vaadin/flow 6.0.0.alpha5

Vaadin Flow 6.0.0.alpha5

on GitHub

Vaadin Flow 6.0.0.alpha5

Changes in Flow from 6.0.0.alpha4

• Breaking Changes:

  • ⧉ Rename connect.generated as it now used for Flow as well. PR:9836. Ticket:9687

    Frontend generated folder is now used by Flow to generate a theme files. It's not limited to a Fusion's connect functionality. Thus, this PR proposes to rename it to something more common. As 'vaadin.frontend.generated.folder' parameter name already exists, the new name is proposed to be 'project.frontend.generated' to not mix them up with each other.

  • ⧉ Update changed value to field with formatting. PR:9227

    Convert value back to representation and write back to field when changed and validation passes. This ensures correct formatting of the value when a converter is used. This changes existing field binding behavior for binder, but for the better. Some applications might have workarounds in place for this and can now remove them.

• New Features:

  • ⧉ Support current pnpm versions. PR:9848

    Remove pnpm-lock.yaml when package.json dependencies are updated to work around pnpm/pnpm#2587. Invoke pnpm via npx instead of relying on global installation or installing into ~/.vaadin/node_modules.

  • ⧉ Implement NativeDetails as html component. PR:9735

    NativeDetails is based on vaadin-details except that the html property is called open instead of opened and the event is called Toggle like the html dom event. To reduce the API noise NativeDetails extends HtmlComponent instead of HtmlContainer. HasText and HasComponents would interfere with the already set <summary> inside the <details>.

  • ⧉ Add HasOrderedComponents in HTML layout elements. PR:9734

    Closes #8188 This PR implements HasOrderedComponents for all common HTML layout elements: - Aside - Article - Div - Footer - Header - Main - Nav - Section The test is created in the base test class to simplify the unit testing of all components. To make sure that the interface isn't removed by accident, every class implements the test explicitly and fails if the interface is removed.

• Fixes:

  • ⧉ Use time-constant comparison for security tokens. PR:9896 Thanks to Xhelal Likaj for reporting this

    This is the same as #9875, but also applied for the upload security key and the push id since both of those are also used to protect against cross-site attacks. In addition, documentation for the push id is clarified to point out its role.

  • ⧉ Bump jackson library version. PR:9892. Ticket:9891

  • ⧉ Use time-constant comparison for CSRF tokens. PR:9875 Thanks to Xhelal Likaj for reporting this

    This hardens the framework against a theoretical timing attack based on comparing how quickly a request with an invalid CSRF token is rejected.

  • ⧉ Peer dependency errors in npm 7 install. PR:9856. Ticket:9714

  • ⧉ Lock versions to what is set in package.json. PR:9859

    Even without platform versions we should manage the used versions by using exactly what is defined in the package.json as if we had a platform versions file.

  • ⧉ Properly initialize and destroy Vaadin Servlet. PR:9866. Ticket:9858

  • ⧉ Configure accessChecker in a thread safe way. PR:9846

  • ⧉ Use thread-safe map for bootstrap HTML fragment cache. PR:9852

    The cache is only protected from multiple accesses at the same time by the same user. Many users can use it simultaneously

  • ⧉ Clean theme file if no theme defined. PR:9841. Ticket:9832

    Remove the theme.[js|d.ts] files if no theme is defined.

  • ⧉ Also load default JAR resources for DevModeInitializer. PR:9823. Ticket:9802

  • ⧉ Add empty list handling to DataCommunicator#collectKeysToFlush. PR:9516. Ticket:1837

  • ⧉ Delay deletion of frontend/generated/vaadin.ts. PR:9816

    Deleting the entire frontend/generated directory before generating its contents again triggers webpack recompilation in an invalid file state during live reload on Windows.

  • ⧉ Only create needed folders. PR:9812

    When copying files for custom theme only create directories that contain file to be copied. Generate directories with mkdirp instead of fs.mkdir as it is more reliable.

  • ⧉ Use 403 Forbidden instead of 410 for expired sess.. PR:9784

    Relates to #9759 Forward port of vaadin/framework#11859

  • ⧉ Resource is not available in java if not referenced in a CSS file. PR:9776. Ticket:9622

    Copies static resources from theme folder to a webpack output folder, so that to make them available from Java pages.

  • ⧉ Generate TS definition for theme-generated.js. PR:9753. Ticket:9678