Packages

helmet

8.3.0 · 12 Jul 2026MIT22.5M / weekRepositoryHomepagenpmAtom feed

Upgrading helmet From 0.2.4 to 8.3.0

108 releases in betweennotes for 43

Reading releases, release notes and advisories…

Other targets from 0.2.4Newest 0.x0.15.0
8.0.0, 7.0.0, 6.0.0, 5.0.0, 4.0.0, 3.0.0, 2.0.0, 1.0.0 have no release note on GitHub or in the repository's changelog, so their breaking changes are missing from the counts below.
  1. 0.2.4yours
  2. 0.3.0major
  3. 2 releases
  4. 0.4.0major
  5. 2 releases
  6. 0.5.0major
  7. 2 releases
  8. 0.5.3security
  9. 1 release
  10. 0.6.0major
  11. 2 releases
  12. 0.7.0major
  13. 1 release
  14. 0.8.0major
  15. 0.9.0major
  16. 1 release
  17. 0.10.0major
  18. 0.11.0major
  19. 0.12.0major
  20. 0.13.0major
  21. 0.14.0major
  22. 0.15.0major
  23. 1.0.0major
  24. 5 releases
  25. 2.0.0major
  26. 6 releases
  27. 3.0.0major
  28. 38 releases
  29. 4.0.0major
  30. 9 releases
  31. 5.0.0major
  32. 4 releases
  33. 6.0.0major
  34. 8 releases
  35. 7.0.0major
  36. 2 releases
  37. 8.0.0major
  38. 2 releases
  39. 8.3.0target
5+
changes to make
0
advisories fixed
19+
new
24+
fixes

Counted from 43 of 108 release notes. Advisories are counted from the advisory database, in full.

Before you upgrade

Tick each one off as you go
  • breaking5.0.1
  • breaking0.8.0
  • breaking0.5.0
  • breaking0.5.0
  • deprecated0.8.0

Security

  • platform version in CSP and X-XSS-Protection

    0.5.3

Release by release

  1. 6.2.0 – 8.3.08 releases, no release note

  2. 6.1.5

    11 Apr 20231 fix
    • fixed

      Fixed yet another issue with TypeScript exports. See #420

  3. 6.1.4

    10 Apr 20231 fix
    • fixed

      Fix another issue with TypeScript default exports. See #418

  4. 6.1.3

    10 Apr 20231 fix
    • fixed

      Fix issue with TypeScript default exports. See #417

  5. 6.1.2

    9 Apr 20231 fix
    • fixed

      Restored main to package to help with some build tools

  6. 6.1.1

    8 Apr 20231 fix
    • fixed

      Fixed missing package metadata

  7. 6.1.0no release note

  8. 6.0.1

    29 Nov 20221 fix
    • fixed

      crossOriginEmbedderPolicy did not accept options at the top level. See #390

38 other lines we could not sort, mostly version bumps

  • Improve imports for CommonJS and ECMAScript modules. See #345

    5.0.2

  • Shrink the published package by about 2.5 kB

    4.4.1

  • helmet.expectCt is no longer a separate package. This should have no effect on end users.

    3.23.3

  • helmet.frameguard is no longer a separate package. This should have no effect on end users.

    3.23.3

  • helmet.dnsPrefetchControl is no longer a separate package. This should have no effect on end users.

    3.23.2

  • helmet.ieNoOpen is no longer a separate package. This should have no effect on end users.

    3.23.1

  • Rewrote internals in TypeScript. This should have no effect on end users.

    3.22.1

  • Updated helmet-csp to v2.9.5

    3.21.3

  • Updated helmet-csp to v2.9.4

    3.21.2

  • Updated helmet-csp to v2.9.0

    3.20.1

1 internal line (docs, tests, tooling) left out.