chore(deps): bump react-dom and @types/react-dom in /frontend/web by dependabot[bot] · Pull Request #8 · pinthoz/FootyVision

dependabot · 2026-09-01T18:41:42Z

Bumps react-dom and @types/react-dom. These dependencies needed to be updated together.
Updates react-dom from 19.2.4 to 19.3.0

Release notes

Sourced from react-dom's releases.

19.3.0 (September 9, 2026)

Below is a list of all new features, APIs, and bug fixes.

Read the React 19.3 release post for more information.

New React Features

<ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@sebmarkbage, @jackpope, @gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)

Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@jackpope, @sebmarkbage, @eps1lon, @Dhakshin2007, @chirokas, @teamleaderleo, @fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@gnoff: #37143, #37241)

Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@gnoff #37193)

Notable changes

Enable Trusted Types API integration (@rickhanlonii #35816)

Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@acdlite #37290)

Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@hoxyq, @eps1lon: #37104, #37203, #37491)

All Changes

React

Fast Refresh Fixes

Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@sophiebits #36965)

Fix Fast Refresh so edits to a memo() comparison function take effect (@sophiebits #36964)

Fix Fast Refresh crash when an edit changes the kind of a component's type (@sophiebits #36963)

Unify hot reload type resolution for Fast Refresh (@sophiebits #36962)

Fix Fast Refresh to remount correctly when an edit changes the component kind (@sophiebits #36950)

Double invoke effects in StrictMode after Fast Refresh (@eps1lon #35962)

Performance Track Fixes

Prevent crash when accessing $$typeof in Performance Tracks (@eps1lon #35679)

Handle non-string function names in Performance Tracks (@eps1lon #35659)

Use minus (-) instead of en dash for removed props in Performance Tracks (@eps1lon #35649)

Handle arrays with bigints in deep objects in Performance Tracks (@eps1lon #35648)

Don't enumerate typed array props in Performance Tracks in DEV (@UditDewan #36913)

Bail out of diffing wide objects and arrays in Performance Tracks (@eps1lon #34742)

Clear potentially large performance measures in DEV (@hoxyq #34803)

Fix missing else branch for renders with no props change in Performance Tracks (@hoxyq #34837)

Activity Fixes

Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@sophiebits #36947)

Hide portal contents when an Activity is hidden (@acdlite #35091)

Prevent metadata hoisting in hidden <Activity> trees (@ronnakamoto #34983)

Prevent errors thrown inside a hidden Activity from escaping to the visible UI (@acdlite #35074)

Don't unhide a node if a direct parent Offscreen is still hidden (@sebmarkbage #34821)

Don't show internal <Offscreen> component in error messages (@rickhanlonii #35763)

Warn in DEV when a component appears to have been unblocked by a conditional use() (@hoxyq, @eps1lon: #37104, #37203, #37491)

Render transitions independently instead of entangling them into a single render (@acdlite #37290)

... (truncated)

Changelog

Sourced from react-dom's changelog.

19.3.0 (September 9, 2026)

New React Features

<ViewTransition />: Adds <ViewTransition /> and addTransitionType APIs to power View Transition animations in React (@sebmarkbage, @jackpope, @gaearon: #31975, #31987, #31996, #31999, #32001, #32002, #32028, #32029, #32031, #32034, #32038, #32041, #32050, #32090, #32105, #32254, #32379, #32422, #32462, #32540, #32545, #32585, #32599, #32611, #32612, #32617, #32651, #32653, #32656, #32664, #32699, #32723, #32734, #32751, #32752, #32760, #32761, #32764, #32772, #32790, #32819, #32820, #32822, #32833, #32849, #33094, #33191, #33200, #33206, #33293, #33330, #33331, #33332, #33357, #33362, #33433, #33576, #34374, #34450, #34481, #34500, #34502, #34510, #34511, #34539, #35567, #35564, #35485, #35380, #35063, #35060, #34676, #36917, #35337, #35520)

Fragment Refs: Add Refs to <Fragment /> to support composable platform behavior (@jackpope, @sebmarkbage, @eps1lon, @Dhakshin2007, @chirokas, @teamleaderleo, @fallintoplace: #32465, #32613, #32619, #32654, #32660, #32682, #32722, #32813, #32814, #33056, #33058, #33093, #34069, #34103, #34544, #34545, #37062, #37061, #37060, #36047, #36010, #35642, #35641, #35637, #35630, #34935, #37457, #37408, #37326, #37251, #37171, #37169, #37168, #37167, #37166, #37165, #37164, #37163, #37162, #37161, #37160, #37125, #37063)

New React DOM Features

browser(): a new react-dom API that returns a usable which errors during server rendering and resolves in the browser. use(browser()) inside a <Suspense> boundary marks a subtree as browser-only without reporting a recoverable error (@gnoff: #37143, #37241)

Added an onBrowserBailout option to the react-dom/server APIs to observe when a subtree defers to the browser (@gnoff #37193)

Notable changes

Enable Trusted Types API integration (@rickhanlonii #35816)

Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (@acdlite #37290)

Added a DEV-only warning when a component appears to have been unblocked by calling use() conditionally (@hoxyq, @eps1lon: #37104, #37203, #37491)

All Changes

React

Fast Refresh Fixes

Fix Fast Refresh to find and remount edits to components wrapped behind lazy() (@sophiebits #36965)

Fix Fast Refresh so edits to a memo() comparison function take effect (@sophiebits #36964)

Fix Fast Refresh crash when an edit changes the kind of a component's type (@sophiebits #36963)

Unify hot reload type resolution for Fast Refresh (@sophiebits #36962)

Fix Fast Refresh to remount correctly when an edit changes the component kind (@sophiebits #36950)

Double invoke effects in StrictMode after Fast Refresh (@eps1lon #35962)

Performance Track Fixes

Prevent crash when accessing $$typeof in Performance Tracks (@eps1lon #35679)

Handle non-string function names in Performance Tracks (@eps1lon #35659)

Use minus (-) instead of en dash for removed props in Performance Tracks (@eps1lon #35649)

Handle arrays with bigints in deep objects in Performance Tracks (@eps1lon #35648)

Don't enumerate typed array props in Performance Tracks in DEV (@UditDewan #36913)

Bail out of diffing wide objects and arrays in Performance Tracks (@eps1lon #34742)

Clear potentially large performance measures in DEV (@hoxyq #34803)

Fix missing else branch for renders with no props change in Performance Tracks (@hoxyq #34837)

Activity Fixes

Fix useSyncExternalStore missing store mutations that happened while an Activity tree was hidden (@sophiebits #36947)

Hide portal contents when an Activity is hidden (@acdlite #35091)

Prevent metadata hoisting in hidden <Activity> trees (@ronnakamoto #34983)

Prevent errors thrown inside a hidden Activity from escaping to the visible UI (@acdlite #35074)

Don't unhide a node if a direct parent Offscreen is still hidden (@sebmarkbage #34821)

Don't show internal <Offscreen> component in error messages (@rickhanlonii #35763)

Warn in DEV when a component appears to have been unblocked by a conditional use() (@hoxyq, @eps1lon: #37104, #37203, #37491)

Render transitions independently instead of entangling them into a single render (@acdlite #37290)

Fix hang when updating a dehydrated boundary inside a hidden tree (@gaearon #37135)

Don't reacquire Host Singletons during dev effect validation (@gnoff #37113)

Only remove properties from Host Singletons on release (@gnoff #37112)

... (truncated)

Commits

f4e439e [Fizz] Add nonce to rendered import maps (#37339)
21c89c9 [DOM] Clean up Fragment listeners on signal abort (#37457)
065bc84 [DOM] Unobserve fragment IntersectionObserver targets after exit (#37408)
ff7445e [DOM] Update HTML parser rules for new select parser (#34804)
2dc7da7 [test] Bump Jest to 30.4 (#37382)
29d9d31 [DOM] Copy source onto the synthetic toggle event (#37389)
269bd40 [test] Remove the custom toThrow override for legacy V8 error messages (#37...
a112448 [DOM] Treat omitted Fragment Event listener options same as capture: false ...
3d05080 [Fizz] Construct the render lifetime controller only when it is needed (#37357)
77ed3f5 [Flight/Fizz] Stop the caller's signal from retaining a finished render (#37315)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react-dom since your current version.

Updates @types/react-dom from 19.2.3 to 19.3.0

Commits

See full diff in compare view

Everything pending from the last rounds of review, in one commit. Cost and abuse - The rate limiter keyed callers on the leftmost X-Forwarded-For entry, which the client writes. A fresh value per request meant a fresh bucket, so the limit on the three LLM endpoints could be skipped at will. It now reads the rightmost hop, written by the proxy in front of the app. The test that asserted the old behaviour is corrected, and a new one makes the attack and expects a 429. - Windows were emptied but never removed: one entry per distinct caller for the life of the process. Idle clients are swept past 10,000 entries. - /assistant and /search took any question length and any k; one request could send all 2,562 profiles to the model. Capped at 500 characters and k <= 12 (the longest eval question is 66 characters; the dashboard asks for 6). - CORS admitted every *.vercel.app with credentials, so any stranger's app could spend the budget from its visitors' browsers, each with a new bucket. Now: localhost, the production alias, and previews of a configured Vercel scope (CORS_PREVIEW_SCOPE). Credentials off; the dashboard sends none. Production cannot refit - scikit-learn, xgboost, lightgbm, shap and rapidfuzz move to a `train` extra. The API imports none of them, and Render no longer installs them. - With the libraries absent, a stale predictions file is served and flagged (`predictions_stale` in /talent/model-info) instead of triggering a 250MB refit on a 512MB instance; a missing one is a 503 naming the command. The team and value fallbacks do the same. - tests/test_footprint.py fails if importing the API loads any training library, if the value artifact needs lightgbm to read, or if the published predictions are missing what the API reads. Earlier fixes, not yet committed - The value router wrote its artifact to src/models/ (parents[3] from api/routers/ is src/), leaving the committed one holding a pickled LGBMRegressor. Fixed, and the artifact regenerated in the right place. - The RAGAS snapshot named gemini-2.5-flash as judge; the run was graded on LM Studio. One judge_name() now resolves it for both the request and the provenance. The snapshot is relabelled to google/gemma-4-e4b. - Answers cut off by the token limit are trimmed to the last sentence and flagged `truncated`; the assistant budget goes from 1400 to 3000 tokens. RAG: "who makes the most X" returns who makes the most X - Retrieval ranked leaders questions by similarity, so the six profiles that read most like the question reached the prompt, not the six that lead the metric -- and a faithful answer then named the best of the wrong six. RAGAS cannot see this: faithfulness and context precision are both satisfied. scripts/eval_metric_leaders.py checks it against the database for the 42 leaders questions in the bank. Similarity alone returned 19% of the true top six and the actual leader 12 times in 42; ordering the filtered pool by the metric returns 99% and the leader 42 times in 42. "Quem faz mais cortes" used to include a goalkeeper with 0.00 clearances. - The playing role (wing-back, centre-back, striker...) is now a hard filter, parsed by the same earliest-mention rule as the position group and derived from each player's primary position when the index loads -- no migration, no re-embedding. Without it a wider pool let centre-backs into wing-back questions; with it, 100% of returned players are in the role asked for. - Metric verbs are recognised ("rematam", "press", "conduzem", "complete the most passes"); each used to find no metric and fall back to similarity. - The prompt says the list is the top of the pool in order, and the response carries `ranked_by`. - Fixed a latent misalignment: metric notes were paired with profiles by list position, so a player with no values would have shifted every later player's figures onto the wrong paragraph. Data layer - tests/test_quality.py covers the rules that decide whether a whole season enters the pool: a full league, a truncated one, a single-club export (which is not a fragment), and null away sides (which must not become a phantom club, as they did in Ligue 1). The null-side test fails if that fix is reverted. - parse_value_eur moves from ml/value.py to etl/sofifa.py, the source whose format it parses; importing the SoFIFA loader no longer pulls in lightgbm. Housekeeping: CI lints scripts/, ruff format applied, README brought up to date (212 tests, 10 competitions, the real model figures, the precompute step). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ESLint - eslint + eslint-config-next 16.3.3 with the flat config Next 16 documents (core-web-vitals and typescript). `npm run lint` fails on any warning, and CI already runs it -- the step existed but had nothing to run. - The first run found five effects that set state synchronously to reset it before a fetch, each costing an extra render. They now keep every response with the request that produced it and derive "loading" from a mismatch (MetricDistribution, MetricScatter, PlayerAvatar, PlayerPickerModal). - The picker had no guard against out-of-order responses: a slow answer to an earlier keystroke could replace the results for the current query. Fixed with the same keyed results and a stale flag; its focus timer is cleared too. - Removed an unused generic, an unused import, and an `activeSlot` prop that Assistant and NLSearch received but never read. page.tsx - 1,649 lines to 996. The seven sub-components below Home move to their own files under app/components/, each importing only what it uses. Verified by multiset diff of every code line before and after: nothing lost or added. Behaviour - The distribution and scatter charts say which selected player they cannot plot and why, instead of dropping them silently. - A truncated assistant answer carries a note saying it stopped early. - The model ladder says when the served predictions are stale. - Assistant sources are titled "Top 6 by <metric> per 90, highest first" when the question asked who leads, so the list reads as the ordering it is. - Pending layout work in globals.css (chart framing and centring) from earlier rounds. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Bumps [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) and [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom). These dependencies needed to be updated together. Updates `react-dom` from 19.2.4 to 19.3.0 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.3.0/packages/react-dom) Updates `@types/react-dom` from 19.2.3 to 19.3.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom) --- updated-dependencies: - dependency-name: "@types/react-dom" dependency-version: 19.2.5 dependency-type: direct:development update-type: version-update:semver-patch - dependency-name: react-dom dependency-version: 19.2.8 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>

vercel · 2026-09-24T21:00:44Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
footy-vision	Error		Sep 24, 2026 9:01pm UTC

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 1, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/frontend/web/multi-15e0f44842 branch 2 times, most recently from e2a8be3 to 78494f0 Compare September 3, 2026 17:54

pinthoz and others added 3 commits September 24, 2026 21:57

dependabot Bot changed the title ~~Bump react-dom and @types/react-dom in /frontend/web~~ chore(deps): bump react-dom and @types/react-dom in /frontend/web Sep 24, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/frontend/web/multi-15e0f44842 branch from 78494f0 to 49a67eb Compare September 24, 2026 21:00

vercel Bot had a problem deploying to Preview September 24, 2026 21:01 Failure

pinthoz force-pushed the main branch from 7513f6a to 5ccefa6 Compare September 24, 2026 22:07

Navigation Menu

chore(deps): bump react-dom and @types/react-dom in /frontend/web - #8

chore(deps): bump react-dom and @types/react-dom in /frontend/web#8
dependabot[bot] wants to merge 3 commits into
mainfrom
dependabot/npm_and_yarn/frontend/web/multi-15e0f44842

dependabot Bot commented on behalf of github Sep 1, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Sep 24, 2026 •

edited

Loading

Uh oh!

This branch had an error being deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

19.3.0 (September 9, 2026)

New React Features

New React DOM Features

Notable changes

All Changes

React

19.3.0 (September 9, 2026)

New React Features

New React DOM Features

Notable changes

All Changes

React

Uh oh!

vercel Bot commented Sep 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This branch had an error being deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Sep 1, 2026 •

edited

Loading

vercel Bot commented Sep 24, 2026 •

edited

Loading