Packages

helmet

8.3.0 · 12 Jul 2026MIT22.5M / weekRepositoryHomepagenpmAtom feed

Upgrading helmet From 2.0.0 to 8.3.0

76 releases in betweennotes for 27

Reading releases, release notes and advisories…

Other targets from 2.0.0Newest 2.x2.3.0
8.0.0, 7.0.0, 6.0.0, 5.0.0, 4.0.0, 3.0.0 have no release note on GitHub or in the repository's changelog, so their breaking changes are missing from the counts below.
  1. 2.0.0yours
  2. 6 releases
  3. 3.0.0major
  4. 38 releases
  5. 4.0.0major
  6. 9 releases
  7. 5.0.0major
  8. 5.0.1breaking
  9. 3 releases
  10. 6.0.0major
  11. 8 releases
  12. 7.0.0major
  13. 2 releases
  14. 8.0.0major
  15. 2 releases
  16. 8.3.0target
2+
changes to make
0
advisories fixed
?
new
14+
fixes

Counted from 27 of 76 release notes. Advisories are counted from the advisory database, in full.

Before you upgrade

Tick each one off as you go
  • breaking5.0.1
  • deprecated3.15.1

Release by release

  1. 6.2.0 – 8.3.08 releases, no release note

  2. 6.1.5

    11 Apr 20231 fix
    • fixed

      Fixed yet another issue with TypeScript exports. See #420

  3. 6.1.4

    10 Apr 20231 fix
    • fixed

      Fix another issue with TypeScript default exports. See #418

  4. 6.1.3

    10 Apr 20231 fix
    • fixed

      Fix issue with TypeScript default exports. See #417

  5. 6.1.2

    9 Apr 20231 fix
    • fixed

      Restored main to package to help with some build tools

  6. 6.1.1

    8 Apr 20231 fix
    • fixed

      Fixed missing package metadata

  7. 6.1.0no release note

  8. 6.0.1

    29 Nov 20221 fix
    • fixed

      crossOriginEmbedderPolicy did not accept options at the top level. See #390

12 other lines we could not sort, mostly version bumps

  • Improve imports for CommonJS and ECMAScript modules. See #345

    5.0.2

  • Shrink the published package by about 2.5 kB

    4.4.1

  • helmet.expectCt is no longer a separate package. This should have no effect on end users.

    3.23.3

  • helmet.frameguard is no longer a separate package. This should have no effect on end users.

    3.23.3

  • helmet.dnsPrefetchControl is no longer a separate package. This should have no effect on end users.

    3.23.2

  • helmet.ieNoOpen is no longer a separate package. This should have no effect on end users.

    3.23.1

  • Rewrote internals in TypeScript. This should have no effect on end users.

    3.22.1

  • Updated helmet-csp to v2.9.5

    3.21.3

  • Updated helmet-csp to v2.9.4

    3.21.2

  • Updated helmet-csp to v2.9.0

    3.20.1