Update all Yarn dependencies (2026-07-22) - #702
Merged
Conversation
helmet 8.3.0 changed the order in which Content-Security-Policy directives are serialized into the header: default directives are now emitted first in helmet's canonical order, and directives we add that are not part of the defaults (report-uri, report-to) are appended last. Previously the directives we configured appeared first, followed by the remaining helmet defaults. The security policy itself is unchanged. The emitted header contains the exact same directives with the same values as before; only their order in the string differs. CSP directives are keyed by name, so ordering is not significant to browsers and nothing about the policy's behavior changes. checkSecurityHeaders asserts the full header string verbatim, so the reordering broke the assertion. This updates the expected string to match helmet 8.3.0's output.
fatadel
approved these changes
Jul 23, 2026
fatadel
left a comment
Contributor
There was a problem hiding this comment.
This needed changing the order of CSP terms inside the test to fulfill the requirements, see the last commit.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is your weekly update of all Yarn dependencies. Please take a good look at what changed and the test results before merging this pull request.
What changed?
✳️ helmet (8.2.0 → 8.3.0, minor) · Repo · Changelog · Diff
✳️ @types/node (25.9.3 → 25.9.5, patch) · Repo
✳️ @types/supertest (7.2.0 → 7.2.1, patch) · Repo
Depfu will only send you the next scheduled PR once you merge or close this one.
All Depfu comment commands