Released version 3.3.1

✨ New Features

• Backed enums in parameters – persistent, action, render and signal parameters can now be typed as a backed enum, e.g. renderDefault(Status $status). The URL carries the case value, link('this', ['status' => Status::Active]) just works, and a value that matches no case is answered with a 404 (nette/nette#1558)
• PHP 8.6 – Nette Application now installs and runs on it

⚠️ Deprecations

• {control} arguments without a comma – write {control menu, $items} instead of {control menu $items}, just as {form}, {input} and {label} already expect; this script adds the missing commas to your templates
• Request constants – Request::FORWARD, RESTORED and VARYING are now Request::Forward, Restored and Varying; the old names keep working

🐛 Bug Fixes

• n:nonce – works with base64url nonces, as produced by common CSP middlewares, and with a nonce at the very start of the Content-Security-Policy header
• #[Parameter] without a default value – when the request lacks it, a nullable property gets null and an array one [], the same as an action argument; any other is answered with a 404
• onShutdown – handlers receive null as the second argument after a successful request, as their type callable(Application, ?Throwable) promises, and a typo in the error presenter name no longer bypasses the error handling of run()
• Components without a presenter – createComponent<Name>() factories work on a component that is not attached to a presenter; a presenter is needed only when the factory carries #[Requires]
• FileResponse – sends Content-Range only with a partial 206 response, and a 416 response states the file size, as RFC 9110 requires
• Tracy routing panel – shows defaults and parameters that are not strings again, each string one only once, and its status colors can be overridden with your own CSS

🛡️ Robustness

• Hardening – requests with the reserved FORWARD HTTP method are rejected with a 4xx (thanks to Jakub Richtr), FileResponse strips quotes, backslashes and control characters from the file name in Content-Disposition, and actions that keep calling switch() on each other stop with an exception
• Overridden createRequest() or requestToUrl() – the DI container now warns about it in a presenter, since links are generated by LinkGenerator and these methods are never called
• Edge cases – #[Requires(methods: ...)] on an action or render method can allow a method outside $allowedMethods, isLinkCurrent() does not throw on a target with #[Requires(forward: true)], links to micro routes inside withModule() can be built, and an ambiguous presenter service ends with InvalidPresenterException instead of refreshing the page over and over