• Support for createPortal() (#452, #486)
• Avoid triggering insertion of a process shim in bundlers (#403, #472 - thanks @kaisermann)

Important security patch

3.18.2 fixes an HTML injection vulnerability (CVE-2018-6341), so we encourage everyone to update. The fix is contained in preact-render-to-string@3.7.2, used by preact-compat/server.

See React's detailed notes for more information. Thanks for @gaearon and the React team for the coordinated fix!