Update dependency helmet to v3.21.0

[dev-mend-for-github-com]

This PR contains the following updates:

Package	Type	Update	Change
helmet (source)	dependencies	minor	3.13.0 -> 3.21.0

By merging this PR, the issue #13 will be automatically resolved and closed:

Severity	CVSS Score	CVE	Reachability
Medium	6.1	WS-2019-0289

---

Release Notes

helmetjs/helmet (helmet)

v3.21.0

Compare Source

Added

• Updated x-xss-protection to v1.3.0
  • Added mode: null to disable mode=block

Changed

• Updated helmet-csp to v2.9.1
  • Updated bowser subdependency from 2.5.3 to 2.5.4. See helmet-csp#88

v3.20.1

Compare Source

Changed

• Updated helmet-csp to v2.9.0

v3.20.0

Compare Source

Changed

• Updated helmet-csp to v2.8.0

v3.19.0

Compare Source

Changed

• Updated dns-prefetch-control to v0.2.0
• Updated dont-sniff-mimetype to v1.1.0
• Updated helmet-crossdomain to v0.4.0
• Updated hide-powered-by to v1.1.0
• Updated x-xss-protection to v1.2.0

v3.18.0

Compare Source

Added

• featurePolicy has 19 new features: ambientLightSensor, documentDomain, documentWrite, encryptedMedia, fontDisplayLateSwap, layoutAnimations, legacyImageFormats, loadingFrameDefaultEager, oversizedImages, pictureInPicture, serial, syncScript, unoptimizedImages, unoptimizedLosslessImages, unoptimizedLossyImages, unsizedMedia, verticalScroll, wakeLock, and xr

Changed

• Updated expect-ct to v0.2.0
• Updated feature-policy to v0.3.0
• Updated frameguard to v3.1.0
• Updated nocache to v2.1.0

v3.17.0

Compare Source

Added

• referrerPolicy now supports multiple values

Changed

• Updated referrerPolicy to v1.2.0

v3.16.0

Compare Source

Added

• Add email to bugs field in package.json

Changed

• Updated hsts to v2.2.0
• Updated ienoopen to v1.1.0
• Changelog is now in the Keep A Changelog format
• Dropped support for Node <4. See the commit for more information
• Updated Adam Baldwin's contact information

Deprecated

• helmet.hsts's setIf option has been deprecated and will be removed in hsts@3. See helmetjs/hsts#22 for more

• The includeSubdomains option (with a lowercase d) has been deprecated and will be removed in hsts@3. Use the uppercase-D includeSubDomains option instead. See helmetjs/hsts#21 for more

v3.15.1

Compare Source

Deprecated

• The hpkp middleware has been deprecated. If you still need to use this module, install the standalone hpkp module from npm. See #​180 for more.

v3.15.0

Compare Source

Added

• helmet.featurePolicy now supports four new features

v3.14.0

Compare Source

Added

• helmet.featurePolicy middleware

---

• If you want to rebase/retry this PR, check this box