You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Add clarification about package.properties not providing automatic discovery #3929
The package.properties file effects only the target JAR content. It supports vaadin.allowed-packages and vaadin.blocked-packages properties in the same way as in the application.properties file. The vaadin.blocked-jar=true property is used to disable scanning of the JAR, entirely.
From that text I assume that "It supports vaadin.allowed-packages and vaadin.blocked-packages properties in the same way as in the application.properties file" meaning that if I add vaadin.allowed-packages with my package, it will automatically discover the add-ons on that jar when doing the scanning.
By the way, why is that the automatic discovery of add-ons is not supported? .. It could be implemented in such a way that if (for some reason) you have the add-on dependency but you don't want it to be scanned, you could disable those packages from the application.properties (of course it should have more relevance than package.properties from add-ons).
IIRC also the settings in application.properties do not activate any discovery. They simply restrict the packages to scan, that by default is everything.
However, for security reasons, this settings take precedence over the ones defined in the jar files.
@mcollovati start.vaadin.com generates application.properties with vaadin.allowed-packages = com.vaadin,org.vaadin,com.example.application, which requires manual configuration in case one uses third-party add-ons with a package other that org.vaadin.* (that's why it's important to clarify that even if an add-on includes package.properties, it will not be scanned unless it's also allowed)
I wonder if it could be helpful if the vaadin-spring add on would print a warning message for the JAR rules that cannot be applied because of global allowed/blocked list.
Perhaps also Vaadin Copilot could propose changes to apply to application.properties.
Activity
mlopezFC commentedon Nov 19, 2024
From the docs:
From that text I assume that "It supports vaadin.allowed-packages and vaadin.blocked-packages properties in the same way as in the application.properties file" meaning that if I add
vaadin.allowed-packageswith my package, it will automatically discover the add-ons on that jar when doing the scanning.By the way, why is that the automatic discovery of add-ons is not supported? .. It could be implemented in such a way that if (for some reason) you have the add-on dependency but you don't want it to be scanned, you could disable those packages from the application.properties (of course it should have more relevance than package.properties from add-ons).
mcollovati commentedon Nov 19, 2024
IIRC also the settings in application.properties do not activate any discovery. They simply restrict the packages to scan, that by default is everything.
However, for security reasons, this settings take precedence over the ones defined in the jar files.
javier-godoy commentedon Nov 19, 2024
@mcollovati start.vaadin.com generates application.properties with
vaadin.allowed-packages = com.vaadin,org.vaadin,com.example.application, which requires manual configuration in case one uses third-party add-ons with a package other that org.vaadin.* (that's why it's important to clarify that even if an add-on includes package.properties, it will not be scanned unless it's also allowed)mcollovati commentedon Nov 19, 2024
I wonder if it could be helpful if the vaadin-spring add on would print a warning message for the JAR rules that cannot be applied because of global allowed/blocked list.
Perhaps also Vaadin Copilot could propose changes to apply to application.properties.
javier-godoy commentedon Nov 10, 2026
Closing as part of a personal cleanup of projects I'm no longer involved in. This does not imply that the underlying issue has been resolved.