Hi Joseph,

1. Starting with R1 2023 release the Kendo UI for jQuery addresses the unsafe-eval directive for all components except for the Spreadsheet. I would suggest taking a look at the article linked below: 

- https://docs.telerik.com/kendo-ui/intro/widget-basics/content-security-policy

With the above,  I would suggest upgrading at least to Kendo version 2023 R1 (we always recommend upgrading to the latest which is currently 2024.1.130) in order to take advantage of the mentioned improvement.

2. What potential risks or extensive modifications might be involved in upgrading from our current version to a CSP-compatible version? - it is hard to say what are the main risks as I am not aware of the components used on your side. In addition, the time gap is huge, and many improvements in the components have been released. However, what will be helpful to take a look related to CSP is the article regarding templates, as in order to be CSP compliant in case you are using templates in your application, you will need rewrite all inline and external templates into CSP-compatible functional templates.

- https://docs.telerik.com/kendo-ui/framework/templates/get-started-csp-templates

As the CSP has been addressed in the 2023 R1 version I am changing the status of the report to 'Declined'. In case you have any additional comments or questions, please let us know.

Regards,
Neli
Progress Telerik