Anything that uses `ajv` under the hood and doesn't use their compile schema options. They use `eval`[0] for a number of things.

Quite a lot of schema validators use `ajv` under the hood. Some, like I believe `yup`, `zod` and `superstruct` do not. I'm not sure why one approach is more advantageous than another, to be honest. I'd think eval would also be a performance issue.

[0]: https://ajv.js.org/security.html#content-security-policy