• New Form::Enum rule checks that a value is a case of a backed enum, so invalid input is caught by validation, in the browser too, before it reaches your typed DTO: ->addRule($form::Enum, arg: Status::class)
• Event handlers resolve both parameters by their type, so function (array $values, Form $form) works in onSuccess, onError, onClick and onValidate (#345)
• %value in error messages reads naturally: uploaded file names, the items of a multi-choice selection, and dates in the control's format, on the server and in netteForms.js alike (#302)
• Rules Filled, Blank and Valid work with any Control implementation, so custom controls no longer need to extend BaseControl to use them (#346)
• PHPStan accepts validators with narrowed parameter types in addRule() and addCondition(), and extension methods that take arguments (#350, #354)
• PHP 8.6 is supported

🐛 Bug Fixes

• Events such as onSuccess can again be fired by calling them as methods (#356)
• In Latte, $form points back to the enclosing form after a nested {form} closes
• Rule messages and translators may return a Stringable object (#349, #312)
• A GET form whose action contains a query parameter without a value (?foo) renders correctly (#348)
• netteForms.js validates like the server: lengths count characters, min/max compare numerically, a URL may have a query or fragment without a path, AVIF is a default image type, and the browser's bad-input check respects the validation scope
• Exceeding post_max_size reports its own message, and the Numeric rule has a default message

• PHP 8.6 is supported
• %value in error messages now reads naturally for every control: uploaded file names, the items of a multi-choice selection joined by commas, and dates in the control's format (#302)
• Rules Filled, Blank and Valid work with any Control implementation, so custom controls no longer need to extend BaseControl to use them (#346)

🐛 Bug Fixes

• Rule messages and translators may return a Stringable object; validation messages, select optgroups and the prompt now accept it (#349, #312)
• Form values map onto int-backed enum properties: numeric strings from text and hidden fields convert to the matching case, and a value with no matching case is passed on unchanged
• A GET form whose action contains a query parameter without a value (?foo) renders correctly (#348)
• Exceeding post_max_size reports its own message instead of the one for file size
• A Form or Container subclass that applies the SmartObject trait again works without a fatal error (nette/utils#338)

• Ready for PHP 8.6
• insert([]) now inserts a row of database defaults on PostgreSQL, SQLite and MS SQL too, not only on MySQL, so saving an empty form works on every engine

🐛 Bug Fixes

• Floats keep their full value, both as bound parameters and inlined in SQL; 1/3 or 1e-11 reach the database exactly as they are in PHP
• Selection::insert() with a list of rows returns the number of inserted rows, as documented; code that used the returned ActiveRow now gets an int (#330)
• transaction() rethrows the original exception even when the final ROLLBACK fails, e.g. after a deadlock
• GroupedSelection::limit() respects the offset when the selection belongs to multiple parent rows, and a Selection over a table without a primary key can be re-queried
• Conditions skipped by a short-circuited ?and / ?or no longer leave their parameters behind
• A where() identical to an existing JOIN condition is no longer dropped, and binary parameters no longer make distinct conditions collide
• Row: isset() and offsetExists() give correct answers, including for falsy values
• Reflection is more accurate across drivers: column order of composite foreign keys and indexes (MySQL, PostgreSQL), column defaults (PostgreSQL, #329), primary key and identity columns (MS SQL), tables without an explicit schema (MS SQL), autoincrement detection (SQLite) and table resolution along search_path (PostgreSQL)
• MS SQL: identifiers containing [ or ] are escaped correctly, and offset-only or zero-limit queries generate valid SQL
• The Tracy panel no longer shows duplicate BlueScreen SQL sections with multiple connections

🛡️ Robustness

• Constraint violations on SQL Server, CHECK violations on SQLite and more connection-loss codes on PostgreSQL and MySQL now map to the specific exception classes
• Misuse reports a clear exception instead of a PHP error: an unknown PDO driver, page() with less than one item per page, related() on a composite primary key, getInsertId() on a failed lazy connection, an unknown table in Reflection on SQLite, an unknown constant in the DI options; the ambiguous-reference message names the table, key and candidates
• The DI extension detects a single connection by the presence of dsn, so key order in the config no longer matters

• Ready for PHP 8.6
• SQLiteStorage now cleans up after itself – expired items are removed by probabilistic garbage collection, just like in FileStorage (#83)

🐛 Bug Fixes

• FileStorage: an Items dependency on an item that is being generated at the same moment no longer hangs the process (#54)
• FileStorage: cleaning the cache leaves alone files and directories of other tools sharing the cache directory, such as Latte, and copes safely with any foreign file it comes across (#45)
• MemcachedStorage: items with an expiration longer than 30 days are now kept for the intended time
• SQLiteStorage: bulkRead() works with any number of keys, regardless of the SQLite limit of query parameters

🛡️ Robustness

• PsrCacheAdapter follows PSR-16 more closely: a zero or negative TTL deletes the item, and a DateInterval TTL is converted independently of the timezone
• Edge cases in storages: a non-positive expiration in MemcachedStorage removes the item, SQLiteJournal keeps priority 0, SQLiteStorage ignores Sliding without Expire like the other storages, and SQLite transactions are rolled back on failure

✨ New Features

• GitHub Actions annotations – the new -o github output marks failed tests directly in the PR diff view, and it switches on automatically when Tester runs on GitHub Actions, so there is nothing to configure
• Test time limit – --timeout <seconds> sets a limit for every test, @timeout overrides it per file; a test that runs over is terminated and reported as a failure instead of blocking the whole run
• --slowest – prints the 10 (or as many as you ask for) slowest tests after the run, so you know exactly where the time goes
• #[DataProvider] and #[Throws] attributes – TestCase methods can now use PHP attributes instead of docblock annotations; the annotations keep working
• HttpAssert::fetch() accepts a timeout (30 seconds by default), so an unresponsive server can't stall a test
• JUnit reports now include test durations, for failed and skipped tests as well
• Faster cold start – TestCase methods are discovered in parallel with other tests, and each test file's annotations are parsed only once

💥 Breaking Changes

• PHP 8.1 is now the minimum required version
• Environment::skip(), Environment::exit() and TestCase::skip() now return never; a subclass overriding them must change its return type too
• The tester command exits with a non-zero code when it finds no tests, so a mistyped path no longer passes in CI
• A TestCase data provider that returns no data sets is now an error, just like an empty file-level provider
• Assertion type 'integer' in Assert::type() is deprecated, use 'int'

🐛 Bug Fixes

• TAP and JUnit outputs no longer contain ANSI color sequences
• Environment::lock() reports an error when the lock directory does not exist

• fromCode() now keeps a file comment placed before declare(strict_types=1) (#182)
• Extracting method and property hook bodies ignores the members of anonymous classes nested inside them
• PropertyHookType is now an alias of PropertyAccessMode, so both enums are interchangeable wherever hooks are added or looked up

🛡️ Robustness

• Invalid declarations now report a clear error when printed: a readonly property that is static or has a default value, a final private constant, an abstract final property hook, and an enum whose backing type is not int or string or whose case values do not match it
• setHooks() validates hook types, and the presence of php-parser 5 is detected reliably, with a clear message when an older version is installed

• Support for PHP 8.6
• Support for nette/neon 4.0: configuration files are read the same way as with 3.x, which keeps working
• #[SensitiveParameter] now hides arrays and other non-scalar arguments too, so database credentials passed as an array no longer show up in Tracy's source snippets
• Nette\DI\Definitions\Definition now lives at Nette\DI\Definition; the old name keeps working as an alias

💥 Breaking Changes

• Locator definitions are checked at compile time. Every reference must match a get*() or create*() method of the interface, and every method with a non-nullable return type must have its reference. A typo in a key now fails compilation with a message naming the reference or method, where it used to compile and throw MissingServiceException only on the first call. Fix the key, or make the method's return type nullable if the service is truly optional. Interfaces with a generic get($name) are exempt.
• Service names may no longer contain __, which is reserved for encoding dots in the names of generated methods.

🐛 Bug Fixes

• Locator methods with an acronym work with the natural key: getPDO() finds the reference pdo (and still pDO), the same for getURL(), getDB() and the like
• Container::createInstance() and callMethod() pass the actual value to a scalar parameter marked #[SensitiveParameter]
• getServiceDescriptors() reports a service named PDO under its real name instead of pDO

💥 Breaking Changes

• Requires PHP 8.4 or newer and the mbstring extension
• The tree API is new: Neon::parse() returns a Nodes\DocumentNode, and the classes Decoder, Node\* and the old Traverser are gone. Code that walked the old nodes moves to the new tree, see examples/tree
• Neon::encode() throws Nette\Neon\Exception for a string that is not valid UTF-8 instead of replacing it with U+FFFD; its errors now name the path to the value
• Some error messages are more precise; code that matches their text may need an update
• neon-lint has a new command-line contract: --debug is gone, and a failure of the tool itself exits with 2
• Neon::BLOCK and Neon::CHAIN are deprecated, use blockMode: true and Neon::Chain

✨ New Features

• Lossless parsing – Neon::parse($text)->print() === $text holds for any input NEON accepts
• Format-preserving editing – setValue(), addItem() and removeItem() change only the tokens they edit: 0x0CEA stays hexadecimal, yes becomes no, a new key is indented like its siblings, and a removed item takes its comment along. A refused edit changes nothing at all, so installers, admin panels and AI agents can rewrite config.neon safely
• A navigable tree – nodes know their parent, their comments and their position (line, column, offset); find(), findAncestor(), siblings, and a public Traverser that can replace and remove nodes on the walk
• Evaluator – subclass it to turn literals, strings or entities into your own values, such as constants or parameters, the way the Nette DI container reads its configuration
• Neon::encode() accepts a closure as $blockMode to decide per array whether it is written as a block, e.g. fn($v, $path) => !$path for the first level only, and writes floats in the shortest form that reads back exactly
• Exception carries the position of the problem as an object and the bare message via getDescription()
• neon-lint reports one line per finding, --json for tools and --check to verify that a file prints back byte for byte; an AI agent can run it after saving a .neon file
• Runnable examples with their real output document the whole API
• The format, the tree and the editing semantics follow a language-neutral specification shared with the JavaScript implementation @nette/neon

• Neon::encode() now quotes strings like -.5 and +.5, so they decode back as strings, not floats
• Multiline strings whose first line starts with whitespace, or with a line starting with ''', now survive an encode and decode round trip unchanged
• neon-lint no longer mistakes --debug for the path to check

🛡️ Robustness

• The parser holds up against hostile input: nesting deeper than 500 levels throws Too deep nesting instead of overflowing the stack, and deeply nested dash lists no longer take exponential time to parse
• Error messages count the column in characters rather than bytes, and their excerpts never cut a multibyte character in half

• PHP 8.6 is officially supported
• Static analysis now knows that getQuery() and getPost() without a key return an array of all parameters
• IResponse::setCookie() declares the $sameSite and $partitioned parameters, so code typed against the interface passes static analysis when using them (#247)

🐛 Bug Fixes

• getQuery(null) and getPost(null) return all parameters, the same as calling them without an argument
• getDomain() of Url and UrlImmutable returns IPv6 addresses with an embedded IPv4 part ([::ffff:192.0.2.1]) and 0.0.0.0 whole instead of splitting them at the dots (#241)

• Ready for PHP 8.6

🐛 Bug Fixes

• Security: the client address behind a trusted proxy is now taken from the rightmost untrusted hop of Forwarded / X-Forwarded-For, so a client cannot spoof it by prepending its own entry. Scheme and host are read from that same hop, and getRemoteAddress() returns null when the forwarded value is not a valid IP.
• UserStorage::setNamespace() now works when switching to another namespace after the storage has been used

• Runner now warns you when Xdebug is active and slows the whole run down many times over, so a forgotten xdebug.mode no longer quietly costs you minutes (no warning when Xdebug serves as the code coverage engine)

🐛 Bug Fixes

• FileMock is ready for PHP 8.6
• Call arguments in stack traces stay on a single line even when strings contain newlines or tabs

• PHP 8.6 is now supported

🐛 Bug Fixes

• The authenticator defined by security: users: in NEON is now autowired to services that require Nette\Security\Authenticator

✨ New Features

• JsonSchema::export() – turns a schema into a JSON Schema
  document, the format editors read to validate and complete JSON or YAML files. It exports
  types, ranges, patterns, required items, enum values and descriptions. A type that exists
  only in PHP, such as a class, throws NotSupportedException instead of exporting something
  the schema would not accept.
• description() – attach a human-readable description to any element. It does not affect
  validation, and it travels into the JSON Schema export.
• Expect::enum() – stop hand-rolling the conversion of backed enums:
  Expect::enum(Suit::class) accepts the backing value or the case itself and always gives
  you the case. An enum-typed property in Expect::from() maps to it automatically.
  Expect::type(Suit::class) keeps meaning plain instanceof, as for any other class.
• Expect::tuple() – a fixed-size list where each position has its own schema:
  Expect::tuple([Expect::string(), Expect::int()]). otherItems() describes the rest
  elements, extend() appends positions, and when configurations are layered, a later tuple
  replaces the earlier one as a whole.
• Expect::listOf() with wrap – Expect::listOf('string', wrap: true) also accepts a single
  value and wraps it into a one-item list, so both email: foo@example.com and
  email: [a@example.com, b@example.com] work.
• mergeMode() and mergeWith() – say in the schema how layered configurations combine
  instead of relying on the deep merge: Expect::arrayOf('string')->mergeMode(MergeMode::Replace)
  takes the later array as a whole, while OverwriteKeys and AppendKeys merge by keys. Any
  element can get its own combining function, such as
  Expect::bool()->mergeWith(fn($value, $base) => $value || $base). A schema without them
  merges exactly as before, and the same calls keep working in 2.0.
• castTo('?type') – castTo('?string') keeps a null and casts everything else. A class
  or an enum keeps the null even without the question mark, so
  Expect::string()->nullable()->castTo(DateTime::class) just works.
• Kind-specific element classes – Expect::string() returns a StringType, Expect::int()
  a NumberType, Expect::listOf() an ArrayType, so your IDE and PHPStan know which options
  each element has. They are subclasses of Type, so existing code keeps working.

⚠️ Deprecations

• before() called repeatedly – a second before() on the same element still replaces the
  first one, but raises a notice: in 2.0 the handlers will chain in declaration order. Merge
  them into one.
• '?int[]' – in 1.x it means an array of nullable items, while 2.0 reads it as a nullable
  array, as phpDoc does. The notice names the replacement that keeps the meaning:
  Expect::arrayOf(Expect::type('int')->nullable()).
• Options that do not fit the element – min(), max(), pattern(), items() and
  mergeDefaults() on a union such as Expect::type('int|string') belong to the variants:
  Expect::anyOf(Expect::int()->min(1), Expect::string()->min(1)). Likewise pattern() on a
  number or an array, items() on a string or a number and mergeDefaults() on anything but
  an array raise a notice.

🐛 Bug Fixes

• A nullable anyOf() containing a structure or an array gives null for a null input,
  wherever the null sits among the variants.
• Smaller fixes: anyOf()->deprecated() emits its warning, min() and max() keep the
  precision of large integer bounds, and the internal _prevent_merging marker no longer
  appears in the output of a structure.

• PHP 8.6 is now supported

🐛 Bug Fixes

• Loading a class with ClassType::from() or fromCode() now keeps the types of typed class constants (PHP 8.3)

• contenteditable, draggable, spellcheck, hidden are no longer treated as plain boolean attributes, because in HTML they are not. contenteditable={$editable} now renders contenteditable="true" or contenteditable="false", so false really turns editing off instead of silently inheriting it from the parent, and draggable can be set to true at all. hidden and popover stay flags but keep a value, so hidden="until-found" survives. With migration warnings on, Latte reports every place where the output changes; use |toggle to keep the old bare-name rendering
• Sandbox – property names in a policy are case-sensitive, as they are in PHP: allowing visible no longer allows Visible
• isPartialFunction() of the call nodes is renamed to isPartialApplication() – only matters for extensions working with the AST

✨ New Features

• PHP 8.6 support
• NodeHelpers::find() and findFirst() accept a node class as the filter: find($node, TextNode::class) returns a list<TextNode>, no type annotation needed
• ExpressionNode::toValue() and hasValue() tell an extension whether an expression is a literal value and which; NodeHelpers::toValue() is deprecated in their favor

🔒 Security

• The sandbox got a thorough review of its runtime checks: a dynamic property name is evaluated just once, so it cannot be checked with one value and accessed with another; (array) cast of an object is forbidden and foreach over an object checks its properties against the policy; $iterator no longer passes calls of unknown methods to the iterated object; and -> / ?-> method calls behave exactly as in PHP
• A <script> whose type is anything the browser might execute (e.g. text/javascript1.5) is escaped as JavaScript; only a plain data type such as text/html or text/x-template is escaped as text
• A custom sandbox policy without getCacheSignature() triggers a deprecation, because its instances with different rules would share compiled templates

🐛 Bug Fixes

• {include parent} restores the block level after an exception and works in a block that includes itself
• {capture $a[$i++]|filter} evaluates its target once
• |slice with a negative start or length works on iterators the same way as on arrays, and |batch keeps every item of an iterator with repeated keys
• An arrow function body swallows and, or and xor, as in PHP
• The deprecation of an unqualified constant is no longer raised for class names written in capitals such as FOO::bar() or new FOO

🛡️ Robustness

• Writing through ?-> anywhere in a chain ($a?->b->c = 1) is a compile error instead of a PHP error later
• The linter writes errors to stderr outside CLI too and restores its error handler for an unreadable file

✨ New Features

• PHP 8.6 is supported

🐛 Bug Fixes

• FileSystem::normalizePath(), joinPaths() and resolvePath() keep the scheme of paths like phar://

✨ New Features

• PHP 8.6 is supported
• Magic factories accept the default as a named argument, so Expect::string(default: 'abc') or Expect::int(default: 10) reads exactly as it means

🐛 Bug Fixes

• A pattern that does not compile now throws InvalidStateException – previously every value failed as a mismatch next to a PHP warning, so a broken schema looked like invalid data
• A transform calling process() on the same Processor no longer wipes out the outer run's errors, which could let invalid data through as valid
• When a before() or transform() of a key schema turns the key into something other than int|string, you get a validation error instead of a TypeError or, worse, a silently cast key overwriting another item
• Expect::from() reflects only public non-static properties of a class without a constructor, so a private, protected or static property no longer makes every process() crash on "Cannot access private property"
• Expect::from() refuses a variadic constructor parameter with a clear exception instead of a cryptic ReflectionException
• Warnings about an array key (e.g. a deprecated key) are labeled as a key, just like errors are

✨ New Features

• TestCase::run() – no longer stops at the first failing method: every test method runs, results come first and the details of each failure follow (#469)
• Stack traces show the actual call arguments, so you immediately see which call failed – redirect('https://…', 302) instead of a bare redirect()
• PHP 8.6 support

🐛 Bug Fixes

• Assert::exception() and Assert::error() – an empty or '0' message is now really checked instead of silently disabling the message check; pass null if you don't want to verify the message
• @phpversion – boundaries and the == and != operators now work as documented: @phpVersion 8.4.3 runs on PHP 8.4.3, == 8.4.1 runs only on 8.4.1 and != 8.4.1 everywhere else. Common forms like @phpVersion 8.1 or < 8.4 behave as before; == and != compare the full version, so == 8.4 matches no release
• @multiple – 0 or a non-numeric value is reported as an error instead of quietly running the test twice
• --stop-on-fail with parallel jobs no longer returns while other tests are still running; Ctrl+C terminates running test processes and every output handler is always finalized
• Environment::lock() no longer eats into the test time limit while waiting for the lock on Windows
• @httpcode reads the right status even when php-cgi prints a warning before the headers
• Environment variables of the runner are restored after starting a test, and a Job works without a temp directory and keeps its stderr
• Dumper no longer changes data reachable through references while dumping it; INF and NAN are dumped as valid PHP
• HttpAssert – with follow: true the headers come from the final response only, so the Location of a redirect no longer leaks through; a header sent several times (e.g. Set-Cookie) is joined with a comma instead of keeping the last value; header existence checks count as assertions
• Masks in Assert::match() – patterns with non-ASCII text match whole UTF-8 characters, %f% rejects invalid numbers like .1.2, and a failing regular expression no longer leaves pcre.backtrack_limit changed
• FileMock – appending through several handles, modes like rb+ and touch() now behave like a real file
• DomQuery – [attr$="value"], attribute values containing quotes and selector lists like a, b on PHP < 8.4 work correctly
• JUnit report stays well-formed XML even when test output contains control characters or invalid UTF-8, and failed tests are counted in the failures attribute instead of errors (tools reading only errors now see 0)
• Helpers::purge() refuses a path that resolves to the root directory, e.g. through .. or a symbolic link
• Code coverage – the HTML report escapes file names, can be rendered repeatedly in one process, handles files with only dead code and numbers the last line of files without a trailing newline; Clover metrics include functions, enums and code outside classes; TAP or JUnit output on stdout is no longer polluted by the coverage summary, and tester exits with code 1 when the requested report cannot be generated
• Clearer error messages, e.g. "No assertions were executed in this test." instead of "This test forgets to execute an assertion.", and Assert::contains() keeps your custom description

💥 Breaking Changes

• Applications configured through the DI extension now trust only X-Forwarded-* headers from a trusted proxy by default, so a client-supplied Forwarded header can no longer spoof the address or host. If your proxy uses the Forwarded header, set http: proxyHeaders: forwarded (or both).
• getRemoteAddress() returns null instead of a non-IP string when the innermost forwarded value is not a valid IP address (e.g. an obfuscated identifier or a broken chain).

✨ New Features

• proxyHeaders option (both|xForwarded|forwarded|none) and the $forwarded / $xForwarded flags of RequestFactory::setProxy() let you tell Nette exactly which forwarding headers your proxy manages – and ignore the rest.
• RequestFactory::setBaseUrl() and the http: baseUrl option give CLI runs (cron, tasks, MCP servers) a real request URL, so %baseUrl%, LinkGenerator, template $baseUrl and assets work outside the web server too. It kicks in only when no host can be detected, so web requests are unaffected.

🐛 Bug Fixes

• Trusted-proxy resolution now parses Forwarded into proper RFC 7239 hops and picks the client by stripping trailing trusted proxies, instead of blindly trusting the leftmost, client-spoofable value; scheme and host are taken from the same hop as the selected address and no longer discarded on multi-hop headers.
• Response::setCookie() treats an explicitly empty $path or $domain as given: '' now yields a host-only cookie or the / path instead of silently falling back to the configured defaults. Only null means "not specified".

✨ New Features

• Containers now reload themselves. PHP cannot redeclare a loaded class, so a worker, dev server or any long-running process with auto-rebuild kept serving the very first compiled container even after the configs changed and the file on disk was regenerated. Each build now declares a fresh class and the loader decides by file content, so a rebuild triggered by another process over the same cache is picked up too.
• New Container::getServiceDescriptors() – a read-only snapshot of every registered service (name, type, autowiring, tags, aliases, and the instance if it exists), in definition order, without instantiating anything. Tools that until now read the container's private properties through Closure::bind() and scanned createService* methods by reflection can drop the tricks; the Tracy panel already has.
• New Nette\Bridges\DIPsr\PsrContainer – wrap your container and hand it to any library that speaks PSR-11. get() resolves both service names and autowired types, with ambiguity reported rather than guessed.
• A service produced by a factory can autowire itself in its own setup, so @self and self-typed arguments work there like anywhere else.

🐛 Bug Fixes

• Windows users: writing the compiled container no longer fails intermittently with "Access is denied" when antivirus or an opcache handle holds the target file for a moment – the rename is briefly retried, and the opcache handle is dropped first. Other platforms behave exactly as before.
• addService() refuses a name already taken by a factory, matching the existing behavior for instances. The counterpart: removeService() now removes factories too, so a name freed by removeService() is genuinely free.

⚡ Performance

• Registering a definition no longer scans every existing definition to check for a case-insensitive name clash; an index does it in constant time. Containers with thousands of services notice.

✨ New Features

• The Dumper now understands modern PHP constructs – PHP 8.4 virtual hooked properties render as {virtual} instead of the misleading unset, WeakReference shows its target (or (dead)), PHP 8.5 Uri\Rfc3986\Uri and Uri\WhatWg\Url expand into address and components, closures reveal the class of their bound $this, and lazy objects expose their eagerly-initialized private and protected properties without throwing
• cURL handles are dumped again – now via CurlHandle, not the long-gone resource type
• X-Tracy-Agent request header – non-browser agents (curl, HTTP clients, CI jobs) can ask for markdown output without the webdriver cookie, and a non-HTML response carries the markdown BlueScreen straight in the body
• editor: false in the Nette configuration finally disables editor links; previously the value was silently ignored

🐛 Bug Fixes

• Tracy's fetch() wrapper no longer drops the options argument and no longer mutates the caller's Request object – AJAX calls reach the server exactly as your code wrote them
• The XMLHttpRequest patch stopped stacking a load listener on every open() call, and a dump with a broken payload no longer aborts the initialization of every other dump on the page
• A corrupt localStorage / sessionStorage entry no longer breaks the Bar and Toggle initialization
• Toggle links can be activated from the keyboard again
• Dumper::$keysToHide and the scrubber now also apply to properties returned by __debugInfo() and custom object exporters – sensitive values no longer slip through
• Debugger::dump() with return: true respects $keysToHide and passes the options in CLI mode
• The email throttle is now atomic and honest: an invalid $emailSnooze interval throws instead of silently flooding your inbox, concurrent requests can no longer both send the same notification, and the snooze window restarts only after the mail was really sent
• TracyToPsrLoggerAdapter no longer logs an exception twice when the accompanying message adds no information, and casts Stringable messages to string
• FileSession hardening – session files are created with mode 0600, unserialization refuses objects, the cookie gets SameSite=Lax plus the secure flag on HTTPS, and concurrent garbage collection no longer emits warnings
• BlueScreen no longer triggers autoloading of class names it finds in an exception message
• The exception fallback output is HTML-escaped in HTML mode
• A repeated DeferredContent::enable() after output has started is a harmless no-op instead of an exception
• The Dumper's exposer ordering comparator is a valid total order and understands interface-keyed exposers, so custom exposers are picked deterministically
• Removed legacy browser workarounds (IE getAttribute flag, keyCode, navigator.platform, document.write() in the panel popup) and evalScripts() no longer leaves executed <script> clones behind in the DOM

✨ New Features

• castTo() now accepts a backed enum – Expect::string()->castTo(Status::class) converts the value via Status::from() and, when it doesn't match, reports a proper validation error listing all allowed cases instead of blowing up with a ValueError. Pure (non-backed) enums are rejected up front with a clear message.
• Casting to a class that can't swallow the given value no longer surfaces as a bare Error – you get an InvalidStateException naming the target class, so you know what failed to be constructed.

🐛 Bug Fixes

• A null value for a nullable array is finally left as null. Previously the "NEON can't tell null from an empty array" workaround kicked in even for schemas explicitly declared nullable(), silently turning your null into [].
• Items with an invalid key are now dropped instead of being merged together – all failing keys used to collapse into a single '' entry, quietly overwriting each other's values.
• Processor::getWarnings() no longer dies with an error when called before anything was processed; it simply returns an empty array.
• deprecated() on a required structure no longer emits a warning when the item isn't present in the input at all – you only get warned about deprecated items you actually used.
• anyOf() stopped losing information in the winning branch: dynamic parameters found inside are propagated to the outer context again (they used to be silently forgotten, so DI never validated them), and skipDefaults is now honored inside the branch. A DynamicParameter schema also no longer registers itself for deferred validation.
• Error messages keep unknown %placeholders% intact instead of tripping over an undefined index.

🔒 Security

• DkimSigner no longer emits the l= body-length tag. With it, anyone could append arbitrary content to a signed message without invalidating the signature.

✨ New Features

• SmtpMailer::setAccessToken() – authenticates with an OAuth 2.0 access token (XOAUTH2), which Gmail and Microsoft 365 require now that they are retiring passwords for SMTP. Pass the token as a string, or as a callback that is called on each connection so an expiring token gets refreshed.
• Message::setUnsubscribe() – emits the pair of one-click unsubscribe headers (RFC 8058) that Gmail and Yahoo require from bulk senders. Getting the two headers to agree is exactly the kind of detail that is easy to get wrong by hand; the headers are also DKIM-signed, so the unsubscribe target cannot be swapped in transit.
• DkimSigner signs with Ed25519 keys (RFC 8463). The algorithm is detected from the key itself, so no new argument is needed. New header oversigning (opt-in via $oversignHeaders) makes appending a second From: header break the signature.
• FileMailer – a mailer that writes each message to an .eml file instead of sending it; ideal for development and testing.
• Addresses with internationalized domains – jan@příklad.cz – are converted to punycode automatically, so they work with ordinary SMTP servers instead of failing with a puzzling server error.

🐛 Bug Fixes

• CssInliner resolves competing declarations by the real CSS cascade – !important, inline styles, selector specificity, source order – instead of letting the last rule win. Inlined emails now look like the page the stylesheet was written for, and each property is written out once, with the winning value.
• CssInliner no longer turns width: auto or calc(...) into width="0" (which collapsed the cell in Outlook), and treats property names case-insensitively, as CSS does.
• Header names are case-insensitive per RFC 5322: getHeader('from') finds the From header, setHeader('SUBJECT') replaces the existing Subject instead of adding a second one, and DKIM signing matches headers whatever their spelling.
• SmtpMailer got a robustness overhaul: a persistent connection dropped by an idle server is detected and re-established instead of failing every send from then on; large messages are no longer silently truncated when the socket buffer fills up; the read timeout holds even against a server that never stops talking; and authentication picks only from mechanisms the server actually offers, including the legacy AUTH= advertisement.
• SmtpMailer STARTTLS accepts only TLS 1.2 and 1.3, reports the actual handshake failure reason instead of a bare "Unable to connect", and defaults to the submission port 587.
• FallbackMailer no longer keeps retrying a mailer whose failure is permanent, like rejected credentials – retrying cannot fix those.
• DkimSigner relaxed canonicalization collapses every whitespace sequence, including tabs, so signatures on such headers verify everywhere.

🔒 Security

• DkimSigner no longer emits the l= body-length tag. With it, anyone could append arbitrary content to a signed message without invalidating the signature.

✨ New Features

• SmtpMailer::setAccessToken() – authenticates with an OAuth 2.0 access token (XOAUTH2), which Gmail and Microsoft 365 require now that they are retiring passwords for SMTP. Pass the token as a string, or as a callback that is called on each connection so an expiring token gets refreshed.
• Message::setUnsubscribe() – emits the pair of one-click unsubscribe headers (RFC 8058) that Gmail and Yahoo require from bulk senders. Getting the two headers to agree is exactly the kind of detail that is easy to get wrong by hand; the headers are also DKIM-signed, so the unsubscribe target cannot be swapped in transit.
• DkimSigner signs with Ed25519 keys (RFC 8463). The algorithm is detected from the key itself, so no new argument is needed. New header oversigning (opt-in via $oversignHeaders) makes appending a second From: header break the signature.
• FileMailer – a mailer that writes each message to an .eml file instead of sending it; ideal for development and testing.
• Addresses with internationalized domains – jan@příklad.cz – are converted to punycode automatically, so they work with ordinary SMTP servers instead of failing with a puzzling server error.

🐛 Bug Fixes

• CssInliner resolves competing declarations by the real CSS cascade – !important, inline styles, selector specificity, source order – instead of letting the last rule win. Inlined emails now look like the page the stylesheet was written for, and each property is written out once, with the winning value.
• CssInliner no longer turns width: auto or calc(...) into width="0" (which collapsed the cell in Outlook), and treats property names case-insensitively, as CSS does.
• Header names are case-insensitive per RFC 5322: getHeader('from') finds the From header, setHeader('SUBJECT') replaces the existing Subject instead of adding a second one, and DKIM signing matches headers whatever their spelling.
• SmtpMailer got a robustness overhaul: a persistent connection dropped by an idle server is detected and re-established instead of failing every send from then on; large messages are no longer silently truncated when the socket buffer fills up; the read timeout holds even against a server that never stops talking; and authentication picks only from mechanisms the server actually offers, including the legacy AUTH= advertisement.
• SmtpMailer STARTTLS accepts only TLS 1.2 and 1.3, reports the actual handshake failure reason instead of a bare "Unable to connect", and defaults to the submission port 587.
• FallbackMailer no longer keeps retrying a mailer whose failure is permanent, like rejected credentials – retrying cannot fix those.
• DkimSigner relaxed canonicalization collapses every whitespace sequence, including tabs, so signatures on such headers verify everywhere.

💥 Behavior Changes & Deprecations

• {$interval|date} without an explicit format now throws instead of silently printing the literal format string j. n. Y. Pass a format for DateInterval, e.g. {$interval|date: '%d days'}.
• {first}, {last}, {sep} used outside a {foreach} now emit a deprecation warning – they rely on an ambient $iterator that only a loop provides. This becomes a compile-time error in Latte 3.2.

✨ New Features

• New |map filter – transform every item with a callback, the natural partner to |filter: {foreach ($items|map: fn($x) => $x->name) as $name}.
• New Extension::afterRender() hook – called in a finally, so it runs even when rendering ends early via {exitIf} or is interrupted by an exception. Perfect for cleanup or measurement.
• The Tracy panel now shows render time per template, both total and self (excluding nested templates), so you can finally see which template actually eats the time.
• |last, |random, |implode/|join, |commas now accept any iterable, not just arrays – hand them a generator or iterator directly, just like |first, |slice and |filter already allowed.

🐛 Bug Fixes

• Security: <script type=" text/javascript "> with surrounding whitespace was classified as raw text while browsers execute it as JavaScript. The type is now trimmed the way browsers do, so context-sensitive escaping kicks in correctly.
• Security: a template compiled under a permissive sandbox policy could be silently reused from cache under a stricter one, because part of the sandbox is enforced at compile time. Policy rules are now part of the cache key.
• Security: xlink:href in inline SVG is now treated as a URL attribute and sanitized like href.
• {capture $x|filter} no longer double-escapes its content. Adding an innocent filter like |trim used to strip the "HTML-ness" of the captured markup, escaping it on output; captured HTML now stays intact (while a filter that changes the content type still yields a plain string).
• {switch} with no expression used to compile to invalid PHP; it now works as a switch-true idiom ({case $cond}).
• <script type="a{$dyn}"> with a partially dynamic type attribute no longer fails compilation with a cryptic "Unhandled match case" – it's treated as JavaScript.
• The empty comment {**} no longer breaks compilation.
• |reverse and |column no longer drop elements from generators or iterators that yield duplicate keys.
• |indent no longer interprets $ or \ in the indentation string as regular-expression backreferences.
• |explode/|split (and |random) now raise a clear RuntimeException on malformed UTF-8 instead of a confusing TypeError.
• |padLeft/|padRight with an empty pad string, and the divisibleBy() function with a zero divisor, now throw a helpful message instead of a raw DivisionByZeroError.
• Compiled template class names now use a 64-bit hash (up from 40-bit), removing a small but real risk of two templates colliding so that one silently renders the other.
• Custom n:attributes whose name contains tag- or inner- (e.g. n:my-tag-attr) are no longer mangled by the prefix stripper.
• Extensions that subclass core nodes no longer silently break {iterateWhile}, {rollback} and {include parent} – Tag::closestTag() now matches subclasses, as its documentation always promised.
• A compile-time failure without a cache directory now surfaces as a proper CompileException pointing at the generated source, instead of a bare ParseError.

⚡ Performance

• The engine no longer recomputes its entire configuration signature on every {include}, {extends} or {embed} – a memoization lost in the 3.1 cache refactor is restored (and properly invalidated whenever you reconfigure the engine). This also fixes a crash when createTemplate(clearCache: false) was the very first call.
• Passing a parameters object to render() is roughly 2.6× faster – the reflection scan of the parameter class is memoized per class instead of being repeated on every render.

✨ New Features

• {spaceless} rewritten from the ground up – the minifier now truly understands HTML, so it squeezes out much more whitespace without ever breaking your page: it strips whitespace completely around block elements, keeps proper word spacing around inline tags like <i> or <a>, and leaves pre, textarea, script, style and attribute values untouched. And it streams, so even huge templates minify with no memory overhead.
• Implicit default block for {embed} – content written directly inside {embed} without a {block} wrapper now overrides {block default} of the embedded template, while an empty {embed} keeps the fallback (#419)
• {layout file, vars} – pass explicit variables straight to the parent template: {layout 'parent.latte', title: 'Hello'}. They reach the layout only (child blocks don't see them) and override same-named parameters. Works with {extends} too; note the comma before the arguments is required.
• |json attribute modifier – JSON-encode a dynamic HTML attribute value with smart quoting: <div data-config={$config|json}>

🐛 Bug Fixes

• {include parent} and {include this} now work inside dynamically named blocks – previously this was a compile error, or worse, silently bound to an outer static block
• {contentType} inside <script> now really switches the escaping context – previously it was a silent no-op unless the script element had a matching type attribute

🛠 For Extension Developers

• Every AST node now carries its full source extent: Node::$position marks the start and the new Node::$end the exclusive end; Range is a standalone start/end value object again (this reverts the shape shipped in 3.1.4)

• Hashed passwords in SimpleAuthenticator – stored passwords may now be crypt-format hashes (anything password_hash() produces) and can be freely mixed with plain-text ones. The format is detected automatically, so hashes just work in the security: users: config section with no extra option. A hash whose algorithm the PHP build doesn't know fails closed instead of being compared as plain text, and plain-text comparison is timing-safe.
• Passwords::bcrypt() and Passwords::argon2id() – name the algorithm instead of juggling PASSWORD_* constants and options arrays: Passwords::bcrypt(12) or Passwords::argon2id(memoryCost: 65536). Omitted parameters keep PHP's defaults, and argon2id() fails with a clear exception on builds without Argon2 support.
• ACL rules in the configuration – the new rules section lets you define permissions declaratively next to your roles and resources:

  security:
      rules:
          allow:
              - [guest, article, view]
              - [registered, comment, [add, edit]]
              - [admin]
          deny:
              - [banned, comment, add]

  Each rule is [role(s), resource(s), privilege(s)]; an omitted or null item means "all", and a bare string grants or revokes everything for that role. Malformed rules are rejected at config time, not at runtime.

🐛 Bug Fixes

• logout() no longer touches the storage when there is nothing to change, so logging out a guest doesn't needlessly regenerate the session ID or overwrite the logout reason. A stored authentication vetoed by wakeupIdentity() (a revoked token, say) is still properly cleared.
• Permission::isAllowed() now saves and restores the queried role and resource, making it re-entrant and exception-safe – an assertion callback can call isAllowed() again without corrupting the results of the outer query.

✨ New Features

• DateTimeImmutable – a new immutable counterpart to Nette\Utils\DateTime. It extends PHP's \DateTimeImmutable with strict validation (invalid dates and times throw instead of being silently rolled over), convenient factories from() and fromParts(), DST-safe relative modifications, and JSON serialization.
• FileSystem::writeAtomic() – writes a file atomically via a temporary file and rename, so a concurrent reader never sees it partially written or truncated. Ideal for caches and generated configs.
• Process::detach() – lets a process keep running in the background after the Process object is destroyed, instead of being killed by the destructor. Output must go to a file or be discarded, since nobody reads the pipes after detaching.
• Process – on Windows with PHP 8.5, captured output now flows through real pipes instead of temporary files, thanks to the fixed stream_select().
• Html::fragment() and add() – create a nameless element pre-filled with children, or append children to an existing element. Unlike addHtml(), plain strings are escaped by default and nulls are skipped.
• Html::text() and Html::html() – new static factories replacing fromText() and fromHtml(), which are now deprecated.
• Finder – the mask now fully drives recursion: **/foo together with in() searches recursively, and the ** short form expands like in zsh, so test/** means test/**/* and **.c means **/*.c (previously such masks silently degraded to a single *).
• Finder – a trailing slash in a find() mask matches directories only: find('temp/').
• Finder::exclude() – now uses the same mask grammar as find(): **.txt works, ./ anchors to the search root, and a trailing /, /* or /** controls whether the directory itself, its contents, or both are excluded.
• Finder – paths are no longer normalized to forward slashes; they stay in their native form, which also fixes corruption of backslashes in POSIX file names. Note: on Windows, returned paths may now contain backslashes where they used to be unified.

🐛 Bug Fixes

• ArrayList::prepend() – no longer misbehaves on an empty list.
• Validators::isUrl() – now rejects malformed IPv4 addresses with octets above 255, so nonsense like http://999.1.1.1 no longer passes as a valid URL.
• Strings::compare() – tolerates invalid UTF-8 instead of failing when the Normalizer gives up.
• Strings::length() – the fallback used when neither mbstring nor iconv is available no longer relies on the deprecated utf8_decode(), so it stays quiet on PHP 8.2+.
• Finder::exclude() – exclude('subdir/') silently excluded nothing due to a greedy regex; the trailing /, /* and /** variants now work as documented.

• Self-links no longer crash on bad input – when a presenter builds a link to the current page (redirect('this'), forward('this'), isLinkCurrent('this'), typically from a language switcher) while the current URL carries a parameter that doesn't fit the action's typed signature (e.g. ?id=abc for int $id), the framework raised an uncaught InvalidLinkException (HTTP 500). It now reports a proper BadRequestException (4xx) through the new InvalidRequestParameterException. Explicitly passed bad link arguments still throw InvalidLinkException, so genuine programmer mistakes stay visible.
• Numeric component ids no longer trigger a TypeError – a crafted query key such as ?1-foo=bar produced a numeric component id that hit getComponent()'s string type hint and threw a TypeError (HTTP 500). The id is now cast to string and the request is handled gracefully.
• Routing panel survives weird parameters – a request like ?do[]=x could crash Tracy's routing panel during development. It now skips non-string presenter/signal/action values instead of throwing.

• Self-links no longer crash on bad input – when a presenter builds a link to the current page (redirect('this'), forward('this'), isLinkCurrent('this'), typically from a language switcher) while the current URL carries a parameter that doesn't fit the action's typed signature (e.g. ?id=abc for int $id), the framework raised an uncaught InvalidLinkException (HTTP 500). It now reports a proper BadRequestException (4xx) through the new InvalidRequestParameterException. Explicitly passed bad link arguments still throw InvalidLinkException, so genuine programmer mistakes stay visible.
• Numeric component ids no longer trigger a TypeError – a crafted query key such as ?1-foo=bar produced a numeric component id that hit getComponent()'s string type hint and threw a TypeError (HTTP 500). The id is now cast to string and the request is handled gracefully.
• Routing panel survives weird parameters – a request like ?do[]=x could crash Tracy's routing panel during development. It now skips non-string presenter/signal/action values instead of throwing.

• Self-links no longer crash on bad input – when a presenter builds a link to the current page (redirect('this'), forward('this'), isLinkCurrent('this'), typically from a language switcher) while the current URL carries a parameter that doesn't fit the action's typed signature (e.g. ?id=abc for int $id), the framework raised an uncaught InvalidLinkException (HTTP 500). It now reports a proper BadRequestException (4xx) through the new InvalidRequestParameterException. Explicitly passed bad link arguments still throw InvalidLinkException, so genuine programmer mistakes stay visible.
• Numeric component ids no longer trigger a TypeError – a crafted query key such as ?1-foo=bar produced a numeric component id that hit getComponent()'s string type hint and threw a TypeError (HTTP 500). The id is now cast to string and the request is handled gracefully.
• Routing panel survives weird parameters – a request like ?do[]=x could crash Tracy's routing panel during development. It now skips non-string presenter/signal/action values instead of throwing.

💥 Breaking Changes

• PHP 8.3 – 8.5 and Latte 3.1 are now required
• More reliable CSRF protection – same-origin is now verified via the browser's Sec-Fetch-Site header instead of a SameSite cookie.
• Default presenter mapping is now App\Presentation\*\**Presenter
• Application::processRequest() returns a Response instead of sending it itself (#350) – sending is handled by run(). This enables long-running runtimes (RoadRunner, FrankenPHP) and PSR integration.
• Presenter::getRequest() throws instead of returning null when the presenter isn't running yet
• LatteFactory::create() now takes ?Control – update any custom LatteFactory implementation to the new create(?Control $control = null) signature.
• Removed {ifCurrent} – use {if isLinkCurrent('...')}.
• Removed compatibility with old class names such as PresenterComponent and IRouter.

⚠️ Deprecations

Mostly very old curiosities that few people knew existed – they still work but now emit a deprecation notice:

• @annotations → PHP attributes: @persistent → #[Persistent], @crossOrigin → #[Requires(sameOrigin: false)], @deprecated → #[Deprecated].
• Array access on RouteList – $router[] = new Route(...) and friends are replaced by $router->addRoute(...) / getRouters().
• Query string in a link destination – link('Product:detail?id=1') should pass arguments instead: link('Product:detail', ['id' => 1]).
• Component::getParameter() second $default argument – use the ?? operator instead.
• Some magic properties ($presenter->view, $layout, $request, $session…) – use the getters.

✨ New Features

• Set the URL fragment straight from arguments – link('Product:detail', ['#' => 'reviews']) produces ...#reviews. The value is URL-encoded, must be scalar, and isn't passed on as a request parameter.
• New Presenter::completeTemplate() – a protected method extracted from sendTemplate() that you can override to inject shared variables or set the template file before rendering.

• PHP 8.3+ and Latte 3.1.4+ are now required.

💥 Breaking Changes

• CSRF is now strictly same-origin. Forms validate the Sec-Fetch-Site header instead of the old SameSite cookie. The previous mechanism trusted submissions from any subdomain of the same site; the new one demands an exact origin match (scheme + host + port).
• setValues() / setDefaults() now expect iterable|stdClass.
• RadioList / CheckboxList: getControlPart() and getLabelPart() throw on an invalid item key instead of silently returning a nonsensical result.
• Removed long-deprecated APIs:** DataClassGenerator, LatteRenderer, getValues(true) (use getValues('array')), and the $default parameter of getOption() (use the ?? operator), negative validation rules

✨ New Features

• {form scope name} – one tag to replace the easily-confused {formContext} and {formContainer}. It pushes the form onto the stack without emitting <form>, resolving the name relatively to an active form when there is one, otherwise from the top level.
• {form detached name} – nest forms at last. HTML forbids nested <form> tags, so detached emits an empty <form></form> up front and links every control back to it via the HTML5 form="..." attribute, no matter where they sit in the DOM.
• addSubmit() accepts an $onSubmit callback – attach a click handler right when you create the button, without a separate ->onClick[] =.

🗑️ Deprecations

• A missing comma before {form} arguments – write {form name, attr=val} instead of {form name attr=val}, freeing keywords like scope/detached next to the name.
• Several magic properties

💥 Breaking Changes

• Monitoring handlers now fire top-down (ancestor → descendant). When a subtree is attached, monitor() listeners are invoked from the outermost ancestor inward, matching the natural order of tree construction. The new implementation is robust against listeners that mutate the tree mid-flight: it re-checks validity before descending into children, deduplicates so the same listener never runs twice, and guards against reentry to prevent infinite loops. If your code relied on the old ordering, review listeners that depend on sibling or parent state.

• attached() / detached() methods removed. These long-deprecated lifecycle hooks are gone. Migrate to explicit callbacks: replace overridden attached($obj) / detached($obj) with monitor($type, attached: ..., detached: ...). Calling monitor() with no handler at all now throws an InvalidStateException – at least one of attached or detached is required.

• Container::getComponents() parameters removed. The method now takes no arguments and returns a plain array of immediate children (previously iterable). The old recursive flag and filter-type argument are gone – passing them throws a DeprecatedException. For recursive traversal use getComponentTree() instead. The internal RecursiveComponentIterator has been removed.

• IContainer::addComponent() signature tightened. Now declared as addComponent(IComponent $component, ?string $name): static. Implementations and callers must match the new return type hint.

• Nette\SmartObject dropped from Component. The component no longer pulls in the SmartObject trait, and the magic $name, $parent, and $components properties are gone. Use the explicit methods (getName(), getParent(), getComponents()) directly.

• IComponent::NAME_SEPARATOR removed. Use IComponent::NameSeparator instead.

• PHP 8.3 required.

Changes

• PHP 8.3 is now required. Time to upgrade your runtime if you haven't already.
• UserStorage is gone – the long-deprecated class has been removed. Use the standard authentication storage instead.
• Request::getRemoteHost() is deprecated and now returns null – reverse DNS lookups were slow, unreliable, and a privacy footgun. Resolve the hostname yourself from getRemoteAddress() if you really need it (#218).

Deprecations (still working, but plan ahead)

• The IResponse::SameSite* constants are deprecated in favor of the new SameSite enum.
• Request::isSameSite() is deprecated – use isFrom() instead.
• Passing integer 0 as the expiration to Response::setCookie() is deprecated – use null for a session cookie.

✨ New Features

• SSRF protection, batteries included – the new IPAddress is an immutable IPv4/IPv6 value object with rich predicates (isPublic(), isPrivate(), isLoopback(), isLinkLocal(), isMulticast(), isReserved()), CIDR matching via isInRange(), and IPv4-mapped IPv6 normalization. Pair it with UrlValidator, a configurable guard that vets scheme, port, host allow/blocklists, userinfo, and – optionally with DNS – the resolved IP ranges. It even hands back the resolved IPs so you can pin the connection through CURLOPT_RESOLVE and defeat DNS-rebinding.
• Request::isFrom() – a single, reliable way to check where a request came from, with site, dest, and user parameters built on the Sec-Fetch-* headers. For browsers without Sec-Fetch support (Safari < 16.4), it transparently falls back to a strict cookie, so same-site detection just works everywhere.
• Type-safe SameSite enum – setCookie() and Session now accept a proper enum instead of magic strings, so typos become compile-time problems, not silent security holes.
• Response::setCookie() speaks modern cookie – it now supports the Partitioned attribute (CHIPS) for third-party cookies, emits a Max-Age attribute (which takes precedence over expires and ignores the client clock), and forces Secure automatically when SameSite=None, sparing you a browser rejection.
• Helpers::expirationToSeconds() – one consistent parser for every expiration value across the library. Numbers are relative seconds, while DateTimeInterface and textual strings like '20 minutes' or '2024-01-01' resolve as absolute times; each caller decides what null means in its own context.
• Helpers::parseQualityList() – parses HTTP quality-value lists (Accept, Accept-Language, …) into a ranked token map. Request::detectLanguage() was rewritten on top of it and is more correct as a result.

• Native types everywhere – filled in missing native type declarations across Container, BaseControl, Validator, Rules, Form and friends, so PHPStan (and your IDE) see the real shape of things
• Sharper phpDoc – tightened phpDoc types and descriptions throughout, giving better autocomplete and clearer intent at every call - Reorganized a few tests and switched some over to allowCrossOrigin() for clarity

💥 Deprecated (will be removed in 4.0)

• Magic properties Component::$name, Component::$parent and Container::$components – use getName(), getParent(), getComponents() instead.
• Calling monitor($type) without callbacks – pass them directly: monitor($type, $attached, $detached). Overriding attached() / detached() in subclasses is on its way out.
• Constant IComponent::NAME_SEPARATOR – switch to IComponent::NameSeparator (the deprecation is now reported via the native #[\Deprecated] attribute).

• SessionStorage no longer refreshes the sliding expiration timestamp once the session has already expired – an expired identity stays expired instead of being silently kept alive for another round
• Adopted nette/phpstan-rules and made static analysis a mandatory part of the build, then resolved the errors it surfaced
• Improved phpDoc types and descriptions across the codebase

• Native types – tightened parameter and return types across Compiler, ContainerLoader, ServiceDefinition and friends
• ContainerPanel – Tracy panel template rewritten with n:attributes for noticeably cleaner Latte syntax
• PHPStan-clean codebase – wide-ranging cleanup across DI internals so the whole tree passes strict analysis
• Richer PHPDoc – improved @param, @return and class descriptions across Compiler, Container, ContainerBuilder, Resolver, Helpers, definitions and extensions, giving IDEs and static analyzers far more to work with
• Better generic types – sharpened PHPDoc generics in autowiring, container builder, definitions and resolver

• Reentry protection for monitor callbacks – Component::refreshMonitors() now refuses to re-enter itself while listeners are running. If a listener removes and re-adds the same component (or otherwise triggers another refresh), each component is processed exactly once instead of looping or double-firing.
• Reliable callback deduplication – switched the in-array check for monitor callbacks to loose comparison. Closures are never === to each other unless they are literally the same instance, so the previous strict check silently let duplicates through.
• Adopted nette/phpstan-rules – stricter ruleset enabled, with a dedicated tests/types/component-types.php driving type tests.

✨ New Features

• AI agent support – Tracy now detects AI agents (via Helpers::isAgent()) and serves them tailored output instead of HTML:
  • BlueScreen renders a dedicated agent template for exceptions, making stack traces and context machine-readable
  • Debug Bar ships an agent-friendly render path with bespoke templates for the Warnings and Dumps panels
  • Debugger::dump() writes to the console when an agent is on the other end, so your dumps land where the agent actually looks
  • Production error page now includes a hint for agents so they don't have to guess what happened behind the generic 500
• Markdown companion files – every HTML error log now gets a .md sibling, giving agents a clean, readable version of the same crash
• Debugger::$transparentPaths – a public, autodetected list of "framework" paths (Tracy, Nette, Latte) whose frames are skipped when locating the real call site. Path-based, so it catches anonymous functions and closures that class-based detection missed
• Helpers::findCallerLocation() – walks the backtrace and returns the first frame outside $transparentPaths, respecting @tracySkipLocation and internal functions. Reusable across Tracy instead of buried in Dumper
• Helpers::countTransparentFrames() – companion helper returning the number of leading transparent frames in a trace
• Logger records caller location – exception reports now show a "Logged from ..." footer pointing to the exact line where Debugger::log() was called, alongside the existing "Report generated at" entry
• Dumper::toText() – gained an optional $key parameter so you can label the dumped value in text output

♻️ Code Refactoring

• BlueScreen stack-trace collapse unified with Debugger::$transparentPaths – one source of truth for which frames to hide, replacing the inline logic in section-stack-exception.php. BlueScreen::$collapsePaths and isCollapsed() remain as @deprecated shims so existing configuration keeps working
• BlueScreen internals cleaned up, including a new prepareStack(\Throwable) method that strips Tracy's own handler frames and returns the frame index to expand by default

• Message::setHtmlBody() – survives large inline data: URIs. A >500 kB base64 payload used to exhaust PCRE's backtrack limit and abort the whole send; the regex is now backtracking-free (#79)
• Message::setHtmlBody() – embeds images whose quoted src="…" or url('…') contains spaces, like "holiday photos/beach.jpg" (#97)
• Message::setHtmlBody() – embeds images whose quoted path contains parentheses, so the classic screenshot (1).png naming no longer silently breaks (#89)
• SendmailMailer – signs the full message so DKIM now covers Subject and To headers, closing a deliverability gap at Gmail, Outlook, and other strict providers (#99)
• MimePart – quotes address phrases containing special characters before MIME-encoding, producing spec-compliant headers even when names include commas, angle brackets, or quotes (#102)
• CssInliner – gracefully skips selectors the DOM engine can't evaluate; pseudo-classes and pseudo-elements like ::marker, :hover, :checked no longer break inlining
• CssInliner – tokenizer regex fixed for very long strings and invalid url() quote combinations that previously tripped the parser

• script-src-elem support in Helpers::getNonce() – nonces are now also picked up from the script-src-elem CSP directive, not just script-src (#612).
• CSP-friendly Tracy Bar – replaced the inline onload attribute in bar.js with a native addEventListener, eliminating a common CSP violation (#614).
• FileSession::clean() – emits a warning when the session directory is not readable, making misconfigured storage easier to diagnose (#538).
• Mobile-friendly error pages – BlueScreen and the 500 error template now include a proper viewport meta tag, so exceptions no longer render microscopically on phones (#604).
• Improved PHPDoc descriptions and fixed PHPStan errors across the codebase.
• open-in-editor on Windows – installer now registers the protocol via AutoLaunchProtocolsFromOrigins, suppressing the browser's "Open external app?" confirmation prompt (#573).

✨ New Features

• getExplorer() – ActiveRow and Selection now expose the underlying Explorer instance, no more jumping through hoops to get back to it
• DeadlockException – catch deadlocks and serialization failures distinctly from other driver errors, so retry logic can stay surgical
• LockTimeoutException – a dedicated exception for lock wait timeouts
• CheckConstraintViolationException – check constraint violations now get their own class instead of being lumped with generic constraint errors
• ConnectionLostException – distinguish dropped connections from other driver failures, making reconnect strategies much cleaner
• Docker Compose setup – a ready-to-run Compose configuration for spinning up test databases locally

♻️ Code Refactoring

• Drivers reflection output – unified FK row shape across drivers, simplified MsSql getIndexes SQL, parameterized SQLite PRAGMA queries, and ForeignKey::$name is now a non-nullable string

📦 Maintenance

• Improved PHPDoc descriptions, phpDoc types, and native type declarations across the codebase

• Minimum PHP version raised from 8.0 to 8.2 – time to upgrade if you haven't already

• Improved PHPDoc types and descriptions for better IDE support and static analysis accuracy

• CssInliner – converts <style> rules into inline style attributes, making your HTML emails render consistently across email clients. Features a single-regex tokenizer, full CSS nesting support, Dom\HTMLDocument selector matching (PHP 8.4+), and automatic Outlook-compatible HTML attribute generation (bgcolor, width, align, etc.). <style> tags are preserved so @media queries keep working.

✨ New Features

• Feature::Dedent – removes structural indentation from paired tag content, so your generated HTML stays clean regardless of how deeply you nest your Latte tags
• Feature::ScopedLoopVariables – variables introduced by {foreach} now live only inside the loop body, preventing accidental leaks into the surrounding scope (supports destructuring via ListNode too)
• |commas filter – joins array elements with , and supports a custom last-item glue (e.g. {$items|commas:' and '} → a, b and c)
• |column filter – extracts values from a single column of a multidimensional array or iterable, mirroring PHP's array_column()
• |limit filter – a friendlier wrapper around |slice with swapped arguments: limit first, offset second, and keys preserved by default
• |slice – now works with iterators, not just arrays and strings
• |padLeft, |padRight – now accept int|float values in addition to strings (#408)

♻️ Code Refactoring

• Helpers::sortBeforeAfter() – reimplemented using Kahn's algorithm for topological sorting, making extension ordering both faster and more correct
• Engine::addDefaultExtensions() – extracted into its own method for better extensibility

• Feature enum with setFeature()/hasFeature() – a unified way to toggle engine capabilities like StrictTypes, StrictParsing, and MigrationWarnings. The old methods (setStrictTypes(), setStrictParsing(), setMigrationWarnings()) still work but are now deprecated in favor of the enum-based API.
• setCacheDirectory() replaces the old setTempDirectory() – because "temp" was way too easily confused with "template". The old method still works but is deprecated.
• LinterExtension now correctly validates ::class expressions – previously {=UnknownClass::class} slipped through validation because it was handled as a class constant instead of a class type check.
• Added missing native type declarations across the codebase.
• Improved phpDoc types and descriptions.
• Unified declare(strict_types=1) to single-line format.

• Fixed all PHPStan errors and improved phpDoc annotations
• Switched to singleline declare statements across the codebase

• Fixed all PHPStan errors and improved phpDoc annotations
• Switched to singleline declare statements across the codebase

• Fixed all PHPStan errors and improved phpDoc annotations
• Switched to singleline declare statements across the codebase

• Fixed all PHPStan errors and improved phpDoc annotations
• Switched to singleline declare statements across the codebase

• Templates converted to Latte-like syntax, paving the way for a cleaner templating pipeline
• Environment guards relocated from Debugger to the individual strategy classes, improving separation of concerns

🔧 Build & CI

• Upgraded to PHPStan level 8 — the strictest static analysis level is now passing

• PhpNamespace::add() now automatically assigns itself as the namespace of any ClassLike passed to it. If your code relied on getNamespace() returning null after adding a class to a namespace, you'll need to update that assumption.

• PhpFile::add() – a single entry point for adding classes, interfaces, traits, enums, functions, and namespaces to a file. It handles namespace creation and bracket syntax automatically, so you can build a complete file with just add() calls.

• ClassLike::getFullName() – returns the fully qualified name when the class belongs to a namespace (e.g., App\Model\User), the short name otherwise, or null for anonymous classes.

• ClassLike constructors now accept FQN – pass 'App\Model\User' and the namespace is extracted automatically. No need to create the namespace separately for simple cases.

• PhpNamespace::add() accepts GlobalFunction – the unified add() method now handles functions alongside class-like types, making the namespace API more consistent.

• The $namespace parameter in ClassLike constructors is deprecated. Use setNamespace() instead. The old signature still works for now, but will be removed in a future version.

• PhpNamespace::add() now automatically assigns itself as the namespace of any ClassLike passed to it. If your code relied on getNamespace() returning null after adding a class to a namespace, you'll need to update that assumption.

• PhpFile::add() – a single entry point for adding classes, interfaces, traits, enums, functions, and namespaces to a file. It handles namespace creation and bracket syntax automatically, so you can build a complete file with just add() calls.

• ClassLike::getFullName() – returns the fully qualified name when the class belongs to a namespace (e.g., App\Model\User), the short name otherwise, or null for anonymous classes.

• ClassLike constructors now accept FQN – pass 'App\Model\User' and the namespace is extracted automatically. No need to create the namespace separately for simple cases.

• PhpNamespace::add() accepts GlobalFunction – the unified add() method now handles functions alongside class-like types, making the namespace API more consistent.

• The $namespace parameter in ClassLike constructors is deprecated. Use setNamespace() instead. The old signature still works for now, but will be removed in a future version.

• Dumper – added support for uninitialized lazy objects (PHP 8.4), displaying them with a (lazy) label and showing only pre-initialized properties
• Source mapper – added column support, so BlueScreen can now pinpoint the exact character position in mapped source files

🐛 Bug Fixes

• keysToHide now applies to bdump()/barDump() as well – previously sensitive keys were only hidden in dump() and BlueScreen (#608)
• TracyExtension sets keysToHide config for Debugger too, not just for BlueScreen (#608)
• Dumper correctly loads its assets even when $showBar = false (#606)

• Tester now uses system php.ini by default (#465)

Improvements

• True parallel test execution on Windows with PHP 8.5 (utilizing fixed stream_select() with proc_open() pipes)
• Fixed stdout data loss when process exits quickly
• hides cursor

New Features

• Global testException() now calls setUp() and tearDown()
• Global test() now calls tearDown() even when test fails
• Added global function testNoError()

Smart HTML Attributes

• Null values: Attributes with null values are now dropped instead of rendering as empty strings.
• Boolean attributes: Attributes like checked or disabled render conditionally based on truthy/falsey values.
• Array support: class and style attributes now accept arrays (e.g., class="{[active: $cond]}").
• Data attributes: data-* attributes automatically JSON-serialize non-string values (arrays, objects, booleans).
• Aria attributes: aria-* attributes render boolean values as "true"/"false".
• Type checking: Passing invalid types (arrays, objects) to standard attributes now triggers a warning and omits the attribute.

New Features

• Added n:elseif support.
• Added nullsafe filter operator ?| (e.g., {$var?|upper}).
• Added |toggle filter for manual boolean attribute control.
• Support for unquoted n-attribute syntax: n:if={$cond}.
• Added Engine::setMigrationWarnings() to help detect changes in attribute rendering.

Breaking Changes & Deprecations

• strictTypes is now enabled by default.
• Using $this and $__* variables in templates is deprecated.
• The undefined unsafe operator ??-> is deprecated (use ?->).
• Global constants should now be prefixed with a slash (e.g., \PHP_VERSION).
• Engine::addFilterLoader() is deprecated.