The second of these failures can be reproduced very easily by creating a job with a Node Label parameter (or running NodeLabelParameterPluginTest in ATH).

I've investigated the call inside evalInnerHtmlScripts while looking at https://issues.jenkins.io/browse/JENKINS-73974.

The purpose of the path that calls geval is to execute JavaScript inside inline script blocks for elements that are dynamically added to the page (e.g. via hetero list). The alternative is including scripts via st:adjunct or script tags with src attribute, both of which are CSP compatible. So for me it would be something that should be fixed in plugins, by getting rid of inline script blocks.

Nothing to be done in core on this (other than maybe a console.warn?), as that path will have to exist to preserve compatibility with plugins that have inline script blocks inside jelly files that can be dynamically rendered.

Nothing to be done in core on this (other than maybe a console.warn?), as that path will have to exist to preserve compatibility with plugins that have inline script blocks inside jelly files that can be dynamically rendered.

Agreed. A warning might make the problem more obvious to someone debugging a CSP failure, which would be a nice developer quality of life improvement even if it has no impact on end users.