diff --git a/History.md b/History.md
index 2410810d33..9ddfe35b88 100644
--- a/History.md
+++ b/History.md
@@ -18,6 +18,10 @@ unreleased
     - deps: raw-body@2.4.0
     - deps: type-is@~1.6.17
   * deps: content-disposition@0.5.3
+  * deps: finalhandler@~1.1.2
+    - Set stricter `Content-Security-Policy` header
+    - deps: parseurl@~1.3.3
+    - deps: statuses@~1.5.0
   * deps: parseurl@~1.3.3
   * deps: proxy-addr@~2.0.5
     - deps: ipaddr.js@1.9.0
diff --git a/package.json b/package.json
index ef83d58d11..6f89e3369d 100644
--- a/package.json
+++ b/package.json
@@ -39,7 +39,7 @@
     "encodeurl": "~1.0.2",
     "escape-html": "~1.0.3",
     "etag": "~1.8.1",
-    "finalhandler": "1.1.1",
+    "finalhandler": "~1.1.2",
     "fresh": "0.5.2",
     "merge-descriptors": "1.0.1",
     "methods": "~1.1.2",