Packages

helmet

8.3.0 · 12 Jul 2026MIT22.5M / weekRepositoryHomepagenpmAtom feed

Upgrading helmet From 3.8.2 to 3.23.3

26 releases in betweennotes for 11

Reading releases, release notes and advisories…

Other targets from 3.8.2Latest8.3.0
  1. 3.8.2yours
  2. 25 releases
  3. 3.23.3target
1+
change to make
0
advisories fixed
?
new
3+
fixes

Counted from 11 of 26 release notes. Advisories are counted from the advisory database, in full.

Before you upgrade

Tick each one off as you go
  • deprecated3.15.1

Release by release

  1. 3.21.2 – 3.23.38 releases, nothing new or fixed; 2 without a note

  2. 3.21.1

    20 Sep 20191 fix
    • fixed

      Updated helmet-csp to v2.9.2

  3. 3.16.0 – 3.21.07 releases, nothing new or fixed; 6 without a note

  4. 3.15.1

    Deprecation10 Feb 2019
    • deprecated

      The hpkp middleware has been deprecated. If you still need to use this module, install the standalone hpkp module from npm. See #180 for more.

  5. 3.13.0 – 3.15.03 releases, no release note

  6. 3.12.2

    20 Jul 20181 fix
    • fixed

      Removed lodash.reduce dependency from csp

  7. 3.12.1

    16 May 20181 fix
    • fixed

      expectCt should use comma instead of semicolon as delimiter

  8. 3.9.0 – 3.12.04 releases, no release note

8 other lines we could not sort, mostly version bumps

  • helmet.expectCt is no longer a separate package. This should have no effect on end users.

    3.23.3

  • helmet.frameguard is no longer a separate package. This should have no effect on end users.

    3.23.3

  • helmet.dnsPrefetchControl is no longer a separate package. This should have no effect on end users.

    3.23.2

  • helmet.ieNoOpen is no longer a separate package. This should have no effect on end users.

    3.23.1

  • Rewrote internals in TypeScript. This should have no effect on end users.

    3.22.1

  • Updated helmet-csp to v2.9.5

    3.21.3

  • Updated helmet-csp to v2.9.4

    3.21.2

  • Updated helmet-csp to v2.9.0

    3.20.1