Error

[lcalhoun-scs]

This is using an outdated version asn1.js where there is an error Can't resolve 'vm' in \node_modules\parse-asn1\node_modules\asn1.js\lib\asn1

[ljharb]

Can you provide a repro, so I can see this error myself? Locally for me, node_modules/asn1.js/lib/asn1.js doesn't have any vm requires, and vm is a node core module so it wouldn't ever try to be resolved in any node version.

[cnemo-cenic]

@ljharb check for node_modules/parse-asn1/node_modules/asn1.js/lib/api.js

This is a regression, see my comment here #39

[ljharb]

Yes, it means that bundlers for CSP-enforced targets still have the problem of using eval.

If the relevant asn1.js fix can be backported to v4, or v5's engines can be widened to match v4's, then we can fix this easily.

[cnemo-cenic]

I think the fix can be backported, although I am no export on backwards compatibility and am not sure the actual change would still retain compatibility with the node version / es version targets you want to support.

This was the change in question: indutny/asn1.js@21a6037

[ljharb]

I think it's very backportable - but that's up to @indutny, not me.