vaadin/flow 25.1.12

Vaadin Flow 25.1.12

on GitHub

Changes since 25.1.11

All changes

New features

• Validate URL schemes in Anchor, IFrame and Page#open (#24539, #24897) (CP: 25.1)
  Commit · Pull request

  branch 25.1, and also disables the validation by default. The defaults when "safeUrlSchemes" configuration is missing is adjusted, so that URL validation is disabled by default, and all URLs are considered safe. This avoids unexpected behavior changes for existing users of Flow 25.1 and below. The URL scheme validation feature could be enabled with configuration when necessary.

• Add configurable max request body size (#24866) (CP: 25.1)
  Commit · Pull request

  Add maxRequestBodySize property to limit UIDL/RPC and push request body size (-1 disables); the default is 10 MB; does not affect uploads.

• Allow setting frontend build toggles via system properties (#24786) (CP: 25.1)
  Commit · Pull request

  Several build-frontend toggles could only be configured through a POM <configuration> block, making it hard to override them for a single build. Add a property attribute to generateBundle, runNpmInstall, generateEmbeddableWebComponents, optimizeBundle and eagerServerLoad so they can be set at runtime, e.g. -Dvaadin.generateBundle=false.

Fixes

• Support gradle 9 in plugin (#24891) (CP: 25.1)
  Commit · Pull request · Issue

  Bump kotlin and dokka versions. Add tests for 9.0.0 and 9.5.0

• Clean up countInstances (#24890) (CP: 25.1)
  Commit · Pull request · Issue

  Make count instances more effective by not using split that compiles a pattern and generates an array for each invocation.

• Allow embedded web components to connect behind a modal (#24857) (CP: 25.1)
  Commit · Pull request

  Embedded web components share a single WebComponentUI and are attached as children of its element. When one of them opens a modal component, the WebComponentUI element becomes inert, which dropped the connect-web-component RPC for any other embedded web component connecting or reconnecting while the modal is open. Mark the connect event with allowInert so the connect handshake bypasses the server-side modality filter, matching how polling and navigation are handled.

• Keep dev mode running when a pre-trial is expired (#24855) (CP: 25.1)
  Commit · Pull request

  In dev mode with dev tools enabled, an expired pre-trial threw PreTrialLicenseValidationException, which aborted server startup so the splash screen was no longer shown. Catch it for the expired state and delegate to dev tools like a missing key; other states are rethrown.

• Allow UI polling while a modal component is open (#24834) (CP: 25.1)
  Commit · Pull request · Issue

  Poll listeners registered through PollNotifier.addPollListener are now registered with DomListenerRegistration::allowInert, so they continue to fire even when a modal component makes the UI inert.

• Write frontend build files into build dir when it is outside project dir (#24805) (CP: 25.1)
  Commit · Pull request · Issue

  When the build dir is relocated outside the project dir, vaadinPrepareFrontend wrote vaadin-dev-server-settings.json and the dev-bundle output paths under the source tree. buildFolder() is now always relative to projectDir.

• Cancel pending validation effect listener on binding removal (#24791) (CP: 25.1)
  Commit · Pull request · Issue

  Binding a not-yet-attached field schedules the internal validation signal effect via a component attach listener instead of creating it immediately. That listener registration was not tracked, so unbind() could not cancel it. After removeBinding(), the stale listener stayed on the field and fired on a later attach, creating an effect for an already-unbound binding. The effect then read the binding's now-null field, throwing a NullPointerException wrapped in "This binding is already unbound" (only reproducible when the attach happened outside the removing UI.access() scope). The attach listener registration is now stored and removed in unbind(), so removing a binding fully tears down its pending effect setup.

• Normalize bare stylesheet paths to prevent MalformedURLException warnings (#24029) (CP: 25.1)
  Commit · Pull request · Issue

  Bare paths like "lumo/lumo.css" from @StyleSheet annotations cause a MalformedURLException warning because ServletContext.getResource() requires a leading '/'. Normalize the path in ResourceContentHash before calling getStaticResource(), and document the '/' requirement in VaadinService.getStaticResource() javadoc.

• Improve shared signal transaction error message (#24663) (CP: 25.1)
  Commit · Pull request

  Clarify error when updating multiple shared signals in a transaction. Explain shared signal transaction restriction with cluster context.

• Write generated frontend files atomically (#24667) (CP: 25.1)
  Commit · Pull request

  Generated frontend files (vaadin.ts, index.ts, generated-flow-imports, etc.) were written via Files.writeString, which truncates the target and rewrites it in place. A file system watcher such as Vite's can observe that intermediate state and read an empty or partially written file, crashing the dev server with errors like "Failed to resolve import './index' from 'generated/vaadin.ts'". This is hit when Java is recompiled in the background (IDE or agent) while the dev server runs. FileIOUtils.writeIfChanged now writes to a temp file in the same directory and moves it over the target with an atomic move (falling back to a regular replace when the file system does not support atomic moves), so watchers only ever see the complete old or complete new content.