Bump helmet-csp and helmet

[dependabot]

Bumps helmet-csp to 2.10.0 and updates ancestor dependency helmet. These dependencies need to be updated together.

Updates helmet-csp from 2.7.0 to 2.10.0

Changelog

Sourced from helmet-csp's changelog.

Changelog

8.3.0 - 2026-07-11

Changed

• Content-Security-Policy: improved performance by ~7% when there are no dynamic directives
• Content-Security-Policy: improved error handling for invalid directive names

Fixed

• Content-Security-Policy: useDefaults: false with no directives is no longer valid, both at runtime and the type level
• Content-Security-Policy: dynamically-computed directive values would throw, not call next, when invalid
• Content-Security-Policy: dynamically-computed directive value entries would throw, not call next, when function threw

8.2.0 - 2026-05-21

• Cross-Origin-Opener-Policy: support noopener-allow-popups. See #522
• Improve error message when passing duplicate options

8.1.0 - 2025-03-17

Changed

• Content-Security-Policy gives a better error when a directive value, like self, should be quoted. See #482

8.0.0 - 2024-09-28

Changed

• Breaking: Strict-Transport-Security now has a max-age of 365 days, up from 180
• Breaking: Content-Security-Policy middleware now throws an error if a directive should have quotes but does not, such as self instead of 'self'. See #454
• Breaking: Content-Security-Policy's getDefaultDirectives now returns a deep copy. This only affects users who were mutating the result
• Breaking: Strict-Transport-Security now throws an error when "includeSubDomains" option is misspelled. This was previously a warning

Removed

• Breaking: Drop support for Node 16 and 17. Node 18+ is now required

7.2.0 - 2024-09-28

Changed

• Content-Security-Policy middleware now warns if a directive should have quotes but does not, such as self instead of 'self'. This will be an error in future versions. See #454

7.1.0 - 2023-11-07

Added

• helmet.crossOriginEmbedderPolicy now supports the unsafe-none directive. See #447

... (truncated)

Commits

• See full diff in compare view

Updates helmet from 3.11.0 to 3.23.3

Changelog

Sourced from helmet's changelog.

3.23.3 - 2020-06-26

Changed

• helmet.expectCt is no longer a separate package. This should have no effect on end users.
• helmet.frameguard is no longer a separate package. This should have no effect on end users.

3.23.2 - 2020-06-23

Changed

• helmet.dnsPrefetchControl is no longer a separate package. This should have no effect on end users.

3.23.1 - 2020-06-16

Changed

• helmet.ieNoOpen is no longer a separate package. This should have no effect on end users.

3.23.0 - 2020-06-12

Deprecated

• helmet.featurePolicy is deprecated. Use the feature-policy module instead.

3.22.1 - 2020-06-10

Changed

• Rewrote internals in TypeScript. This should have no effect on end users.

3.22.0 - 2020-03-24

Changed

• Updated helmet-csp to v2.10.0
  • Add support for the allow-downloads sandbox directive. See helmet-csp#103

Deprecated

• helmet.noCache is deprecated. Use the nocache module instead. See #215

3.21.3 - 2020-02-24

Changed

• Updated helmet-csp to v2.9.5
  • Updated bowser subdependency from 2.7.0 to 2.9.0
  • Fixed an issue some people were having when importing the bowser subdependency. See helmet-csp#96 and #101

... (truncated)

Commits

• 3edd5e1 3.23.3
• 8662052 Include expect-ct and x-frame-options in npm package
• 5c4a499 Update changelog for 3.23.3 release
• 35b3e6d Proofread of SECURITY.md
• 04d446c Update Jest and @​types/jest to their latest versions
• 7906601 Import X-Frame-Options (frameguard) middleware
• 837765d Minor formatting changes in license
• d03c555 Import Expect-CT (expect-ct) middleware
• 16243e6 3.23.2
• 223edeb Update changelog for 3.23.2 release
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.