unstale

npm / helmet

helmet

What changed in helmet 8, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-20.

1 breaking1 new APIs and options1 performance4 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli on npm

helmet 87 changes

Breaking changes 1

  • Using useDefaults: false with no directives is no longer valid at runtime or in the type system.

    8.3.0release notes

New APIs and options 1

  • Adds support for the noopener-allow-popups value.

    8.2.0release notes

Performance 1

  • Performance improved by about 7% when there are no dynamic directives.

    8.3.0release notes

Fixes and other changes 4

  • Error handling improved for invalid directive names.

    8.3.0release notes

  • When a function throws, dynamically-computed directive value entries call next instead of throwing.

    8.3.0release notes

  • Invalid dynamically-computed directive values call next instead of throwing.

    8.3.0release notes

  • Improves the error message shown when duplicate options are passed.

    8.2.0release notes