vaadin/flow 24.9.22

Vaadin Flow 24.9.22

on GitHub

Changes since 24.9.21

All changes

Breaking changes

• Add runtime license checking
  Commit · Pull request

  Verify the Vaadin license at runtime in VaadinServlet and at build time in the frontend build tool. Development mode fails on an invalid license; production mode only logs the failure so the app keeps running. Update OSGi bundle licenses to the commercial license terms. Force-off commercial banner in build plugins. Disable pre-trial licensing so trials can't be started or honored.

New features

• Validate URL schemes in Anchor, IFrame and Page#open (CP: 24.9)
  Commit · Pull request

  branch 25.1, and also disables the validation by default. The defaults when "safeUrlSchemes" configuration is missing is adjusted, so that URL validation is disabled by default, and all URLs are considered safe. This avoids unexpected behavior changes for existing users of Flow 25.1 and below. The URL scheme validation feature could be enabled with configuration when necessary. (cherry picked from commit 28e55a3)

• Add configurable max request body size (#24866) (CP: 24.9)
  Commit · Pull request

  Add maxRequestBodySize property to limit UIDL/RPC and push request body size (-1 disables); the default is 10 MB; does not affect uploads.

Fixes

• Write frontend build files into build dir when it is outside project dir (#24805) (CP: 25.0) (#24821) (CP: 24.9)
  Commit · Pull request

  This PR cherry-picks changes from the original PR #24805 to branch 25.0. --- #### Original PR description > ## Description > > When the build dir is relocated outside the project dir, vaadinPrepareFrontend wrote vaadin-dev-server-settings.json and the dev-bundle output paths under the source tree. buildFolder() is now always relative to projectDir. > > Fixes #24804 > > ## Type of change > > - [ x] Bugfix > - [ ] Feature > > ## Checklist > > - [x ] I have read the contribution guide: https://vaadin.com/docs/latest/guide/contributing/overview/ > - [x ] I have added a description following the guideline. > - [ x] The issue is created in the corresponding repository and I have referenced it. > - [ x] I have added tests to ensure my change is effective and works as intended. > - [ x] New and existing tests are passing locally with my change. > - [ x] I have performed self-review and corrected misspellings. > >

• Unpack prod bundle on Windows mapped network drives (CP: 24.10) (#24564) (CP: 24.9)
  Commit · Pull request · Issue

  The Zip Slip guard in CompressUtil.newFile canonicalized the target dir and the not-yet-created entry separately; on mapped/subst drives getCanonicalPath() returns inconsistent forms, so legitimate entries were rejected. Canonicalize the destination once and resolve entries lexically, checking containment with Path.startsWith. Cherry-pick of #24560