Packages

helmet

8.3.0 · 12 Jul 2026MIT22.5M / weekRepositoryHomepagenpmAtom feed

Upgrading helmet From 3.2.0 to 8.3.0

67 releases in betweennotes for 20

Reading releases, release notes and advisories…

Other targets from 3.2.0Newest 3.x3.23.3
8.0.0, 7.0.0, 6.0.0, 5.0.0, 4.0.0 have no release note on GitHub or in the repository's changelog, so their breaking changes are missing from the counts below.
  1. 3.2.0yours
  2. 36 releases
  3. 4.0.0major
  4. 9 releases
  5. 5.0.0major
  6. 5.0.1breaking
  7. 3 releases
  8. 6.0.0major
  9. 8 releases
  10. 7.0.0major
  11. 2 releases
  12. 8.0.0major
  13. 2 releases
  14. 8.3.0target
1+
change to make
0
advisories fixed
?
new
11+
fixes

Counted from 20 of 67 release notes. Advisories are counted from the advisory database, in full.

Before you upgrade

Tick each one off as you go
  • breaking5.0.1

Release by release

  1. 6.2.0 – 8.3.08 releases, no release note

  2. 6.1.5

    11 Apr 20231 fix
    • fixed

      Fixed yet another issue with TypeScript exports. See #420

  3. 6.1.4

    10 Apr 20231 fix
    • fixed

      Fix another issue with TypeScript default exports. See #418

  4. 6.1.3

    10 Apr 20231 fix
    • fixed

      Fix issue with TypeScript default exports. See #417

  5. 6.1.2

    9 Apr 20231 fix
    • fixed

      Restored main to package to help with some build tools

  6. 6.1.1

    8 Apr 20231 fix
    • fixed

      Fixed missing package metadata

  7. 6.1.0no release note

  8. 6.0.1

    29 Nov 20221 fix
    • fixed

      crossOriginEmbedderPolicy did not accept options at the top level. See #390

10 other lines we could not sort, mostly version bumps

  • Improve imports for CommonJS and ECMAScript modules. See #345

    5.0.2

  • Shrink the published package by about 2.5 kB

    4.4.1

  • helmet.expectCt is no longer a separate package. This should have no effect on end users.

    3.23.3

  • helmet.frameguard is no longer a separate package. This should have no effect on end users.

    3.23.3

  • helmet.dnsPrefetchControl is no longer a separate package. This should have no effect on end users.

    3.23.2

  • helmet.ieNoOpen is no longer a separate package. This should have no effect on end users.

    3.23.1

  • Rewrote internals in TypeScript. This should have no effect on end users.

    3.22.1

  • Updated helmet-csp to v2.9.5

    3.21.3

  • Updated helmet-csp to v2.9.4

    3.21.2

  • Updated helmet-csp to v2.9.0

    3.20.1