I imagine this is due to the recent security breach on Meta, but whatever changes were made to the Content Security Policy seem to have broken communication between Commons and iNaturalist. This means it is no longer possible to use the iNaturalist2Commons tool, which is frequently used there. (It's been used to import 190,918 files over the past 7 years).

Steps to replicate the issue (include links if applicable):

• Install the iNaturalist2Commons user script
• Go to a category page for a taxon, e.g. https://commons.wikimedia.org/wiki/Category:Tauraco_corythaix.
• Click the iNaturalist import button.

What happens?:

It gives the error "Error: Loading images failed. If you are using a privacy plug-in like Privacy Badger, you may need to adjust your settings."

In the Javascript console, it gives the following error:
Content-Security-Policy: The page’s settings blocked the loading of a resource (connect-src) at https://api.inaturalist.org/v1/observations?photo_license=cc0%2Ccc-by%2Ccc-by-sa&quality_grade=research&taxon_id=153516&per_page=84 because it violates the following directive: “default-src 'unsafe-eval' 'unsafe-inline' 'self' data: blob: https://*.wikimedia.org https://*.wikipedia.org https://*.wikinews.org https://*.wiktionary.org https://*.wikibooks.org https://*.wikiversity.org https://*.wikisource.org https://wikisource.org https://*.wikiquote.org https://*.wikidata.org https://*.wikifunctions.org https://*.wikivoyage.org https://*.mediawiki.org https://mediawiki.org https://wikimedia.org https://*.wmflabs.org https://*.wmcloud.org https://*.toolforge.org https://*.jsdelivr.net https://unpkg.com https://cdnjs.cloudflare.com https://raw.githubusercontent.com https://*.github.com https://code.jquery.com https://cdn.mathjax.org https://use.typekit.net https://fonts.cdnfonts.com https://use.fontawesome.com https://i.ytimg.com https://rsms.me https://doi.org https://localhost https://localhost:* http://localhost:* https://*.google.com https://*.gstatic.com https://*.googleapis.com https://*.translate.yandex.net https://yastatic.net https://ya.ru https://radically.github.io https://cdn.sammdot.ca https://cdn.fontshare.com https://viaf.org https://publicai-proxy.alaexis.workers.dev https://iiif.archive.org https://api.flickr.com https://live.staticflickr.com https://api.anthropic.com https://api.openai.com https://api.publicai.co https://catalogo.pusc.it https://parsifal.urbe.it https://opac.sbn.it https://overpass-api.de https://api.openrouteservice.org https://archive.org https://*.openstreetmap.org https://*.waymarkedtrails.org https://*.thunderforest.com” jquery.js:9940:10

What should have happened instead?:
It should allow communication with the iNaturalist API.

Other information (browser name/version, screenshots, etc.):
Firefox and Chrome tested.