By catch on
Change record status: 
Published (View all published change records)
Project: 
Drupal core
Introduced in branch: 
10.1.x
Introduced in version: 
10.1.3
Issue links: 
https://www.drupal.org/node/3355381
Description: 

Drupal 10.1.0 introduced new inline JavaScript in the toolbar module to prevent flickering.

Since Drupal 10.1.3, this JavaScript has been moved to a file in a new toolbar.anti-flicker library which is a dependency of the main toolbar library, and will no longer be rendered inline.

Sites that were previously removing the anti-flicker js by by implementing hook_page_attachments() and unsetting the 'anti_flicker_js' key from 'html_head' can remove that code after updating.

There should be no API changes as a result of this change.

Impacts: 
Site builders, administrators, editors
Module developers
Themers

Comments

john.glynn.davies’s picture

john.glynn.davies commented

Although, the JS adds an inline style element, which may also cause CSP issues. So you may still want to remove the file if your CSP doesn't allow inline styles.

bburg’s picture

bburg
he/him
Location Washington, DC
commented

I'm testing out some updates to my CSP setup, and I get 

Refused to apply inline style because it violates the following Content Security Policy directive:  ... . Note also that 'style-src' was not explicitly set, so 'default-src' is used as a fallback.

(anonymous) @ toolbar.anti-flicker.js?v=10.3.2:62

I've created an issue in the CSP module issue queue here #3470501: Core Toolbar anti-flicker script adds inline style