Plugin script blocked when using a strict content security policy

Hello, I am applying a strict content security policy (CSP) to my WordPress sites using the Strict CSP plugin.

This small block of JavaScript in the PublishPress Permissions plugin is getting blocked on all the site’s front-end pages in browsers when the Strict CSP plugin is active:

<script type="text/javascript">
  document.querySelectorAll("ul.nav-menu").forEach(
    ulist => {
      if (ulist.querySelectorAll("li").length == 0) {
        ulist.style.display = "none";
      }
    }
  );
</script>

In browser dev tools, a console error of the CSP violation and script block appears. Chrome, for example, starts with this: “Executing inline script violates the following Content Security Policy directive …”.

All other plugin scripts in my sites are receiving the nonce required for the strict CSP, except for the one above from your plugin. This may be due to your plugin manually printing the script tag instead of using the WordPress helper functions, as described on the Strict CSP plugin page.

Other than that method, if your plugin has another way to opt into a strict CSP, please let me know.

The page I need help with: [log in to see the link]