Add 16.4.2 and other releases to changelog
Dan Abramov committed
Aug 1, 2018 at 20:29 UTC
0624c719f4c228281a8b0a9145418f739b0bf8ad
1 file changed
+32
CHANGELOG.md
+32
@@ -7,6 +7,14 @@
7
8
</details>
9
10
+## 16.4.2 (August 1, 2018)
11
+
12
+### React DOM Server
13
+
14
+* Fix a [potential XSS vulnerability when the attacker controls an attribute name](https://reactjs.org/blog/2018/08/01/react-v-16-4-2.html) (`CVE-2018-6341`). This fix is available in the latest `react-dom@16.4.2`, as well as in previous affected minor versions: `react-dom@16.0.1`, `react-dom@16.1.2`, `react-dom@16.2.1`, and `react-dom@16.3.3`. ([@gaearon](https://github.com/gaearon) in [#13302](https://github.com/facebook/react/pull/13302))
15
+
16
+* Fix a crash in the server renderer when an attribute is called `hasOwnProperty`. This fix is only available in `react-dom@16.4.2`. ([@gaearon](https://github.com/gaearon) in [#13303](https://github.com/facebook/react/pull/13303))
17
+
18
## 16.4.1 (June 13, 2018)
19
20
### React
@@ -88,6 +96,12 @@
96
97
* Add a UMD build. ([@bvaughn](https://github.com/bvaughn) in [#12594](https://github.com/facebook/react/pull/12594))
98
99
+## 16.3.2 (August 1, 2018)
100
+
101
+### React DOM Server
102
+
103
+* Fix a [potential XSS vulnerability when the attacker controls an attribute name](https://reactjs.org/blog/2018/08/01/react-v-16-4-2.html) (`CVE-2018-6341`). This fix is available in the latest `react-dom@16.4.2`, as well as in previous affected minor versions: `react-dom@16.0.1`, `react-dom@16.1.2`, `react-dom@16.2.1`, and `react-dom@16.3.3`. ([@gaearon](https://github.com/gaearon) in [#13302](https://github.com/facebook/react/pull/13302))
104
+
105
## 16.3.1 (April 3, 2018)
106
107
### React
@@ -179,6 +193,12 @@
193
194
* Fix a crash on updates. ([@rmhartog](https://github.com/rmhartog) in [#11955](https://github.com/facebook/react/pull/11955))
195
196
+## 16.2.1 (August 1, 2018)
197
+
198
+### React DOM Server
199
+
200
+* Fix a [potential XSS vulnerability when the attacker controls an attribute name](https://reactjs.org/blog/2018/08/01/react-v-16-4-2.html) (`CVE-2018-6341`). This fix is available in the latest `react-dom@16.4.2`, as well as in previous affected minor versions: `react-dom@16.0.1`, `react-dom@16.1.2`, `react-dom@16.2.1`, and `react-dom@16.3.3`. ([@gaearon](https://github.com/gaearon) in [#13302](https://github.com/facebook/react/pull/13302))
201
+
202
## 16.2.0 (November 28, 2017)
203
204
### React
@@ -203,6 +223,12 @@
223
224
* Many tests were rewritten against the public API. Big thanks to [everyone who contributed](https://github.com/facebook/react/issues/11299)!
225
226
+## 16.1.2 (August 1, 2018)
227
+
228
+### React DOM Server
229
+
230
+* Fix a [potential XSS vulnerability when the attacker controls an attribute name](https://reactjs.org/blog/2018/08/01/react-v-16-4-2.html) (`CVE-2018-6341`). This fix is available in the latest `react-dom@16.4.2`, as well as in previous affected minor versions: `react-dom@16.0.1`, `react-dom@16.1.2`, `react-dom@16.2.1`, and `react-dom@16.3.3`. ([@gaearon](https://github.com/gaearon) in [#13302](https://github.com/facebook/react/pull/13302))
231
+
232
## 16.1.1 (November 13, 2017)
233
234
### React
@@ -293,6 +319,12 @@ Starting with 16.1.0, we will no longer be publishing new releases on Bower. You
319
320
* First release of the [new experimental package](https://github.com/facebook/react/tree/master/packages/react-call-return) for parent-child communication. ([@gaearon](https://github.com/gaearon) in [#11364](https://github.com/facebook/react/pull/11364))
321
322
+## 16.0.1 (August 1, 2018)
323
+
324
+### React DOM Server
325
+
326
+* Fix a [potential XSS vulnerability when the attacker controls an attribute name](https://reactjs.org/blog/2018/08/01/react-v-16-4-2.html) (`CVE-2018-6341`). This fix is available in the latest `react-dom@16.4.2`, as well as in previous affected minor versions: `react-dom@16.0.1`, `react-dom@16.1.2`, `react-dom@16.2.1`, and `react-dom@16.3.3`. ([@gaearon](https://github.com/gaearon) in [#13302](https://github.com/facebook/react/pull/13302))
327
+
328
## 16.0.0 (September 26, 2017)
329
330
### New JS Environment Requirements