Packages

helmet

8.3.0 · 12 Jul 2026MIT22.5M / weekRepositoryHomepagenpmAtom feed

Upgrading helmet From 0.3.1 to 8.3.0

106 releases in betweennotes for 50

Reading releases, release notes and advisories…

Other targets from 0.3.1Newest 0.x0.15.0
8.0.0, 7.0.0, 6.0.0, 5.0.0, 4.0.0, 3.0.0, 2.0.0, 1.0.0 have no release note on GitHub or in the repository's changelog, so their breaking changes are missing from the counts below.
  1. 0.3.1yours
  2. 1 release
  3. 0.4.0major
  4. 2 releases
  5. 0.5.0major
  6. 2 releases
  7. 0.5.3security
  8. 1 release
  9. 0.6.0major
  10. 2 releases
  11. 0.7.0major
  12. 1 release
  13. 0.8.0major
  14. 0.9.0major
  15. 1 release
  16. 0.10.0major
  17. 0.11.0major
  18. 0.12.0major
  19. 0.13.0major
  20. 0.14.0major
  21. 0.15.0major
  22. 1.0.0major
  23. 5 releases
  24. 2.0.0major
  25. 6 releases
  26. 3.0.0major
  27. 38 releases
  28. 4.0.0major
  29. 9 releases
  30. 5.0.0major
  31. 4 releases
  32. 6.0.0major
  33. 8 releases
  34. 7.0.0major
  35. 2 releases
  36. 8.0.0major
  37. 2 releases
  38. 8.3.0target
6+
changes to make
0
advisories fixed
19+
new
27+
fixes

Counted from 50 of 106 release notes. Advisories are counted from the advisory database, in full.

Before you upgrade

Tick each one off as you go
  • breaking5.0.1
  • breaking0.8.0
  • breaking0.5.0
  • breaking0.5.0
  • deprecated3.15.1
  • deprecated0.8.0

Security

  • platform version in CSP and X-XSS-Protection

    0.5.3

Release by release

  1. 6.2.0 – 8.3.08 releases, no release note

  2. 6.1.5

    11 Apr 20231 fix
    • fixed

      Fixed yet another issue with TypeScript exports. See #420

  3. 6.1.4

    10 Apr 20231 fix
    • fixed

      Fix another issue with TypeScript default exports. See #418

  4. 6.1.3

    10 Apr 20231 fix
    • fixed

      Fix issue with TypeScript default exports. See #417

  5. 6.1.2

    9 Apr 20231 fix
    • fixed

      Restored main to package to help with some build tools

  6. 6.1.1

    8 Apr 20231 fix
    • fixed

      Fixed missing package metadata

  7. 6.1.0no release note

  8. 6.0.1

    29 Nov 20221 fix
    • fixed

      crossOriginEmbedderPolicy did not accept options at the top level. See #390

40 other lines we could not sort, mostly version bumps

  • Improve imports for CommonJS and ECMAScript modules. See #345

    5.0.2

  • Shrink the published package by about 2.5 kB

    4.4.1

  • helmet.expectCt is no longer a separate package. This should have no effect on end users.

    3.23.3

  • helmet.frameguard is no longer a separate package. This should have no effect on end users.

    3.23.3

  • helmet.dnsPrefetchControl is no longer a separate package. This should have no effect on end users.

    3.23.2

  • helmet.ieNoOpen is no longer a separate package. This should have no effect on end users.

    3.23.1

  • Rewrote internals in TypeScript. This should have no effect on end users.

    3.22.1

  • Updated helmet-csp to v2.9.5

    3.21.3

  • Updated helmet-csp to v2.9.4

    3.21.2

  • Updated helmet-csp to v2.9.0

    3.20.1

1 internal line (docs, tests, tooling) left out.