Update vaadin.version to v25.3.1

[xdev-renovate]

This PR contains the following updates:

Package	Type	Update	Change
com.vaadin:vaadin-bom (source)	import	minor	25.2.3 → 25.3.1
com.vaadin:vaadin-maven-plugin (source)	build	minor	25.2.3 → 25.3.1

---

Release Notes

vaadin/platform (com.vaadin:vaadin-bom)

v25.3.1: Vaadin 25.3.1

Compare Source

This is a maintenance release for Vaadin 25.3. See 25.3.0 release notes for details and resources.

Changes since 25.3.0

• Flow: 25.3.0 → 25.3.1 → 25.3.2
• Hilla: 25.3.0 → 25.3.1
• Web Components: 25.3.0 → 25.3.1 → 25.3.2
• Flow Components: 25.3.0 → 25.3.1
• Copilot: 25.3.0 → 25.3.1
• AppSec Kit: 4.1.0 → 4.1.1 (docs)

Unchanged Modules

• TestBench: 25.3.0
• Browserless Test: 25.3.0
• Multiplatform Runtime (MPR): 8.0.1
• Router: 2.0.1
• Collaboration Engine: 7.1.0
• Kubernetes Kit: 3.1.1
• Observability Kit: 5.0.0
• SSO Kit: 4.2.0
• CDI add-on: 16.1.2
• Quarkus plugin: 3.2.2
• Azure Kit: 1.0.0 (docs)
• Swing Kit: 3.0.1 (docs)

v25.3.0: Vaadin 25.3.0

Compare Source

Upgrading · Docs · Get Started

New and Noteworthy Since Vaadin 25.2

Platform

• New vaadin-ee artifact: an Enterprise Edition umbrella alongside vaadin and vaadin-core.

Flow

• HTML Table components: A new Table component family for building semantic HTML tables in Java, with captions, column groups, header/body/footer sections, spanning and signal-bound rows. The API only lets you build tables the HTML specification allows. Deprecates NativeTable.
• Validation groups in Binder: BeanValidationBinder can now validate against specific JSR-303 validation groups, so one bean can carry more than one rule set. setValidationGroups(...) sets the rules enforced as the user types, and a one-shot validate(Publish.class) / isValid(Publish.class) checks the stricter rules that should only block saving or publishing. Required indicators follow the groups actually in effect.
• Dev loop daemon: a new vaadin-dev CLI, installed with mvn vaadin:install-dev-cli, owns the edit-to-running-app loop from a long-running daemon: background compilation, hot swap or restart as the change requires, CSS and theme pushes into the open page, and browser refresh. One vaadin-dev apply reports whether your change is actually live, as an exit code, so coding agents stop guessing. Targets AI development.
• Service event bus: a VaadinService event bus replaces the session lock and RPC invocation listeners added in 25.2, and reports data provider count and fetch queries on the same bus.
• Client engine rewritten in TypeScript: The client-side engine that runs in the browser has been ported from GWT to TypeScript, making it easier to debug and provide source maps. Purely internal: no application code changes required.
• Also: Element.whenAttached for attach scoped setup and cleanup

Hilla

• Object models in Auto components: AutoGrid, AutoForm and AutoCrud accept @​vaadin/hilla-models object models.

Design System

New components

• Switch: a new input field that presents a binary on/off choice as a toggle, for settings that take effect immediately
• Breadcrumbs: A navigation trail showing users where they are in the app's page hierarchy, built automatically from your routes or defined manually. (Previously shipped behind a feature flag.)

AI Integrations

• Split by tier: vaadin-ai-core-flow is free and ships in vaadin-core, vaadin-ai-extensions-flow is commercial and ships in vaadin and vaadin-ee.
• Form AI controller: source tracking and confidence levels for AI filled values, a revertable field marker replacing the previous highlighting, plus field state awareness and cross field validation.
• Orchestrator: a request interceptor, per turn session context, response metadata including token usage, ToolException for LLM safe tool errors, and background execution for the built in providers.

New in existing components

• Date Picker and Date Time Picker: disabled dates and disabled weekdays, a date metadata provider for styling, and a default time filled in when a date is picked.
• Grid: no data is generated or sent for hidden columns, and row details and selection are decoupled from activeItem.
• Also: Combo Box partial match mode, a Dialog autofocus API replacing the focus trap, Message List bubble and one-to-one variants, Tree Grid selectAll() selecting descendants, signal binding for Markdown content, zoom limits on Map, Aura variants for Checkbox and Progress Bar, and Spreadsheet fixes.

Accessibility and i18n

• GridI18n: accessible names for selection checkboxes and sorters.
• Also: an accessible name for the Date Picker calendar overlay, keyboard resizing and separator label i18n in Split Layout, AriaLinkMode on Tooltip, configurable heading levels in Login and Accordion, and HasAriaRole adopted by Dialog, Popover, Badge and Card.

Copilot

See the Vaadin Copilot documentation.

• Kotlin project support: Copilot works on Kotlin projects (not 100% feature parity yet, unsupported features disabled instead of failing).
  FormLayout in the UI Library: drag and drop into a FormLayout and edit its responsive steps. Switch, Breadcrumbs and Dashboard join the palette.
• Aura global theme editor: color scheme modes, accent colors and reset.
• Also: an experimental All Components view, route editing with unsaved changes dialogs, an icon picker, Spring Security setup buttons, editing components injected through dependency injection, HTTP proxy support, connectivity diagnostics, performance improvements on large applications, and a visual refresh of panels and dialogs.

Testing

A SwitchTester for the new Switch component, Grid column elements exposed as real TestBench elements, and fixes across the Select, Time Picker and Date Time Picker testers.

Observability Kit 5 (Pro)

Agent less rebuild on Micrometer. The OpenTelemetry Java agent of 4.x is gone: adding a dependency is enough, with no -javaagent and no separate collector required to get started.

• Two integrations: observability-kit-starter for Spring Boot, observability-kit-spring for plain Spring. Both support GraalVM native image.
• Vaadin specific metrics and tracing: sessions, UIs, requests, RPC and session lock, navigation timing, errors attributed to route and component, UI state size, and data provider queries. Spans go through the Micrometer Observation API.
• Also: an insights endpoint for backtracking failed and slow user interactions, a live metrics panel in Copilot, configuration through an ObservabilitySettings builder and vaadin.observability.* properties, and a failed license check degrading to no telemetry instead of failing startup.

Dependency Updates

Compared with 25.2.0:

• TypeScript updated to 7.0.2 (from 6.0.3)
• Vite updated to 8.3.0 (from 8.0.16)
• React Router updated to 8.4.0 (from 7.17.0), React to 19.3.0
• Node.js updated to 24.21.0 (from 24.17.0)
• pnpm updated to 11.26.0 (from 11.6.0)
• Tailwind CSS updated to 4.3.3 (from 4.3.1)
• Spring Boot updated to 4.1.1 (from 4.1.0)
• Jackson BOM updated to 3.1.5 (from 3.1.3)
• Jetty updated to 12.1.13 (from 12.1.9)
• JUnit Jupiter updated to 6.1.3 (from 6.1.0), with all JUnit artifacts managed through junit-bom
• Hibernate Validator updated to 9.1.3.Final (from 9.1.0.Final)
• Guava updated to 33.7.1-jre (from 33.6.0-jre)
• jsoup updated to 1.23.2 (from 1.22.2)
• SLF4J updated to 2.0.19 (from 2.0.18)
• TestBench updated to 25.3 (from 25.2)
• Kotlin updated to 2.4.20 (web push module)

Changelogs

• Flow (25.3.0) and Hilla (25.3.0)
• Design System
  • Web Components (25.3.0)
  • Flow Components (25.3.0)
• TestBench (25.3.0)
• Browserless Test(25.3.0)
• Feature Pack(25.0.0)
• Modernization Toolkit (Documentation)
  • Feature Pack (Documentation)
  • Dragonfly (Documentation)
  • Modernization Toolkit Analyzer (Analyzer for Eclipse, Analyzer for Maven)
• Multiplatform Runtime (MPR) (8.0.1)
• Router (2.0.1)
• Vaadin Kits
  • *AppSec Kit (4.1.0)
  • Azure Kit (1.0.0)
  • *Collaboration Engine (7.1.0)
  • Copilot (25.3.0)
  • Kubernetes Kit (3.1.1)
  • Observability Kit (5.0.0)
  • *SSO Kit (4.2.0)
  • Swing Kit (3.0.1)

*AppSec Kit, Collaboration Engine and SSO Kit has been marked as deprecated in Vaadin 25.3, which will be dropped in Vaadin 26.

Official add-ons and plugins:

• Spring add-on (25.3.0)
• CDI add-on (16.1.2)
• Maven plugin (25.3.0)
• Gradle plugin (25.3.0)
• Quarkus plugin (3.2.2)

Upgrading guides

• Upgrading to Vaadin 25

Support

Vaadin 25 is the latest stable version, with extended support options available (release model).

Vaadin also provides commercial support and warranty.

Supported technologies

Desktop browser	Chrome (evergreen). Firefox (evergreen). Firefox Extended Support Release (ESR). Safari 17 or newer (latest minor version in each major series). Edge (Chromium, evergreen).
Mobile browser	Chrome (evergreen) for Android (4.4 or newer). Safari 17 for iOS or newer (latest minor version in each major series).
Development OS	Windows macOS Linux
IDE	Any IDE or editor that works with the language of your choice should work well. Our teams often use IntelliJ, Eclipse, VS Code among others. Vaadin IDE plugins (IntelliJ and VS Code) support the IDE versions released during the last 12 months Vaadin Designer supports the following IDEs: Eclipse from Photon and upwards JetBrains IntelliJ IDEA from 2017 upwards
Java	Version 21 of any JDK or JRE
Maven	Version 3.8 or newer
Gradle	Version 8.14 or newer
Application server	Vaadin Flow requires Java Servlet API 6.1 and Java 21 or newer. It is tested on: Apache Tomcat 11 Open Liberty 23 RedHat JBoss EAP 8.1 To work with RedHat JBoss EAP 8.0, the following content needs to be added under WEB-INF folder as jboss-deployment-structure.xml Workaround for supporting RedHat JBoss EAP 8.0 <jboss-deployment-structure> <deployment> <exclude-subsystems> <subsystem name="jaxrs" /> </exclude-subsystems> </deployment> </jboss-deployment-structure> WildFly 36 + Latest WildFly versions are still using Jackson 2, in order to work with Vaadin 25, the following content needs to be added under WEB-INF folder as jboss-deployment-structure.xml Workaround for supporting WildFly 36 <jboss-deployment-structure> <deployment> <exclude-subsystems> <subsystem name="jaxrs" /> </exclude-subsystems> </deployment> </jboss-deployment-structure> Workaround for supporting WildFly 37+ <jboss-deployment-structure> <deployment> <exclusions> <module name="com.fasterxml.jackson.core.jackson-annotations"/> </exclusions> </deployment> </jboss-deployment-structure> Jetty 12 Payara Server 6 Payara Micro 6
Node.js	Version 24 or newer
NPM	Version 11.3 or newer
PNPM	Version 10.16 or newer
Spring Boot	Version 4.1 or newer

Known issues and limitations

Flow	The Template-in-Template feature has some limitations

v25.2.10: Vaadin 25.2.10

Compare Source

This is a maintenance release for Vaadin 25.2. See 25.2.0 release notes for details and resources.

Changes since 25.2.9

• Flow: 25.2.10 → 25.2.11 → 25.2.12
• Hilla: 25.2.10 → 25.2.11
• Web Components: 25.2.13 → 25.2.14
• Flow Components: 25.2.9 → 25.2.10
• Copilot: 25.2.8 → 25.2.9
• AppSec Kit: 4.0.4 → 4.0.5 (docs)

Unchanged Modules

• TestBench: 25.2.2
• Browserless Test: 1.1.2
• Multiplatform Runtime (MPR): 8.0.1
• Router: 2.0.1
• Collaboration Engine: 7.0.0
• Kubernetes Kit: 3.1.1
• Observability Kit: 4.1.2
• SSO Kit: 4.1.4
• CDI add-on: 16.1.2
• Quarkus plugin: 3.2.2
• Azure Kit: 1.0.0 (docs)
• Swing Kit: 3.0.1 (docs)

v25.2.9: Vaadin 25.2.9

Compare Source

This is a maintenance release for Vaadin 25.2. See 25.2.0 release notes for details and resources.

Changes since 25.2.8

• Flow: 25.2.9 → 25.2.10
• Hilla: 25.2.9 → 25.2.10
• Web Components: 25.2.11 → 25.2.12 → 25.2.13
• Flow Components: 25.2.8 → 25.2.9
• Copilot: 25.2.7 → 25.2.8
• Observability Kit: 4.1.1 → 4.1.2
• SSO Kit: 4.1.3 → 4.1.4

Unchanged Modules

• TestBench: 25.2.2
• Browserless Test: 1.1.2
• Multiplatform Runtime (MPR): 8.0.1
• Router: 2.0.1
• Collaboration Engine: 7.0.0
• Kubernetes Kit: 3.1.1
• CDI add-on: 16.1.2
• Quarkus plugin: 3.2.2
• AppSec Kit: 4.0.4 (docs)
• Azure Kit: 1.0.0 (docs)
• Swing Kit: 3.0.1 (docs)

v25.2.8: Vaadin 25.2.8

Compare Source

This is a maintenance release for Vaadin 25.2. See 25.2.0 release notes for details and resources.

Changes since 25.2.7

• Flow: 25.2.8 → 25.2.9
• Hilla: 25.2.8 → 25.2.9
• Web Components: 25.2.10 → 25.2.11
• Flow Components: 25.2.7 → 25.2.8
• TestBench: 25.2.1 → 25.2.2
• Copilot: 25.2.6 → 25.2.7

Unchanged Modules

• Browserless Test: 1.1.2
• Multiplatform Runtime (MPR): 8.0.1
• Router: 2.0.1
• Collaboration Engine: 7.0.0
• Kubernetes Kit: 3.1.1
• Observability Kit: 4.1.1
• SSO Kit: 4.1.3
• CDI add-on: 16.1.2
• Quarkus plugin: 3.2.2
• AppSec Kit: 4.0.4 (docs)
• Azure Kit: 1.0.0 (docs)
• Swing Kit: 3.0.1 (docs)

v25.2.7: Vaadin 25.2.7

Compare Source

This is a maintenance release for Vaadin 25.2. See 25.2.0 release notes for details and resources.

Changes since 25.2.6

• Flow: 25.2.6 → 25.2.7 → 25.2.8
• Hilla: 25.2.6 → 25.2.7 → 25.2.8
• Web Components: 25.2.7 → 25.2.8 → 25.2.9 → 25.2.10
• Flow Components: 25.2.6 → 25.2.7
• Copilot: 25.2.5 → 25.2.6
• CDI add-on: 16.1.1 → 16.1.2
• Quarkus plugin: 3.2.1 → 3.2.2
• AppSec Kit: 4.0.3 → 4.0.4 (docs)

Unchanged Modules

• TestBench: 25.2.1
• Browserless Test: 1.1.2
• Multiplatform Runtime (MPR): 8.0.1
• Router: 2.0.1
• Collaboration Engine: 7.0.0
• Kubernetes Kit: 3.1.1
• Observability Kit: 4.1.1
• SSO Kit: 4.1.3
• Azure Kit: 1.0.0 (docs)
• Swing Kit: 3.0.1 (docs)

v25.2.6: Vaadin 25.2.6

Compare Source

This is a maintenance release for Vaadin 25.2. See 25.2.0 release notes for details and resources.

Changes since 25.2.5

• Flow: 25.2.5 → 25.2.6
• Hilla: 25.2.5 → 25.2.6
• Web Components: 25.2.6 → 25.2.7
• Flow Components: 25.2.5 → 25.2.6
• TestBench: 25.2.0 → 25.2.1
• Browserless Test: 1.1.1 → 1.1.2
• Copilot: 25.2.4 → 25.2.5
• CDI add-on: 16.1.0 → 16.1.1

Unchanged Modules

• Multiplatform Runtime (MPR): 8.0.1
• Router: 2.0.1
• Collaboration Engine: 7.0.0
• Kubernetes Kit: 3.1.1
• Observability Kit: 4.1.1
• SSO Kit: 4.1.3
• Quarkus plugin: 3.2.1
• AppSec Kit: 4.0.3 (docs)
• Azure Kit: 1.0.0 (docs)
• Swing Kit: 3.0.1 (docs)

v25.2.5: Vaadin 25.2.5

Compare Source

This is a maintenance release for Vaadin 25.2. See 25.2.0 release notes for details and resources.

Changes since 25.2.4

• Flow Components: 25.2.4 → 25.2.5

Unchanged Modules

• Flow: 25.2.5
• Hilla: 25.2.5
• Web Components: 25.2.6
• TestBench: 25.2.0
• Browserless Test: 1.1.1
• Multiplatform Runtime (MPR): 8.0.1
• Router: 2.0.1
• Copilot: 25.2.4
• Collaboration Engine: 7.0.0
• Kubernetes Kit: 3.1.1
• Observability Kit: 4.1.1
• SSO Kit: 4.1.3
• CDI add-on: 16.1.0
• Quarkus plugin: 3.2.1
• AppSec Kit: 4.0.3 (docs)
• Azure Kit: 1.0.0 (docs)
• Swing Kit: 3.0.1 (docs)

v25.2.4: Vaadin 25.2.4

Compare Source

This is a maintenance release for Vaadin 25.2. See 25.2.0 release notes for details and resources.

Changes since 25.2.3

• Flow: 25.2.4 → 25.2.5
• Hilla: 25.2.1 → 25.2.4 → 25.2.5
• Web Components: 25.2.4 → 25.2.5 → 25.2.6
• Flow Components: 25.2.3 → 25.2.4
• Copilot: 25.2.3 → 25.2.4
• Quarkus plugin: 3.2.0 → 3.2.1

Unchanged Modules

• TestBench: 25.2.0
• Browserless Test: 1.1.1
• Multiplatform Runtime (MPR): 8.0.1
• Router: 2.0.1
• Collaboration Engine: 7.0.0
• Kubernetes Kit: 3.1.1
• Observability Kit: 4.1.1
• SSO Kit: 4.1.3
• CDI add-on: 16.1.0
• AppSec Kit: 4.0.3 (docs)
• Azure Kit: 1.0.0 (docs)
• Swing Kit: 3.0.1 (docs)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.