vaadin/flow 25.3.0-alpha4

Vaadin Flow 25.3.0-alpha4

on GitHub

Changes since 25.3.0-alpha3

All changes

Breaking changes

• Restore cached Gradle frontend build outputs
  Commit · Pull request · Issue

  Gradle production builds could produce application archives (JAR/WAR) without the Vaadin frontend resources when the vaadinBuildFrontend output was restored from Gradle's build cache, causing the packaged application to fail in production because the client bundle was missing. The production frontend output is now a declared task output, so it is correctly restored from the build cache and reliably packaged into the application archive, including custom archive tasks. The new includeArchiveTasks and excludeArchiveTasks options let you control which archives receive the frontend bundle. Breaking change: a custom frontendOutputDirectory must now follow the META-INF/VAADIN/webapp layout (as the default does). A value that does not end in META-INF/VAADIN/webapp is rejected with a build error in production mode. Previously it silently produced an archive without the frontend bundle and, on Gradle 9, failed with an implicit task-dependency error.

New features

• Reject uploads with a synchronous validator
  Commit · Pull request · Issue

  The pre-made upload handlers offered no supported way to refuse an upload while it was being received; only a fully custom UploadHandler could call UploadEvent.reject(...). Subclassing a pre-made handler to reject a captured event did not help: rejection was signalled asynchronously and never checked, so the success callback still ran and file handlers left the written file on disk. Add UploadValidator, registered via withValidator(...), which is invoked synchronously while the upload is received and can call UploadEvent.reject(...) to abort it before it is stored. Downloads are unaffected.

Fixes

• Respect custom npm registry in seeded package-lock.json
  Commit · Pull request

  When seeding a project's package-lock.json from the dev-bundle template, Flow copied it verbatim, keeping the hardcoded registry.npmjs.org URLs in every resolved field. With a custom npm registry configured, this leaves a committed lock (with cleanFrontendFiles=false) that still points at registry.npmjs.org, and packages can end up being downloaded from npmjs instead of the configured registry — for example when only a scoped @scope:registry is set, or when npm's registry-host rewriting is turned off. This breaks private/air-gapped setups and any tooling that consumes the lock without npm's rewriting. Strip the resolved fields from the seeded npm package-lock.json when a custom registry is configured, so npm re-resolves the download URLs against that registry. The integrity hashes are kept so npm still verifies the downloaded tarballs against the versions Vaadin tested. Default setups keep the verbatim fast-path copy. Whether a custom registry is configured is now determined by npm itself (npm config ls --json) rather than by scanning .npmrc files, so it also covers registries set through environment variables, the global npmrc, or the command line, as well as scoped registries.

• Prevent NPE in ElementEffect detach listener on re-attach
  Commit · Pull request · Issue

  ElementEffect registered a new detach listener on every attach, stored it in the single detachRegistration field, and relied on each detach listener removing itself. When an element is re-attached without a detach event firing in between - StateNode.removeFromTree(false), as used by UIInternals.moveToNewUI for @PreserveOnRefresh - a second detach listener was registered while the first was still present. The next real detach ran both: the first nulled detachRegistration, the second dereferenced null and threw a NullPointerException. Register the detach listener through a helper that removes any previous registration before adding a new one, and null-guard the removal inside the listener so at most one detach listener is ever active.

• Skip vaadinBuildFrontend in development mode
  Commit · Pull request · Issue

  The Gradle vaadinBuildFrontend task is now skipped when Vaadin production mode is not enabled. This prevents development and multi-module builds from failing when the task is part of the build graph, and avoids producing a production configuration while running in development mode.