search

wireapp / wire-webapp

👽 Wire for web
https://app.wire.com
GNU General Public License v3.0
1.13k stars 289 forks source link

chore(deps): bump helmet from 7.1.0 to 8.0.0 in /server #18103

Closed dependabot[bot] closed 5 days ago

dependabot[bot] commented 5 days ago

Bumps helmet from 7.1.0 to 8.0.0.

Changelog

Sourced from helmet's changelog.

8.0.0

Changed

  • Breaking: Strict-Transport-Security now has a max-age of 365 days, up from 180
  • Breaking: Content-Security-Policy middleware now throws an error if a directive should have quotes but does not, such as self instead of 'self'. See #454
  • Breaking: Content-Security-Policy's getDefaultDirectives now returns a deep copy. This only affects users who were mutating the result
  • Breaking: Strict-Transport-Security now throws an error when "includeSubDomains" option is misspelled. This was previously a warning

Removed

  • Breaking: Drop support for Node 16 and 17. Node 18+ is now required

7.2.0 - 2024-09-28

Changed

  • Content-Security-Policy middleware now warns if a directive should have quotes but does not, such as self instead of 'self'. This will be an error in future versions. See #454
Commits
  • 9a8e6d5 8.0.0
  • 6562cd7 CSP: speed up getDefaultDirectives
  • a8befb3 getDefaultDirectives should do a deep copy
  • 558ef2c HSTS: throw when misspelling "includeSubDomains" option
  • 73e7595 Content-Security-Policy: throw if directive value lacks necessary quotes
  • 76410e1 Content-Security-Policy can now use Object.hasOwn
  • 293bd18 Strict-Transport-Security: increase max-age to 1 year
  • 898cdc4 Require Node 18+
  • 7e2b069 7.2.0
  • 7bea915 Update changelog for 7.2.0 release
  • Additional commits viewable in compare view


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
sonarcloud[bot] commented 5 days ago

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud