gapi.client.init({
            'apiKey': '____myAPIkey_______',
            'discoveryDocs': ["https://www.googleapis.com/discovery/v1/apis/calendar/v3/rest"],
        }).then(() =>
            gapi.client.calendar.events.list({
                calendarId: '____myCalendarkey_______',
                timeMin: (new Date('2019-04-09')).toISOString(),
                timeMax: (new Date('2019-04-09T23:00:00.000Z')).toISOString(),
                showDeleted: false,
                singleEvents: true,
                maxResults: 20,
                orderBy: 'startTime',
            }))
            .then(data => console.log(data.result))
            .catch(error => console.error(error))
    })
</script>