Update helmet: 4.3.1 → 4.6.0 (minor)

[depfu]

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ helmet (4.3.1 → 4.6.0) · Repo · Changelog

Release Notes

4.6.0 (from changelog)

Added

• helmet.contentSecurityPolicy: the useDefaults option, defaulting to false, lets you selectively override defaults more easily
• Explicitly define TypeScript types in package.json. See #303

4.5.0 (from changelog)

Added

• helmet.crossOriginEmbedderPolicy: a new middleware for the Cross-Origin-Embedder-Policy header, disabled by default
• helmet.crossOriginOpenerPolicy: a new middleware for the Cross-Origin-Opener-Policy header, disabled by default
• helmet.crossOriginResourcePolicy: a new middleware for the Cross-Origin-Resource-Policy header, disabled by default

Changed

• true enables a middleware with default options. Previously, this would fail with an error if the middleware was already enabled by default.
• Log a warning when passing options to originAgentCluster at the top level

Fixed

• Incorrect documentation

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 40 commits:

• 4.6.0
• Update changelog for 4.6.0 release
• Content-Security-Policy: useDefaults option
• Upgrade HTTP doc links to HTTPS, and fix broken link
• CI should test on Node 16; update Node CI action
• Update changelog for new "types" field in package.json
• Add explicit types declaration to package.json
• Cross-Origin-Resource-Policy 0.3.0
• Prepare Cross-Origin-Resource-Policy standalone package
• 4.5.0
• Update changelog for 4.5.0 release
• 4.5.0-rc.1
• Publish new middlewares
• Remove internal MiddlewareOption type
• Add Cross-Origin-Opener-Policy middleware
• Add Cross-Origin-Resource-Policy middleware
• Add Cross-Origin-Embedder-Policy middleware
• Upgrade devDependencies to latest versions
• Update devDependencies to latest versions
• Use "real" hyphens instead of en dashes in changelog links
• Fix minor typo in changelog
• Update CSP documentation
• 4.4.1
• Update changelog for 4.4.1 release
• Add "everything is disabled" test
• Don't collect coverage from /dist/
• Content-Security-Policy: remove some minor duplication
• Add basic code coverage requirements
• Test that Origin-Agent-Cluster is missing from default
• Remove CONTRIBUTING.md and CODE_OF_CONDUCT.md from published package
• "Minify" middleware package's package.json
• To save some bytes, switch from `files` to `.npmignore`
• Run Origin-Agent-Cluster tests
• 4.4.0
• Update changelog for 4.4.0 release
• Save ~100 bytes by formatting built files
• Minor: alphabetize Origin-Agent-Cluster code in a few more places
• Minor: where possible, shorten top-level middleware assignment
• Add Origin-Agent-Cluster middleware
• Update license year for 2021

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

[ghost]

Sider has detected 1 warning on analyzing the commit 9e5c1c4.

• ⚠️ Goodcheck

We recommend fixing them as possible by updating the dependencies, configuring the analysis tool, configuring sider.yml, turning off unused tools, and so on.

If you have problems or questions still, feel free to ask us via chat. 💬

---

You can turn off such notifications if unnecessary.