I was wondering if it were possible to create a note on the CSP documentation page that explicitly says that without 'unsafe-eval' being allowed locally, you will not be able to use HMR/fast refresh during development. This was a painpoint for us for the past few weeks, and something i did not uncover until I started reading the WS messaging produced by webpack-hmr to find the root of the issue.
process.env.NODE_ENV === "development" ? "'unsafe-eval'" : "", is the gist of it.
If you're using Next.js 15, Server Components HMR configuration might be a safer option. Please give this a try and let me know if it works for your project 
https://nextjs.org/docs/app/api-reference/config/next-config-js/serverComponentsHmrCache
Hi ! We are actually still on the pages router for now (Next 14 as well). We have our CSP configured in our next.config.js, which is why I was hoping to see this documented!
Understood. I'll share this info with the docs team so we can figure out the best way to document this scenario. Thanks for making the suggestion!