build(deps): bump the frontend-runtime group across 1 directory with 3 updates by dependabot[bot] · Pull Request #39 · Victoria824/QueryAssure

dependabot · 2026-09-14T13:13:04Z

Bumps the frontend-runtime group with 3 updates in the / directory: next, react and react-dom.

Updates next from 16.4.0 to 16.4.2

Release notes

v16.4.2

What's Changed

[lts-active] turbo-tasks snapshot consistency fixes (#99644, #99732, #99649) by @lukesandberg in vercel/next.js#100002

[lts-active] Turbopack: backport Pages Router dev module graph chaining (#98823, #99910, #100091) by @sokra in vercel/next.js#100008

[lts-active] fix(next-code-frame): snap visible window to char boundaries by @lukesandberg in vercel/next.js#100212

[lts-active] [turbopack] Fix two GC paths that leave half-torn-down dependency edges by @lukesandberg in vercel/next.js#100209

[lts-active] Turbopack: Ignore realpath errors during module resolution, matching node's behavior by @lukesandberg in vercel/next.js#100217

[lts-active] Backport docs fixes since v16.4.0 by @icyJoseph in vercel/next.js#100246

[lts-active] Fix Turbopack lazy dynamic-import chunk-list collisions by @lukesandberg in vercel/next.js#100211

[lts-active] Backport additional documentation fixes since v16.4.0 by @aurorascharff in vercel/next.js#100262

Full Changelog: vercel/next.js@v16.4.1...v16.4.2

v16.4.1

This release contains security fixes for the following advisories:

Critical:

Unauthenticated Remote Code Execution in use cache functions returning typed arrays

Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used

High:

Denial of Service in App Router using Server Actions

Commits

2864b17 v16.4.2
a42cb59 Revert "[lts-active] Keep requests through middleware in a single OpenTelemet...
f0760ec [lts-active] Backport additional documentation fixes since v16.4.0 (#100262)
845007a [lts-active] Fix Turbopack lazy dynamic-import chunk-list collisions (#100211)
6a79d8a [lts-active] Backport docs fixes since v16.4.0 (#100246)
a75a782 [lts-active] Keep requests through middleware in a single OpenTelemetry trace...
8ad8524 [lts-active] Turbopack: Ignore realpath errors during module resolution, matc...
29d030e [lts-active] [turbopack] Fix two GC paths that leave half-torn-down dependenc...
3e50b82 [lts-active] fix(next-code-frame): snap visible window to char boundaries (#1...
9458fb9 [lts-active] Turbopack: backport Pages Router dev module graph chaining (#988...
Additional commits viewable in compare view

Updates react from 19.2.8 to 19.3.1

Release notes

Sourced from react's releases.

19.3.1 (October 14th, 2026)

React Server Components

Improve transport protocol (#37845 by @unstubbable and @eps1lon)

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

<ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@sebmarkbage, @jackpope, @gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)

Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@jackpope, @sebmarkbage, @eps1lon, @Dhakshin2007, @chirokas, @teamleaderleo, @fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@gnoff: #37143, #37241)

Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@gnoff #37193)

Notable changes

Enable Trusted Types API integration (@rickhanlonii #35816)

Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@acdlite #37290)

Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@hoxyq, @eps1lon: #37104, #37203, #37491)

All Changes

React

Fast Refresh Fixes

Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@sophiebits #36965)

Fix Fast Refresh so edits to a memo() comparison function take effect (@sophiebits #36964)

Fix Fast Refresh crash when an edit changes the kind of a component's type (@sophiebits #36963)

Unify hot reload type resolution for Fast Refresh (@sophiebits #36962)

Fix Fast Refresh to remount correctly when an edit changes the component kind (@sophiebits #36950)

Double invoke effects in StrictMode after Fast Refresh (@eps1lon #35962)

Performance Track Fixes

Prevent crash when accessing $$typeof in Performance Tracks (@eps1lon #35679)

Handle non-string function names in Performance Tracks (@eps1lon #35659)

Use minus (-) instead of en dash for removed props in Performance Tracks (@eps1lon #35649)

Handle arrays with bigints in deep objects in Performance Tracks (@eps1lon #35648)

Don't enumerate typed array props in Performance Tracks in DEV (@UditDewan #36913)

Bail out of diffing wide objects and arrays in Performance Tracks (@eps1lon #34742)

Clear potentially large performance measures in DEV (@hoxyq #34803)

Fix missing else branch for renders with no props change in Performance Tracks (@hoxyq #34837)

Activity Fixes

Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@sophiebits #36947)

Hide portal contents when an Activity is hidden (@acdlite #35091)

Prevent metadata hoisting in hidden <Activity> trees (@ronnakamoto #34983)

... (truncated)

Changelog

Sourced from react's changelog.

19.3.0 (September 9, 2026)

New React Features

<ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@sebmarkbage, @jackpope, @gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)

Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@jackpope, @sebmarkbage, @eps1lon, @Dhakshin2007, @chirokas, @teamleaderleo, @fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@gnoff: #37143, #37241)

Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@gnoff #37193)

Notable changes

Enable Trusted Types API integration (@rickhanlonii #35816)

Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@acdlite #37290)

Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@hoxyq, @eps1lon: #37104, #37203, #37491)

All Changes

React

Fast Refresh Fixes

Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@sophiebits #36965)

Fix Fast Refresh so edits to a memo() comparison function take effect (@sophiebits #36964)

Fix Fast Refresh crash when an edit changes the kind of a component's type (@sophiebits #36963)

Unify hot reload type resolution for Fast Refresh (@sophiebits #36962)

Fix Fast Refresh to remount correctly when an edit changes the component kind (@sophiebits #36950)

Double invoke effects in StrictMode after Fast Refresh (@eps1lon #35962)

Performance Track Fixes

Prevent crash when accessing $$typeof in Performance Tracks (@eps1lon #35679)

Handle non-string function names in Performance Tracks (@eps1lon #35659)

Use minus (-) instead of en dash for removed props in Performance Tracks (@eps1lon #35649)

Handle arrays with bigints in deep objects in Performance Tracks (@eps1lon #35648)

Don't enumerate typed array props in Performance Tracks in DEV (@UditDewan #36913)

Bail out of diffing wide objects and arrays in Performance Tracks (@eps1lon #34742)

Clear potentially large performance measures in DEV (@hoxyq #34803)

Fix missing else branch for renders with no props change in Performance Tracks (@hoxyq #34837)

Activity Fixes

Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@sophiebits #36947)

Hide portal contents when an Activity is hidden (@acdlite #35091)

Prevent metadata hoisting in hidden <Activity> trees (@ronnakamoto #34983)

Prevent errors thrown inside a hidden Activity from escaping to the visible UI (@acdlite #35074)

Don't unhide a node if a direct parent Offscreen is still hidden (@sebmarkbage #34821)

Don't show internal <Offscreen> component in error messages (@rickhanlonii #35763)

Warn in DEV when a component appears to have been unblocked by a conditional use() (@hoxyq, @eps1lon: #37104, #37203, #37491)

Render transitions independently instead of entangling them into a single render (@acdlite #37290)

Fix hang when updating a dehydrated boundary inside a hidden tree (@gaearon #37135)

Don't reacquire Host Singletons during dev effect validation (@gnoff #37113)

Only remove properties from Host Singletons on release (@gnoff #37112)

... (truncated)

Commits

61aa00d [19.3.x][Flight] Improve transport protocol (#37845)
2dc7da7 [test] Bump Jest to 30.4 (#37382)
4f93894 docs: remove stale parentType param from validateChildKeys JSDoc (#36928)
dbc3750 Update required references to GitHub repo (#36752)
900ae09 [flow] Bump flow to v0.317.0 (#36701)
fbb1370 [flow] Bump flow to v0.307.1 (#36199)
56922cf [react-native-renderer] Delete Paper (legacy) renderer (#36285)
74568e8 [Flight] Transport AggregateErrors.errors (#36156)
e66ef64 [tests] remove withoutStack from assertConsole helpers (#35498)
db71391 [Fiber] Instrument the lazy initializer thenable in all cases (#35521)
Additional commits viewable in compare view

Updates react-dom from 19.2.8 to 19.3.1

Release notes

Sourced from react-dom's releases.

19.3.1 (October 14th, 2026)

React Server Components

Improve transport protocol (#37845 by @unstubbable and @eps1lon)

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

<ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@sebmarkbage, @jackpope, @gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)

Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@jackpope, @sebmarkbage, @eps1lon, @Dhakshin2007, @chirokas, @teamleaderleo, @fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@gnoff: #37143, #37241)

Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@gnoff #37193)

Notable changes

Enable Trusted Types API integration (@rickhanlonii #35816)

Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@acdlite #37290)

Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@hoxyq, @eps1lon: #37104, #37203, #37491)

All Changes

React

Fast Refresh Fixes

Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@sophiebits #36965)

Fix Fast Refresh so edits to a memo() comparison function take effect (@sophiebits #36964)

Fix Fast Refresh crash when an edit changes the kind of a component's type (@sophiebits #36963)

Unify hot reload type resolution for Fast Refresh (@sophiebits #36962)

Fix Fast Refresh to remount correctly when an edit changes the component kind (@sophiebits #36950)

Double invoke effects in StrictMode after Fast Refresh (@eps1lon #35962)

Performance Track Fixes

Prevent crash when accessing $$typeof in Performance Tracks (@eps1lon #35679)

Handle non-string function names in Performance Tracks (@eps1lon #35659)

Use minus (-) instead of en dash for removed props in Performance Tracks (@eps1lon #35649)

Handle arrays with bigints in deep objects in Performance Tracks (@eps1lon #35648)

Don't enumerate typed array props in Performance Tracks in DEV (@UditDewan #36913)

Bail out of diffing wide objects and arrays in Performance Tracks (@eps1lon #34742)

Clear potentially large performance measures in DEV (@hoxyq #34803)

Fix missing else branch for renders with no props change in Performance Tracks (@hoxyq #34837)

Activity Fixes

Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@sophiebits #36947)

Hide portal contents when an Activity is hidden (@acdlite #35091)

Prevent metadata hoisting in hidden <Activity> trees (@ronnakamoto #34983)

... (truncated)

Changelog

Sourced from react-dom's changelog.

19.3.0 (September 9, 2026)

New React Features

<ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@sebmarkbage, @jackpope, @gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539,

…3 updates Bumps the frontend-runtime group with 3 updates in the / directory: [next](https://github.com/vercel/next.js), [react](https://github.com/react/react/tree/HEAD/packages/react) and [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom). Updates `next` from 16.4.0 to 16.4.2 - [Release notes](https://github.com/vercel/next.js/releases) - [Commits](vercel/next.js@v16.4.0...v16.4.2) Updates `react` from 19.2.8 to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react) Updates `react-dom` from 19.2.8 to 19.3.1 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom) --- updated-dependencies: - dependency-name: next dependency-version: 16.3.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: frontend-runtime - dependency-name: react dependency-version: 19.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: frontend-runtime - dependency-name: react-dom dependency-version: 19.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: frontend-runtime ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 14, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/frontend-runtime-1c688e89b4 branch from 96c26fc to 38e8661 Compare October 19, 2026 13:11

Navigation Menu

Repository navigation

build(deps): bump the frontend-runtime group across 1 directory with 3 updates - #39

build(deps): bump the frontend-runtime group across 1 directory with 3 updates#39
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/frontend-runtime-1c688e89b4

dependabot Bot commented on behalf of github Sep 14, 2026 •

edited

Loading

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v16.4.2

What's Changed

v16.4.1

19.3.1 (October 14th, 2026)

React Server Components

19.3.0 (September 9, 2026)

New React Features

New React DOM Features

Notable changes

All Changes

React

19.3.0 (September 9, 2026)

New React Features

New React DOM Features

Notable changes

All Changes

React

19.3.1 (October 14th, 2026)

React Server Components

19.3.0 (September 9, 2026)

New React Features

New React DOM Features

Notable changes

All Changes

React

19.3.0 (September 9, 2026)

New React Features

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Sep 14, 2026 •

edited

Loading