Failed to deploy SPFx with PS Add-PnPApp - getting error Value of: [CSPConfig] cannot exceed: [100000].

[kat3ryna-vovk]

Target SharePoint environment

SharePoint Online

What SharePoint development model, framework, SDK or API is this about?

💥 SharePoint Framework

Developer environment

Windows

What browser(s) / client(s) have you tested

• 💥 Internet Explorer
• 💥 Microsoft Edge
• 💥 Google Chrome
• 💥 FireFox
• 💥 Safari
• mobile (iOS/iPadOS)
• mobile (Android)
• not applicable
• other (enter in the "Additional environment details" area below)

Additional environment details

• browser version
• SPFx version
• Node.js version
• etc

Describe the bug / error

It's not possible to deploy an SPFx to the site collection App catalog on one of our tenants anymore. It started to fail on 22.09.25 and then any deployment is possible - with PnP PS command Add-PnPApp or with ALM PnP.
"Value of: [CSPConfig] cannot exceed: [100000]."
I assume the problem is with Content Security Policy and Trusted Script Sources that reached 582 entries on this environment. And I can't delete them anymore.

From the UI on the Site Collection App Catalog it's possible to deploy an app with 'Deploy' button.

Steps to reproduce

1. Create SPFx solution
2. Add & Publish SPFx to Site Collection App Catalog with PnP Powershell:
   Add-PnPApp -Path ./myapp.sppkg -Publish

Expected behavior

Deployment should not fail.

[Ashlesha-MSFT]

Hello @kat3ryna-vovk,
Thank you for bringing this issue to our attention. We will look into it and get back to you shortly.

[Ashlesha-MSFT]

@kat3ryna-vovk,
The deployment succeeded without any errors, which suggests that the issue may be specific to your environment or SPFx solution.

To investigate further, could you please share the following?

• The .sppkg file or a minimal repro version of your SPFx solution.
• Any customizations you've made (e.g., external scripts, CSP configurations).
• Approximate number of existing apps or deployments in your Site Collection App Catalog (in case it's a CSP limit accumulation issue).

[kat3ryna-vovk]

Hello Ashlesha-MSFT

Thanks for the answer.

I think it's an environment issue as on other environment the same package works well (also on this one it worked well until specific date, when it stopped, probably limit was reached). On that environment where it fails there are a lot of site collections, but inside Site Collection App Catalog - there are not many apps: 1 or 2 on each site. Same on tenant level - 17 apps in total.
But I assume that it combines script sources from ALL site collections (as mentioned here - #10369) when check the limit, and not only the Site Collection where you are deploying.

To answer your questions:

• it happens with any spfx solution (Hello World from MS) if you specify "cdnBasePath" to site relative URL (specific library on the site level where you deploy); "includeClientSideAssets": false
• on site collection app catalog - I have only 1 app (this one that can't be deployed)

In console log it shows me error messages from ALL site collections where some spfx were dpeloyed:
"The source list for the Content Security Policy directive 'script-src' contains an invalid source: '//'. It will be ignored."

[Ashlesha-MSFT]

@kat3ryna-vovk,
At this time, Microsoft’s public documentation does not specify any exact limit (e.g., 100000 characters) for CSPConfig or the total number of trusted script sources. The limit you're encountering appears to be an internal platform safeguard.
To prevent this issue and align with future enforcement:

• Use "includeClientSideAssets": true
  Embeds assets into the .sppkg and avoids creating external CSP entries.

• Avoid site-relative URLs in cdnBasePath
  Use fully qualified URLs hosted in a central, trusted location (like your tenant CDN or app catalog document library).

[vlad-nvs]

Hi @Ashlesha-MSFT

A few days ago, we started experiencing the same issue on one tenant.

We have SPFx solutions programmatically installed on more than 400 different sites, and now we’re encountering the following error:
[CSPConfig] cannot exceed: [100000]

Each site uses a unique cdnBasePath, and we’ve also tried using a full URL, but without any success.

We’re confident this is a new issue, as we haven’t experienced it before.

Additionally, it’s not possible to clean up the script sources through the SharePoint Admin Center UI — there are simply too many entries (see screenshot)
Unfortunately, I couldn’t find any PowerShell commands related to managing or deleting Script Sources.

Could you please confirm if there’s any PowerShell command or API that can be used to remove CSP Script Sources?

It seems critical and likely related to the large number of script sources added to the Content Security Policy (CSP) configuration.

Any ideas?

[kat3ryna-vovk]

Hi @Ashlesha-MSFT

Thanks for the recommendations. It didn't work like this.
Finally, we were able to delete CSP Script Sources, and now it works. You need to select ALL sources and delete them all at once.
So it looks like the problem is with pnp command to deploy SPFX (deploy only, because the app is added to the App catalog, but not deployed), and it fails only when the number of scripts is too large.