Vaadin 25.3 Brings Auditable AI and Full TypeScript Migration

Overview

Vaadin has released version 25.3 of its leading Java component framework, introducing significant enhancements to AI integration and a foundational shift in its browser-side architecture. This release marks the third feature update in the 25.x line and addresses critical developer concerns around transparency, observability, and user experience.

The most prominent addition is auditable AI, which allows developers to track exactly how and why AI models fill form fields. Alongside this, the framework has completed its migration from Java-compiled JavaScript to native TypeScript for the Flow browser engine. These technical shifts are accompanied by a suite of new UI components and the deprecation of three older kits.

Vaadin 25.3 answers the question "what just happened?" in three distinct ways: by revealing AI source data, exposing production application states, and verifying whether coding agents have successfully deployed changes.

AI Observability and Auditing

The 25.3 release builds upon the AI form filler introduced in version 25.2 by adding a robust record-keeping layer. Every field modified by an AI model now carries a visible marker. When users or developers click this marker, a popover appears displaying the AI-generated value and offering a control to revert that specific field. This ensures that users can correct incorrect values without having to retype data that was already accurate.

For environments requiring higher security, enabling source tracking attaches detailed metadata to values filled from attached documents. This includes the ConfidenceLevel reported by the model and SourceExtract snippets showing the specific text the AI read. If the source provides a location, the system can highlight the relevant passage in the document. However, this tracking is disabled by default because it increases output token costs.

Security-conscious organizations can now utilize the RequestInterceptor to inspect every user prompt and attachment before the orchestrator acts. Developers can mask sensitive parts of the request or reject it entirely, enforcing data-protection rules directly in code. Furthermore, ResponseMetadata provides finish reasons and token usage for each turn, allowing teams to log costs and detect truncated responses.

It is important to note a packaging change for upgrade planning. The AI modules are now split into two dependencies:

1. vaadin-ai-core-flow: Free to use and contains the interceptor, response metadata, and provider API.
2. vaadin-ai-extensions-flow: Requires a commercial subscription and houses the Grid, Chart, and Form controllers.

The AI integration remains a preview feature. Developers must enable it using the com.vaadin.experimental.aiComponents feature flag.

New Components and UI Enhancements

Vaadin 25.3 introduces several components designed to improve standard UI interactions. The new Switch component is ideal for settings that take effect immediately upon toggling, eliminating the need for a separate save button. It supports helper text, required indicators, error messages, and various style variants.

For tabular data that does not require the complexity of a data grid, the new Table component family replaces the deprecated NativeTable. It provides a typed API for generating HTML table markup, including features like header rows and caption text.

Message List now supports proper chat UI layouts with bubble styling and typing indicators, simplifying the development of conversational interfaces.

The MessageList component has been enhanced with variant support for bubble and one-to-one layouts. Developers can now distinguish between user and assistant messages using new markers. A typing indicator is also available behind a feature flag, showing who is currently typing with their name and avatar.

Additional updates include:

• Date Picker and Date Time Picker: These now support disabling individual dates and weekdays. A DateMetadataProvider allows attaching custom metadata to specific dates, enabling features like booking forms that display unavailable dates visually.
• Combo Box: Users can now commit partial matches. The setPartialMatchMode method allows the component to select the first match or the only remaining match when the user presses Enter, highlighting options as they type.

TypeScript Migration and Deprecations

A significant architectural change in this release is the migration of Flow's browser-side engine from Java compiled to JavaScript via GWT to TypeScript. This move modernizes the framework's codebase and improves maintainability for developers familiar with modern web standards.

Concurrently, Vaadin is phasing out three specialized kits. The SSO Kit, Collaboration Kit, and AppSec Kit are deprecated and will not be included in Vaadin 26. The upgrade documentation provides details on what replaces each kit, ensuring teams can plan their migration paths effectively.

With this release, Vaadin continues to balance enterprise-grade security and observability with modern developer experience improvements, solidifying its position in the full-stack Java ecosystem.