First concrete, legitimate reason I've seen all thread. Is there something fundamental about jQuery's design that forces it to use eval(), or is it possible a new version could avoids that?
Re:Removing jQuery from GitHub.com frontend
by AmericanChopper on Thursday July 26, 2018 @07:49AM
(#17616681)
Performing evals is a core part of the design. Take a look at the additional notes section on this documentation of the .html method.
>By design, any jQuery constructor or method that accepts an HTML string — jQuery(), .append(), .after(), etc. — can potentially execute code
This makes jQuery less safe in general, but I think the CSP restrictions this puts in place are probably a greater issue for most people. I’ve been involved in retro-fitting strict CSPs into a few projects, and more than once I’ve been thwarted by very minor use of jQuery in a couple of places.
CSP is an incredibly useful tool, and it’s close to impossible to use it properly with jQuery.