Maven targets use wrong jars when Flow version has been overridden

[Artur-]

Description of the bug

If you create an application using Vaadin 24 alpha 15 and override the Flow version from alpha22 to alpha23, then mvn vaadin:build-frontend will generate package.json using Flow alpha22 and not alpha23 (e.g. @babel/preset-react will be ^7 and not 7.23.3).

This apparently happens because that the class loader created using the URLs from the project compile path (these URLs are correct and include Flow alpha 23) is set to use the context class loader as the parent class loader here:

flow/flow-plugins/flow-plugin-base/src/main/java/com/vaadin/flow/server/scanner/ReflectionsClassFinder.java

Lines 59 to 60 in ba28266

	classLoader = new URLClassLoader(urls,
	Thread.currentThread().getContextClassLoader());

Now the context class loader apparently contains the plugin dependencies and as the plugin was built using Flow alpha22, it contains a reference to that. Class loader specs also say that any class loader should first try the parent class loader, so when trying to find e.g. com/vaadin/flow/server/frontend/dependencies/vite/package.json then the created class loader will first consult the parent, which finds flow-server alpha22 and returns the URL to the resource.

Expected behavior

The project classpath would be used, not the classpath used to create the plugin

Minimal reproducible example

New project + Flow override, as described

Versions

• Vaadin / Flow version:
• Java version:
• OS version:
• Browser version (if applicable):
• Application Server (if applicable):
• IDE (if applicable):