Release v4.1.0

[EvanHahn]

Expected release date: 2020-08-15

Try this out with npm install helmet@4.1.0-rc.2.

Read the changelog to see what changed.

Closes #235.
Closes #243.

[anthony-telljohann]

@EvanHahn After installing helmet@4.1.0-rc.2, I was able to fix the typescript errors by importing the default export:

import helmet from 'helmet'
app.use(helmet(helmetConfig))

[EvanHahn]

@anthony-telljohann I assume that's a good thing, but let me know if that's not ideal for you.

[anthony-telljohann]

It's a good thing. Looking forward to the release!

[EvanHahn]

This has been released!

[kytrongchinh]

Hi @EvanHahn
I installed with version helmet@4.1.0-rc.2 and run it on Nodejs version 10.15.3
But I just still got the same error

My site just working when I install with version 3.23.3

[EvanHahn]

@kytrongchinh This is happening because Helmet 4 sets a default Content Security Policy. See this section of the upgrade guide for help.

Also: you no longer need to install the release candidate. Helmet v4.1.0 has been released.

[kytrongchinh]

Thank @EvanHahn so much!
The reason that is not noted on the document, so I and more dev use helmet have problems.

// This disables the contentSecurityPolicy middleware but keeps the rest.
app.use(
helmet({
contentSecurityPolicy: false,
})
);
Good for noted, Thanks again.