Vaadin Flow 25.0.15

Changes since 25.0.14

All changes

Unmaintained version

An unmaintained message is shown when application starts

New features

• Validate URL schemes in Anchor, IFrame and Page#open (CP: 25.0)
  Commit · Pull request

  branch 25.1, and also disables the validation by default. The defaults when "safeUrlSchemes" configuration is missing is adjusted, so that URL validation is disabled by default, and all URLs are considered safe. This avoids unexpected behavior changes for existing users of Flow 25.1 and below. The URL scheme validation feature could be enabled with configuration when necessary. (cherry picked from commit 28e55a3)

• Add configurable max request body size (#24866) (CP: 25.0)
  Commit · Pull request

  Add maxRequestBodySize property to limit UIDL/RPC and push request body size (-1 disables); the default is 10 MB; does not affect uploads.

Fixes

• Write frontend build files into build dir when it is outside project dir (#24805) (CP: 25.0)
  Commit · Pull request · Issue

  When the build dir is relocated outside the project dir, vaadinPrepareFrontend wrote vaadin-dev-server-settings.json and the dev-bundle output paths under the source tree. buildFolder() is now always relative to projectDir.

• Unpack prod bundle on Windows mapped network drives (#24560) (CP: 25.0)
  Commit · Pull request · Issue

  The Zip Slip guard in CompressUtil.newFile canonicalized the target dir and the not-yet-created entry separately; on mapped/subst drives getCanonicalPath() returns inconsistent forms, so legitimate entries were rejected. Canonicalize the destination once and resolve entries lexically, checking containment with Path.startsWith.