vaadin/flow 24.10.5

Vaadin Flow 24.10.5

on GitHub

Changes since 24.10.4

All changes

New features

• Expose application properties via Options for TypeScriptBootstrapModifier consumers (#24073) (CP: 24.10)
  Commit · Pull request · Issue

  TypeScriptBootstrapModifier implementations (e.g., Copilot) need access to application properties to conditionally modify bootstrap TypeScript. Currently, the Copilot script is injected in dev mode regardless of whether Copilot is enabled in the project configuration. Add withApplicationConfiguration to Options and property accessor methods (getApplicationStringProperty, getApplicationBooleanProperty) that return Optional.empty() when configuration is unavailable (build time). Wire ApplicationConfiguration from DevModeInitializer.

Fixes

• Load Image/IFrame sources when disabled (CP: 24.10)
  Commit · Pull request · Issue

  When an Image or IFrame backed by a DownloadHandler lives inside a disabled component, the browser receives a 403 and the resource never loads. Image.setSrc(DownloadHandler) and IFrame.setSrc(DownloadHandler) now allow the resource to be served regardless of the owner's enabled state, since these sources are fetched passively as part of rendering rather than as a user action.

• NPE when web push subscription is expired (CP: 24.10)
  Commit · Pull request · Issue

  When the push service reports a subscription as expired, WebPush.sendNotification threw NullPointerException instead of the intended WebPushException. Remove a leftover reference to an unassigned HttpResponse local variable that was no longer populated after the migration to com.interaso.webpush.

• Install pnpm deps in hoisted mode + declare @babel/types (#24288) (CP: 24.10)
  Commit · Pull request

  Cherry-pick of #24288 (commit d9290f8) from main to 24.10. ## Summary Same fix as #24288: switches pnpm install to hoisted (flat npm-style) layout so transitive npm deps (@babel/types, @lit/reactive-element, cookie, set-cookie-parser, @preact/signals-react/runtime) are always reachable from project root, eliminating the vite-basics IT hang and similar symptoms. ## Adjustments for 24.10 24.10 is pre-flow-build-tools refactor (#23161), so all the Java files the original commit touches (FrontendTools.java, FrontendToolsTest.java, NodeUpdaterTest.java, TaskRunPnpmInstallTest.java) live under flow-server/ here. The edits are otherwise identical. Two version adjustments to match this branch's dep graph: 1. @babel/types pinned to 7.28.5 (matching @babel/preset-react) instead of main's 7.29.0. 24.10 does not declare @babel/core, so version coherence is anchored to preset-react. 2. Skipped @babel/core and @babel/plugin-transform-react-jsx-development declarations from the main commit — not declared as direct deps on 24.10, and the React function location plugin only imports @babel/types. ## Supersedes #24289 This PR replaces #24289 (the narrower @babel/types-only fix). Once this lands, #24289 should be closed. ## Test plan - [ ] CI on this PR passes (specifically it-tests (1) and it-tests (2)). - [ ] mvn -pl flow-server test -Dtest=NodeUpdaterTest,TaskRunPnpmInstallTest,FrontendToolsTest passes. - [ ] After install in any vite-using IT module, node_modules/.pnpm/ does not exist (or is empty); node_modules/@babel/types/ and node_modules/@lit/reactive-element/ exist as real directories at the project root. 🤖 Generated with Claude Code

• Wrong existence check in getStaticResource (CP: 25.0) (#24285) (CP: 24.10)
  Commit · Pull request

  This PR cherry-picks changes from the original PR #24285 to branch 24.10. --- #### Original PR description > This PR cherry-picks changes from the original PR #24283 to branch 25.0. > > A conflict in flow-server/src/test/java/com/vaadin/flow/server/VaadinServletServiceTest.java was resolved manually: the new getStaticResource_jarUrlOnJetty12_returnsUrlInsteadOfThrowing test was rewritten in JUnit 4 idioms (@Rule TemporaryFolder, Assert.*) since 25.0 has not adopted the JUnit 5 migration that landed on main. > > --- > > > On Jetty 12.1.9, requests for static resources packaged inside a JAR (e.g. vaadinPush.js from flow-push) fail with > > FileSystemNotFoundException. VaadinServletService.getStaticResource verifies the URL returned by ServletContext.getResource via Path.of(url.toURI()), which for a jar:file:...!/entry URI requires the JAR's NIO FileSystem to already be mounted in the JVM-wide cache. Jetty 12.1.8 incidentally kept those filesystems mounted during resource resolution; 12.1.9 no longer does, so getFileSystem throws and the existing catch (URISyntaxException) lets the unchecked exception escape, producing HTTP 500. > > > > Probe the URL with URL.openStream() instead. JarURLConnection and FileURLConnection use java.util.jar.JarFile / java.io.File directly and are independent of the NIO FileSystems cache, so the check works uniformly for file: and jar:file: URLs and on every Jetty 12 build. The catch is broadened to IOException, covering both missing files (the original Jetty 12 workaround) and missing JAR entries.