# What changed in helmet

> 7 changes in helmet 8 from its official release notes, upgrade guides and advisories: 1 breaking, 1 new APIs and options. Each one cited. Sources checked 2026-10-20. HTML: https://unstale.sh/npm/helmet/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## helmet 8

### Breaking changes

- Using `useDefaults: false` with no directives is no longer valid at runtime or in the type system. (8.3.0) — [release notes](https://github.com/helmetjs/helmet/blob/f03f70da21409f525f90418a049ae7222261e9a2/CHANGELOG.md#830---2026-07-11)

### New APIs and options

- Adds support for the noopener-allow-popups value. (8.2.0) — [release notes](https://github.com/helmetjs/helmet/blob/f03f70da21409f525f90418a049ae7222261e9a2/CHANGELOG.md#820---2026-05-21)

### Performance

- Performance improved by about 7% when there are no dynamic directives. (8.3.0) — [release notes](https://github.com/helmetjs/helmet/blob/f03f70da21409f525f90418a049ae7222261e9a2/CHANGELOG.md#830---2026-07-11)

### Fixes and other changes

- Error handling improved for invalid directive names. (8.3.0) — [release notes](https://github.com/helmetjs/helmet/blob/f03f70da21409f525f90418a049ae7222261e9a2/CHANGELOG.md#830---2026-07-11)
- When a function throws, dynamically-computed directive value entries call `next` instead of throwing. (8.3.0) — [release notes](https://github.com/helmetjs/helmet/blob/f03f70da21409f525f90418a049ae7222261e9a2/CHANGELOG.md#830---2026-07-11)
- Invalid dynamically-computed directive values call `next` instead of throwing. (8.3.0) — [release notes](https://github.com/helmetjs/helmet/blob/f03f70da21409f525f90418a049ae7222261e9a2/CHANGELOG.md#830---2026-07-11)
- Improves the error message shown when duplicate options are passed. (8.2.0) — [release notes](https://github.com/helmetjs/helmet/blob/f03f70da21409f525f90418a049ae7222261e9a2/CHANGELOG.md#820---2026-05-21)