The JavaScript that integrates Chosen with this module causes CSP violations:
Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self' 'nonce-Equl_2eohxDGRCJcCxBV7g'". Either the 'unsafe-inline' keyword, a hash ('sha256-WSyK6rX8LkmsLk4KZ+sgst7zNWGGx0TTFHVs96TQk+4='), or a nonce ('nonce-...') is required to enable inline execution. Note that hashes do not apply to event handlers, style attributes and javascript: navigations unless the 'unsafe-hashes' keyword is present.
This is caused by the following line:
select.attr('style','display:visible; position:absolute; width:0px; height: 0px; clip:rect(0,0,0,0)');
Enable a strict Content Security Policy without the unsafe-inline directive (e.g. using the CSP module → )
Add a CSS class instead of setting the style attribute.
Postponed
4.0
Code
The current fix in 🐛 Client-side-validation broken with Chosen Needs review fixes this issue as well, so let's wait until that one gets committed.