[dependabot]

Bumps com.vaadin:vaadin-spring from 3.2.1 to 25.3.7.

Release notes

Sourced from com.vaadin:vaadin-spring's releases.

Vaadin Flow 25.3.5

Changes since 25.3.4

All changes

New features

• Verify default Node.js download against shipped checksums (#26416) (CP: 25.3) (#26465)
• Pass custom JVM flags to the app with --jvm-args (#26299) (CP: 25.3) (#26410)

Fixes

• Ignore null granted authorities in role checks (#26531) (CP: 25.3) (#26656)
• Revert "add a playable game to the PWA offline page" (#26557) (CP: 25.3) (#26558)
• Reject misplaced dots in EmailValidator local part (#26533) (CP: 25.3) (#26537)
• Nest overlays inside visually modal components (#26425) (CP: 25.3) (#26498)
• Track visual modality so dialogs are refreshed on hotswap (#25417) (CP: 25.3) (#26488)
• Seed the change baseline from a launch-time snapshot (#26347) (CP: 25.3) (#26494)
• Escape < in initial UIDL script in index.html (#26455) (CP: 25.3) (#26474)
• Skip class scanning in install-dev-cli goal (#26359) (CP: 25.3) (#26462)
• Use pagehide instead of unload in push client (#26348) (CP: 25.3) (#26406)

Vaadin Flow 25.3.4

Changes since 25.3.3

All changes

New features

• Add opt-in Maven compile for Java (#26203) (CP: 25.3) (#26336)
• Add developmentOnly attribute to @Route (#26211) (CP: 25.3) (#26323)

Fixes

• Throw from removeAttribute for bound attribute with null value (#26264) (CP: 25.3) (#26351)
• Disable Atmosphere CORS headers on push requests (#26215) (CP: 25.3) (#26296)
• Cap future-dated file times in the change baseline (#26228) (CP: 25.3) (#26259)

Vaadin Flow 25.3.3

Changes since 25.3.2

All changes

New features

• Fire event when browser-too-old page is shown (#26227) (CP: 25.3) (#26250)
• Report AI coding agent in usage statistics (#26204) (CP: 25.3) (#26243)
• Fire service events for resent, resync and out-of-sync messages (#25960) (CP: 25.3) (#26187)

Fixes

... (truncated)

Commits

• See full diff in compare view

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 3a11ad7.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

OpenSSF Scorecard

Package	Version	Score	Details
maven/com.vaadin:vaadin-spring	25.3.7	🟢 5.5	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 17 issue activity found in the last 90 days -- score normalized to 10 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Dangerous-Workflow ⚠️ 0 dangerous workflow patterns detected License 🟢 10 license file detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 4 binaries present in source code Signed-Releases ⚠️ -1 no releases found Pinned-Dependencies 🟢 9 dependency not pinned by hash detected -- score normalized to 9 Fuzzing ⚠️ 0 project is not fuzzed Security-Policy 🟢 10 security policy file detected Packaging 🟢 10 packaging workflow detected Branch-Protection 🟢 4 branch protection is not maximal on development and all release branches SAST 🟢 10 SAST tool detected

Scanned Files

• web-widgets/pom.xml

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.