From 60b85d8adea984eaa50bfb1d56a06d825154d85f Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Fri, 26 Aug 2022 18:21:22 +0000
Subject: [PATCH 1/2] fix(deps): update dependency helmet to v6

Signed-off-by: Renovate Bot <bot@renovateapp.com>
---
 .changeset/renovate-16f36a0.md          | 9 +++++++++
 packages/backend-common/package.json    | 2 +-
 plugins/app-backend/package.json        | 2 +-
 plugins/graphql-backend/package.json    | 2 +-
 plugins/kubernetes-backend/package.json | 2 +-
 plugins/vault-backend/package.json      | 2 +-
 yarn.lock                               | 8 ++++----
 7 files changed, 18 insertions(+), 9 deletions(-)
 create mode 100644 .changeset/renovate-16f36a0.md

diff --git a/.changeset/renovate-16f36a0.md b/.changeset/renovate-16f36a0.md
new file mode 100644
index 0000000000..d7bf43dfe1
--- /dev/null
+++ b/.changeset/renovate-16f36a0.md
@@ -0,0 +1,9 @@
+---
+'@backstage/backend-common': patch
+'@backstage/plugin-app-backend': patch
+'@backstage/plugin-graphql-backend': patch
+'@backstage/plugin-kubernetes-backend': patch
+'@backstage/plugin-vault-backend': patch
+---
+
+Updated dependency `helmet` to `^6.0.0`.
diff --git a/packages/backend-common/package.json b/packages/backend-common/package.json
index 43b1f81b12..6800bc2783 100644
--- a/packages/backend-common/package.json
+++ b/packages/backend-common/package.json
@@ -60,7 +60,7 @@
     "express-promise-router": "^4.1.0",
     "fs-extra": "10.1.0",
     "git-url-parse": "^12.0.0",
-    "helmet": "^5.0.2",
+    "helmet": "^6.0.0",
     "isomorphic-git": "^1.8.0",
     "jose": "^4.6.0",
     "keyv": "^4.0.3",
diff --git a/plugins/app-backend/package.json b/plugins/app-backend/package.json
index d6b5c1ea26..0d85c75cdf 100644
--- a/plugins/app-backend/package.json
+++ b/plugins/app-backend/package.json
@@ -42,7 +42,7 @@
     "express": "^4.17.1",
     "express-promise-router": "^4.1.0",
     "fs-extra": "10.1.0",
-    "helmet": "^5.0.2",
+    "helmet": "^6.0.0",
     "knex": "^2.0.0",
     "lodash": "^4.17.21",
     "luxon": "^3.0.0",
diff --git a/plugins/graphql-backend/package.json b/plugins/graphql-backend/package.json
index 4944d1d016..1f8477bc17 100644
--- a/plugins/graphql-backend/package.json
+++ b/plugins/graphql-backend/package.json
@@ -45,7 +45,7 @@
     "express-promise-router": "^4.1.0",
     "graphql": "^16.0.0",
     "graphql-modules": "^2.0.0",
-    "helmet": "^5.0.2",
+    "helmet": "^6.0.0",
     "reflect-metadata": "^0.1.13",
     "winston": "^3.2.1",
     "yn": "^4.0.0"
diff --git a/plugins/kubernetes-backend/package.json b/plugins/kubernetes-backend/package.json
index 52c1a53404..01b7342dee 100644
--- a/plugins/kubernetes-backend/package.json
+++ b/plugins/kubernetes-backend/package.json
@@ -54,7 +54,7 @@
     "express": "^4.17.1",
     "express-promise-router": "^4.1.0",
     "fs-extra": "10.1.0",
-    "helmet": "^5.0.2",
+    "helmet": "^6.0.0",
     "lodash": "^4.17.21",
     "luxon": "^3.0.0",
     "morgan": "^1.10.0",
diff --git a/plugins/vault-backend/package.json b/plugins/vault-backend/package.json
index af097d50e4..4e7eb054f6 100644
--- a/plugins/vault-backend/package.json
+++ b/plugins/vault-backend/package.json
@@ -44,7 +44,7 @@
     "cors": "^2.8.5",
     "express-promise-router": "^4.1.0",
     "express": "^4.17.1",
-    "helmet": "^5.0.2",
+    "helmet": "^6.0.0",
     "node-fetch": "^2.6.7",
     "p-limit": "^3.1.0",
     "winston": "^3.7.2",
diff --git a/yarn.lock b/yarn.lock
index c715a4816c..f584908e5f 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -15165,10 +15165,10 @@ headers-polyfill@^3.0.4:
   resolved "https://registry.npmjs.org/headers-polyfill/-/headers-polyfill-3.0.7.tgz#725c4f591e6748f46b036197eae102c92b959ff4"
   integrity sha512-JoLCAdCEab58+2/yEmSnOlficyHFpIl0XJqwu3l+Unkm1gXpFUYsThz6Yha3D6tNhocWkCPfyW0YVIGWFqTi7w==
 
-helmet@^5.0.2:
-  version "5.1.1"
-  resolved "https://registry.npmjs.org/helmet/-/helmet-5.1.1.tgz#609823c5c2e78aea62dd9afc8f544ca409da5e85"
-  integrity sha512-/yX0oVZBggA9cLJh8aw3PPCfedBnbd7J2aowjzsaWwZh7/UFY0nccn/aHAggIgWUFfnykX8GKd3a1pSbrmlcVQ==
+helmet@^6.0.0:
+  version "6.0.0"
+  resolved "https://registry.npmjs.org/helmet/-/helmet-6.0.0.tgz#8e183820ddccd7729a206ad73c577b264f495595"
+  integrity sha512-FO9RpR1wNJepH/GbLPQVtkE2eESglXL641p7SdyoT4LngHFJcZheHMoyUcjCZF4qpuMMO1u5q6RK0l9Ux8JBcg==
 
 hexoid@1.0.0:
   version "1.0.0"

From 17b1c64ca449803f72d48e6b1db7612c8843e63b Mon Sep 17 00:00:00 2001
From: Johan Haals <johan.haals@gmail.com>
Date: Mon, 29 Aug 2022 13:34:45 +0200
Subject: [PATCH 2/2] chore: clarify helmet changes in changelog

Signed-off-by: Johan Haals <johan.haals@gmail.com>
---
 .changeset/renovate-16f36a0.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.changeset/renovate-16f36a0.md b/.changeset/renovate-16f36a0.md
index d7bf43dfe1..74c33ec0a7 100644
--- a/.changeset/renovate-16f36a0.md
+++ b/.changeset/renovate-16f36a0.md
@@ -7,3 +7,8 @@
 ---
 
 Updated dependency `helmet` to `^6.0.0`.
+
+Please note that these policies are no longer applied by default:
+
+helmet.contentSecurityPolicy no longer sets block-all-mixed-content directive by default
+helmet.expectCt is no longer set by default. It can, however, be explicitly enabled. It will be removed in Helmet 7.