CSP enables Trusted Types
The policy includes require-trusted-types-for, so DOM XSS sinks must receive a trusted type instead of a raw string.
Why it matters
Trusted Types blocks a common way to turn attacker text into HTML or a script URL.
What to do
No change is required for this result. Keep the directive while you assign policies for the sinks your app uses.
Reference
CSP Level 3 defines the directives and source lists this check evaluates.