Update helmet 6.0.0 → 7.1.0 (major)

[depfu]

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ helmet (6.0.0 → 7.1.0) · Repo · Changelog

Release Notes

7.1.0 (from changelog)

Added

• helmet.crossOriginEmbedderPolicy now supports the unsafe-none directive. See #477

7.0.0 (from changelog)

Changed

• Breaking: Cross-Origin-Embedder-Policy middleware is now disabled by default. See #411

Removed

• Breaking: Drop support for Node 14 and 15. Node 16+ is now required
• Breaking: Expect-CT is no longer part of Helmet. If you still need it, you can use the expect-ct package. See #378

6.2.0 (from changelog)

• Expose header names (e.g., strictTransportSecurity for the Strict-Transport-Security header, instead of hsts)
• Rework documentation

6.1.5 (from changelog)

Fixed

• Fixed yet another issue with TypeScript exports. See #420

6.1.4 (from changelog)

Fixed

• Fix another issue with TypeScript default exports. See #418

6.1.3 (from changelog)

Fixed

• Fix issue with TypeScript default exports. See #417

6.1.2 (from changelog)

Fixed

• Retored main to package to help with some build tools

6.1.1 (from changelog)

Fixed

• Fixed missing package metadata

6.1.0 (from changelog)

Changed

• Improve support for various TypeScript setups, including "nodenext". See #405

6.0.1 (from changelog)

Fixed

• crossOriginEmbedderPolicy did not accept options at the top level. See #390

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 69 commits:

• 7.1.0
• Update changelog for 7.1.0 release
• Add additional package keywords
• Update devDependencies to latest versions
• Update changelog for recent COEP change
• Support `unsafe-none` in COEP
• CI: update setup-node action to version 4
• Update devDependencies to latest versions
• CI should use the latest Node version
• CI should test on Node 20
• Update devDependencies to latest versions
• Switch from ts-node to tsx
• Update GitHub Actions checkout dependency
• Update devDependencies to latest versions
• Update ESLint dependencies
• Update Prettier to latest version
• Add `consistent-type-imports` rule
• Add `no-confusing-void-expression` lint rule
• Add some lint rules that require no code changes
• Update devDependencies to latest versions
• Fix changelog header for 6.2.0
• 7.0.0
• Update changelog for 7.0.0 release
• Strict-Transport-Security: remove old `setIf` warning
• Disable Cross-Origin-Embedder-Policy by default
• Remove Expect-CT middleware
• Require Node 16+
• Minor: fix non-legacy values being under the "legacy" comment
• 6.2.0
• Update changelog for 6.2.0 release
• Update devDependencies to latest versions
• Rework readme
• Expose full header names for options
• Expose new names for standalone middleware
• Address TODO
• 6.1.5
• Update changelog for 6.1.5 release
• Fix yet another issue with TypeScript exports
• 6.1.4
• Update changelog for 6.1.4 release
• Add my contact info to contributing and security docs
• Update devDependencies to latest versions
• Fix another issue with TypeScript default exports
• 6.1.3
• Update changelog for 6.1.3 release
• Fix default export for some bundlers
• 6.1.2
• Update changelog for 6.1.2 release
• Enable (and fix) strict ESLint rules
• Re-run `npm install` to update package-lock
• Minor: fix extra parenthesis in build output
• Re-add "main" key to package.json
• Remove badges from readme
• 6.1.1
• Fix missing package metadata (regression in 6.1.0)
• Don't update .md files during publish
• 6.1.0
• Update changelog for 6.1.0 release
• Improve support for various TypeScript setups, including "nodenext"
• Update devDependencies to latest versions
• Update docs: `expectCt` is no longer set by default
• Update devDependencies to latest versions
• Update license year for 2023
• Update devDependencies to latest versions
• Update devDependencies to latest versions
• 6.0.1
• Fix `crossOriginEmbedderPolicy` top-level options
• Remove `--save` arg from docs
• Remove duplicate changelog entry

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)