[Security] Bump react-dom from 16.4.1 to 16.7.0

[dependabot-preview]

Bumps react-dom from 16.4.1 to 16.7.0. This update includes security fixes.

Vulnerabilities fixed

Sourced from The GitHub Security Advisory Database.

Low severity vulnerability that affects react-dom
React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That lack of escaping could lead to a cross-site scripting vulnerability. This vulnerability can only affect some server-rendered React apps. Purely client-rendered apps are not affected.

This issue affected minor releases 16.0.x, 16.1.x, 16.2.x, 16.3.x, and 16.4.x. It was fixed in 16.0.1, 16.1.2, 16.2.1, 16.3.3, and 16.4.2.

Affected versions: >= 16.4.0 < 16.4.2

Release notes

Sourced from react-dom's releases.

v16.7.0

React DOM

• Fix performance of React.lazy for large numbers of lazily-loaded components. ([acdlite](http://github.com/acdlite) in #14429)
• Clear fields on unmount to avoid memory leaks. ([trueadm](http://github.com/trueadm) in #14276)
• Fix bug with SSR and context when mixing react-dom/server@16.6 and react@<16.6. ([gaearon](http://github.com/gaearon) in #14291)
• Fix a performance regression in profiling mode. ([bvaughn](http://github.com/bvaughn) in #14383)

Scheduler (Experimental)

• Post to MessageChannel instead of window. ([acdlite](http://github.com/acdlite) in #14234)
• Reduce serialization overhead. ([developit](http://github.com/developit) in #14249)
• Fix fallback to setTimeout in testing environments. ([bvaughn](http://github.com/bvaughn) in #14358)
• Add methods for debugging. ([mrkev](http://github.com/mrkev) in #14053)

v16.6.3

16.6.3 (November 12, 2018)

React DOM

• Fix bugs in Suspense and lazy. ([acdlite](https://github.com/acdlite) in #14133, #14157, and #14164)
• Fix highlighting of React.memo updates in React DevTools. ([bvaughn](https://github.com/bvaughn) in #14141)
• Fix interaction of Suspense with the React Profiler. ([bvaughn](https://github.com/bvaughn) in #14065)
• Fix a false positive warning when using Suspense. ([acdlite](https://github.com/acdlite) in #14158)

React DOM Server

• Fix incorrect sharing of context state between renderToNodeStream() calls. ([sebmarkbage](https://github.com/sebmarkbage) in #14182)
• Add a warning about incorrect usage of the context API. ([trueadm](https://github.com/trueadm) in #14033)

v16.6.1

16.6.1 (November 6, 2018)

React DOM

• Fallback should not remount every time a promise resolves. ([acdlite](https://github.com/acdlite) in #14083)
• Fix bug where Suspense keeps showing fallback even after everything finishes loading. ([acdlite](https://github.com/acdlite) in #14083)
• Fix unresolved default props in lifecycle methods of a lazy component. ([gaearon](https://github.com/gaearon) in #14112)
• Fix bug when recovering from an error thrown during complete phase. ([gaearon](https://github.com/gaearon) in #14104)

Scheduler (Experimental)

• Switch from deadline object to shouldYield API. ([acdlite](https://github.com/acdlite) in #14025)

v16.6.0

16.6.0 (October 23, 2018)

React

• Add React.memo() as an alternative to PureComponent for functions. ([acdlite](https://github.com/acdlite) in #13748)

... (truncated)

Changelog

Sourced from react-dom's changelog.

16.7.0 (December 19, 2018)

React DOM

• Fix performance of React.lazy for large numbers of lazily-loaded components. ([acdlite](http://github.com/acdlite) in #14429)
• Clear fields on unmount to avoid memory leaks. ([trueadm](http://github.com/trueadm) in #14276)
• Fix bug with SSR and context when mixing react-dom/server@16.6 and react@<16.6. ([gaearon](http://github.com/gaearon) in #14291)
• Fix a performance regression in profiling mode. ([bvaughn](http://github.com/bvaughn) in #14383)

Scheduler (Experimental)

• Post to MessageChannel instead of window. ([acdlite](http://github.com/acdlite) in #14234)
• Reduce serialization overhead. ([developit](http://github.com/developit) in #14249)
• Fix fallback to setTimeout in testing environments. ([bvaughn](http://github.com/bvaughn) in #14358)
• Add methods for debugging. ([mrkev](http://github.com/mrkev) in #14053)

16.6.3 (November 12, 2018)

React DOM

• Fix bugs in Suspense and lazy. ([acdlite](https://github.com/acdlite) in #14133, #14157, and #14164)
• Fix highlighting of React.memo updates in React DevTools. ([bvaughn](https://github.com/bvaughn) in #14141)
• Fix interaction of Suspense with the React Profiler. ([bvaughn](https://github.com/bvaughn) in #14065)
• Fix a false positive warning when using Suspense. ([acdlite](https://github.com/acdlite) in #14158)

React DOM Server

• Fix incorrect sharing of context state between renderToNodeStream() calls. ([sebmarkbage](https://github.com/sebmarkbage) in #14182)
• Add a warning about incorrect usage of the context API. ([trueadm](https://github.com/trueadm) in #14033)

16.6.2 (November 12, 2018)

This release was published in a broken state and should be skipped.

16.6.1 (November 6, 2018)

React DOM

• Fallback should not remount every time a promise resolves. ([acdlite](https://github.com/acdlite) in #14083)
• Fix bug where Suspense keeps showing fallback even after everything finishes loading. ([acdlite](https://github.com/acdlite) in #14083)
• Fix unresolved default props in lifecycle methods of a lazy component. ([gaearon](https://github.com/gaearon) in #14112)
• Fix bug when recovering from an error thrown during complete phase. ([gaearon](https://github.com/gaearon) in #14104)

Scheduler (Experimental)

• Switch from deadline object to shouldYield API. ([acdlite](https://github.com/acdlite) in #14025)

16.6.0 (October 23, 2018)

... (truncated)

Commits

• 4a10721 Memoize promise listeners to prevent exponential growth (#14429)
• 535804f Removed Fabric-specific feature flag files and updated Rollup to use the (non...
• 2743fb7 Enable hooks by default for FB React Native renderer (#14435)
• 7325ebe Inject overrideProps() fn to DevTools (#14427)
• a22880e Add support for Suspense & lazy() to the react-is package (#14423)
• 947bddd Remove redundant argument of getPlugins function (#14419)
• ce43a8c Updated version incrementing suggestion in release script based on team discu...
• f64906f Dangerfile exits early if build failed (#14400)
• 8df4d59 Implement pauseExecution, continueExecution, dumpQueue for Scheduler (#14053)
• 5bb4ad7 Added ErrorBoundary tests for useEffect and useLayoutEffect (#14401)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge
• @dependabot reopen will reopen this PR if it is closed
• @dependabot ignore this [patch|minor|major] version will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Automerge options (never/patch/minor, and dev/runtime dependencies)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

Finally, you can contact us by mentioning @dependabot.

[dependabot-preview]

Superseded by #390.