fix(eval): add allowUnsafeEval via loophole
chore(tag): v4.0.2