Skip to content

chore(deps): bump csp-header from 5.2.1 to 6.4.0 - #137

Open
dependabot[bot] wants to merge 5 commits into
v4from
dependabot/npm_and_yarn/csp-header-6.4.0
Open

dependabot[bot] wants to merge 5 commits into
v4from
dependabot/npm_and_yarn/csp-header-6.4.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 6, 2026 •

Copy link
Copy Markdown
Contributor

Bumps csp-header from 5.2.1 to 6.4.0.

Release notes

Sourced from csp-header's releases.

v6.4.0

What's Changed

  • Added native ESM and CommonJS builds
  • Added constants for HTTP(S) and WS(S) scheme sources

New Contributors

Full Changelog: frux/csp@v6.3.1...v6.4.0

v6.3.1

What's Changed

  • Add allow-downloads to CSP sandbox directive type

Full Changelog: frux/csp@v6.3.0...v6.3.1

v6.3.0

What's Changed

  • Added custom CSP string processing

New Contributors

Full Changelog: frux/csp@v6.2.1...v6.3.0

v6.2.1

What's Changed

  • Fixed typo in the allow-scripts constant

New Contributors

Full Changelog: frux/csp@v6.2.0...v6.2.1

v6.2.0

What's Changed

  • Support false as a directive value for conditional directives (for example 'script-src': [isExample && 'example.com'])

New Contributors

Full Changelog: frux/csp@v6.1.0...v6.2.0

v6.1.0

What's Changed

New Contributors

... (truncated)

Changelog

Sourced from csp-header's changelog.

6.4.0 (2026-09-04)

🚀 Features

  • Add native ESM and CommonJS builds (#21)
  • Add constants for HTTP(S) and WS(S) scheme sources (#20)

❤️ Thank You

  • Kara Brightwell
  • Vladimir Kudinov

6.3.1 (2026-03-11)

  • Add allow-downloads to CSP sandbox directive type / (#19)

❤️ Thank You

  • Mads Mætzke Tandrup

6.3.0 (2025-12-19)

  • Added custom CSP string processing / (#18)

❤️ Thank You

  • Dmitrii Kanatnikov

6.2.1 (2025-11-28)

🚀 Patches

  • Fix allow-scripts header / Fixes #15 (#15)

❤️ Thank You

  • tandrup

6.2.0 (2025-10-08)

🚀 Features

  • add nonce to res.locals as well / closes #12 (#12)
  • add support boolean in CSPListDirectiveValue (074a8a9)

❤️ Thank You

  • Dmitry Los
  • Vladimir Kudinov

... (truncated)

Commits

@dependabot
dependabot Bot requested review from DakEnviy and resure as code owners November 6, 2026 10:29
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 6, 2026

@resure resure left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

probably breaking change

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/csp-header-6.4.0 branch 2 times, most recently from 17c79b1 to 97ec171 Compare November 6, 2026 13:20
Bumps [csp-header](https://github.com/frux/csp) from 5.2.1 to 6.4.0.
- [Release notes](https://github.com/frux/csp/releases)
- [Changelog](https://github.com/frux/csp/blob/master/CHANGELOG.md)
- [Commits](frux/csp@v5.2.1...v6.4.0)

---
updated-dependencies:
- dependency-name: csp-header
  dependency-version: 6.4.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/csp-header-6.4.0 branch from 97ec171 to 8ad1273 Compare November 6, 2026 15:13
@resure
resure changed the base branch from main to v4 November 6, 2026 15:54
DenisVershkov and others added 4 commits November 9, 2026 12:39
* feat: request detail on 5xx and app-provided response extra

* fix: remove unnecessary code
Bumps the npm_and_yarn group with 1 update in the / directory: [@grpc/grpc-js](https://github.com/grpc/grpc-node).


Updates `@grpc/grpc-js` from 1.14.4 to 1.14.7
- [Release notes](https://github.com/grpc/grpc-node/releases)
- [Commits](https://github.com/grpc/grpc-node/compare/@grpc/grpc-js@1.14.4...@grpc/grpc-js@1.14.7)

---
updated-dependencies:
- dependency-name: "@grpc/grpc-js"
  dependency-version: 1.14.5
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code next-major

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants