Content-Security-Policy violation while using 3.0.X

We recently upgraded our version of the redux-api-middleware from 2.3.0 to 3.0.1. However, our system stopped working entirely because we define a Content-Security-Policy that disables unsafe-eval.

After spending several hours going deep into what was going wrong, we tracked it back to the way the new version of redux-api-middleware is being built. By packaging it with rollup, it now includes a number of dependencies. One of the transitive dependencies is regenerator-runtime, which introduces such an unsafe eval. It has since been addressed here:

https://github.com/facebook/regenerator/pull/346

However, this package will continue to have references to the offending line.

After forking the project and reverting to the old build mechanism with a similar babel config and removing rollup, I was able to get the new version of the package working as expected. This took quite a bit of time to track down and address, and still relies on a fork of this project as a result, so I'm documenting my investigation to hopefully save someone else hours of time tracking this down.