Upgrade notes for Shiny 1.3.0

Full changelog

Revamped Shiny’s reactlog viewer which debugs reactivity within a shiny application. This allows users to traverse the reactivity history of a shiny application, filter to the dependency tree of a selected reactive object, and search for matching reactive objects. See ?reactlogShow for more details and how to enable this feature. (#2107)
Shiny now serves static files on a background thread. This means that things like JavaScript and CSS assets can be served without blocking or being blocked by the main R thread, and should result in significantly better performance for heavily loaded servers. (#2280)

The Shiny-Shared-Secret security header is now checked using constant-time comparison to prevent timing attacks (thanks @dirkschumacher!). (#2319)

Fixed #2245: updateSelectizeInput() did not update labels. (#2248)
Fixed #2308: When restoring a bookmarked application, inputs with a leading . would not be restored. (#2311)
Fixed #2305, #2322, #2351: When an input in dynamic UI is restored from bookmarks, it would keep getting set to the same value. (#2360)
Fixed #2349, #2329, #1817: These were various bugs triggered by the presence of the networkD3 package’s Sankey plot in an app. Impacted features included dateRangeInput, withProgressBar, and bookmarking (#2359)

Fixed #2247: renderCachedPlot now supports using promises for either expr or cacheKeyExpr. (Shiny v1.2.0 supported async expr, but only if cacheKeyExpr was async as well; now you can use any combination of sync/async for expr and cacheKeyExpr.) #2261