vaadin/flow 25.0.0-rc2

Vaadin Flow 25.0.0-rc2

on GitHub

Changes since 25.0.0-rc1

All changes

New features

• Throw when data provider returns more items than requested
  Commit · Pull request

Fixes

• Use environment protection for pull_request_target workflows
  Commit · Pull request

  After GitHub's December 2025 changes to pull_request_target: - Workflows now always run from default branch (not PR branch) - We cannot use workflows from release branches, only from main Because TB tests require secrets, we need pull_request_target to run validations on forked branches. The pr-tests environment ensures only authorized reviewers can approve workflow runs from forks. Changes: - validation.yml: Use pull_request_target with environment protection - sonar-pr.yml: Use pull_request_target with environment protection - check-permissions.yml: Removed (replaced by environment protection) - formatter.yml: Keep pull_request (no secrets needed)

• Replace pull_request_target with secure alternatives
  Commit · Pull request

  Address GitHub's December 2025 security changes to pull_request_target: - Workflows now always run from default branch (not PR branch) - Environment protection rules evaluate against execution branch Changes: - formatter.yml: Use pull_request (no secrets needed) - validation.yml: Use pull_request with protected environment for forks Requires creating 'pr-tests' environment in GitHub settings with required reviewers for PRs from forks.