[BUG] When compile in vite, throws error about use of eval is strongly discouraged as it poses security risks and may cause issues with minification

[ac-tech-madcoz]

🐛 Bug Report

Lib version: 4.4.0-protobi.5

Steps To Reproduce

Just include the exceljs library in any React SPA application and build with exceljs in a single chunk:

vite build

The expected behaviour:

There should be no compilation errors when build in vite.

Possible solution (optional, but very helpful):

I have found a similar issue reported in another exceljs fork, the issue is located as below:
devextreme-exceljs-fork produces artifacts with eval

And the issue is related to "asn1.js", which describe as below:
Remove eval

I have also checked the complied code in "dist/exceljs.js":

...
Entity.prototype._createNamed = function createNamed(base) {
  var named;
  try {
    named = require('vm').runInThisContext('(function ' + this.name + '(entity) {\n' + '  this._initNamed(entity);\n' + '})');
  } catch (e) {
    named = function named(entity) {
      this._initNamed(entity);
    };
  }
  inherits(named, base);
  named.prototype._initNamed = function initnamed(entity) {
    base.call(this, entity);
  };
  return new named(this);
};
...

which matches the issue in "Remove eval" in "asn1.js", according to the changes in "devextreme-exceljs-fork" located as below:
Grids: devextreme-exceljs-fork produces artifacts with eval

Need to update the version of "asn1.js" from 4.10.1 to 5.4.1.

The dependencies chain is follows:
browserify (16.5.2) -> crypto-browserify (3.12.0) -> browserify-sign (4.2.5) -> parse-asn1 (5.1.9) -> asn1.js (4.10.1)

[protobi-pieter]

Thanks for the detailed report @ac-tech-madcoz tracking this down through the dependency chain.

Confirmed and Fixed

I've confirmed the issue and implemented the fix you suggested. The problem was indeed the outdated asn1.js@4.10.1 dependency using require('vm').runInThisContext(), which violates Vite's Content Security Policy.

Dependency chain:

browserify@16.5.2 
  → crypto-browserify@3.12.0 
    → browserify-sign@4.2.5 
      → parse-asn1@5.1.9 
        → asn1.js@4.10.1 (contained eval)

Fix applied:
Added npm overrides to force asn1.js to version 5.4.1, which removed the eval usage:

"overrides": {
  "asn1.js": "5.4.1"
}

Verification:

• asn1.js upgraded: 4.10.1 → 5.4.1
• Rebuilt all dist bundles
• Confirmed zero eval() calls in dist/exceljs.js, dist/exceljs.min.js, and all other browser bundles
• CSP-compliant for Vite builds

This will be included in the next release (4.4.0-protobi.6).

Workaround for immediate use

If you need this fix right away, add the override to your own package.json:

{
  "overrides": {
    "asn1.js": "5.4.1"
  }
}

Then run:

npm install
# Rebuild your Vite project

---

Note: This issue also affects upstream exceljs/exceljs - they use the same browserify@16.5.2 version. I may submit a PR upstream as well.

[ac-tech-madcoz]

@protobi-pieter Thank you for the prompt action, I will apply the workaround.