<commit_before>## 6.x

- 6.0.0 (2020-03-07)
  - **BREAKING CHANGE**
    - Lumen project does not automatically add SecureHeadersMiddleware to global middleware.
    - Remove HPKP (Public Key Pinning mechanism was deprecated in favor of Certificate Transparency and Expect-CT header)
    - Feature-Policy remove `speaker` and `vr` directives
    - Disable HSTS preload by default ([#42](https://github.com/BePsvPT/secure-headers/pull/42))
    - Content-Security-Policy remove `custom-csp` key
    - Content-Security-Policy empty directive config will just be omitted(before 6.0 was set to `'none'`). 
    - Content-Security-Policy directive keyword `unsafe-hashed-attributes` is replaced by `unsafe-hashes`
    - Content-Security-Policy directive `nonces` array had removed(according to RFC, it should generate a unique nonce value each time. Thus, it should not setup by user).
    - `SecureHeaders::nonce` method requires one parameter now, it should be `'script'` or `'style'`(default is `'script'`).
  - Content-Security-Policy directive `add-generated-nonce` key was removed, it is no longer needed.
  - Content-Security-Policy supports following directives: `report-to`, `child-src`, `navigate-to`, `prefetch-src`, `require-trusted-types-for`, `script-src-attr`, `script-src-elem`, `style-src-attr`, `style-src-elem`, `trusted-types` 
  - Feature-Policy supports following directives: `battery`, `execution-while-not-rendered`, `execution-while-out-of-viewport`, `layout-animations`, `legacy-image-formats`, `navigation-override`, `oversized-images`, `publickey-credentials`, `unoptimized-images`, `unsized-media`, `wake-lock`, `xr-spatial-tracking`

## 5.x

- 5.6.0 (2020-03-05)
  - Support Laravel 7.0

- 5.5.0 (2019-09-07)
  - Support Laravel 6.0
  - Support X-Power-By header

- 5.4.0 (2019-06-07)
  - Support disable HSTS `preload`
  - Add `display-capture` and `document-domain` to Feature-Policy
  - Add `src` allowlist to Feature-Policy

- 5.3.3 (2019-02-28)
  - Support Laravel 5.8
  - Let Travis CI cover all supported PHP and Laravel versions

- 5.3.2 (2018-10-26)
  - Support Feature-Policy sync-xhr directive

- 5.3.1 (2018-09-06)
  - Support Laravel 5.7

- 5.3.0 (2018-08-04)
  - Support Feature-Policy header
<commit_msg>update 6.0.1 changelog<commit_after>## 6.x

- 6.0.1 (2020-04-15)
  - Fix nonces are not cleared. ([#46](https://github.com/bepsvpt/secure-headers/issues/46))

- 6.0.0 (2020-03-07)
  - **BREAKING CHANGE**
    - Lumen project does not automatically add SecureHeadersMiddleware to global middleware.
    - Remove HPKP (Public Key Pinning mechanism was deprecated in favor of Certificate Transparency and Expect-CT header)
    - Feature-Policy remove `speaker` and `vr` directives
    - Disable HSTS preload by default ([#42](https://github.com/BePsvPT/secure-headers/pull/42))
    - Content-Security-Policy remove `custom-csp` key
    - Content-Security-Policy empty directive config will just be omitted(before 6.0 was set to `'none'`).
    - Content-Security-Policy directive keyword `unsafe-hashed-attributes` is replaced by `unsafe-hashes`
    - Content-Security-Policy directive `nonces` array had removed(according to RFC, it should generate a unique nonce value each time. Thus, it should not setup by user).
    - `SecureHeaders::nonce` method requires one parameter now, it should be `'script'` or `'style'`(default is `'script'`).
  - Content-Security-Policy directive `add-generated-nonce` key was removed, it is no longer needed.
  - Content-Security-Policy supports following directives: `report-to`, `child-src`, `navigate-to`, `prefetch-src`, `require-trusted-types-for`, `script-src-attr`, `script-src-elem`, `style-src-attr`, `style-src-elem`, `trusted-types`
  - Feature-Policy supports following directives: `battery`, `execution-while-not-rendered`, `execution-while-out-of-viewport`, `layout-animations`, `legacy-image-formats`, `navigation-override`, `oversized-images`, `publickey-credentials`, `unoptimized-images`, `unsized-media`, `wake-lock`, `xr-spatial-tracking`

## 5.x

- 5.6.0 (2020-03-05)
  - Support Laravel 7.0

- 5.5.0 (2019-09-07)
  - Support Laravel 6.0
  - Support X-Power-By header

- 5.4.0 (2019-06-07)
  - Support disable HSTS `preload`
  - Add `display-capture` and `document-domain` to Feature-Policy
  - Add `src` allowlist to Feature-Policy

- 5.3.3 (2019-02-28)
  - Support Laravel 5.8
  - Let Travis CI cover all supported PHP and Laravel versions

- 5.3.2 (2018-10-26)
  - Support Feature-Policy sync-xhr directive

- 5.3.1 (2018-09-06)
  - Support Laravel 5.7

- 5.3.0 (2018-08-04)
  - Support Feature-Policy header

{'fraction_non_alphanumeric': 0.13792354474370114, 'fraction_numerical': 0.04908774978279757, 'mean_word_length': 3.7523219814241484, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 3, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1140113', 'n_tokens_mistral': 1681, 'n_tokens_neox': 1500, 'n_words': 430}