fix(common): make SlickDataView filtering CSP-safe by default

[ghiscoding]

replicate Slickgrid-Universal PR 2774 into SlickGrid. You can see the included ChatGPT summary below.

Summary

Make SlickDataView filtering CSP-safe by default by removing runtime filter compilation through new Function().

The previous CSP-safe and non-CSP filtering paths are consolidated into a single callback-based implementation. Existing inlineFilters and useCSPSafeFilter options remain accepted for backward compatibility, but are now deprecated no-ops because filtering is always CSP-safe.

Why

The generated filter implementation required CSP policies to allow unsafe-eval, which prevents strict Content Security Policy usage when inlineFilters is enabled.

This repo uses inlineFilters in many examples and tests, so keeping the option accepted is important for backward compatibility. However, the option can no longer preserve its previous generated-code behavior if DataView filtering is to be unconditionally CSP-safe.

Changes

• Removed DataView filter compilation through new Function().
• Consolidated filtering into the CSP-safe callback loop.
• Simplified setFilter(), getFilter(), and filtered item dispatch.
• Corrected expanding-filter cache behavior so successful matches are stored.
• Deprecated inlineFilters and useCSPSafeFilter; both remain accepted but are ignored.
• Deprecated the FilterCspFn and FilterWithCspCachingFn aliases.
• Updated the CSP header example to stop passing useCSPSafeFilter.
• Added QUnit-style DataView coverage for:
  • deprecated CSP-safe option compatibility;
  • filter-argument compatibility;
  • expanding-filter cache behavior with deprecated inline options.

Not Included

• No Vitest tests were added because this repo does not use Vitest.
• No benchmark files or benchmark scripts were copied from the external fork.
• No README updates were made.

Backward Compatibility

Existing code that passes inlineFilters: true or useCSPSafeFilter: true continues to compile and run.

The behavioral difference is that inlineFilters no longer enables generated runtime filtering. Filtering results remain compatible, but performance characteristics can change for consumers that relied on the old generated-code path.

Because SlickGrid uses inlineFilters more widely than the fork this was copied from, this trade-off affects more local examples and consumers. The copied PR’s benchmark notes that string-heavy predicates may be slower when compared with the old generated Function path, while default filtering and numeric/branch-heavy predicates are equivalent or improved.

Validation

• npm run build:types passed.
• npm run lint passed.
• npm run build:prod passed.
• Cypress CSP E2E was not run because the Cypress binary was not installed locally and downloading it was declined.

Checklist

• CSP-unsafe DataView filter generation removed.
• Deprecated options remain accepted for compatibility.
• Tests added using this repo’s existing QUnit-style DataView test suite.
• CSP example updated.
• Vitest and benchmark changes intentionally excluded.