Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

build(deps): bump cia.project.versions.vaadin from 8.14.4 to 8.27.7 #7253

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

build(deps): bump cia.project.versions.vaadin from 8.14.4 to 8.27.7 #7253

wants to merge 1 commit into from
+2 −2

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Mar 14, 2025 •
edited
Loading

Bumps cia.project.versions.vaadin from 8.14.4 to 8.27.7.
Updates com.vaadin:vaadin-themes from 8.14.4 to 8.27.7

Release notes

Sourced from com.vaadin:vaadin-themes's releases.

Vaadin Framework 8.27.7 is an Extended Maintenance patch release with the following changes:

  • Major update to Vaadin Maven Plugin to avoid depending on obsolete packages with open CVEs. While none of the affected packages have presented an actual risk to users due to how they were used within the Vaadin build process, they were being flagged as security issues, and as such were undesireable to have in the dependency list.
  • Fixed an issue where the SessionDestroyListener would receive a null WrappedSession instance and thus the HTTP session could not be explicitly invalidated. This is a backport from Flow. See Flow issue #6959.
  • Fixed Grid's sorting indicator visibility when using the Runo theme.

Vaadin Framework 8.27.6 is an Extended Maintenance patch release with the following changes:

  • Fixed an issue with license checking related to pro components (Charts, Spreadsheet, etc.). The widgetset compilation process was incorrectly checking for an old form product key in certain edge cases, and would cause the build to fail when the key could not be found.

Vaadin Framework 8.27.5 is an Extended Maintenance patch release with the following changes:

  • Fixed an issue where exceptions might not be properly processed as a component is being detached. Exceptions are now caught both when handling the detach event and when calling detach manually. The detach event now fires reliably when the connector tracker is updated even when an exception occurs during detach.

  • Altered handling of the eager UI cleanup feature to not use the beforeunload event as a workaround on Safari. Safari will instead use the default pagehide event to listen for imminent UI disposal. Using the beforeunload event caused an issue where resource links would erroneously be treated as navigation away from the current UI, causing the UI to be invalidated.

    Firefox and Internet Explorer still use the beforeunload event to signal cleanup for the UI.

Vaadin Framework 8.27.4 is an Extended Maintenance patch release with the following changes:

  • Added feature to automatically resume Push connection when a client unexpectedly loses communication with the server. Pending Push messages are now cached on the server until the session times out or connectivity is restored for a better user experience.

    This is a backport of Flow pull request #20283.

  • Fixed Framework issue #11699. Previously, calling UI.getCurrent() inside a UI.access() callback could return a random UI instance under certain circumastances. CurrentInstance is now properly cleared before the current session reference is set before running any pending access callbacks.

    This is a backport of Flow pull request #20255.

  • Moved (some) blocking calls outside of session lock. Fixes a potential deadlock issue.

    This is a backport of Flow pull request #20475.

  • Specified pointer-events: auto as default for overlay containers in the Valo theme. This fixes an edge case where users were unable to select values from V8 comboboxes placed inside a V14 Dialog component when running under the Vaadin Multi Platform Runtime.

Vaadin Framework 8.27.3 is an Extended Maintenance patch release with the following changes:

  • Added an option to disable Push disconnect on refresh. This is a special-case workaround. Normally when UI is refreshed when @PreserveOnRefresh is used, UI checks if an associated Push connection is active and disconnects it in order to avoid a race condition. This functionality was originally introduced to fix Framework [issue #12577](vaadin/framework#12577). However, with some containers such as Payara this can have unwanted side effects, such as CDI reporting that no session scoped context is available after refresh.

    This feature can now be toggled off using the protected UI method setDisconnectPushOnRefresh(false).

  • Updated Atmosphere to detect Payara alongside Glassfish and enable async support for it. This is a workaround for a bug/feature that exists both in Glassfish and Payara that provides a null ServerContainer reference that would otherwise cause initialization to fail.

Vaadin Framework 8.27.2 is an Extended Maintenance patch release with the following changes:

  • Included the vaadin-portlet package in the Vaadin 8 BOM. As a result, the version of the vaadin-portlet package does not need to be defined if the vaadin-bom artifact is imported. This definition was originally left out due to an oversight and the omission was discovered during internal manual testing.

  • Improved initialization of the eager unload feature when using Firefox, Safari or any iOS browser.

    PLEASE NOTE: this feature will make the "are you sure you want to leave" confirmation not function as intended, as these browsers need to hook onto the beforeunload event. This will cause the session to become invalidated and will require reloading the page even if the user decides to stay. If you need to disable the eager unload functionality for Safari/Firefox/iOS in order to display the confirmation, directly assign a handler to window.onbeforeunload with a JavaScript call.

Vaadin Framework 8.27.1 is an Extended Maintenance hotfix release with the following changes:

... (truncated)

Changelog

Sourced from com.vaadin:vaadin-themes's changelog.

Vaadin 8.27.7

  • Major update to Vaadin Maven Plugin to avoid depending on obsolete packages with open CVEs. While none of the affected packages have presented an actual risk to users due to how they were used within the Vaadin build process, they were being flagged as security issues, and as such were undesireable to have in the dependency list.

  • Fixed an issue where the SessionDestroyListener would receive a null WrappedSession instance and thus the HTTP session could not be explicitly invalidated. This is a backport from Flow. See Flow issue #6959.

  • Fixed Grid's sorting indicator visibility when using the Runo theme.

Vaadin 8.27.6

  • Fixed an issue with license checking related to pro components (Charts, Spreadsheet, etc.). The widgetset compilation process was incorrectly checking for an old form product key in certain edge cases, and would cause the build to fail when the key could not be found.

Vaadin 8.27.5

  • Fixed an issue where exceptions might not be properly processed as a component is being detached. Exceptions are now caught both when handling the detach event and when calling detach manually. The detach event now fires reliably when the connector tracker is updated even when an exception occurs during detach.

  • Altered handling of the eager UI cleanup feature to not use the beforeunload event as a workaround on Safari. Safari will instead use the default pagehide event to listen for imminent UI disposal. Using the beforeunload event caused an issue where resource links would erroneously be treated as navigation away from the current UI, causing the UI to be invalidated.

    Firefox and Internet Explorer still use the beforeunload event to signal cleanup for the UI.

Vaadin 8.27.4

  • Added feature to automatically resume Push connection when a client unexpectedly loses communication with the server. Pending Push messages are now cached on the server until the session times out or connectivity is restored for a better user experience.

    This is a backport of Flow pull request #20283.

  • Fixed Framework issue #11699. Previously, calling UI.getCurrent() inside a UI.access() callback could return a random UI instance under certain circumastances. CurrentInstance is now properly cleared before the current session reference is set before running any pending access callbacks.

    This is a backport of Flow pull request #20255.

  • Moved (some) blocking calls outside of session lock. Fixes a potential deadlock issue.

    This is a backport of Flow pull request #20475.

  • Specified pointer-events: auto as default for overlay containers in the Valo theme. This fixes an edge case where users were unable to select values from V8 comboboxes placed inside a V14 Dialog component when running under the Vaadin Multi Platform Runtime.

Vaadin 8.27.3

  • Added an option to disable Push disconnect on refresh. This is a special-case workaround. Normally when UI is refreshed when @PreserveOnRefresh is used, UI checks if an associated Push connection is active and disconnects it in order to avoid a race condition. This functionality was originally introduced to fix Framework [issue #12577](vaadin/framework#12577). However, with some containers such as Payara this can have unwanted side effects, such as CDI reporting that no session scoped context is available after refresh.

    This feature can now be toggled off using the protected UI method setDisconnectPushOnRefresh(false).

  • Updated Atmosphere to detect Payara alongside Glassfish and enable async support for it. This is a workaround for a bug/feature that exists both in Glassfish and Payara that provides a null ServerContainer reference that would otherwise cause initialization to fail.

Vaadin 8.27.2

  • Included the vaadin-portlet package in the Vaadin 8 BOM. As a result, the version of the vaadin-portlet package does not need to be defined if the vaadin-bom artifact is imported. This definition was originally left out due to an oversight and the omission was discovered during internal manual testing.

  • Improved initialization of the eager unload feature when using Firefox, Safari or any iOS browser.

    PLEASE NOTE: this feature will make the "are you sure you want to leave" confirmation not function as intended, as these browsers need to hook onto the beforeunload event. This will cause the session to become invalidated and will require reloading the page even if the user decides to stay. If you need to disable the eager unload functionality for Safari/Firefox/iOS in order to display the confirmation, directly assign a handler to window.onbeforeunload with a JavaScript call.

... (truncated)

Commits

Updates com.vaadin:vaadin-compatibility-server from 8.14.4 to 8.27.7

Release notes

Sourced from com.vaadin:vaadin-compatibility-server's releases.

Vaadin Framework 8.27.7 is an Extended Maintenance patch release with the following changes:

  • Major update to Vaadin Maven Plugin to avoid depending on obsolete packages with open CVEs. While none of the affected packages have presented an actual risk to users due to how they were used within the Vaadin build process, they were being flagged as security issues, and as such were undesireable to have in the dependency list.
  • Fixed an issue where the SessionDestroyListener would receive a null WrappedSession instance and thus the HTTP session could not be explicitly invalidated. This is a backport from Flow. See Flow issue #6959.
  • Fixed Grid's sorting indicator visibility when using the Runo theme.

Vaadin Framework 8.27.6 is an Extended Maintenance patch release with the following changes:

  • Fixed an issue with license checking related to pro components (Charts, Spreadsheet, etc.). The widgetset compilation process was incorrectly checking for an old form product key in certain edge cases, and would cause the build to fail when the key could not be found.

Vaadin Framework 8.27.5 is an Extended Maintenance patch release with the following changes:

  • Fixed an issue where exceptions might not be properly processed as a component is being detached. Exceptions are now caught both when handling the detach event and when calling detach manually. The detach event now fires reliably when the connector tracker is updated even when an exception occurs during detach.

  • Altered handling of the eager UI cleanup feature to not use the beforeunload event as a workaround on Safari. Safari will instead use the default pagehide event to listen for imminent UI disposal. Using the beforeunload event caused an issue where resource links would erroneously be treated as navigation away from the current UI, causing the UI to be invalidated.

    Firefox and Internet Explorer still use the beforeunload event to signal cleanup for the UI.

Vaadin Framework 8.27.4 is an Extended Maintenance patch release with the following changes:

  • Added feature to automatically resume Push connection when a client unexpectedly loses communication with the server. Pending Push messages are now cached on the server until the session times out or connectivity is restored for a better user experience.

    This is a backport of Flow pull request #20283.

  • Fixed Framework issue #11699. Previously, calling UI.getCurrent() inside a UI.access() callback could return a random UI instance under certain circumastances. CurrentInstance is now properly cleared before the current session reference is set before running any pending access callbacks.

    This is a backport of Flow pull request #20255.

  • Moved (some) blocking calls outside of session lock. Fixes a potential deadlock issue.

    This is a backport of Flow pull request #20475.

  • Specified pointer-events: auto as default for overlay containers in the Valo theme. This fixes an edge case where users were unable to select values from V8 comboboxes placed inside a V14 Dialog component when running under the Vaadin Multi Platform Runtime.

Vaadin Framework 8.27.3 is an Extended Maintenance patch release with the following changes:

  • Added an option to disable Push disconnect on refresh. This is a special-case workaround. Normally when UI is refreshed when @PreserveOnRefresh is used, UI checks if an associated Push connection is active and disconnects it in order to avoid a race condition. This functionality was originally introduced to fix Framework [issue #12577](vaadin/framework#12577). However, with some containers such as Payara this can have unwanted side effects, such as CDI reporting that no session scoped context is available after refresh.

    This feature can now be toggled off using the protected UI method setDisconnectPushOnRefresh(false).

  • Updated Atmosphere to detect Payara alongside Glassfish and enable async support for it. This is a workaround for a bug/feature that exists both in Glassfish and Payara that provides a null ServerContainer reference that would otherwise cause initialization to fail.

Vaadin Framework 8.27.2 is an Extended Maintenance patch release with the following changes:

  • Included the vaadin-portlet package in the Vaadin 8 BOM. As a result, the version of the vaadin-portlet package does not need to be defined if the vaadin-bom artifact is imported. This definition was originally left out due to an oversight and the omission was discovered during internal manual testing.

  • Improved initialization of the eager unload feature when using Firefox, Safari or any iOS browser.

    PLEASE NOTE: this feature will make the "are you sure you want to leave" confirmation not function as intended, as these browsers need to hook onto the beforeunload event. This will cause the session to become invalidated and will require reloading the page even if the user decides to stay. If you need to disable the eager unload functionality for Safari/Firefox/iOS in order to display the confirmation, directly assign a handler to window.onbeforeunload with a JavaScript call.

Vaadin Framework 8.27.1 is an Extended Maintenance hotfix release with the following changes:

... (truncated)

Changelog

Sourced from com.vaadin:vaadin-compatibility-server's changelog.

Vaadin 8.27.7

  • Major update to Vaadin Maven Plugin to avoid depending on obsolete packages with open CVEs. While none of the affected packages have presented an actual risk to users due to how they were used within the Vaadin build process, they were being flagged as security issues, and as such were undesireable to have in the dependency list.

  • Fixed an issue where the SessionDestroyListener would receive a null WrappedSession instance and thus the HTTP session could not be explicitly invalidated. This is a backport from Flow. See Flow issue #6959.

  • Fixed Grid's sorting indicator visibility when using the Runo theme.

Vaadin 8.27.6

  • Fixed an issue with license checking related to pro components (Charts, Spreadsheet, etc.). The widgetset compilation process was incorrectly checking for an old form product key in certain edge cases, and would cause the build to fail when the key could not be found.

Vaadin 8.27.5

  • Fixed an issue where exceptions might not be properly processed as a component is being detached. Exceptions are now caught both when handling the detach event and when calling detach manually. The detach event now fires reliably when the connector tracker is updated even when an exception occurs during detach.

  • Altered handling of the eager UI cleanup feature to not use the beforeunload event as a workaround on Safari. Safari will instead use the default pagehide event to listen for imminent UI disposal. Using the beforeunload event caused an issue where resource links would erroneously be treated as navigation away from the current UI, causing the UI to be invalidated.

    Firefox and Internet Explorer still use the beforeunload event to signal cleanup for the UI.

Vaadin 8.27.4

  • Added feature to automatically resume Push connection when a client unexpectedly loses communication with the server. Pending Push messages are now cached on the server until the session times out or connectivity is restored for a better user experience.

    This is a backport of Flow pull request #20283.

  • Fixed Framework issue #11699. Previously, calling UI.getCurrent() inside a UI.access() callback could return a random UI instance under certain circumastances. CurrentInstance is now properly cleared before the current session reference is set before running any pending access callbacks.

    This is a backport of Flow pull request #20255.

  • Moved (some) blocking calls outside of session lock. Fixes a potential deadlock issue.

    This is a backport of Flow pull request #20475.

  • Specified pointer-events: auto as default for overlay containers in the Valo theme. This fixes an edge case where users were unable to select values from V8 comboboxes placed inside a V14 Dialog component when running under the Vaadin Multi Platform Runtime.

Vaadin 8.27.3

  • Added an option to disable Push disconnect on refresh. This is a special-case workaround. Normally when UI is refreshed when @PreserveOnRefresh is used, UI checks if an associated Push connection is active and disconnects it in order to avoid a race condition. This functionality was originally introduced to fix Framework [issue #12577](vaadin/framework#12577). However, with some containers such as Payara this can have unwanted side effects, such as CDI reporting that no session scoped context is available after refresh.

    This feature can now be toggled off using the protected UI method setDisconnectPushOnRefresh(false).

  • Updated Atmosphere to detect Payara alongside Glassfish and enable async support for it. This is a workaround for a bug/feature that exists both in Glassfish and Payara that provides a null ServerContainer reference that would otherwise cause initialization to fail.

Vaadin 8.27.2

  • Included the vaadin-portlet package in the Vaadin 8 BOM. As a result, the version of the vaadin-portlet package does not need to be defined if the vaadin-bom artifact is imported. This definition was originally left out due to an oversight and the omission was discovered during internal manual testing.

  • Improved initialization of the eager unload feature when using Firefox, Safari or any iOS browser.

    PLEASE NOTE: this feature will make the "are you sure you want to leave" confirmation not function as intended, as these browsers need to hook onto the beforeunload event. This will cause the session to become invalidated and will require reloading the page even if the user decides to stay. If you need to disable the eager unload functionality for Safari/Firefox/iOS in order to display the confirmation, directly assign a handler to window.onbeforeunload with a JavaScript call.

... (truncated)

Commits

Updates com.vaadin:vaadin-maven-plugin from 8.14.3 to 8.27.7

Commits
  • ac06514 fix: Revert vaadin-client dependency version to LATEST (#160)
  • 23ade79 feat: Update project to remove references to vulnerable libraries (#156)
  • beb27e5 chore: run Spotless formatting on the main POM (#159)
  • 88494b1 chore: Update POM to new parent model, add formatting and flattener (#158)
  • ee8033b chore: Update license checker to 1.13.3 (#151)
  • 26c165e chore: Update jdom dependency for security (#147)
  • ebc6fa7 fix: get framework version from runtime vaadin-server variant (#144)
  • 4537b70 chore: Update plexus-archiver version (#142)
  • cc38257 fix: Allow both development and release license types at compile time (#140)
  • 6172614 Always check license when compiling, use new license checker (#136)
  • See full diff in compare view

Updates com.vaadin:vaadin-server from 8.14.4 to 8.27.7

Release notes

Sourced from com.vaadin:vaadin-server's releases.

Vaadin Framework 8.27.7 is an Extended Maintenance patch release with the following changes:

  • Major update to Vaadin Maven Plugin to avoid depending on obsolete packages with open CVEs. While none of the affected packages have presented an actual risk to users due to how they were used within the Vaadin build process, they were being flagged as security issues, and as such were undesireable to have in the dependency list.
  • Fixed an issue where the SessionDestroyListener would receive a null WrappedSession instance and thus the HTTP session could not be explicitly invalidated. This is a backport from Flow. See Flow issue #6959.
  • Fixed Grid's sorting indicator visibility when using the Runo theme.

Vaadin Framework 8.27.6 is an Extended Maintenance patch release with the following changes:

  • Fixed an issue with license checking related to pro components (Charts, Spreadsheet, etc.). The widgetset compilation process was incorrectly checking for an old form product key in certain edge cases, and would cause the build to fail when the key could not be found.

Vaadin Framework 8.27.5 is an Extended Maintenance patch release with the following changes:

  • Fixed an issue where exceptions might not be properly processed as a component is being detached. Exceptions are now caught both when handling the detach event and when calling detach manually. The detach event now fires reliably when the connector tracker is updated even when an exception occurs during detach.

  • Altered handling of the eager UI cleanup feature to not use the beforeunload event as a workaround on Safari. Safari will instead use the default pagehide event to listen for imminent UI disposal. Using the beforeunload event caused an issue where resource links would erroneously be treated as navigation away from the current UI, causing the UI to be invalidated.

    Firefox and Internet Explorer still use the beforeunload event to signal cleanup for the UI.

Vaadin Framework 8.27.4 is an Extended Maintenance patch release with the following changes:

  • Added feature to automatically resume Push connection when a client unexpectedly loses communication with the server. Pending Push messages are now cached on the server until the session times out or connectivity is restored for a better user experience.

    This is a backport of Flow pull request #20283.

  • Fixed Framework issue #11699. Previously, calling UI.getCurrent() inside a UI.access() callback could return a random UI instance under certain circumastances. CurrentInstance is now properly cleared before the current session reference is set before running any pending access callbacks.

    This is a backport of Flow pull request #20255.

  • Moved (some) blocking calls outside of session lock. Fixes a potential deadlock issue.

    This is a backport of Flow pull request #20475.

  • Specified pointer-events: auto as default for overlay containers in the Valo theme. This fixes an edge case where users were unable to select values from V8 comboboxes placed inside a V14 Dialog component when running under the Vaadin Multi Platform Runtime.

Vaadin Framework 8.27.3 is an Extended Maintenance patch release with the following changes:

  • Added an option to disable Push disconnect on refresh. This is a special-case workaround. Normally when UI is refreshed when @PreserveOnRefresh is used, UI checks if an associated Push connection is active and disconnects it in order to avoid a race condition. This functionality was originally introduced to fix Framework [issue #12577](vaadin/framework#12577). However, with some containers such as Payara this can have unwanted side effects, such as CDI reporting that no session scoped context is available after refresh.

    This feature can now be toggled off using the protected UI method setDisconnectPushOnRefresh(false).

  • Updated Atmosphere to detect Payara alongside Glassfish and enable async support for it. This is a workaround for a bug/feature that exists both in Glassfish and Payara that provides a null ServerContainer reference that would otherwise cause initialization to fail.

Vaadin Framework 8.27.2 is an Extended Maintenance patch release with the following changes:

  • Included the vaadin-portlet package in the Vaadin 8 BOM. As a result, the version of the vaadin-portlet package does not need to be defined if the vaadin-bom artifact is imported. This definition was originally left out due to an oversight and the omission was discovered during internal manual testing.

  • Improved initialization of the eager unload feature when using Firefox, Safari or any iOS browser.

    PLEASE NOTE: this feature will make the "are you sure you want to leave" confirmation not function as intended, as these browsers need to hook onto the beforeunload event. This will cause the session to become invalidated and will require reloading the page even if the user decides to stay. If you need to disable the eager unload functionality for Safari/Firefox/iOS in order to display the confirmation, directly assign a handler to window.onbeforeunload with a JavaScript call.

Vaadin Framework 8.27.1 is an Extended Maintenance hotfix release with the following changes:

... (truncated)

Changelog

Sourced from com.vaadin:vaadin-server's changelog.

Vaadin 8.27.7

  • Major update to Vaadin Maven Plugin to avoid depending on obsolete packages with open CVEs. While none of the affected packages have presented an actual risk to users due to how they were used within the Vaadin build process, they were being flagged as security issues, and as such were undesireable to have in the dependency list.

  • Fixed an issue where the SessionDestroyListener would receive a null WrappedSession instance and thus the HTTP session could not be explicitly invalidated. This is a backport from Flow. See Flow issue #6959.

  • Fixed Grid's sorting indicator visibility when using the Runo theme.

Vaadin 8.27.6

  • Fixed an issue with license checking related to pro components (Charts, Spreadsheet, etc.). The widgetset compilation process was incorrectly checking for an old form product key in certain edge cases, and would cause the build to fail when the key could not be found.

Vaadin 8.27.5

  • Fixed an issue where exceptions might not be properly processed as a component is being detached. Exceptions are now caught both when handling the detach event and when calling detach manually. The detach event now fires reliably when the connector tracker is updated even when an exception occurs during detach.

  • Altered handling of the eager UI cleanup feature to not use the beforeunload event as a workaround on Safari. Safari will instead use the default pagehide event to listen for imminent UI disposal. Using the beforeunload event caused an issue where resource links would erroneously be treated as navigation away from the current UI, causing the UI to be invalidated.

    Firefox and Internet Explorer still use the beforeunload event to signal cleanup for the UI.

Vaadin 8.27.4

  • Added feature to automatically resume Push connection when a client unexpectedly loses communication with the server. Pending Push messages are now cached on the server until the session times out or connectivity is restored for a better user experience.

    This is a backport of Flow pull request #20283.

  • Fixed Framework issue #11699. Previously, calling UI.getCurrent() inside a UI.access() callback could return a random UI instance under certain circumastances. CurrentInstance is now properly cleared before the current session reference is set before running any pending access callbacks.

    This is a backport of Flow pull request #20255.

  • Moved (some) blocking calls outside of session lock. Fixes a potential deadlock issue.

    This is a backport of Flow pull request #20475.

  • Specified pointer-events: auto as default for overlay containers in the Valo theme. This fixes an edge case where users were unable to select values from V8 comboboxes placed inside a V14 Dialog component when running under the Vaadin Multi Platform Runtime.

Vaadin 8.27.3

  • Added an option to disable Push disconnect on refresh. This is a special-case workaround. Normally when UI is refreshed when @PreserveOnRefresh is used, UI checks if an associated Push connection is active and disconnects it in order to avoid a race condition. This functionality was originally introduced to fix Framework [issue #12577](vaadin/framework#12577). However, with some containers such as Payara this can have unwanted side effects, such as CDI reporting that no session scoped context is available after refresh.

    This feature can now be toggled off using the protected UI method setDisconnectPushOnRefresh(false).

  • Updated Atmosphere to detect Payara alongside Glassfish and enable async support for it. This is a workaround for a bug/feature that exists both in Glassfish and Payara that provides a null ServerContainer reference that would otherwise cause initialization to fail.

Vaadin 8.27.2

  • Included the vaadin-portlet package in the Vaadin 8 BOM. As a result, the version of the vaadin-portlet package does not need to be defined if the vaadin-bom artifact is imported. This definition was originally left out due to an oversight and the omission was discovered during internal manual testing.

  • Improved initialization of the eager unload feature when using Firefox, Safari or any iOS browser.

    PLEASE NOTE: this feature will make the "are you sure you want to leave" confirmation not function as intended, as these browsers need to hook onto the beforeunload event. This will cause the session to become invalidated and will require reloading the page even if the user decides to stay. If you need to disable the eager unload functionality for Safari/Firefox/iOS in order to display the confirmation, directly assign a handler to window.onbeforeunload with a JavaScript call.

... (truncated)

Commits

Updates com.vaadin:vaadin-client-compiled from 8.14.4 to 8.27.7

Release notes

Sourced from com.vaadin:vaadin-client-compiled's releases.

Vaadin Framework 8.27.7 is an Extended Maintenance patch release with the following changes:

  • Major update to Vaadin Maven Plugin to avoid depending on obsolete packages with open CVEs. While none of the affected packages have presented an actual risk to users due to how they were used within the Vaadin build process, they were being flagged as security issues, and as such were undesireable to have in the dependency list.
  • Fixed an issue where the SessionDestroyListener would receive a null WrappedSession instance and thus the HTTP session could not be explicitly invalidated. This is a backport from Flow. See Flow issue #6959.
  • Fixed Grid's sorting indicator visibility when using the Runo theme.

Vaadin Framework 8.27.6 is an Extended Maintenance patch release with the following changes:

  • Fixed an issue with license checking related to pro components (Charts, Spreadsheet, etc.). The widgetset compilation process was incorrectly checking for an old form product key in certain edge cases, and would cause the build to fail when the key could not be found.

Vaadin Framework 8.27.5 is an Extended Maintenance patch release with the following changes:

  • Fixed an issue where exceptions might not be properly processed as a component is being detached. Exceptions are now caught both when handling the detach event and when calling detach manually. The detach event now fires reliably when the connector tracker is updated even when an exception occurs during detach.

  • Altered handling of the eager UI cleanup feature to not use the beforeunload event as a workaround on Safari. Safari will instead use the default pagehide event to listen for imminent UI disposal. Using the beforeunload event caused an issue where resource links would erroneously be treated as navigation away from the current UI, causing the UI to be invalidated.

    Firefox and Internet Explorer still use the beforeunload event to signal cleanup for the UI.

Vaadin Framework 8.27.4 is an Extended Maintenance patch release with the following changes:

  • Added feature to automatically resume Push connection when a client unexpectedly loses communication with the server. Pending Push messages are now cached on the server until the session times out or connectivity is restored for a better user experience.

    This is a backport of Flow pull request #20283.

  • Fixed Framework issue #11699. Previously, calling UI.getCurrent() inside a UI.access() callback could return a random UI instance under certain circumastances. CurrentInstance is now properly cleared before the current session reference is set before running any pending access callbacks.

    This is a backport of Flow pull request #20255.

  • Moved (some) blocking calls outside of session lock. Fixes a potential deadlock issue.

    This is a backport of Flow pull request #20475.

  • Specified pointer-events: auto as default for overlay containers in the Valo theme. This fixes an edge case where users were unable to select values from V8 comboboxes placed inside a V14 Dialog component when running under the Vaadin Multi Platform Runtime.

Vaadin Framework 8.27.3 is an Extended Maintenance patch release with the following changes:

  • Added an option to disable Push disconnect on refresh. This is a special-case workaround. Normally when UI is refreshed when @PreserveOnRefresh is used, UI checks if an associated Push connection is active and disconnects it in order to avoid a race condition. This functionality was originally introduced to fix Framework [issue #12577](vaadin/framework#12577). However, with some containers such as Payara this can have unwanted side effects, such as CDI reporting that no session scoped context is available after refresh.

    This feature can now be toggled off using the protected UI method setDisconnectPushOnRefresh(false).

  • Updated Atmosphere to detect Payara alongside Glassfish and enable async support for it. This is a workaround for a bug/feature that exists both in Glassfish and Payara that provides a null ServerContainer reference that would otherwise cause initialization to fail.

Vaadin Framework 8.27.2 is an Extended Maintenance patch release with the following changes:

  • Included the vaadin-portlet package in the Vaadin 8 BOM. As a result, the version of the vaadin-portlet package does not need to be defined if the vaadin-bom artifact is imported. This definition was originally left out due to an oversight and the omission was discovered during internal manual testing.

  • Improved initialization of the eager unload feature when using Firefox, Safari or any iOS browser.

    PLEASE NOTE: this feature will make the "are you sure you want to leave" confirmation not function as intended, as these browsers need to hook onto the beforeunload event. This will cause the session to become invalidated and will require reloading the page even if the user decides to stay. If you need to disable the eager unload functionality for Safari/Firefox/iOS in order to display the confirmation, directly assign a handler to window.onbeforeunload with a JavaScript call.

Vaadin Framework 8.27.1 is an Extended Maintenance hotfix release with the following changes:

... (truncated)

Changelog

Sourced from com.vaadin:vaadin-client-compiled's changelog.

Vaadin 8.27.7

  • Major update to Vaadin Maven Plugin to avoid depending on obsolete packages with open CVEs. While none of the affected packages have presented an actual risk to users due to how they were used within the Vaadin build process, they were being flagged as security issues, and as such were undesireable to have in the dependency list.

  • Fixed an issue where the SessionDestroyListener would receive a null WrappedSession instance and thus the HTTP session could not be explicitly invalidated. This is a backport from Flow. See Flow issue #6959.

  • Fixed Grid's sorting indicator visibility when using the Runo theme.

Vaadin 8.27.6

  • Fixed an issue with license checking related to pro components (Charts, Spreadsheet, etc.). The widgetset compilation process was incorrectly checking for an old form product key in certain edge cases, and would cause the build to fail when the key could not be found.

Vaadin 8.27.5

  • Fixed an issue where exceptions might not be properly processed as a component is being detached. Exceptions are now caught both when handling the detach event and when calling detach manually. The detach event now fires reliably when the connector tracker is updated even when an exception occurs during detach.

  • Altered handling of the eager UI cleanup feature to not use the beforeunload event as a workaround on Safari. Safari will instead use the default pagehide event to listen for imminent UI disposal. Using the beforeunload event caused an issue where resource links would erroneously be treated as navigation away from the current UI, causing the UI to be invalidated.

    Firefox and Internet Explorer still use the beforeunload event to signal cleanup for the UI.

Vaadin 8.27.4

  • Added feature to automatically resume Push connection when a client unexpectedly loses communication with the server. Pending Push messages are now cached on the server until the session times out or connectivity is restored for a better user experience.

    This is a backport of Flow pull request #20283.

  • Fixed Framework issue #11699. Previously, calling UI.getCurrent() inside a UI.access() callback could return a random UI instance under certain circumastances. CurrentInstance is now properly cleared before the current session reference is set before running any pending access callbacks.

    This is a backport of Flow pull request #20255.

  • Moved (some) blocking calls outside of session lock. Fixes a potential deadlock issue.

    This is a backport of Flow pull request #20475.

  • Specified pointer-events: auto as default for overlay containers in the Valo theme. This fixes an edge case where users were unable to select values from V8 comboboxes placed inside a V14 Dialog component when running under the Vaadin Multi Platform Runtime.

Vaadin 8.27.3

  • Added an option to disable Push disconnect on refresh. This is a special-case workaround. Normally when UI is refreshed when @PreserveOnRefresh is used, UI checks if an associated Push connection is active and disconnects it in order to avoid a race condition. This functionality was originally introduced to fix Framework [issue #12577](vaadin/framework#12577). However, with some containers such as Payara this can have unwanted side effects, such as CDI reporting that no session scoped context is available after refresh.

    This feature can now be toggled off using the protected UI method setDisconnectPushOnRefresh(false).

  • Updated Atmosphere to detect Payara alongside Glassfish and enable async support for it. This is a workaround for a bug/feature that exists both in Glassfish and Payara that provides a null ServerContainer reference that would otherwise cause initialization to fail.

Vaadin 8.27.2

  • Included the vaadin-portlet package in the Vaadin 8 BOM. As a result, the version of the vaadin-portlet package does not need to be defined if the vaadin-bom artifact is imported. This definition was originally left out due to an oversight and the omission was discovered during internal manual testing.

  • Improved initialization of the eager unload feature when using Firefox, Safari or any iOS browser.

    PLEASE NOTE: this feature will make the "are you sure you want to leave" confirmation not function as intended, as these browsers need to hook onto the beforeunload event. This will cause the session to become invalidated and will require reloading the page even if the user decides to stay. If you need to disable the eager unload functionality for Safari/Firefox/iOS in order to display the confirmation, directly assign a handler to window.onbeforeunload with a JavaScript call.

... (truncated)

Commits

Updates com.vaadin:vaadin-client from 8.14.4 to 8.27.7

Release notes

Sourced from com.vaadin:vaadin-client's releases.

Vaadin Framework 8.27.7 is an Extended Maintenance patch release with the following changes:

  • Major update to Vaadin Maven Plugin to avoid depending on obsolete packages with open CVEs. While none of the affected packages have presented an actual risk to users due to how they were used within the Vaadin build process, they were being flagged as security issues, and as such were undesireable to have in the dependency list.
  • Fixed an issue where the SessionDestroyListener would receive a null WrappedSession instance and thus the HTTP session could not be explicitly invalidated. This is a backport from Flow. See Flow issue #6959.
  • Fixed Grid's sorting indicator visibility when using the Runo theme.

Vaadin Framework 8.27.6 is an Extended Maintenance patch release with the following changes:

  • Fixed an issue with license checking related to pro components (Charts, Spreadsheet, etc.). The widgetset compilation process was incorrectly checking for an old form product key in certain edge cases, and would cause the build to fail when the key could not be found.

Vaadin Framework 8.27.5 is an Extended Maintenance patch release with the following changes:

  • Fixed an issue where exceptions might not be properly processed as a component is being detached. Exceptions are now caught both when handling the detach event and when calling detach manually. The detach event now fires reliably when the connector tracker is updated even when an exception occurs during detach.

  • Altered handling of the eager UI cleanup feature to not use the beforeunload event as a workaround on Safari. Safari will instead use the default pagehide event to listen for imminent UI...

    Description has been truncated

@dependabot dependabot bot added dependencies java Pull requests that update Java code labels Mar 14, 2025
@dependabot dependabot bot requested a review from pethers as a code owner March 14, 2025 16:54
@github-actions GitHub Actions
Copy link

github-actions bot commented Mar 14, 2025 •
edited
Loading

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 1 package(s) with unknown licenses.
See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA b582133.
Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

License Issues

web-widgets/pom.xml

PackageVersionLicenseIssue Type
com.vaadin:vaadin-maven-plugin8.27.7NullUnknown License

OpenSSF Scorecard

PackageVersionScoreDetails
maven/com.vaadin:vaadin-maven-plugin 8.27.7 UnknownUnknown

Scanned Files

  • web-widgets/pom.xml

@dependabot dependabot bot force-pushed the dependabot/maven/cia.project.versions.vaadin-8.27.7 branch 17 times, most recently from 51c8c19 to da230b2 Compare March 21, 2025 10:01
@dependabot dependabot bot force-pushed the dependabot/maven/cia.project.versions.vaadin-8.27.7 branch 3 times, most recently from 27f2d9b to 31105aa Compare March 26, 2025 09:54
@dependabot
build(deps): bump cia.project.versions.vaadin from 8.14.4 to 8.27.7
b582133 
Bumps `cia.project.versions.vaadin` from 8.14.4 to 8.27.7.

Updates `com.vaadin:vaadin-themes` from 8.14.4 to 8.27.7
- [Release notes](https://github.com/vaadin/framework/releases)
- [Changelog](https://github.com/vaadin/framework/blob/master/CHANGELOG-VAADIN8.md)
- [Commits](vaadin/framework@8.14.4...8.27.7)

Updates `com.vaadin:vaadin-compatibility-server` from 8.14.4 to 8.27.7
- [Release notes](https://github.com/vaadin/framework/releases)
- [Changelog](https://github.com/vaadin/framework/blob/master/CHANGELOG-VAADIN8.md)
- [Commits](vaadin/framework@8.14.4...8.27.7)

Updates `com.vaadin:vaadin-maven-plugin` from 8.14.3 to 8.27.7
- [Commits](vaadin/maven-plugin@8.14.3...8.27.7)

Updates `com.vaadin:vaadin-server` from 8.14.4 to 8.27.7
- [Release notes](https://github.com/vaadin/framework/releases)
- [Changelog](https://github.com/vaadin/framework/blob/master/CHANGELOG-VAADIN8.md)
- [Commits](vaadin/framework@8.14.4...8.27.7)

Updates `com.vaadin:vaadin-client-compiled` from 8.14.4 to 8.27.7
- [Release notes](https://github.com/vaadin/framework/releases)
- [Changelog](https://github.com/vaadin/framework/blob/master/CHANGELOG-VAADIN8.md)
- [Commits](vaadin/framework@8.14.4...8.27.7)

Updates `com.vaadin:vaadin-client` from 8.14.4 to 8.27.7
- [Release notes](https://github.com/vaadin/framework/releases)
- [Changelog](https://github.com/vaadin/framework/blob/master/CHANGELOG-VAADIN8.md)
- [Commits](vaadin/framework@8.14.4...8.27.7)

Updates `com.vaadin:vaadin-compatibility-client` from 8.14.4 to 8.27.7
- [Release notes](https://github.com/vaadin/framework/releases)
- [Changelog](https://github.com/vaadin/framework/blob/master/CHANGELOG-VAADIN8.md)
- [Commits](vaadin/framework@8.14.4...8.27.7)

Updates `com.vaadin:vaadin-compatibility-shared` from 8.14.4 to 8.27.7
- [Release notes](https://github.com/vaadin/framework/releases)
- [Changelog](https://github.com/vaadin/framework/blob/master/CHANGELOG-VAADIN8.md)
- [Commits](vaadin/framework@8.14.4...8.27.7)

Updates `com.vaadin:vaadin-client-compiler` from 8.14.4 to 8.27.7
- [Release notes](https://github.com/vaadin/framework/releases)
- [Changelog](https://github.com/vaadin/framework/blob/master/CHANGELOG-VAADIN8.md)
- [Commits](vaadin/framework@8.14.4...8.27.7)

Updates `com.vaadin:vaadin-push` from 8.14.4 to 8.27.7
- [Release notes](https://github.com/vaadin/framework/releases)
- [Changelog](https://github.com/vaadin/framework/blob/master/CHANGELOG-VAADIN8.md)
- [Commits](vaadin/framework@8.14.4...8.27.7)

---
updated-dependencies:
- dependency-name: com.vaadin:vaadin-themes
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: com.vaadin:vaadin-compatibility-server
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: com.vaadin:vaadin-maven-plugin
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: com.vaadin:vaadin-server
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: com.vaadin:vaadin-client-compiled
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: com.vaadin:vaadin-client
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: com.vaadin:vaadin-compatibility-client
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: com.vaadin:vaadin-compatibility-shared
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: com.vaadin:vaadin-client-compiler
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: com.vaadin:vaadin-push
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/maven/cia.project.versions.vaadin-8.27.7 branch from 31105aa to b582133 Compare March 26, 2025 22:01
@sonarqubecloud SonarQubeCloud
Copy link

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@pethers pethers Awaiting requested review from pethers pethers is a code owner

Assignees
No one assigned
Labels
dependencies java Pull requests that update Java code size/XS
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants