GeezerVison

✨ New Features

• New Form::Enum rule checks that a value is a case of a backed enum, so invalid input is caught by validation, in the browser too, before it reaches your typed DTO: ->addRule($form::Enum, arg: Status::class)
• Event handlers resolve both parameters by their type, so function (array $values, Form $form) works in onSuccess, onError, onClick and onValidate (#345)
• %value in error messages reads naturally: uploaded file names, the items of a multi-choice selection, and dates in the control's format, on the server and in netteForms.js alike (#302)
• Rules Filled, Blank and Valid work with any Control implementation, so custom controls no longer need to extend BaseControl to use them (#346)
• PHPStan accepts validators with narrowed parameter types in addRule() and addCondition(), and extension methods that take arguments (#350, #354)
• PHP 8.6 is supported

🗑️ Deprecations

• A missing comma before {input} and {label} arguments – write {input name, class: 'big'} instead of {input name class: 'big'}, just as {form} expects since 3.3.0. This script adds the missing commas to your templates.

🐛 Bug Fixes

• Events such as onSuccess can again be fired by calling them as methods (#356)
• In Latte, $form points back to the enclosing form after a nested {form} closes
• Rule messages and translators may return a Stringable object (#349, #312)
• A GET form whose action contains a query parameter without a value (?foo) renders correctly (#348)
• netteForms.js validates like the server: lengths count characters, min/max compare numerically, a URL may have a query or fragment without a path, AVIF is a default image type, and the browser's bad-input check respects the validation scope
• Exceeding post_max_size reports its own message, and the Numeric rule has a default message

✨ New Features

• PHP 8.6 is supported
• %value in error messages now reads naturally for every control: uploaded file names, the items of a multi-choice selection joined by commas, and dates in the control's format (#302)
• Rules Filled, Blank and Valid work with any Control implementation, so custom controls no longer need to extend BaseControl to use them (#346)

🐛 Bug Fixes

• Rule messages and translators may return a Stringable object; validation messages, select optgroups and the prompt now accept it (#349, #312)
• Form values map onto int-backed enum properties: numeric strings from text and hidden fields convert to the matching case, and a value with no matching case is passed on unchanged
• A GET form whose action contains a query parameter without a value (?foo) renders correctly (#348)
• Exceeding post_max_size reports its own message instead of the one for file size
• A Form or Container subclass that applies the SmartObject trait again works without a fatal error (nette/utils#338)

The headline of 3.3 is CSRF protection that the browser handles for you – no token, no cookie, no server-side state, and it holds even against XSS. On top of that, the confusing {formContext} / {formContainer} pair collapses into a single {form scope}, you can finally nest forms with {form detached}, and a round of housekeeping clears out long-deprecated APIs. Please test and report anything that breaks for you.

• PHP 8.3+ and Latte 3.1.4+ are now required.

💥 Breaking Changes

• CSRF is now strictly same-origin. Forms validate the Sec-Fetch-Site header instead of the old SameSite cookie. The previous mechanism trusted submissions from any subdomain of the same site; the new one demands an exact origin match (scheme + host + port).
• setValues() / setDefaults() now expect iterable|stdClass.
• RadioList / CheckboxList: getControlPart() and getLabelPart() throw on an invalid item key instead of silently returning a nonsensical result.
• Removed long-deprecated APIs:** DataClassGenerator, LatteRenderer, getValues(true) (use getValues('array')), and the $default parameter of getOption() (use the ?? operator), negative validation rules

✨ New Features

• {form scope name} – one tag to replace the easily-confused {formContext} and {formContainer}. It pushes the form onto the stack without emitting <form>, resolving the name relatively to an active form when there is one, otherwise from the top level.
• {form detached name} – nest forms at last. HTML forbids nested <form> tags, so detached emits an empty <form></form> up front and links every control back to it via the HTML5 form="..." attribute, no matter where they sit in the DOM.
• addSubmit() accepts an $onSubmit callback – attach a click handler right when you create the button, without a separate ->onClick[] =.

🗑️ Deprecations

• A missing comma before {form} arguments – write {form name, attr=val} instead of {form name attr=val}, freeing keywords like scope/detached next to the name. This script adds the missing commas to your templates.
• Several magic properties

A maintenance-focused release that tightens type safety across the whole codebase, modernizes the JavaScript test stack, and turns static analysis into a non-negotiable part of the build. No API changes – just a more solid foundation under the hood.

• Native types everywhere – filled in missing native type declarations across Container, BaseControl, Validator, Rules, Form and friends, so PHPStan (and your IDE) see the real shape of things
• Sharper phpDoc – tightened phpDoc types and descriptions throughout, giving better autocomplete and clearer intent at every call - Reorganized a few tests and switched some over to allowCrossOrigin() for clarity

• support for PHP 8.5
• compatible with Latte 3.1
• CheckboxList, RadioList::getControl() return empty element when has no items

• composer: allows Latte 3.1
• optimized global function calls

• SelectBox: correctly selects prompt #343
• MultiChoiceControl: fixed order of selected items
• tests: improved descriptions
• netteForms: do not propagate 'submit' event further when the form is invalid
• netteForms: fixed submitter property

• Container::addEmail(): added $maxLength=255 #303
• ChoiceControl, MultiChoiceControl: disabled items are processed in getValue() instead of loadHttpData()
• removed return type from __call() nette/utils#315
• SelectBox: fixed 2edbd6c
• netteForms: uses the submitter property

• Container::getValue() supports conversion to enums [Close #337]
• UploadControl: added setNullable()
• netteForms: rewritten to TypeScript
• Button: is omitted from values #330
• DefaultFormRenderer: fixed cummulate instances of Nette\HtmlStringable #335
• Helpers::getSupportedTypes() returns array #332
• support for PHP 8.4

• netteForms: modernized code
• netteForms: reimplemented compact transmission mode via formdata event
• netteForms: processes only elements with 'data-nette-rules'
• netteForms: added typehints to jsDoc
• netteForms: improved badInput reporting
• netteForms: rule 'length' works with numbers #329
• Form: does not show 'no associated handlers' error if the form is not submitted by the button
• Blueprint: fixed nullable types detection
• TextBase, HiddenField: added isNullable()