Skip to content

Vaadin Flow 24.10.8

Choose a tag to compare

View all tags
@vaadin-bot vaadin-bot released this 09 Jul 13:04
24.10.8
7a2e45e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Changes since 24.10.7

All changes

Breaking changes

  • Add runtime license checking (#24652) (CP:24.10)
    Commit · Pull request

    Verify the Vaadin license at runtime in VaadinServlet and at build time in the frontend build tool. Development mode fails on an invalid license; production mode only logs the failure so the app keeps running. Update OSGi bundle licenses to the commercial license terms. Force-off commercial banner in build plugins. Disable pre-trial licensing so trials can't be started or honored.

New features

  • Validate URL schemes in Anchor, IFrame and Page#open (CP: 24.10)
    Commit · Pull request

    branch 25.1, and also disables the validation by default. The defaults when "safeUrlSchemes" configuration is missing is adjusted, so that URL validation is disabled by default, and all URLs are considered safe. This avoids unexpected behavior changes for existing users of Flow 25.1 and below. The URL scheme validation feature could be enabled with configuration when necessary. (cherry picked from commit 28e55a3) (cherry picked from commit 51048d1)

  • Add configurable max request body size (#24866) (CP: 24.10)
    Commit · Pull request

    Add maxRequestBodySize property to limit UIDL/RPC and push request body size (-1 disables); the default is 10 MB; does not affect uploads.

Fixes

  • Clean up countInstances (#24890) (CP: 24.10)
    Commit · Pull request · Issue

    Make count instances more effective by not using split that compiles a pattern and generates an array for each invocation.

  • Allow UI polling while a modal component is open (cp 24.10) (#24834)
    Commit · Pull request · Issue

    Poll listeners registered through PollNotifier.addPollListener are now registered with DomListenerRegistration::allowInert, so they continue to fire even when a modal component makes the UI inert.

  • Write frontend build files into build dir when it is outside project dir (#24805) (CP: 25.0) (#24821) (CP: 24.10)
    Commit · Pull request

    When the build dir is relocated outside the project dir, vaadinPrepareFrontend wrote vaadin-dev-server-settings.json and the dev-bundle output paths under the source tree. buildFolder() is now always relative to projectDir.

  • Unpack prod bundle on Windows mapped network drives (CP: 24.10)
    Commit · Pull request · Issue

    The Zip Slip guard in CompressUtil.newFile canonicalized the target dir and the not-yet-created entry separately; on mapped/subst drives getCanonicalPath() returns inconsistent forms, so legitimate entries were rejected. Canonicalize the destination once and resolve entries lexically, checking containment with Path.startsWith. Cherry-pick of #24560

Assets 2
Loading