nette/application

Nette Application 3.3 modernizes the foundations: PHP 8.3+ and Latte 3.1, more reliable CSRF protection driven by the browser itself, and a default presenter mapping that finally matches the structure used throughout the documentation. It also clears out a pile of long-forgotten legacy. Please test the RC and report anything that breaks before the stable release.

💥 Breaking Changes

• PHP 8.3 – 8.5 and Latte 3.1 are now required
• More reliable CSRF protection – same-origin is now verified via the browser's Sec-Fetch-Site header instead of a SameSite cookie.
• Default presenter mapping is now App\Presentation\*\**Presenter
• Application::processRequest() returns a Response instead of sending it itself (#350) – sending is handled by run(). This enables long-running runtimes (RoadRunner, FrankenPHP) and PSR integration.
• Presenter::getRequest() throws instead of returning null when the presenter isn't running yet
• LatteFactory::create() now takes ?Control – update any custom LatteFactory implementation to the new create(?Control $control = null) signature.
• Removed {ifCurrent} – use {if isLinkCurrent('...')}.
• Removed compatibility with old class names such as PresenterComponent and IRouter.

⚠️ Deprecations

Mostly very old curiosities that few people knew existed – they still work but now emit a deprecation notice:

• @annotations → PHP attributes: @persistent → #[Persistent], @crossOrigin → #[Requires(sameOrigin: false)], @deprecated → #[Deprecated].
• Array access on RouteList – $router[] = new Route(...) and friends are replaced by $router->addRoute(...) / getRouters().
• Query string in a link destination – link('Product:detail?id=1') should pass arguments instead: link('Product:detail', ['id' => 1]).
• Component::getParameter() second $default argument – use the ?? operator instead.
• Some magic properties ($presenter->view, $layout, $request, $session…) – use the getters.

✨ New Features

• Set the URL fragment straight from arguments – link('Product:detail', ['#' => 'reviews']) produces ...#reviews. The value is URL-encoded, must be scalar, and isn't passed on as a request parameter.
• New Presenter::completeTemplate() – a protected method extracted from sendTemplate() that you can override to inject shared variables or set the template file before rendering.

A hardening release. Crafted or malformed request parameters that used to slip through as uncaught 500s now degrade gracefully to 4xx. If your site gets probed by scanners – and it does – these three fixes turn a batch of "Server Error" reports into clean Bad Request / Not Found responses.

• Self-links no longer crash on bad input – when a presenter builds a link to the current page (redirect('this'), forward('this'), isLinkCurrent('this'), typically from a language switcher) while the current URL carries a parameter that doesn't fit the action's typed signature (e.g. ?id=abc for int $id), the framework raised an uncaught InvalidLinkException (HTTP 500). It now reports a proper BadRequestException (4xx) through the new InvalidRequestParameterException. Explicitly passed bad link arguments still throw InvalidLinkException, so genuine programmer mistakes stay visible.
• Numeric component ids no longer trigger a TypeError – a crafted query key such as ?1-foo=bar produced a numeric component id that hit getComponent()'s string type hint and threw a TypeError (HTTP 500). The id is now cast to string and the request is handled gracefully.
• Routing panel survives weird parameters – a request like ?do[]=x could crash Tracy's routing panel during development. It now skips non-string presenter/signal/action values instead of throwing.

• Sharper phpDoc types and descriptions throughout the codebase
• Reverted the experimental hasPresenter()/getPresenterIfExists() addition and the $throw deprecation in Component/Form::getPresenter() – the previous API behavior stays unchanged
• {layout auto} no longer triggers infinite recursion – when used inside a referring template, the layout finder is now skipped instead of looping back on itself
• Response and router classes now use promoted readonly properties, trimming boilerplate across Application, FileResponse, JsonResponse, RedirectResponse, TextResponse, ForwardResponse and CliRouter
• Callback parameters in PresenterFactory, CallbackResponse and Multiplier are normalized to Closure for stronger typing

• added #[TemplateVariable]
• LinkGenerator: throws an error when the link points to #[Requires(forward: true)]

• support for PHP 8.5
• compatible with Latte 3.1
• LinkGenerator: do not pass defaults of #[Parameter] (#355)
• PresenterFactoryCallback: fixed $invalidLinkMode can't be overwritten by config #337

• Latte: added filter |absoluteUrl and {linkBase}
• SnippetRuntime: Fixed snippets rendering when multiple templates are rendered (#349)
• TemplateFactory: does not assign the default property to the template if it does not match the type #352
• class Template is abstract
• error 500: improved CSS style reset nette/tracy#581
• optimized global function calls

• LatteExtension: added option 'locale'
• LatteExtension: automatically passes translator to Latte\Essential\TranslatorExtension
• support for PHP 8.4

• ApplicationExtension: checks the correct usage of attributes
• Component::tryCall() throws BadRequestException
• Multiplier::createComponent() allow to return a null (#327)
• LatteExtension: fixed v3.2.3