Update to 25.3.4, Vaadin Create recap, and Oracle Forms to Java

Vaadin Newsletter

October 2026

Three security fixes, time to update

Three security advisories went public this month, so if you have been postponing the update, now is a good time. The Push one (CVE-2026-110737) only affects apps using @Push with long polling or streaming. The Charts fix (CVE-2026-107588) matters if data you don’t control ends up in the chart configuration. And for Vaadin 8 users there’s a fix for a session lock leak (CVE-2026-110803). The latest Vaadin 25.3.4 includes all the 25.x fixes, while 25.2.11 and 8.32.2 cover the older lines. Details and a workaround in the security advisories. Vaadin Enterprise gives security updates for older versions, but if you are upgrading to 25.3, read the upgrade guide first, there were small changes in browser support.

How was Vaadin Create 2026?

Thank you to everyone who joined us in Barcelona! AI and modernization were the big themes, like expected. Simon Martinelli showed how specs keep AI-generated code under control, Josh Long also streamed his Coffee + Software show live from the venue with Leif and Marcus. From our side, “Draiv” and browserless testing and Figma design to a working Vaadin UI. If you missed Create, we’re still on the road: W-JAX in Munich on November 2 and J-Fall in Ede on November 11.

Same LLM model, better results?

Back in August we shared the first VaadinBench LLM results. Here is a 7-min video showing the thing: AI coding agents work from memory and can’t tell if their change actually worked, and the free Vaadin tools fix both. In the latest runs, the MCP server, and the new Dev Loop improvements in 25.3 made the same tasks 27% faster and 18% cheaper. Setup for Claude Code, Codex, Cursor and Copilot is at the end. Give the Dev Loop tutorial to your agent and let it do the work.

Oracle Forms to Java with AI in two weeks?

Speaking of which, Oracle Forms migrations are still steady work for our consultants, and Jean-Christophe looked into how much of the manual work Claude Code can do in two weeks? Full migration to Vaadin and Spring Boot, starting from written architecture decisions. The AI knew Oracle Forms behaviour surprisingly well, but it also reported nothing when the screen was clearly wrong. Here is Jean-Christophe’s honest write-up about both, and the code and mapping rules are on GitHub. Nice case study and worth a read if you have an old Forms app nobody wants to touch.

Until next month!

Sami

Vaadin Newsletter curated by the Vaadin DevRel team! In this newsletter, we'll share the most important and interesting news in and around the Vaadin ecosystem each month. If you have topics you think we should share with the Vaadin community, please send us your feedback. You can always email us at [email protected].

Vaadin Ltd, Lemminkäisenkatu 3, Turku, FI-20520, Finland