vaadin/flow 25.2.0-alpha4

Vaadin Flow 25.2.0-alpha4

on GitHub

Changes since 25.2.0-alpha3

All changes

Breaking changes

• Stop auto-running vaadinPrepareFrontend in development mode
  Commit · Pull request · Issue

  IDE-triggered Gradle builds (e.g. IntelliJ compiling on file change) were running vaadinPrepareFrontend via processResources, which interfered with the running Vite dev server and broke hotdeploy. Since Vaadin 25, the dev server handles frontend preparation at runtime, so the task no longer needs to run automatically. The previous behavior can be restored by setting alwaysExecutePrepareFrontend = true.

New features

• Add help goal for maven plugin
  Commit · Pull request

  Adds generation of help goal for the Flow maven plugin. Also renamed execution identifier to avoid double execution of the descriptor goal.

• Expose application properties via Options for TypeScriptBootstrapModifier consumers
  Commit · Pull request · Issue

  TypeScriptBootstrapModifier implementations (e.g., Copilot) need access to application properties to conditionally modify bootstrap TypeScript. Currently, the Copilot script is injected in dev mode regardless of whether Copilot is enabled in the project configuration. Add withApplicationConfiguration to Options and property accessor methods (getApplicationStringProperty, getApplicationBooleanProperty) that return Optional.empty() when configuration is unavailable (build time). Wire ApplicationConfiguration from DevModeInitializer.

Fixes

• Respect user opt-out when adding overrides
  Commit · Pull request

  Adjust the checks for user opt-out in package.json overrides, so that an existing override for new entries added by Vaadin is considered as an opt-out, so that the existing user value is kept. This behavior satisfies the previously existing NodeUpdatePackagesNpmVersionLockingTest.shouldNotUpdatesOverrides_whenHasUserModification test.

• Prevent deletion of app-shell-imports by frontend cleanup task
  Commit · Pull request

  TaskRemoveOldFrontendGeneratedFiles deletes files in the frontend generated folder that are not recognized as known generated files. The app-shell-imports.js and app-shell-imports.d.ts files were missing from the known files list, causing them to be deleted when vaadinPrepareFrontend runs without the index generation task, for example when IntelliJ IDEA triggers a Gradle compilation while the dev server is running with hot deploy. Add APP_SHELL_IMPORTS_NAME and APP_SHELL_IMPORTS_D_TS_NAME to the known files list. Also improve test coverage by verifying all known file types, including Hilla generated files. Related to #24108

• Add package.json overrides for workbox dependencies
  Commit · Pull request

  • Add PwaConfiguration parameter to TaskUpdateVite constructor - Remove service worker plugin and its imports from vite.generated.ts when offline build is not enabled - Use FrontendDependenciesScanner in TaskGeneratePackageJson to generate correct dev dependencies - Enhance TaskUpdatePackages for proper override handling - Move all workbox dependencies to workbox/package.json and only add when offline sw build is needed - Add overrides for workbox dependencies to package.json - Add overrides support to NodeUpdater - Remove empty vaadin.overrides from package.json

• Add popover attribute to system error container
  Commit · Pull request

  E.g. Dialog can obscure the message

• Remove duplicate CI run for main branch merges
  Commit · Pull request

  Summary - Remove main from the push trigger branches in validation.yml to avoid duplicate CI runs - Since merge queue is enabled on main, every merge triggers both a merge_group and a push event for the same commit, causing two full CI runs (build + unit tests + integration tests) - Direct pushes to main are not possible (branch protection), so the push trigger for main is redundant - Other branches (25.1, 25.0, 24.10, etc.) still need the push trigger as they do not use merge queue ## Context When a PR merges via the merge queue, GitHub fires two events for the same commit (example vs example). The concurrency groups differ between the two events (gh-readonly-queue/main/... vs main), so they do not cancel each other and both run to completion. merge_group workflow run uses the same commit hash as the merged commit, so Bender should be able to match against it. This should be verified after merging.

• Filter hop-by-hop headers in dev server proxy
  Commit · Pull request

  The dev server proxy in AbstractDevServerRunner forwarded all HTTP headers between the browser and the Vite dev server, including hop-by-hop headers that must not be forwarded by a proxy per RFC 9110 Section 7.6.1. It also forwarded the upstream Content-Length which may not match the actual bytes after HttpURLConnection decoding, causing broken responses on some servlet containers. This change filters hop-by-hop headers and Content-Length from proxied requests and responses, and avoids closing the output stream after sendError(). Related to #23564

• Encode location query parameter in init request to preserve +
  Commit · Pull request

  Re-add encodeURIComponent() around the location parameter in the init request query string. Without encoding, a literal + in the URL path (e.g. /+/dashboard) is interpreted as a space by the servlet container's query parameter decoding, resulting in InvalidLocationException: Relative path cannot start with / The encodeURIComponent was removed in #22791 to preserve %2F in wildcard parameters, but this is not needed: double-encoding (%2F becomes %252F) is correctly undone by the servlet's single query parameter decode.

• Log Vite build failure only once instead of on every request
  Commit · Pull request

  When the Vite dev server fails to start, the exception was re-thrown on every subsequent HTTP request, flooding the log with identical stack traces. Now the error is thrown once and subsequent requests gets the error in the browser instead.