[Snyk] Upgrade helmet from 3.21.3 to 3.23.3

[snyk-bot]

Snyk has created this PR to upgrade helmet from 3.21.3 to 3.23.3.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 6 versions ahead of your current version.
• The recommended version was released 3 years ago, on 2020-06-26.

Release notes

Package name: helmet

• 3.23.3 - 2020-06-26
  

  3.23.3

• 3.23.2 - 2020-06-23
  

  3.23.2

• 3.23.1 - 2020-06-16
  

  3.23.1

• 3.23.0 - 2020-06-12
  

  3.23.0

• 3.22.1 - 2020-06-10
  

  3.22.1

• 3.22.0 - 2020-03-24
  

  3.22.0

• 3.21.3 - 2020-02-24
  

  3.21.3

from helmet GitHub release notes

Commit messages

Package name: helmet

• 3edd5e1 3.23.3
• 8662052 Include expect-ct and x-frame-options in npm package
• 5c4a499 Update changelog for 3.23.3 release
• 35b3e6d Proofread of SECURITY.md
• 04d446c Update Jest and @ types/jest to their latest versions
• 7906601 Import X-Frame-Options (frameguard) middleware
• 837765d Minor formatting changes in license
• d03c555 Import Expect-CT (expect-ct) middleware
• 16243e6 3.23.2
• 223edeb Update changelog for 3.23.2 release
• 124e95e X-DNS-Prefetch-Control: remove redundant contributors from package
• 0510abf Update outdated devDependencies
• e933c28 Import X-DNS-Prefetch-Control (dns-prefetch-control) middleware
• b120eb4 3.23.1
• 978b402 Update changelog for 3.23.1 release
• 1b7dc4b ienoopen@1.1.1
• 13b496f Import X-Download-Options (ienoopen) middleware
• 53a0299 Remove Feature-Policy middleware from documentation, as it is deprecated
• d93cdb6 3.23.0
• e40318d Update changelog for 3.23.0 release
• e5d4aa1 Deprecate Feature-Policy
• da4b623 Update code of conduct
• 852abfc Jest should ignore files in /dist/
• 39a8292 Add `prepublishOnly` script

Compare

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[stackblitz]

Run & review this pull request in StackBlitz Codeflow.

[socket-security]

New dependency changes detected. Learn more about Socket for GitHub ↗︎

---

🚨 Potential security issues found in this pull request. To accept the risk, merge this PR and you will not be notified again.

Bot Commands

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@* or ignore all packages with @SocketSecurity ignore-all

• @SocketSecurity ignore helmet@3.23.3

⚠️ URL strings

Package contains fragments of external URLs or IP addresses, which may indicate that it covertly exfiltrates data.

Avoid using packages that make connections to the network, since this helps to leak data.

Package	URL Fragment	Location	Source
helmet@3.23.3 (upgraded)	helmetjs/helmet#215	dist/index.js	package-lock.json, package.json

Pull request alert summary

Issue	Status
Critical CVE	✅ 0 issues
CVE	✅ 0 issues
Mild CVE	✅ 0 issues
Install scripts	✅ 0 issues
Native code	✅ 0 issues
Bin script confusion	✅ 0 issues
Bin script shell injection	✅ 0 issues
Filesystem access	✅ 0 issues
Network access	✅ 0 issues
Shell access	✅ 0 issues
Debug access	✅ 0 issues
Long strings	✅ 0 issues
High entropy strings	✅ 0 issues
URL strings	⚠️ 1 issue
Uses eval	✅ 0 issues
Dynamic require	✅ 0 issues
Environment variable access	✅ 0 issues
Missing dependency	✅ 0 issues
Unused dependency	✅ 0 issues
Peer dependency	✅ 0 issues
Uncaught optional dependency	✅ 0 issues
Unresolved require	✅ 0 issues
Extraneous dependency	✅ 0 issues
Obfuscated require	✅ 0 issues
Obfuscated code	✅ 0 issues
Minified code	✅ 0 issues
Bidirectional unicode control characters	✅ 0 issues
Zero width unicode chars	✅ 0 issues
Bad text encoding	✅ 0 issues
Unicode homoglyphs	✅ 0 issues
Invisible chars	✅ 0 issues
Suspicious strings	✅ 0 issues
Invalid package.json	✅ 0 issues
HTTP dependency	✅ 0 issues
Git dependency	✅ 0 issues
GitHub dependency	✅ 0 issues
File dependency	✅ 0 issues
No tests	✅ 0 issues
No repository	✅ 0 issues
Bad semver	✅ 0 issues
Bad dependency semver	✅ 0 issues
No v1	✅ 0 issues
No website	✅ 0 issues
No bug tracker	✅ 0 issues
No contributors or author data	✅ 0 issues
CommonJS depending on ESModule	✅ 0 issues
Empty package	✅ 0 issues
Trivial Package	✅ 0 issues
No README	✅ 0 issues
Deprecated	✅ 0 issues
Chronological version anomaly	✅ 0 issues
Semver anomaly	✅ 0 issues
New author	✅ 0 issues
Unstable ownership	✅ 0 issues
Non-existent author	✅ 0 issues
Unmaintained	✅ 0 issues
Unpublished package	✅ 0 issues
Major refactor	✅ 0 issues
Missing package tarball	✅ 0 issues
Unsafe copyright	✅ 0 issues
License change	✅ 0 issues
Non OSI license	✅ 0 issues
Deprecated license	✅ 0 issues
Missing license	✅ 0 issues
Non SPDX license	✅ 0 issues
Unclear license	✅ 0 issues
Mixed license	✅ 0 issues
Legal notice	✅ 0 issues
Modified license	✅ 0 issues
Modified license exception	✅ 0 issues
License exception	✅ 0 issues
Deprecated SPDX exception	✅ 0 issues
Potential typo squat	✅ 0 issues
Known Malware	✅ 0 issues
Telemetry	✅ 0 issues
Protestware/Troll package	✅ 0 issues

---

📊 Modified Dependency Overview:

⬆️ Updated Package	Version Diff	Added Capability Access	+/- Transitive Count	Publisher
helmet@3.23.3	3.21.3...3.23.3	None	+1/-5	evanhahn