Leif Åstrand

Memory leak from _handleNative with ShadyDOM

5

### Description The Shady DOM polyfill overrides `addEventListener` and among other things stores some metadata as an extra property on the event handler function or object. This causes memory leaks...

Polymer cannot be used with Skypack

2

Polymer cannot be used reliably from the Skypack CDN. By extension, any application that uses third party web components based on Polymer cannot use the new Streaming Imports mode introduced...

Make it easier to debug an empty @Endpoint class

2

If you e.g. forget to mark your endpoint method as `public`, then there will not be any generated .ts file for your `@Endpoint` class. This may lead you towards investigating...

### Description of the bug / feature If `executeJs` is used for an element that is currently being detached, then that `executeJs` invocation will be sent to the client and...

Ensure vaadin-compatibility-client is OSGi compatible

3

According to https://vaadin.com/forum/thread/17756874/vaadin-7-to-8-migration-vaadin-compatibility-client-not-osgi-compatible, the `vaadin-compatibility-client` is not OSGi compatible. Based on a quick look at `MANIFEST.MF`, it does indeed seem like the customary OSGi entires are missing.

Consider adding nosniff header to sensitive responses

2

In addition to the `no-store` header for potentially sensitive responses that was added in #10306 and #10628, there's also a new `X-Content-Type-Options: nosniff` header that is used by newly introduced...

Automatically test that components do not have unintended dependencies

1

Components and add-ons are supposed to use `provided` for all generic Flow dependencies. None of our modules are supposed to have non-provided dependencies for e.g. the Servlet API or any...

Spring Boot actively ignores web fragments which means that the `flow-server-compatibility-mode` dependency isn't automatically enabling compatibility mode. This is mentioned in the documentation but there's still a significant risk that...

Ignore VaadinServiceInitListener from ServiceLoader if it's also discovered in some other way

6

If you have a `VaadinServiceInitListener` class defined through `META-INF/services/com.vaadin.flow.server.VaadinServiceInitListener` and the same class is also e.g. a Spring `@Component`, then each mechanism will create one instance of that listener and...

A bean that is also a Vaadin Component will typically not work with any other scopes than prototype, view or UI. In any other case, the component will either be...