Merge pull request #9321 from backstage/dependabot/npm_and_yarn/helmet-5.0.2
chore(deps): bump helmet from 4.4.1 to 5.0.2
This commit is contained in:
Patrik Oldsberg
@@ -0,0 +1,8 @@
|
||||
---
|
||||
'@backstage/backend-common': patch
|
||||
'@backstage/plugin-app-backend': patch
|
||||
'@backstage/plugin-graphql-backend': patch
|
||||
'@backstage/plugin-kubernetes-backend': patch
|
||||
---
|
||||
|
||||
chore(deps): bump `helmet` from 4.4.1 to 5.0.2
|
||||
@@ -0,0 +1,7 @@
|
||||
---
|
||||
'@backstage/plugin-auth-backend': patch
|
||||
'@backstage/plugin-rollbar-backend': patch
|
||||
'@backstage/plugin-scaffolder-backend': patch
|
||||
---
|
||||
|
||||
Removed unused `helmet` dependency.
|
||||
@@ -57,7 +57,7 @@
|
||||
"express-promise-router": "^4.1.0",
|
||||
"fs-extra": "9.1.0",
|
||||
"git-url-parse": "^11.6.0",
|
||||
"helmet": "^4.0.0",
|
||||
"helmet": "^5.0.2",
|
||||
"isomorphic-git": "^1.8.0",
|
||||
"jose": "^1.27.1",
|
||||
"keyv": "^4.0.3",
|
||||
|
||||
@@ -19,7 +19,7 @@ import compression from 'compression';
|
||||
import cors from 'cors';
|
||||
import express, { Router, ErrorRequestHandler } from 'express';
|
||||
import helmet from 'helmet';
|
||||
import { ContentSecurityPolicyOptions } from 'helmet/dist/middlewares/content-security-policy';
|
||||
import { ContentSecurityPolicyOptions } from 'helmet/dist/types/middlewares/content-security-policy';
|
||||
import * as http from 'http';
|
||||
import stoppable from 'stoppable';
|
||||
import { Logger } from 'winston';
|
||||
@@ -215,8 +215,17 @@ export class ServiceBuilderImpl implements ServiceBuilder {
|
||||
httpsSettings: this.httpsSettings,
|
||||
helmetOptions: {
|
||||
contentSecurityPolicy: {
|
||||
useDefaults: false,
|
||||
directives: applyCspDirectives(this.cspOptions),
|
||||
},
|
||||
// These are all disabled in order to maintain backwards compatibility
|
||||
// when bumping helmet v5. We can't enable these by default because
|
||||
// there is no way for users to configure them.
|
||||
// TODO(Rugvip): We should give control of this setup to consumers
|
||||
crossOriginEmbedderPolicy: false,
|
||||
crossOriginOpenerPolicy: false,
|
||||
crossOriginResourcePolicy: false,
|
||||
originAgentCluster: false,
|
||||
},
|
||||
};
|
||||
}
|
||||
@@ -232,6 +241,11 @@ export function applyCspDirectives(
|
||||
// It should be replaced by any other solution that doesn't require unsafe-eval.
|
||||
result['script-src'] = ["'self'", "'unsafe-eval'"];
|
||||
|
||||
// TODO(Rugvip): This is removed so that we maintained backwards compatibility
|
||||
// when bumping to helmet v5, we could remove this as well as
|
||||
// skip setting `useDefaults: false` in the future.
|
||||
delete result['form-action'];
|
||||
|
||||
if (directives) {
|
||||
for (const [key, value] of Object.entries(directives)) {
|
||||
if (value === false) {
|
||||
|
||||
@@ -42,7 +42,7 @@
|
||||
"express": "^4.17.1",
|
||||
"express-promise-router": "^4.1.0",
|
||||
"fs-extra": "9.1.0",
|
||||
"helmet": "^4.0.0",
|
||||
"helmet": "^5.0.2",
|
||||
"knex": "^1.0.2",
|
||||
"lodash": "^4.17.21",
|
||||
"luxon": "^2.0.2",
|
||||
|
||||
@@ -51,7 +51,6 @@
|
||||
"express-session": "^1.17.1",
|
||||
"fs-extra": "9.1.0",
|
||||
"google-auth-library": "^7.6.1",
|
||||
"helmet": "^4.0.0",
|
||||
"jose": "^1.27.1",
|
||||
"jwt-decode": "^3.1.0",
|
||||
"knex": "^1.0.2",
|
||||
|
||||
@@ -45,7 +45,7 @@
|
||||
"express": "^4.17.1",
|
||||
"express-promise-router": "^4.1.0",
|
||||
"graphql": "^16.0.0",
|
||||
"helmet": "^4.0.0",
|
||||
"helmet": "^5.0.2",
|
||||
"reflect-metadata": "^0.1.13",
|
||||
"winston": "^3.2.1",
|
||||
"yn": "^4.0.0"
|
||||
|
||||
@@ -50,7 +50,7 @@
|
||||
"express": "^4.17.1",
|
||||
"express-promise-router": "^4.1.0",
|
||||
"fs-extra": "9.1.0",
|
||||
"helmet": "^4.0.0",
|
||||
"helmet": "^5.0.2",
|
||||
"lodash": "^4.17.21",
|
||||
"morgan": "^1.10.0",
|
||||
"stream-buffers": "^3.0.2",
|
||||
|
||||
@@ -43,7 +43,6 @@
|
||||
"express": "^4.17.1",
|
||||
"express-promise-router": "^4.1.0",
|
||||
"fs-extra": "9.1.0",
|
||||
"helmet": "^4.0.0",
|
||||
"lodash": "^4.17.21",
|
||||
"morgan": "^1.10.0",
|
||||
"node-fetch": "^2.6.7",
|
||||
|
||||
@@ -58,7 +58,6 @@
|
||||
"git-url-parse": "^11.6.0",
|
||||
"globby": "^11.0.0",
|
||||
"handlebars": "^4.7.6",
|
||||
"helmet": "^4.0.0",
|
||||
"isbinaryfile": "^4.0.8",
|
||||
"isomorphic-git": "^1.8.0",
|
||||
"jsonschema": "^1.2.6",
|
||||
|
||||
@@ -13317,10 +13317,10 @@ headers-utils@^3.0.2:
|
||||
resolved "https://registry.npmjs.org/headers-utils/-/headers-utils-3.0.2.tgz#dfc65feae4b0e34357308aefbcafa99c895e59ef"
|
||||
integrity sha512-xAxZkM1dRyGV2Ou5bzMxBPNLoRCjcX+ya7KSWybQD2KwLphxsapUVK6x/02o7f4VU6GPSXch9vNY2+gkU8tYWQ==
|
||||
|
||||
helmet@^4.0.0:
|
||||
version "4.4.1"
|
||||
resolved "https://registry.npmjs.org/helmet/-/helmet-4.4.1.tgz#a17e1444d81d7a83ddc6e6f9bc6e2055b994efe7"
|
||||
integrity sha512-G8tp0wUMI7i8wkMk2xLcEvESg5PiCitFMYgGRc/PwULB0RVhTP5GFdxOwvJwp9XVha8CuS8mnhmE8I/8dx/pbw==
|
||||
helmet@^5.0.2:
|
||||
version "5.0.2"
|
||||
resolved "https://registry.npmjs.org/helmet/-/helmet-5.0.2.tgz#3264ec6bab96c82deaf65e3403c369424cb2366c"
|
||||
integrity sha512-QWlwUZZ8BtlvwYVTSDTBChGf8EOcQ2LkGMnQJxSzD1mUu8CCjXJZq/BXP8eWw4kikRnzlhtYo3lCk0ucmYA3Vg==
|
||||
|
||||
hexoid@1.0.0:
|
||||
version "1.0.0"
|
||||
|
||||
Reference in New Issue
Block a user