vaadin/flow 24.9.7

Vaadin Flow 24.9.7

on GitHub

Changes since 24.9.6

All changes

Fixes

• WebComponent supported types
  Commit · Pull request · Issue

  to have serializable BaseJsonNode instead of JsonNode.

• Replace pull_request_target with secure alternatives (#22952)
  Commit · Pull request

  Address GitHub's December 2025 security changes to pull_request_target: - Workflows now always run from default branch (not PR branch) - Environment protection rules evaluate against execution branch Changes: - validation.yml: Use pull_request with protected environment for forks

• Ensure route annotation is on component class (#22878)
  Commit · Pull request · Issue

  Throws an exception at startup if a Route annotation is put on a class that does not extend Component.

• Use direct VAADIN path for push script URL (#22827) (CP: 24.9)
  Commit · Pull request · Issue

  The correct approach is to use the direct VAADIN/... path without any navigation prefix. This works because the already points to the servlet root, so relative URLs resolve correctly to {context-path}/{servlet-path}/VAADIN/...