Vaadin Flow Components V25.1.10

Vaadin Flow Components 25.1.10

This is a release of the Java integration for Vaadin Components to be used from the Java server side with Vaadin Flow.

Changes in Flow Components from 25.1.9

Changes in All Components

• Chore:
  • ⧉ Increase Web-Component version
  • ⧉ Increase Web-Component version
  • ⧉ Increase Web-Component version
  • ⧉ Increase Web-Component version

Changes in vaadin-charts-flow

• New Features:

  • ⧉ Validate navigation-related URL schemes (#9447) (CP: 25.1). PR:9708

    Mirror the Flow URL-scheme validation (vaadin/flow#24539) for the navigation, action and link sinks in flow-components. A javascript: (or other non-allow-listed) scheme on a value that the browser later treats as a link, form action or script source is a familiar XSS shape; rejecting it at the setter closes that path while leaving an explicit escape hatch for trusted, hard-coded URLs. Validating setters added across the affected components, each with a matching setUnsafe* variant that bypasses validation: - SideNavItem.setPath / BreadcrumbsItem.setPath — navigation link. - Credits.setHref — clickable Highcharts credits link. - AbstractLogin.setAction — the form action attribute the browser POSTs to on submit. - Exporting.setUrl — Highcharts posts SVG to this URL as a form action for export fallback. - Exporting.setLibURL — concatenated into <script src="…"> to load offline-export dependencies at runtime. SideNavItem constructor that takes a String path validates transitively via setPath; their Javadoc now documents @throws IllegalArgumentException and explicit constructor tests cover the behaviour. Safe schemes are configured through the safeUrlSchemes property and default to http, https, mailto, tel, ftp. Image, icon, SVG, Avatar, map tile and chart-resource URLs are intentionally not validated: javascript: cannot execute in <img src> / SVG <image> elements, and data: URLs are a legitimate, common use there. LoginFormTest and LoginOverlayTest already mock LoggerFactory to capture the existing "action attribute together with login listeners" warning. After merging Flow main, those tests started NPE-ing: Flow's UrlUtil.isSafeUrl debug-logs a fallback notice, going through LoggerFactory.getLogger(UrlUtil.class) which returned null inside the broad mock. The mock now uses Mockito.CALLS_REAL_METHODS so unrelated lookups fall through to the real factory; the explicit LoginForm/Overlay.class stubs still take precedence. Part of vaadin/flow#24539 --------- (cherry picked from commit 691149c) ---------

Changes in vaadin-combo-box-flow

• Breaking Changes:

  • ⧉ Update multi-select-combo-box to synchronize on change (CP: 25.1). PR:9686

    This PR cherry-picks changes from the original PR #9631 to branch 25.1. --- > ## Description > > Fixes #9611 > > With @Push and two push frames around a server-side setValue, MultiSelectComboBox could reset its value to empty because the selected-items-changed notification also fires for programmatic changes and gets echoed back as a spurious client value change. > > - Synchronized the value on the web component change event instead of selected-items-changed, so only genuine user gestures are treated as client changes > - Updated TestBench helpers to dispatch change (and deselectAll to use clear()) > - Added integration tests for the push scenario and user value commits > > > [!WARNING] > > Client-side changes to the web component selectedItems property no longer synchronize to the server unless a change event is dispatched. Server-side setValue and end-user interactions are unaffected. > > ## Type of change > > - Behavior altering fix > > --- > > 🤖 Generated with Claude Code

Changes in vaadin-grid-flow

• Fixes:

  • ⧉ Keep scroll position when setting item selectable provider (#9644). PR:9655

    This PR cherry-picks changes from the original PR #9644 to branch 25.1. --- #### Original PR description > This PR changes setItemSelectableProvider to use refreshViewport() instead of dataCommunicator.reset() to avoid resetting TreeGrid's scroll position and adds a corresponding test to TreeGridScrollPositionIT.

  • ⧉ Keep scroll position when toggling Grid enabled state (#9649). PR:9651

    This PR cherry-picks changes from the original PR #9649 to branch 25.1. --- #### Original PR description > This PR changes onEnabledStateChanged to use refreshViewport() instead of dataCommunicator.reset() to avoid resetting TreeGrid's scroll position and adds a corresponding test to TreeGridScrollPositionIT. >

Changes in vaadin-login-flow

• New Features:

  • ⧉ Validate navigation-related URL schemes (#9447) (CP: 25.1). PR:9708

    Mirror the Flow URL-scheme validation (vaadin/flow#24539) for the navigation, action and link sinks in flow-components. A javascript: (or other non-allow-listed) scheme on a value that the browser later treats as a link, form action or script source is a familiar XSS shape; rejecting it at the setter closes that path while leaving an explicit escape hatch for trusted, hard-coded URLs. Validating setters added across the affected components, each with a matching setUnsafe* variant that bypasses validation: - SideNavItem.setPath / BreadcrumbsItem.setPath — navigation link. - Credits.setHref — clickable Highcharts credits link. - AbstractLogin.setAction — the form action attribute the browser POSTs to on submit. - Exporting.setUrl — Highcharts posts SVG to this URL as a form action for export fallback. - Exporting.setLibURL — concatenated into <script src="…"> to load offline-export dependencies at runtime. SideNavItem constructor that takes a String path validates transitively via setPath; their Javadoc now documents @throws IllegalArgumentException and explicit constructor tests cover the behaviour. Safe schemes are configured through the safeUrlSchemes property and default to http, https, mailto, tel, ftp. Image, icon, SVG, Avatar, map tile and chart-resource URLs are intentionally not validated: javascript: cannot execute in <img src> / SVG <image> elements, and data: URLs are a legitimate, common use there. LoginFormTest and LoginOverlayTest already mock LoggerFactory to capture the existing "action attribute together with login listeners" warning. After merging Flow main, those tests started NPE-ing: Flow's UrlUtil.isSafeUrl debug-logs a fallback notice, going through LoggerFactory.getLogger(UrlUtil.class) which returned null inside the broad mock. The mock now uses Mockito.CALLS_REAL_METHODS so unrelated lookups fall through to the real factory; the explicit LoginForm/Overlay.class stubs still take precedence. Part of vaadin/flow#24539 --------- (cherry picked from commit 691149c) ---------

Changes in vaadin-side-nav-flow

• New Features:

  • ⧉ Validate navigation-related URL schemes (#9447) (CP: 25.1). PR:9708

    Mirror the Flow URL-scheme validation (vaadin/flow#24539) for the navigation, action and link sinks in flow-components. A javascript: (or other non-allow-listed) scheme on a value that the browser later treats as a link, form action or script source is a familiar XSS shape; rejecting it at the setter closes that path while leaving an explicit escape hatch for trusted, hard-coded URLs. Validating setters added across the affected components, each with a matching setUnsafe* variant that bypasses validation: - SideNavItem.setPath / BreadcrumbsItem.setPath — navigation link. - Credits.setHref — clickable Highcharts credits link. - AbstractLogin.setAction — the form action attribute the browser POSTs to on submit. - Exporting.setUrl — Highcharts posts SVG to this URL as a form action for export fallback. - Exporting.setLibURL — concatenated into <script src="…"> to load offline-export dependencies at runtime. SideNavItem constructor that takes a String path validates transitively via setPath; their Javadoc now documents @throws IllegalArgumentException and explicit constructor tests cover the behaviour. Safe schemes are configured through the safeUrlSchemes property and default to http, https, mailto, tel, ftp. Image, icon, SVG, Avatar, map tile and chart-resource URLs are intentionally not validated: javascript: cannot execute in <img src> / SVG <image> elements, and data: URLs are a legitimate, common use there. LoginFormTest and LoginOverlayTest already mock LoggerFactory to capture the existing "action attribute together with login listeners" warning. After merging Flow main, those tests started NPE-ing: Flow's UrlUtil.isSafeUrl debug-logs a fallback notice, going through LoggerFactory.getLogger(UrlUtil.class) which returned null inside the broad mock. The mock now uses Mockito.CALLS_REAL_METHODS so unrelated lookups fall through to the real factory; the explicit LoginForm/Overlay.class stubs still take precedence. Part of vaadin/flow#24539 --------- (cherry picked from commit 691149c) ---------

Changes in vaadin-spreadsheet-flow

• Fixes:

  • ⧉ Style spreadsheet overlays when nested in a shadow root (#9713) (CP: 25.1). PR:9716

    This PR cherry-picks changes from the original PR #9713 to branch 25.1. --- #### Original PR description > Since #9303, spreadsheet overlays (context menu, popup-button filters, cell comments, tooltips) live in a #spreadsheet-overlays container in the component's light DOM, styled by a global <style> in document.head. When <vaadin-spreadsheet> is nested in another element's shadow root — for example embedded as a web component, as in the docs filtering example — the container ends up inside that shadow tree, which the document-level stylesheet cannot cross, so the overlays render unstyled. > > To reproduce: open the docs "spreadsheet filtering" example (the spreadsheet is embedded as a web component) and open a column filter — the popup shows with no rounded corners, background, or shadow. > > On attach, also adopt the overlay stylesheet onto the container's own root (this._overlays.getRootNode()) when that root is a ShadowRoot, so the scoped #spreadsheet-overlays … rules apply inside the shadow tree. Top-level usage is unchanged: the root is the document, already covered by the existing document.head stylesheet. > > Follow-up to #9303 > > --- > > 🤖 Generated with Claude Code > > https://claude.ai/code/session_01QjNdPXWEUciMEXQe9hMgMt >

Compatibility

• This release use Web Components listed in Vaadin Platform 25.1.10
• Tested with Vaadin Flow version 25.1.13