Vaadin 18.0.6

Vaadin consists of a set of web components, a Java web framework, configurable themes, tools and a set of app templates.

This is a maintenance release of Vaadin.
See the full release notes for vaadin 18.0 in GitHub releases, including new features, getting started, supported browsers and other technologies, and migration notes.

Visit vaadin.com to get started.

New and Noteworthy

Here are the highlighted new and improved features in this maintenance release.

Flow

• Breaking Changes:

  • ⧉ Make VaadinService.dependencyFilters unmodifiable

    While the change is backwards compatible from API perspective, it could be considered a behavior change although there is quite low risk of exposure in apps. Thus targeting 2.5 for the LTS and the recently released 5.0.

• Fixes:

  • ⧉ Remove old devDependencies. PR:9931. Ticket:9720

    Clean away also old devDependencies on Package update.

  • ⧉ Encode attribute value during transfer from embedded web app. PR:9583

    encode attribute value during transfer from embedded web app

  • ⧉ Add empty list handling to DataCommunicator#collectKeysToFlush. PR:9516. Ticket:1837

  • ⧉ Lock versions to what is set in package.json. PR:9859

    Even without platform versions we should manage the used versions by using exactly what is defined in the package.json as if we had a platform versions file.

  • ⧉ Correct regexp to only match when digit first. PR:9496. Ticket:9494

    Use Matcher::find instead of Matcher::matches as matches never matched.

  • ⧉ Use ordered Set for deterministic CompositeDataGenerator. PR:9657. Ticket:9656

    Use LinkedHashSet (not HashSet) to keep the order of data generators in CompositeDataGenerator.

  • ⧉ Avoid BeforeClient executions for nodes with different StateTree. PR:9715. Ticket:9397

  • ⧉ Use proper logging for installing pnpm and its directory. PR:9724. Ticket:9571

  • ⧉ Use thread-safe map for bootstrap HTML fragment cache. PR:9852

    The cache is only protected from multiple accesses at the same time by the same user. Many users can use it simultaneously

  • ⧉ Use time-constant comparison for CSRF tokens. PR:9875 Thanks to Xhelal Likaj for reporting this

    This hardens the framework against a theoretical timing attack based on comparing how quickly a request with an invalid CSRF token is rejected.

  • ⧉ Use time-constant comparison for security tokens (#9896). PR:9910 Thanks to Xhelal Likaj for reporting this

    This is the same as #9875, but also applied for the upload security key and the push id since both of those are also used to protect against cross-site attacks. In addition, documentation for the push id is clarified to point out its role.

  • ⧉ Importing binary file in frontend file (#9955). PR:9959. Ticket:9926

    Catch MalformedInputException for reading file during import visit for frontend files where file is binary and can not be read as lines.

Components

Changes in vaadin-crud-flow

• Fixes:
  • ⧉ Replace select(null) with deselectAll() (#189). PR:566

Changes in vaadin-grid-flow

• Fixes:
  • ⧉ Clear subchildren when refreshing item (#588). PR:599. Ticket:1819

Support

Vaadin 18 is supported for one month after Vaadin 19 has been released. The latest LTS (long term support) version is Vaadin 14. More details of our release model are available on our roadmap page.

Vaadin also provides commercial support and warranty.

Getting Started with Vaadin

App starters

The best way to get started with Vaadin is to go to https://vaadin.com/start and pick an app template for the technology stack you’re interested in.

For the full list of how to get started go to the GitHub releases.

Known Issues and Limitations

Flow

Components

Reporting Issues

We appreciate if you try to find the most relevant repository to report the issue in. If it is not obvious which project to add issues to, you are always welcome to report any issue at https://github.com/vaadin/platform/issues.

A few rules of thumb will help you and us in finding the correct repository for the issue:

1. Bug tickets and enhancement requests that are specific to a certain Vaadin component should be posted in the component's Web Component repostory (e.g. https://github.com/vaadin/vaadin-button for Button).
2. Issues that are not component-specific (e.g. requests for new components) or encompass multiple components should be posted in vaadin-flow-components repository.
3. If you encounter an issue with Flow which does not seem to be related to a specific component, the problem is likely in Flow itself. The Flow repository is https://github.com/vaadin/flow
4. If you encounter an issue with Designer, the repository is https://github.com/vaadin/designer
5. If you encounter an issue with TestBench, the repository is https://github.com/vaadin/testbench