Just tried to upgrade but the new version will not work in a chrome extension

[richtera]

It looks like the latest minor upgrade uses @chainsafe/as-sha256 as a dependency which is not compatible with manifest 3 chrome extensions, because it loads the wasm using new Module() passing it as a string. This is equivalent to requiring the wasm-unsafe-eval permission which is not something that can be provided inside of manifest 3. We had to switch back. It's a bit unfortunate that this upgrade happened in a minor upgrade, because going back requires a bit of yarn.lock hacking.

[meeh0w]

Encountered the same issue with @ethereumjs/util.

@chainsafe/ssz added as a dependency here depends on @chainsafe/as-sha256 which is a WebAssembly module.

It prevents the client apps from working in the extension realm (Chrome's manifest V3 does not allow wasm):

(no, you can't just override this particular part of the CSP, Chrome won't allow that)

[richtera]

I think if the wasm was imported from a file instead of being passed as a string to new Module() it could possibly work

[acolytec3]

Thanks for reporting. We're going to discuss with chainsafe on a way forward.

[meeh0w]

I just found out that you can add script-src 'self' 'wasm-unsafe-eval'; to the CSP and it makes it work, Manifest v3 allows that. So it becomes a matter of wether it's something one wants to allow.

[paulmillr]

ChainSafe/ssz#313

[holgerd77]

Addressed right now in #2721

Release likely in 1-2 weeks

[holgerd77]

This has been released, will close.