-
Notifications
You must be signed in to change notification settings - Fork 36
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Update dependency helmet to v4 #1668
Conversation
I resolved one of the issues with this update, which was the removal of the The test for @muffinresearch (or anyone else on the team) do you have an opinion on this? |
+1 to taking Helmet's new default for |
bf35d79
to
5a2b15e
Compare
Codecov Report
@@ Coverage Diff @@
## master #1668 +/- ##
=======================================
Coverage 98.04% 98.04%
=======================================
Files 63 63
Lines 2712 2712
Branches 702 702
=======================================
Hits 2659 2659
Misses 42 42
Partials 11 11
Continue to review full report at Codecov.
|
This is now fixed and can be merged! |
This PR contains the following updates:
3.23.3
->4.0.0
Release Notes
helmetjs/helmet
v4.0.0
Compare Source
See the Helmet 4 upgrade guide for help upgrading from Helmet 3.
Added
helmet.contentSecurityPolicy
:default-src
directive is supplied, an error is thrownChanged
helmet.contentSecurityPolicy
:helmet.xssFilter
now disables the buggy XSS filter by default. See #230Removed
helmet.featurePolicy
. If you still need it, use thefeature-policy
package on npm.helmet.hpkp
. If you still need it, use thehpkp
package on npm.helmet.noCache
. If you still need it, use thenocache
package on npm.helmet.contentSecurityPolicy
:browserSniff
anddisableAndroid
parameters). See helmetjs/csp#97reportOnly
. Read this if you need help.setAllHeaders
parameter). Read this if you need help.loose
optionhelmet.frameguard
:ALLOW-FROM
action. Read more here.helmet.hidePoweredBy
no longer accepts arguments. See this article to see how to replicate the removed behavior. See #224.helmet.hsts
:includeSubdomains
with a lowercase D. See #231setIf
. Read this if you need help.. See #232helmet.xssFilter
no longer accepts options. Read "How to disable blocking with X–XSS–Protection" and "How to enable thereport
directive with X–XSS–Protection" if you need the legacy behavior.Renovate configuration
📅 Schedule: At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻️ Rebasing: Renovate will not automatically rebase this PR, because other commits have been found.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by WhiteSource Renovate. View repository job log here.