Vaadin Flow 25.0.9

Changes since 25.0.8

All changes

New features

• BuildFrontend Incremental build (#23884)
  Commit · Pull request

  Add incremental build to the buildFrontend task. Closes #17354

Fixes

• Prevent stale JAR cache in Reflector under Maven daemon (mvnd) (#23863)
  Commit · Pull request

  Mirror the Gradle daemon fix (33fa374) in the Maven plugin's Reflector and ReflectorClassLoader/CombinedClassLoader: - Extract ReflectionsClassFinder.disableJarCaching() as a public utility so both plugins can reuse it. - Wrap jar: URLs in ReflectorClassLoader.getResource() and getResources() (flow-maven-plugin) and CombinedClassLoader (flow-dev-bundle-plugin) with useCaches(false) to prevent stale JarFileFactory entries across daemon builds. - Make Reflector implement Closeable with a close() method that releases the URLClassLoader file handles, and register a Cleaner action for best-effort GC cleanup of abandoned instances. - Close the temporary Reflector in FlowModeAbstractMojo.isHillaAvailable(MavenProject) via try-with-resources. Releated to #15458

• Prevent addon stylesheet links from being removed during CSS live reload (#23892) (CP: 25.0)
  Commit · Pull request · Issue

• Prevent stale JAR cache in ReflectionsClassFinder under Gradle daemon
  Commit · Pull request · Issue

  Close URLClassLoader on cleanup to release JAR file handles, and disable JVM-level JAR caching in getResource() by wrapping jar: URLs with a URLStreamHandler that sets useCaches(false). The Gradle daemon reuses JVMs across builds. When a sibling module's JAR is rewritten, two independent caching layers can hold stale file handles: 1. URLClassLoader internal cache (URLClassPath → JarLoader) 2. JarFileFactory static HashMap (populated via JarURLConnection) The URLClassLoader.close() call addresses layer 1, but layer 2 is JVM-global and independent of the class loader. Setting useCaches(false) on jar: URL connections prevents JarFileFactory from caching JarFile instances, matching the approach used by Spring's PathMatchingResourcePatternResolver (SPR-4639).

• Propagate forceInstantiation and recreateLayoutChain flags through forward/reroute (#23848) (CP: 25.1) (#23954) (CP: 25.0)
  Commit · Pull request

• Move thread start out of DevServerWatchDog constructor (#23898)
  Commit · Pull request

  Starting a thread in a constructor can expose a partially constructed object. Extract the thread start into a separate start() method that callers invoke after construction completes.

• Route with context path name (#23836)
  Commit · Pull request · Issue

  the same start as the context path from clearing context path out from the url when using react router.

• Move import statements to top in generated web component imports file (#23817) (CP: 25.0)
  Commit · Pull request

  This PR cherry-picks changes from the original PR #23817 to branch 25.0. --- #### Original PR description > AbstractUpdateImports.process() already reorders import lines to > the top for generatedFlowImports, but the same sorting was not > applied to generatedFlowWebComponentImports. This caused interleaved > import and non-import lines (e.g. injectGlobalWebcomponentCss() > calls mixed with import statements) in the web component output. > > Extract a reusable moveImportsToTop() method and apply it both in > process() for main imports and in mergeWebComponentOutputLines() > after merging and deduplicating the web component sources. > > Related to #23689 (comment)

• Improve npm resolution for non-windows (#23810)
  Commit · Pull request

  Adds another potential path to the npm resolver algorithm to make it compatible with node installation performed by frontend-maven-plugin

Vaadin Flow 23.6.10

Changes since 23.6.9

All changes

New features

• Implement production mode license verification in VaadinServlet
  Commit · Pull request

  Add runtime license verification for production mode. License check failure is only logged, it does not prevent the application from running.

Fixes

• Move thread start out of DevServerWatchDog constructor (#23898)
  Commit · Pull request

  Starting a thread in a constructor can expose a partially constructed object. Extract the thread start into a separate start() method that callers invoke after construction completes.

Vaadin Flow 25.1.0

Vaadin Flow 25.1 introduces production-ready reactive UI state management aka Signals API, along with the free browser-less testing framework (aka old commercial UI unit testing) and various other enhancements and bug-fixes.

Breaking Changes

Signal API Changes

• Enforce signal reads in computed signals and effects
  Commit · Pull request

  Signals now enforce reactive context requirements when reading values in computed signals and effects.

• Standardize signal callback interfaces
  Commit · Pull request

• Move component-bound effect to Signal public API
  Commit · Pull request

• Remove WritableSignal interface and simplify signal API
  Commit · Pull request

  Simplified the signal API by removing the WritableSignal interface and consolidating functionality.

• Rename Signal value()/value(T) to get()/set(T)
  Commit · Pull request

  Renamed signal methods for clarity and consistency with Java conventions.

• Restructure signals package for clarity between shared and local signals
  Commit · Pull request

• Merge signals module into flow-server
  Commit · Pull request

  The separate signals module has been merged into flow-server for better integration.

• Rename Binder.Binding.value() to valueSignal() and return signal
  Commit · Pull request

  Reworks Binding.value() to return a ValueSignal instead of the raw value.

• Rename getValidationStatus() to validationStatusSignal()
  Commit · Pull request

  Renames the Binder method to better reflect that it returns a Signal.

• Make localeSignal() read-only on VaadinSession and UI
  Pull request

  The locale signal is now read-only to prevent accidental modifications. Use setLocale() to change the locale.

• Split computed into separate cached and direct versions
  Pull request

  Signal.computed() now creates a cached computed signal by default. For non-cached behavior, use Signal.computedDirect().

Component and API Changes

• Make wrapperElement field private
  Commit · Pull request

  The wrapperElement field is now private and moved to UIInternals.

• Prevent lumo utility classes from being imported automatically
  Commit · Pull request · Issue

• Set proper value of isFromClient when using Focusable focus() and blur()
  Commit · Pull request

  The isFromClient flag now properly reflects the origin of focus/blur events.

• BeforeEvent target as extends Component
  Commit · Pull request

Browser Compatibility

• Update old browser check to verify compatibility with Vaadin 25+
  Commit · Pull request · Issue

  Updated browser compatibility check to ensure Popover API availability, required for Vaadin 25 web components.

New Features

Signal-Based Reactive Programming

• Use type-parameter-level nullability for Signal APIs
  Commit · Pull request

• Add custom equality checker support to ValueSignal
  Commit · Pull request

• Throw IllegalStateException when Signal.get() is called outside a reactive context
  Commit · Pull request

• Make shared signals use asynchronous signal trees
  Commit · Pull request

• Detect accidental sharing of ValueSignal with background threads
  Commit · Pull request

• Detect accidental sharing of local signals between sessions
  Commit · Pull request

• Automatic repeatable reads for shared signals while session is locked
  Commit · Pull request

• Make shared signals Serializable
  Commit · Pull request

• Add local ListSignal for per-entry reactive lists
  Commit · Pull request

• Add two-way computed signals via WritableSignal.map
  Commit · Pull request

• Remove FLOW_FULLSTACK_SIGNALS feature flag and enable signals by default
  Commit · Pull request

• Prevent serialization of shared signals
  Commit · Pull request

• Add equality checker to ListSignal
  Commit · Pull request

• Add moveTo method to ListSignal
  Commit · Pull request

• Add SignalBinding with rich BindingContext for bind methods
  Pull request

  Provides more context and control over signal bindings.

• Allow setProperty if signal write callback is present
  Pull request

  Enables two-way bindings with custom write logic.

• Add helpers to get all items from a list signal
  Pull request

  Convenience methods for working with list signal contents.

Component Signal Bindings

• Add signal bind methods for NativeDetails, HtmlObject, and HasStyle
  Commit · Pull request

• Add bindRequiredIndicatorVisible to HasValue / HasValueAndElement
  Commit · Pull request

• Add windowSizeSignal() to Page for reactive window size tracking
  Commit · Pull request

• Add localeSignal() to UI and VaadinSession
  Commit

• Add signal binding constructors and methods for HTML components
  Commit · Pull request

• Add bindChildren method to HasComponents mix-in
  Commit · Pull request

• Add Anchor signal-based constructors
  Commit · Pull request

• Add FieldSet::bindLegendText
  Commit · Pull request

• Add Html(signal) and bindHtmlContent(signal)
  Commit · Pull request

• Add bindWidth(Signal) and bindHeight(Signal)
  Commit · Pull request

• Add bindReadOnly(Signal)
  Commit · Pull request

• Add HasValidation::bindErrorMessage and bindInvalid
  Commit · Pull request

• Add HasPlaceholder::bindPlaceholder(Signal)
  Commit · Pull request

• Add HasHelper::bindHelperText
  [Commit](https:/...

Vaadin Flow 25.1.0-rc1

Changes since 25.1.0-beta3

All changes

New features

• BuildFrontend Incremental build (#23884)
  Commit · Pull request

  Add incremental build to the buildFrontend task. Closes #17354

• Retain local signal values during hotswap (#23854)
  Commit · Pull request · Issue

  Automatically transfer local signal values from old view fields to matching fields in the new view during hotswap refresh.

• Add local web components plugin to vite.generated.ts (#23793)
  Commit · Pull request

  Auto-detects a web-components/node_modules directory in the project root and redirects @polymer/* and @vaadin/* imports to it in dev mode. A custom folder can be specified through vite.config.ts using the overrideVaadinConfig mechanism.

Fixes

• Use targeted item refresh when signal-bound item value changes (#23913)
  Commit · Pull request · Issue

  • Add a two-argument refreshItem(T newItem, T oldItem) overload to DataProvider, DataView, and related classes, enabling targeted refresh when an item's identity changes (e.g., signal-bound items replaced with new instances) - DataRefreshEvent now carries an optional old item reference via getOldItem(), allowingDataCommunicator and KeyMapper to remap from the old identity to the new one instead of failing to find the item - HierarchicalDataCommunicator throws UnsupportedOperationException for identity-changing refreshes, deferring TreeGrid bindItems support to a future change

• Move thread start out of DevServerWatchDog constructor (#23898)
  Commit · Pull request

  Starting a thread in a constructor can expose a partially constructed object. Extract the thread start into a separate start() method that callers invoke after construction completes.

• Use String type for Style.bind return value (#23888)
  Commit · Pull request

  Change Style.bind(String, Signal<String>) return type from SignalBinding<?> to SignalBinding<String> since the method always accepts a Signal<String> and we always know the value type is String. This provides better type safety and eliminates the need for casts when using the binding's onChange callbacks.

• Route with context path name (#23836)
  Commit · Pull request · Issue

  the same start as the context path from clearing context path out from the url when using react router.

Vaadin Flow 23.7.0-beta2

Changes since 23.7.0-beta1

All changes

New features

• Implement production mode license verification in VaadinServlet (#23864)
  Commit · Pull request

  Add runtime license verification for production mode. License check failure is only logged, it does not prevent the application from running.

Fixes

• Move thread start out of DevServerWatchDog constructor (#23898)
  Commit · Pull request

  Starting a thread in a constructor can expose a partially constructed object. Extract the thread start into a separate start() method that callers invoke after construction completes.

• Set required Java and Maven versions in flow-maven-plugin
  Commit · Pull request

  Prevents potential issues with Maven versions >= 3.9.12 if a Java version newer than the supported one is used to package the Maven plugin.

Vaadin Flow 2.13.3

Changes since 2.13.2

All changes

New features

• Implement production mode license verification in VaadinServletService
  Commit · Pull request

  Add runtime license verification for production mode. License check failure is only logged, it does not prevent the application from running.

Vaadin Flow 24.10.0

Changes since 24.10.0-beta1

All changes

Fixes

• Move thread start out of DevServerWatchDog constructor (#23898)
  Commit · Pull request

  Starting a thread in a constructor can expose a partially constructed object. Extract the thread start into a separate start() method that callers invoke after construction completes.

• Route with context path name (#23836)
  Commit · Pull request · Issue

  the same start as the context path from clearing context path out from the url when using react router.

Vaadin Flow 25.1.0-beta3

Changes since 25.1.0-beta2

All changes

Breaking changes

• Make localeSignal() read-only on VaadinSession and UI (#23828)
  Commit · Pull request

  Return Signal instead of SharedValueSignal/ValueSignal from localeSignal() so that all locale changes go through setLocale(), which handles UI propagation and LocaleChangeObserver notification. Add javadoc showing two-way binding pattern with bindValue and setLocale. Add tests for bindValue-based locale switching, UI locale independence from session, and session setLocale with per-UI override.

• Split computed into separate cached and direct versions (#23822)
  Commit · Pull request

  Previously, the computed method was just one out of many ways of creating a computed signal with the distinction that this computed signal was also caching. This made it difficult to understand when to use the method. computed signal and introducing a separate cached method that creates a cached signal out of any other signal. signals

New features

• Apply ElementEffect once when created (#23824)
  Commit · Pull request · Issue

  ElementEffect is executed immediately once when created. This affects all Signal.effect calls with an owner component. Immediate execution ensures that exceptions can be thrown eagerly when e.g. bindText(signal) is called, not later when component is attached.

• Throw binding exception if setItems is called while an active signal binding (#23807)
  Commit · Pull request · Issue

• Add bindItems to HasDataProvider components (#23761)
  Commit · Pull request

Fixes

• Skip ElementEffect callback on reattach when no signals changed (#23771)
  Commit · Pull request · Issue

  Add passivate/activate lifecycle to Effect so that ElementEffect can preserve tracked Usage instances across detach/attach cycles. On reattach, activate checks whether any dependency has changed since passivation: if so, the callback re-runs with isInitialRun=true; if not, only the dependency listeners are re-registered without invoking the callback, avoiding redundant work and confusing double invocations.

• Allow local signal reads in computed callbacks triggered from transaction commit (#23791)
  Commit · Pull request · Issue

  During the StagedTransaction commit phase, listener callbacks that re-evaluate computed signals could not read local signals because inExplicitTransaction() still returned true. The transaction is no longer staging commands at that point, so local signal access is safe.

• Move import statements to top in generated web component imports file (#23817)
  Commit · Pull request

  AbstractUpdateImports.process() already reorders import lines to the top for generatedFlowImports, but the same sorting was not applied to generatedFlowWebComponentImports. This caused interleaved import and non-import lines (e.g. injectGlobalWebcomponentCss() calls mixed with import statements) in the web component output. Extract a reusable moveImportsToTop() method and apply it both in process() for main imports and in mergeWebComponentOutputLines() after merging and deduplicating the web component sources. Related to #23689 (comment)

• Improve npm resolution for non-windows (#23810)
  Commit · Pull request

  Adds another potential path to the npm resolver algorithm to make it compatible with node installation performed by frontend-maven-plugin

• Detect router-link attribute in ancestor elements during click navigation (#23786)
  Commit · Pull request

  When a nested element (e.g., Button) inside a RouterLink is clicked, the navigation trigger was incorrectly reported as CLIENT_SIDE because only the direct click target was checked for the router-link attribute. Traverse the composed path instead so any ancestor with router-link is correctly identified as a ROUTER_LINK trigger.

Tests

• Migrate flow-polymer-template tests to JUnit 6 (#23625)
  Commit · Pull request

• Migrate flow-build-tools tests to JUnit 5 (#23623)
  Commit · Pull request

• Migrate flow-data tests to JUnit 5 (#23599)
  Commit · Pull request

  Convert 71 test files from JUnit 4 to JUnit 5: - Replace JUnit 4 imports with JUnit 5 equivalents - Before/After -> BeforeEach/AfterEach - Test(expected=X.class) -> assertThrows(X.class, ...) - ExpectedException Rule -> assertThrows + message assertions - Assert.xxx() -> static imports from Assertions - Message-first assertions reordered to message-last - RunWith(Parameterized.class) -> ParameterizedTest + ValueSource for DataCommunicatorTest and DataCommunicatorAsyncTest - Visibility adjustments for cross-package inheritance

• Migrate vaadin-dev-server tests to JUnit 6 (#23622)
  Commit · Pull request

Vaadin Flow 24.10.0-beta1

Changes since 24.10.0-alpha2

All changes

Fixes

• Detect router-link attribute in ancestor elements during click navigation (#23786)
  Commit · Pull request

  When a nested element (e.g., Button) inside a RouterLink is clicked, the navigation trigger was incorrectly reported as CLIENT_SIDE because only the direct click target was checked for the router-link attribute. Traverse the composed path instead so any ancestor with router-link is correctly identified as a ROUTER_LINK trigger.

• Log instead of throwing (#23692)
  Commit · Pull request · Issue

  Log instead of throwing when node_modules removal fails in cleanUp.

• Clamp effectiveRequested range in DataCommunicator to prevent IndexOutOfBoundsException (#23672)
  Commit · Pull request · Issue

  When a data provider returns fewer items than its size() reports (e.g. items deleted between the count and fetch queries), getJsonItems() would crash with an IndexOutOfBoundsException. Clamp effectiveRequested to match the actual number of fetched items before processing changes.

• Use raw request URI for baseHref calculation to support encoded slashes (#23569)
  Commit · Pull request · Issue

  The previous fix for encoded slashes (%2F) in wildcard route parameters (commit b0c121b) set urlPathHelper.setUrlDecode(false) in ForwardingRequestWrapper, which made getPathInfo() return percent-encoded paths for all requests. This broke static resource serving for files with spaces in their names and potentially affected other getPathInfo() consumers like DAUUtils. Instead of disabling URL decoding globally, fix the actual site where the raw path matters: BootstrapHandlerHelper.getServiceUrl(). This method uses getCancelingRelativePath() to count path segments for the baseHref, which must use the raw URI so that %2F is not mistaken for a real path separator. The fix computes the raw path info by stripping the context path and servlet path from the request URI, preserving the original encoding. This allows reverting setUrlDecode(false) so that getPathInfo() returns properly decoded paths for all consumers.

Vaadin Flow 25.0.8

Changes since 25.0.7

All changes

Fixes

• Detect router-link attribute in ancestor elements during click navigation (#23786)
  Commit · Pull request

  When a nested element (e.g., Button) inside a RouterLink is clicked, the navigation trigger was incorrectly reported as CLIENT_SIDE because only the direct click target was checked for the router-link attribute. Traverse the composed path instead so any ancestor with router-link is correctly identified as a ROUTER_LINK trigger.

• Make flattened TreeDataProvider consider entire hierarchy when filtering (#23691)
  Commit · Pull request

  When filtering in FLATTENED hierarchy format, ancestors were not shown if a filter matched a descendant that was not expanded. Now the provider recurses into collapsed subtrees to check for matching descendants, ensuring ancestors are included in the result even when the matching descendant is not expanded.

• Log instead of throwing (#23692)
  Commit · Pull request · Issue

  Log instead of throwing when node_modules removal fails in cleanUp.

• Clamp effectiveRequested range in DataCommunicator to prevent IndexOutOfBoundsException (#23672)
  Commit · Pull request · Issue

  When a data provider returns fewer items than its size() reports (e.g. items deleted between the count and fetch queries), getJsonItems() would crash with an IndexOutOfBoundsException. Clamp effectiveRequested to match the actual number of fetched items before processing changes.

Tests

• Suppress duplicate WEB-INF/lib JAR scan warnings in Jetty (#23740) (CP: 25.1) (#23756)
  Commit · Pull request