Packages

helmet

8.3.0 · 12 Jul 2026MIT22.5M / weekRepositoryHomepagenpmAtom feed

Upgrading helmet From 0.3.2 to 0.15.0

22 releases in betweennotes for 18

Reading releases, release notes and advisories…

Other targets from 0.3.2Latest8.3.0
  1. 0.3.2yours
  2. 0.4.0major
  3. 2 releases
  4. 0.5.0major
  5. 2 releases
  6. 0.5.3security
  7. 1 release
  8. 0.6.0major
  9. 2 releases
  10. 0.7.0major
  11. 1 release
  12. 0.8.0major
  13. 0.9.0major
  14. 1 release
  15. 0.10.0major
  16. 0.11.0major
  17. 0.12.0major
  18. 0.13.0major
  19. 0.14.0major
  20. 0.15.0target
4+
changes to make
0
advisories fixed
14+
new
8+
fixes

Counted from 18 of 22 release notes. Advisories are counted from the advisory database, in full.

Before you upgrade

Tick each one off as you go
  • breaking0.8.0
  • breaking0.5.0
  • breaking0.5.0
  • deprecated0.8.0

Security

  • platform version in CSP and X-XSS-Protection

    0.5.3

Release by release

  1. 0.15.0nothing new or fixed in the note

  2. 0.14.0

    1 Nov 20151 new
    • new

      nocache now sends the Surrogate-Control header

  3. 0.13.0

    23 Oct 20152 new
    • new

      xssFilter now has a function name

    • new

      Added new CSP docs to readme

  4. 0.12.0no release note

  5. 0.11.0

    18 Sep 20153 new · 1 fix
    • new

      csp now supports Microsoft Edge

    • new

      CSP Level 2 support

    • new

      Added license key to csp's package.json

    • fixed

      Empty csp directives now support every directive, not just sandbox

  6. 0.10.0

    9 Jul 20152 new · 1 fix
    • new

      Add "Handling CSP violations" to csp readme

    • new

      Add license to package.json

    • fixed

      hpkp might have miscalculated maxAge slightly wrong

  7. 0.9.1no release note

  8. 0.9.0

    24 Apr 20151 new
    • new

      Added a description to package.json

27 other lines we could not sort, mostly version bumps

  • hpkp allows a report-uri without the Report-Only header

    0.15.0

  • nocache no longer contains the private directive in the Cache-Control header

    0.14.0

  • HSTS option renamed from includeSubdomains to includeSubDomains

    0.13.0

  • Updated connect to 3.4.0

    0.11.0

  • Updated depd to 1.1.0

    0.11.0

  • hpkp had a link to the wrong place in its readme

    0.10.0

  • hpkp requires 2 or more pins

    0.10.0

  • nocache adds private to its Cache-Control directive

    0.9.0

  • Removed hefty Lodash dependency from HSTS and CSP

    0.8.0

  • Updated string detection module in Frameguard

    0.8.0

1 internal line (docs, tests, tooling) left out.