Application Laravel Package

A hardening release. Crafted or malformed request parameters that used to slip through as uncaught 500s now degrade gracefully to 4xx. If your site gets probed by scanners – and it does – these three fixes turn a batch of "Server Error" reports into clean Bad Request / Not Found responses.

• Self-links no longer crash on bad input – when a presenter builds a link to the current page (redirect('this'), forward('this'), isLinkCurrent('this'), typically from a language switcher) while the current URL carries a parameter that doesn't fit the action's typed signature (e.g. ?id=abc for int $id), the framework raised an uncaught InvalidLinkException (HTTP 500). It now reports a proper BadRequestException (4xx) through the new InvalidRequestParameterException. Explicitly passed bad link arguments still throw InvalidLinkException, so genuine programmer mistakes stay visible.
• Numeric component ids no longer trigger a TypeError – a crafted query key such as ?1-foo=bar produced a numeric component id that hit getComponent()'s string type hint and threw a TypeError (HTTP 500). The id is now cast to string and the request is handled gracefully.
• Routing panel survives weird parameters – a request like ?do[]=x could crash Tracy's routing panel during development. It now skips non-string presenter/signal/action values instead of throwing.

Nette Application 3.3 modernizes the foundations: PHP 8.3+ and Latte 3.1, more reliable CSRF protection driven by the browser itself, and a default presenter mapping that finally matches the structure used throughout the documentation. It also clears out a pile of long-forgotten legacy. Please test the RC and report anything that breaks before the stable release.

💥 Breaking Changes

• PHP 8.3 – 8.5 and Latte 3.1 are now required
• More reliable CSRF protection – same-origin is now verified via the browser's Sec-Fetch-Site header instead of a SameSite cookie.
• Default presenter mapping is now App\Presentation\*\**Presenter
• Application::processRequest() returns a Response instead of sending it itself (#350) – sending is handled by run(). This enables long-running runtimes (RoadRunner, FrankenPHP) and PSR integration.
• Presenter::getRequest() throws instead of returning null when the presenter isn't running yet
• LatteFactory::create() now takes ?Control – update any custom LatteFactory implementation to the new create(?Control $control = null) signature.
• Removed {ifCurrent} – use {if isLinkCurrent('...')}.
• Removed compatibility with old class names such as PresenterComponent and IRouter.

⚠️ Deprecations

Mostly very old curiosities that few people knew existed – they still work but now emit a deprecation notice:

• [@annotations](https://github.com/annotations) → PHP attributes: [@persistent](https://github.com/persistent) → #[Persistent], [@crossOrigin](https://github.com/crossOrigin) → #[Requires(sameOrigin: false)], [@deprecated](https://github.com/deprecated) → #[Deprecated].
• Array access on RouteList – $router[] = new Route(...) and friends are replaced by $router->addRoute(...) / getRouters().
• Query string in a link destination – link('Product:detail?id=1') should pass arguments instead: link('Product:detail', ['id' => 1]).
• Component::getParameter() second $default argument – use the ?? operator instead.
• Some magic properties ($presenter->view, $layout, $request, $session…) – use the getters.

✨ New Features

• Set the URL fragment straight from arguments – link('Product:detail', ['#' => 'reviews']) produces ...#reviews. The value is URL-encoded, must be scalar, and isn't passed on as a request parameter.
• New Presenter::completeTemplate() – a protected method extracted from sendTemplate() that you can override to inject shared variables or set the template file before rendering.

Nette Application 3.3 modernizes the foundations: PHP 8.3+ and Latte 3.1, more reliable CSRF protection driven by the browser itself, and a default presenter mapping that finally matches the structure used throughout the documentation. It also clears out a pile of long-forgotten legacy. Please test the RC and report anything that breaks before the stable release.

💥 Breaking Changes

• PHP 8.3 – 8.5 and Latte 3.1 are now required
• More reliable CSRF protection – same-origin is now verified via the browser's Sec-Fetch-Site header instead of a SameSite cookie.
• Default presenter mapping is now App\Presentation\*\**Presenter
• Application::processRequest() returns a Response instead of sending it itself (#350) – sending is handled by run(). This enables long-running runtimes (RoadRunner, FrankenPHP) and PSR integration.
• Presenter::getRequest() throws instead of returning null when the presenter isn't running yet
• LatteFactory::create() now takes ?Control – update any custom LatteFactory implementation to the new create(?Control $control = null) signature.
• Removed {ifCurrent} – use {if isLinkCurrent('...')}.
• Removed compatibility with old class names such as PresenterComponent and IRouter.

⚠️ Deprecations

Mostly very old curiosities that few people knew existed – they still work but now emit a deprecation notice:

• [@annotations](https://github.com/annotations) → PHP attributes: [@persistent](https://github.com/persistent) → #[Persistent], [@crossOrigin](https://github.com/crossOrigin) → #[Requires(sameOrigin: false)], [@deprecated](https://github.com/deprecated) → #[Deprecated].
• Array access on RouteList – $router[] = new Route(...) and friends are replaced by $router->addRoute(...) / getRouters().
• Query string in a link destination – link('Product:detail?id=1') should pass arguments instead: link('Product:detail', ['id' => 1]).
• Component::getParameter() second $default argument – use the ?? operator instead.
• Some magic properties ($presenter->view, $layout, $request, $session…) – use the getters.

✨ New Features

• Set the URL fragment straight from arguments – link('Product:detail', ['#' => 'reviews']) produces ...#reviews. The value is URL-encoded, must be scalar, and isn't passed on as a request parameter.
• New Presenter::completeTemplate() – a protected method extracted from sendTemplate() that you can override to inject shared variables or set the template file before rendering.

• Sharper phpDoc types and descriptions throughout the codebase
• Reverted the experimental hasPresenter()/getPresenterIfExists() addition and the $throw deprecation in Component/Form::getPresenter() – the previous API behavior stays unchanged
• {layout auto} no longer triggers infinite recursion – when used inside a referring template, the layout finder is now skipped instead of looping back on itself
• Response and router classes now use promoted readonly properties, trimming boilerplate across Application, FileResponse, JsonResponse, RedirectResponse, TextResponse, ForwardResponse and CliRouter
• Callback parameters in PresenterFactory, CallbackResponse and Multiplier are normalized to Closure for stronger typing

• added #[TemplateVariable]
• LinkGenerator: throws an error when the link points to #[Requires(forward: true)]

• support for PHP 8.5
• compatible with Latte 3.1
• LinkGenerator: do not pass defaults of #[Parameter] (#355)
• PresenterFactoryCallback: fixed $invalidLinkMode can't be overwritten by config #337

• Latte: added filter |absoluteUrl and {linkBase}
• SnippetRuntime: Fixed snippets rendering when multiple templates are rendered (#349)
• TemplateFactory: does not assign the default property to the template if it does not match the type #352
• class Template is abstract
• error 500: improved CSS style reset nette/tracy#581
• optimized global function calls

• LatteExtension: added option 'locale'
• LatteExtension: automatically passes translator to Latte\Essential\TranslatorExtension
• support for PHP 8.4

• ApplicationExtension: checks the correct usage of attributes
• Component::tryCall() throws BadRequestException
• Multiplier::createComponent() allow to return a null (#327)
• LatteExtension: fixed v3.2.3

• requires PHP 8.1
• uses PHP 8.1 features

changes:

• Control, Presenter::createTemplate() has argument
• Request: removed flag SECURED
• Form: do not send 'do' when action is changed

• Component::tryCall() throws BadRequestException
• AbortException & BadRequestException extends LogicException
• Latte: sets Tag::$node
• composer: relaxed dependencies

• added feature "link aliases"
• added attributes #[Requires] and #[Deprecated]
• Presenter: added switch()
• PresenterFactory: support for location Foo/FooPresenter via **
• Presenter: support for templates without /template folder
• LinkGenerator: unified with link generation in presenters
• added ComponentReflection::getActionRenderMethod() & getSignalMethod()
• Latte: CacheExtension & FormExtension are added before user extensions #320
• Latte: UIExtension is added before user extensions if $control is passed to LatteFactory::create()
• RoutingPanel: show presenter class even if it doesn't exist
• Revert "ApplicationExtension: $catchExceptions can be '4xx' in addition to bool"

• added Application::$error4xxPresenter & DI option
• ApplicationExtension: option 'mapping' can be string
• ApplicationExtension: $catchExceptions can be '4xx' in addition to bool
• Application::$catchExceptions is silently deprecated
• Presenter & others: injected services are readonly
• Presenter: $payload access refactoring

• added attribute #Parameter
• RoutingPanel: redesigned #285
• Application: previous presenter is passed to error presenter (#317)
• SnippetNode, SnippetAreaNode: name can be class constant nette/latte#346
• Presenter: added PATCH to $allowedMethods
• MicroPresenter: injects service only for non-builtin types
• ComponentReflection::convertType() supports true & false
• Latte: {layout auto} always call Presenter::findLayoutTemplateFile()

• LatteExtension: added options strictParsing & phpLinter
• Presenter: checks $allowedMethods
• added Presenter::findTemplateFile()

• RoutingPanel: URL & link to presenter moved to the top
• Latte: n:snippet works with <script>
• Latte: n:href prints line
• constants are PascalCase

• Presenter: fixed InvalidLinkException on detectedCsrf() #300
• Persistent: added constructor #305
• composer: allows nette/utils 4.0
• Latte: uses TracyExtension
• used PhpStorm Language attribute

• support for PHP 8.2
• Control::templatePrepareFilters() silently deprecated
• Component::getParameter() $default is silently deprecated

• {link} disables URL checking
• TranslatorExtension moved to Latte (BC break)

• support for Latte 3
• added tag {translate}
• {_var} and {translate} can translate values during compile time
• RoutingPanel: withPath() fix II.

• ApplicationExtension: support for creating presenters via Tracy
• RoutingPanel: supports withPath(...)
• Revert "Component::link() & etc uses variadic parameter" #298
• improved coding standard

• support for PHP 8.1
• Presenter: support for @deprecated in presenters, action & signals
• Presenter::run() saves global state on sendRequest()
• Presenter::canonicalize() uses variadics
• Component::link() & etc uses variadic parameter
• UIRuntime: improved {templatePrint}
• phpstorm.meta: added exitPoint Component::error (#293)
• Presenter: Add return never typehint. (#291) (#290)

• UIMacros: supports {control |noescape}
• LatteExtension: inject interface to be more compatible (#288)
• LatteExtension: fixed debug panel for custom templates
• LatteExtension: changed UI\TemplateFactory type to ApplicationLatte\TemplateFactory (#283)
• Component: persistent parameters does not have to be initialized #286

• Presenter: try to find Template file for each action (#277)
• Component: Throw exception in case of signal method in Component or Presenter is private #263
• Presenter, Control: formatTemplateClass() refactoring
• Presenter: non-final createRequest() #262
• RoutingPanel: displays one-way flags #274
• LatteExtension: fix undefined property
• Form::disableSameSiteProtection() replaced with allowCrossOrigin()
• UIMacros: added /* line */ comment
• improved phpDoc
• composer: accepts routing 3.1

• PresenterFactory: removed case mismatch checks because may work incorrectly
• MicroPresenter: accepts any callable objects
• ComponentReflection: type 'NULL' replaced with pseudotype 'scalar'
• added support for union types in arguments and persistent parameters
• ComponentReflection: supports type 'mixed'
• Form::disableSameSiteProtection() replaced with allowCrossOrigin()
• ApplicationExtension: fixed scanDir merging

For the details you can have a look at the diff.

• Component::createComponent() warns on non-presenter components nette/forms#147
• LatteExtension: option 'xhtml' is deprecated
• LatteExtension: initializes Latte Panel, added option 'debugger'
• TemplateFactory::createTemplate() returns Nette\Bridges\ApplicationLatte (BC break)
• Control::flashMessage: allow HtmlStringable as a message
• UIMacros: {control} can be used in HTML attribute nette/latte#250

For the details you can have a look at the diff.

Features

• Template divided into hierarchy Template > DefaultTemplate
• DefaultTemplate: added default properites and @methods
• Template, DefaultTemplate: magic access via __get/__set replaced with object properties
• Control, Presenter::createTemplate() added parameter $class for custom creation of the Template
• Control, Presenter::createTemplate() tries to create custom Template according to naming convention
• Presenter::sendTemplate() added parameter $template
• Link: added isLinkCurrent() & getComponent() [Closes #229]
• UIMacros: support named arguments {control x: 1}
• Control::flashMessage accepts custom flash object
• Template: passes the template to the latte instead of just parameters.
• UIMacros: overloaded macro {templatePrint}

Changes

• requires PHP 7.2
• RoutingExtension: creates service 'routes' only when routes are defined (BC break)
• RoutingExtension: removed option 'routeClass' (BC break)
• Presenter::getContext() & others trigger error message
• removed prefix I from interfaces (except for IPresenter & IPresenterLoader)
• ApplicationExtension: option 'scanFilter' changed to pattern, default is '*Presenter'
• ApplicationExtension: catchExceptions is always true on production mode (BC break)
• UIMacros: modifiers are deprecated in {control}
• Route, SimpleRouter: flags is deprecated

• compatible with PHP 8
• PresenterFactory: removed case mismatch checks because may work incorrectly
• strict type fix
• MicroPresenter: accepts any callable objects

For the details you can have a look at the diff.

• compatible with PHP 8.0
• added PHP 8 attributes #[Persistent] & [CrossOrigin]#
• MicroPresenter: throws BadRequestException on invalid argument
• ApplicationExtension, RoutingExtension: detects Tracy by presence of service nette/di#245

For the details you can have a look at the diff.

• Application: Micro:* presenter are not achievable
• MicroPresenter: parameter callback must be a Closure, removed support for __invoke
• RoutingPanel: fixed calling to undefined RouteList::getModule() #264
• LinkGenerator: added withReferenceUrl()
• Presenter: added support for typehint 'object'
• RoutingPanel: improved visualisation of error
• RoutingPanel: fixed compatibility with new RouteList III.

For the details you can have a look at the diff.

• class aliases are loaded on demand
• added .phpstorm.meta.php
• Template: prevents unserialization for security reasons

For the details you can have a look at the diff.

• UIMacros: fixed (expand) in {control) nette/latte#223
• .phpstorm.meta: added exit points
• PresenterFactoryCallback: fixed multiple services of type found #258
• RoutingPanel: display RouteList groups
• RoutingPanel: fixed compatibility with new RouteList II. #251 #253
• RoutingPanel: changed Application\Routers* classes to Nette\Routing*
• RoutingPanel: Better mask responsivity.
• Template: prevents unserialization for security reasons

For the details you can have a look at the diff.

• Presenter::restoreRequest() redirects on GET request
• Template: added custom functions isLinkCurrent() and isModuleCurrent()
• Presenter: added isModuleCurrent() #240 (#243)
• RoutingPanel: fixed compatibility with new RouteList
• uses latte 2.6
• class aliases are loaded on demand

For the details you can have a look at the diff.

• Template: added addFunction() for Latte 2.6
• RoutingPanel: uses capturing
• FileResponse: added some checks (#238)
• ComponentReflection: changed way how it detects built-in types #241
• ApplicationExtension: options scanDirs has higher priority than robotLoader
• ApplicationExtension: always creates directory for touch file (#237)
• Presenter: injectPrimary() params are required because $httpRequest is required. (#239)
• updated .phpstorm.meta.php
• uses nette/utils 3.1
• fixed bugs reported by PHPStan

For the details you can have a look at the diff.