Packages

helmet

8.3.0 · 12 Jul 2026MIT22.5M / weekRepositoryHomepagenpmAtom feed

Upgrading helmet From 0.9.1 to 0.15.0

6 releases in betweennotes for 5

Reading releases, release notes and advisories…

Other targets from 0.9.1Latest8.3.0
  1. 0.9.1yours
  2. 0.10.0major
  3. 0.11.0major
  4. 0.12.0major
  5. 0.13.0major
  6. 0.14.0major
  7. 0.15.0target
?
changes to make
0
advisories fixed
8+
new
2+
fixes

Counted from 5 of 6 release notes. Advisories are counted from the advisory database, in full.

Release by release

  1. 0.15.0nothing new or fixed in the note

  2. 0.14.0

    1 Nov 20151 new
    • new

      nocache now sends the Surrogate-Control header

  3. 0.13.0

    23 Oct 20152 new
    • new

      xssFilter now has a function name

    • new

      Added new CSP docs to readme

  4. 0.12.0no release note

  5. 0.11.0

    18 Sep 20153 new · 1 fix
    • new

      csp now supports Microsoft Edge

    • new

      CSP Level 2 support

    • new

      Added license key to csp's package.json

    • fixed

      Empty csp directives now support every directive, not just sandbox

  6. 0.10.0

    9 Jul 20152 new · 1 fix
    • new

      Add "Handling CSP violations" to csp readme

    • new

      Add license to package.json

    • fixed

      hpkp might have miscalculated maxAge slightly wrong

7 other lines we could not sort, mostly version bumps

  • hpkp allows a report-uri without the Report-Only header

    0.15.0

  • nocache no longer contains the private directive in the Cache-Control header

    0.14.0

  • HSTS option renamed from includeSubdomains to includeSubDomains

    0.13.0

  • Updated connect to 3.4.0

    0.11.0

  • Updated depd to 1.1.0

    0.11.0

  • hpkp had a link to the wrong place in its readme

    0.10.0

  • hpkp requires 2 or more pins

    0.10.0