Forms Laravel Package

The headline of 3.3 is CSRF protection that the browser handles for you – no token, no cookie, no server-side state, and it holds even against XSS. On top of that, the confusing {formContext} / {formContainer} pair collapses into a single {form scope}, you can finally nest forms with {form detached}, and a round of housekeeping clears out long-deprecated APIs. Please test and report anything that breaks for you.

• PHP 8.3+ and Latte 3.1.4+ are now required.

💥 Breaking Changes

• CSRF is now strictly same-origin. Forms validate the Sec-Fetch-Site header instead of the old SameSite cookie. The previous mechanism trusted submissions from any subdomain of the same site; the new one demands an exact origin match (scheme + host + port).
• setValues() / setDefaults() now expect iterable|stdClass.
• RadioList / CheckboxList: getControlPart() and getLabelPart() throw on an invalid item key instead of silently returning a nonsensical result.
• Removed long-deprecated APIs:** DataClassGenerator, LatteRenderer, getValues(true) (use getValues('array')), and the $default parameter of getOption() (use the ?? operator), negative validation rules

✨ New Features

• {form scope name} – one tag to replace the easily-confused {formContext} and {formContainer}. It pushes the form onto the stack without emitting <form>, resolving the name relatively to an active form when there is one, otherwise from the top level.
• {form detached name} – nest forms at last. HTML forbids nested <form> tags, so detached emits an empty <form></form> up front and links every control back to it via the HTML5 form="..." attribute, no matter where they sit in the DOM.
• addSubmit() accepts an $onSubmit callback – attach a click handler right when you create the button, without a separate ->onClick[] =.

🗑️ Deprecations

• A missing comma before {form} arguments – write {form name, attr=val} instead of {form name attr=val}, freeing keywords like scope/detached next to the name.
• Several magic properties

The headline of 3.3 is CSRF protection that the browser handles for you – no token, no cookie, no server-side state, and it holds even against XSS. On top of that, the confusing {formContext} / {formContainer} pair collapses into a single {form scope}, you can finally nest forms with {form detached}, and a round of housekeeping clears out long-deprecated APIs. Please test and report anything that breaks for you.

• PHP 8.3+ and Latte 3.1.4+ are now required.

💥 Breaking Changes

• CSRF is now strictly same-origin. Forms validate the Sec-Fetch-Site header instead of the old SameSite cookie. The previous mechanism trusted submissions from any subdomain of the same site; the new one demands an exact origin match (scheme + host + port).
• setValues() / setDefaults() now expect iterable|stdClass.
• RadioList / CheckboxList: getControlPart() and getLabelPart() throw on an invalid item key instead of silently returning a nonsensical result.
• Removed long-deprecated APIs:** DataClassGenerator, LatteRenderer, getValues(true) (use getValues('array')), and the $default parameter of getOption() (use the ?? operator), negative validation rules

✨ New Features

• {form scope name} – one tag to replace the easily-confused {formContext} and {formContainer}. It pushes the form onto the stack without emitting <form>, resolving the name relatively to an active form when there is one, otherwise from the top level.
• {form detached name} – nest forms at last. HTML forbids nested <form> tags, so detached emits an empty <form></form> up front and links every control back to it via the HTML5 form="..." attribute, no matter where they sit in the DOM.
• addSubmit() accepts an $onSubmit callback – attach a click handler right when you create the button, without a separate ->onClick[] =.

🗑️ Deprecations

• A missing comma before {form} arguments – write {form name, attr=val} instead of {form name attr=val}, freeing keywords like scope/detached next to the name.
• Several magic properties

A maintenance-focused release that tightens type safety across the whole codebase, modernizes the JavaScript test stack, and turns static analysis into a non-negotiable part of the build. No API changes – just a more solid foundation under the hood.

• Native types everywhere – filled in missing native type declarations across Container, BaseControl, Validator, Rules, Form and friends, so PHPStan (and your IDE) see the real shape of things
• Sharper phpDoc – tightened phpDoc types and descriptions throughout, giving better autocomplete and clearer intent at every call - Reorganized a few tests and switched some over to allowCrossOrigin() for clarity

• support for PHP 8.5
• compatible with Latte 3.1
• CheckboxList, RadioList::getControl() return empty element when has no items

• composer: allows Latte 3.1
• optimized global function calls

• SelectBox: correctly selects prompt #343
• MultiChoiceControl: fixed order of selected items
• tests: improved descriptions
• netteForms: do not propagate 'submit' event further when the form is invalid
• netteForms: fixed submitter property

• Container::addEmail(): added $maxLength=255 #303
• ChoiceControl, MultiChoiceControl: disabled items are processed in getValue() instead of loadHttpData()
• removed return type from __call() nette/utils#315
• SelectBox: fixed 2edbd6c
• netteForms: uses the submitter property

• Container::getValue() supports conversion to enums [Close #337]
• UploadControl: added setNullable()
• netteForms: rewritten to TypeScript
• Button: is omitted from values #330
• DefaultFormRenderer: fixed cummulate instances of Nette\HtmlStringable #335
• Helpers::getSupportedTypes() returns array #332
• support for PHP 8.4

• netteForms: modernized code
• netteForms: reimplemented compact transmission mode via formdata event
• netteForms: processes only elements with 'data-nette-rules'
• netteForms: added typehints to jsDoc
• netteForms: improved badInput reporting
• netteForms: rule 'length' works with numbers #329
• Form: does not show 'no associated handlers' error if the form is not submitted by the button
• Blueprint: fixed nullable types detection
• TextBase, HiddenField: added isNullable()

• SelectBox: prompt <option> is hidden/disabled when is required
• SelectBox: prompt key is always unique
• typos

Hidden on Windows:

Disabled on Apple:

• netteForms: converts float & int to numbers #313
• partially revert "some classes marked as final (BC break)"
• SubmitButton::setValidationScope() accepts strings
• Container::getUntrustedValues() has default value

• requires PHP 8.1
• uses PHP 8.1 features
• Latte: {inputError} must have argument
• BaseControl, ControlGroup::getOption() parameter $default is deprecated
• Container: getValues(true) is deprecated (BC break)

• added Blueprint, replaces LatteRenderer, DataClassGenerator, {formPrint}, {formClassPrint}
• DateTimeControl: default date for 'time' is 0001-01-01
• examples: updated bootstrap examples
• Latte: sets Tag::$node
• Latte: fixed rendering of empty <label> for CheckboxList/RadioList items

• added addDate(), addTime() & addDateTime(), addColor()
• netteForms: min/max/range can compare strings
• AVIF image support
• tests: grunt replaced with karma
• FormsExtension: added getCacheKey() to force refresh cache

• support for PHP 8.3
• added addFloat()
• Container::getValues() respects validation scope #287
• netteForms: bad numbers are checked at the beginning #289
• netteForms: the 'number' element value is not available only on badInput error
• netteForms: resets toggles when form is reset #306
• Latte: split initialization and form rendering
• netteForms: showModal uses <dialog> by default
• removed fix for IE
• Container: const Array changed to public #301

• DefaultFormRenderer: new methods for rendering elements (#299)
• added BackedEnum support (#282 #293)
• UploadControl: added automatic rule MaxLength
• UploadControl: refactoring
• Latte: fixed escaping on button #298
• constants are PascalCase

• FormNNameNode: $form is created before tag itself #291
• latte: fixed parsing of {input} & {label} arguments
• Latte: better error message when form is missing
• Latte: {inputError ...} should have argument
• getUnsafeValues() renamed to getUntrustedValues()
• supports nette/utils 4

• support for PHP 8.2
• Form::initialize() sets 'secure' flag nette/http#217
• BaseControl, ControlGroup::getOption() parameter $default is silently deprecated
• cs

• support for Latte 3
• FormMacros: optimized code
• Form::addProtection() fixed error "Argument 3 must be of the type string or null, int given"
• coding style
• Runtime: fixed method name
• improved Latte examples

• compatibility: fixed interfaces
• added DataClassGenerator & tag {formClassPrint}
• LatteRenderer: do not send cookie
• Latte generator moved from Rutime to new class LatteRenderer
• Latte Blueprint: used code highlighting

• {formPrint} calls fireRenderEvents()
• Container::getValues($obj) mapping to PHP 8 constructor
• BaseControl: added addFilter()
• refactoring
• Container: catches infinite loop in getValue() #277
• netteForms: improved netteFormsModal CSS for problematic browsers
• netteForms: visible doc comment
• improved error messages
• Button: preserves prototype when caption is null #276
• Revert "added FormFactory & DI service"

• support for PHP 8.1
• Button: allows change to <button> #273
• Form::addGroup() loose type (#269)
• Form: checks the existence of handlers
• netteForms: uses <dialog> in Opera & mobile Chromium because it loses focus after alert() #275
• netteForms: added Nette.showModal() method

• Form::getValues() fixed when in validation scope is container
• fixed compatibility with Symfony DebugClassLoader

• added Container::getUnsafeValues(), onValidate does not throw warning [Closes #266]
• fixed validation after 1592cf64 [Closes #268]
• added Form::initialize() for standalone forms
• added FormFactory & DI service

• phpDoc: fixed event type hints [Closes #265]
• Revert "Form::onValidate - values are passed only when form is valid"
• Latte: added more comments /* line */
• FormMacros: internal variables are prefixed $ʟ_

• requires PHP 7.2

Features

• Form: POST form checks Http\Request::isSameSite() as CSRF protection
• Guess first parameter for event by type hint (#219)
• Container::getValues($obj) to hydrate object

Changes

• Form::getValues() triggers warning when form is not valid
• Form::getValues() returns only controls in scope (BC break)
• Form::onValidate - values are passed only when form is valid
• Validator Form::URL autocompletes https:// instead of http:// (BC break)
• Validator::validateEqual returns false if control value is empty array (BC break) [Closes #257]
• Validator::formatMessage() added validator name to error message (#263)
• breaks exporting rules to JS after non-static validator [Closes #259]
• FormMacros: removed deprecated $_form
• Container: addImage() renamed to addImageButton()
• Checkbox: getSeparatorPrototype() renamed to getContainerPrototype()
• removed deprecated stuff

compatible with PHP 8.0

• compatible with PHP 8.0
• examples: added Latte example
• netteForms: added parameter 'event' to toggle()
• netteForms: parameter srcElement is passed to Nette.toggle() even during initialization (possible BC break)
• netteForms: removed hasOwnProperty() check
• netteForms: added variable Nette.invalidNumberMessage with error message #252
• netteForms: avoid checking of invalid number in nested validateControl() #252

For the details you can have a look at the diff.

• {formPrint} more compact output
• {formPrint} is selectable
• FormMacros: added {formContext}
• strict fix (#249)

For the details you can have a look at the diff.

• CheckboxList: compact transmission mode in form name=val1,val2,val3
• CsrfProtection: auto-starts session before form is rendered #239
• Container: detects property type of mapped class
• Validator::validateNumeric() accepts unsigned integer #246
• Rules::getIterator() moves BLANK before FILLED #233
• Rules::getToggleStates() synced with netteForms.js toggleControl
• netteForms: fixed toggleControl(), synced with validateControl()
• Rules::validate() $emptyOptional is always false in BLANK condition
• Container::addHidden Allow any type so it works same as setDefaultValue (#245) BC break!
• Latte: prints {label/}

For the details you can have a look at the diff.

• FormMacros: added {formPrint $form}
• netteForms: added mime-type validation #173
• netteForms: image validator accepts image/webp
• SelectBox, MultiSelectBox: added setOptionAttribute()
• Container::getValues('array') propagates arrays to inner containers only when mappedType is not set
• Validator::validateInteger() returns false when integer is too big
• DefaultFormRenderer: options 'class' & 'id' are used for 'control' part when 'pair' part is empty
• DefaultFormRenderer: supports option 'nextTo' & style 'control .multi'
• renders correctly Nette\Utils\IHtmlString in data-nette-rules #243
• getLabel() removed return type void #241
• FormsExtension: uses $initialization

For the details you can have a look at the diff.

• HiddenField: added setNullable() and addFilter() #171
• HiddenField: value is not converted to string #152
• UploadControl: automatically sets MAX_FILE_SIZE #238
• UploadControl: addRule() checks upload_max_filesize limit
• Rules: added removeRule()
• Form: added setHtmlAttribute()
• BaseControl: supports setHtmlAttribute('name')
• Validator::formatMessage() label is translated using form translator (#237)
• added .phpstorm.meta.php
• readme: info about netteForms.js

For the details you can have a look at the diff.

• supports PHP 7.4
• Validator::formatMessage() Fixed using label placeholder in validation rule with Html label (#235)
• throwing exceptions from __toString() is allowed since PHP 7.4
• some fixes

For the details you can have a look at the diff.