nette/forms

The headline of 3.3 is CSRF protection that the browser handles for you – no token, no cookie, no server-side state, and it holds even against XSS. On top of that, the confusing {formContext} / {formContainer} pair collapses into a single {form scope}, you can finally nest forms with {form detached}, and a round of housekeeping clears out long-deprecated APIs. Please test and report anything that breaks for you.

• PHP 8.3+ and Latte 3.1.4+ are now required.

💥 Breaking Changes

• CSRF is now strictly same-origin. Forms validate the Sec-Fetch-Site header instead of the old SameSite cookie. The previous mechanism trusted submissions from any subdomain of the same site; the new one demands an exact origin match (scheme + host + port).
• setValues() / setDefaults() now expect iterable|stdClass.
• RadioList / CheckboxList: getControlPart() and getLabelPart() throw on an invalid item key instead of silently returning a nonsensical result.
• Removed long-deprecated APIs:** DataClassGenerator, LatteRenderer, getValues(true) (use getValues('array')), and the $default parameter of getOption() (use the ?? operator), negative validation rules

✨ New Features

• {form scope name} – one tag to replace the easily-confused {formContext} and {formContainer}. It pushes the form onto the stack without emitting <form>, resolving the name relatively to an active form when there is one, otherwise from the top level.
• {form detached name} – nest forms at last. HTML forbids nested <form> tags, so detached emits an empty <form></form> up front and links every control back to it via the HTML5 form="..." attribute, no matter where they sit in the DOM.
• addSubmit() accepts an $onSubmit callback – attach a click handler right when you create the button, without a separate ->onClick[] =.

🗑️ Deprecations

• A missing comma before {form} arguments – write {form name, attr=val} instead of {form name attr=val}, freeing keywords like scope/detached next to the name.
• Several magic properties

A maintenance-focused release that tightens type safety across the whole codebase, modernizes the JavaScript test stack, and turns static analysis into a non-negotiable part of the build. No API changes – just a more solid foundation under the hood.

• Native types everywhere – filled in missing native type declarations across Container, BaseControl, Validator, Rules, Form and friends, so PHPStan (and your IDE) see the real shape of things
• Sharper phpDoc – tightened phpDoc types and descriptions throughout, giving better autocomplete and clearer intent at every call - Reorganized a few tests and switched some over to allowCrossOrigin() for clarity

• support for PHP 8.5
• compatible with Latte 3.1
• CheckboxList, RadioList::getControl() return empty element when has no items

• composer: allows Latte 3.1
• optimized global function calls

• SelectBox: correctly selects prompt #343
• MultiChoiceControl: fixed order of selected items
• tests: improved descriptions
• netteForms: do not propagate 'submit' event further when the form is invalid
• netteForms: fixed submitter property

• Container::addEmail(): added $maxLength=255 #303
• ChoiceControl, MultiChoiceControl: disabled items are processed in getValue() instead of loadHttpData()
• removed return type from __call() nette/utils#315
• SelectBox: fixed 2edbd6c
• netteForms: uses the submitter property

• Container::getValue() supports conversion to enums [Close #337]
• UploadControl: added setNullable()
• netteForms: rewritten to TypeScript
• Button: is omitted from values #330
• DefaultFormRenderer: fixed cummulate instances of Nette\HtmlStringable #335
• Helpers::getSupportedTypes() returns array #332
• support for PHP 8.4

• netteForms: modernized code
• netteForms: reimplemented compact transmission mode via formdata event
• netteForms: processes only elements with 'data-nette-rules'
• netteForms: added typehints to jsDoc
• netteForms: improved badInput reporting
• netteForms: rule 'length' works with numbers #329
• Form: does not show 'no associated handlers' error if the form is not submitted by the button
• Blueprint: fixed nullable types detection
• TextBase, HiddenField: added isNullable()