bug: Stencil 4.7.2 introduces CSP issue

[plyworks]

Prerequisites

• I have read the Contributing Guidelines.
• I agree to follow the Code of Conduct.
• I have searched for existing issues that already report this problem, without success.

Stencil Version

4.7.2

Current Behavior

index.js:3371 Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'nonce-myNonce' ". Either the 'unsafe-inline' keyword, a hash ('sha256-+j8iWsl9MVf18edWBLWXvGwGeA90tRYZxjJ+fI89OSY='), or a nonce ('nonce-...') is required to enable inline execution.

Expected Behavior

https://github.com/ionic-team/stencil/blob/main/src/runtime/bootstrap-lazy.ts#L209

To have the nonce attribute added tot the dataStyles before it is inserted

System Info

System: node 18.16.0
    Platform: darwin (23.1.0)
   CPU Model: Intel(R) Core(TM) i9-9980HK CPU @ 2.40GHz (16 cpus)
    Compiler: /Users/tvasselt/Projects/clone/beagle/node_modules/@stencil/core/compiler/stencil.js
       Build: 1699889895
     Stencil: 4.7.2 🐄
  TypeScript: 5.2.2
      Rollup: 2.42.3
      Parse5: 7.1.2
      Sizzle: 2.42.3
      Terser: 5.24.0

Steps to Reproduce

• have Content-Security-Policy set for default-src, style-src and script-src with a nonce
• upgrade Stencil core to 4.7.2
• see csp errors

Code Reproduction URL

cannot

Additional Information

No response

[tanner-reits]

@plyworks Thanks for finding this! Silly mistake on my part. I published a dev build that re-orders the code for inserting those styles into the DOM if you wanna give that a try and verify it solves the issue:
npm i @stencil/core@4.8.0-dev.1701099049.800cac3

[plyworks]

@tanner-reits thanks for your quick response! Unfortunately, i get the exact same error.

Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'nonce-hash60fffc8bc00da' .... ". Either the 'unsafe-inline' keyword, a hash ('sha256-7xelfedyXZ52Vi8+xE7nnZQGPPdbH2aFvZElToAINc0='), or a nonce ('nonce-...') is required to enable inline execution.

[tanner-reits]

@plyworks Hmmm bummer. Would it be possible to get a small reproduction case? I'm not seeing anything else that would be preventing the nonce attribute from getting applied.

[tanner-reits]

The fix for this was included as a part of today's v4.8.1 release!