vaadin/flow 24.10.8 on GitHub

Changes since 24.10.7

Add runtime license checking (#24652) (CP:24.10)
Commit · Pull request
Verify the Vaadin license at runtime in VaadinServlet and at build time in the frontend build tool. Development mode fails on an invalid license; production mode only logs the failure so the app keeps running. Update OSGi bundle licenses to the commercial license terms. Force-off commercial banner in build plugins. Disable pre-trial licensing so trials can't be started or honored.

Validate URL schemes in Anchor, IFrame and Page#open (CP: 24.10)
Commit · Pull request
branch 25.1, and also disables the validation by default. The defaults when "safeUrlSchemes" configuration is missing is adjusted, so that URL validation is disabled by default, and all URLs are considered safe. This avoids unexpected behavior changes for existing users of Flow 25.1 and below. The URL scheme validation feature could be enabled with configuration when necessary. (cherry picked from commit 28e55a3) (cherry picked from commit 51048d1)
Add configurable max request body size (#24866) (CP: 24.10)
Commit · Pull request
Add maxRequestBodySize property to limit UIDL/RPC and push request body size (-1 disables); the default is 10 MB; does not affect uploads.

Clean up countInstances (#24890) (CP: 24.10)
Commit · Pull request · Issue
Make count instances more effective by not using split that compiles a pattern and generates an array for each invocation.
Allow UI polling while a modal component is open (cp 24.10) (#24834)
Commit · Pull request · Issue
Poll listeners registered through PollNotifier.addPollListener are now registered with DomListenerRegistration::allowInert, so they continue to fire even when a modal component makes the UI inert.
Write frontend build files into build dir when it is outside project dir (#24805) (CP: 25.0) (#24821) (CP: 24.10)
Commit · Pull request
When the build dir is relocated outside the project dir, vaadinPrepareFrontend wrote vaadin-dev-server-settings.json and the dev-bundle output paths under the source tree. buildFolder() is now always relative to projectDir.
Unpack prod bundle on Windows mapped network drives (CP: 24.10)
Commit · Pull request · Issue
The Zip Slip guard in CompressUtil.newFile canonicalized the target dir and the not-yet-created entry separately; on mapped/subst drives getCanonicalPath() returns inconsistent forms, so legitimate entries were rejected. Canonicalize the destination once and resolve entries lexically, checking containment with Path.startsWith. Cherry-pick of #24560