Update dependency helmet to v8

Open renovate[bot] opened this issue 1 year ago • 0 comments

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
helmet (source)	`^6.0.0` -> `^8.0.0`

[!WARNING] Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

helmetjs/helmet (helmet)

Breaking: Strict-Transport-Security now has a max-age of 365 days, up from 180
Breaking: Content-Security-Policy middleware now throws an error if a directive should have quotes but does not, such as self instead of 'self'. See #454
Breaking: Content-Security-Policy's getDefaultDirectives now returns a deep copy. This only affects users who were mutating the result
Breaking: Strict-Transport-Security now throws an error when "includeSubDomains" option is misspelled. This was previously a warning

Content-Security-Policy middleware now warns if a directive should have quotes but does not, such as self instead of 'self'. This will be an error in future versions. See #454

helmet.crossOriginEmbedderPolicy now supports the unsafe-none directive. See #477

Breaking: Cross-Origin-Embedder-Policy middleware is now disabled by default. See #411

Breaking: Drop support for Node 14 and 15. Node 16+ is now required
Breaking: Expect-CT is no longer part of Helmet. If you still need it, you can use the expect-ct package. See #378