Skip to content

Update dependency helmet to v6

Ghost User requested to merge renovate-helmet-6.x into main

This MR contains the following updates:

Package Change Age Adoption Passing Confidence
helmet (source) ^4.6.0 -> ^6.0.0 age adoption passing confidence

Release Notes

helmetjs/helmet

v6.0.1

Compare Source

Fixed
  • crossOriginEmbedderPolicy did not accept options at the top level. See #​390

v6.0.0

Compare Source

Changed
  • Breaking: helmet.contentSecurityPolicy no longer sets block-all-mixed-content directive by default
  • Breaking: helmet.expectCt is no longer set by default. It can, however, be explicitly enabled. It will be removed in Helmet 7. See #​310
  • Breaking: Increase TypeScript strictness around some arguments. Only affects TypeScript users, and may not require any code changes. See #​369
  • helmet.frameguard no longer offers a specific error when trying to use ALLOW-FROM; it just says that it is unsupported. Only the error message has changed
Removed
  • Breaking: Dropped support for Node 12 and 13. Node 14+ is now required

v5.1.1

Compare Source

Changed
  • Fix TypeScript bug with some TypeScript configurations. See #​375 and #​359

v5.1.0

Compare Source

Added
  • Cross-Origin-Embedder-Policy: support credentialless policy. See #​365
  • Documented how to set both Content-Security-Policy and Content-Security-Policy-Report-Only
Changed
  • Cleaned up some documentation around Origin-Agent-Cluster

v5.0.2

Compare Source

Changed
  • Improve imports for CommonJS and ECMAScript modules. See #​345
  • Fixed some documentation

v5.0.1

Compare Source

Changed
  • Fixed some documentation
Removed
  • Removed some unused internal code

v5.0.0

Compare Source

Added
  • ECMAScript module imports (i.e., import helmet from "helmet" and import { frameguard } from "helmet"). See #​320
Changed
  • Breaking: helmet.contentSecurityPolicy: useDefaults option now defaults to true
  • Breaking: helmet.contentSecurityPolicy: form-action directive is now set to 'self' by default
  • Breaking: helmet.crossOriginEmbedderPolicy is enabled by default
  • Breaking: helmet.crossOriginOpenerPolicy is enabled by default
  • Breaking: helmet.crossOriginResourcePolicy is enabled by default
  • Breaking: helmet.originAgentCluster is enabled by default
  • helmet.frameguard: add TypeScript editor autocomplete. See #​322
  • Top-level helmet() function is slightly faster
Removed
  • Breaking: Drop support for Node 10 and 11. Node 12+ is now required

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this MR and you won't be reminded about this update again.

  • If you want to rebase/retry this MR, check this box

This MR has been generated by Renovate Bot.

Merge request reports