Release v2.14.0

v2.14.0

Changelog

Security: CSRF action forms (CsrfOnlyType, HiddenFieldsCsrfType, CsrfOnlyFormFactory, csrf_action_form) fail closed without the form CSRF extension. See UPGRADING.

Security

• CSRF action forms fail closed: CsrfOnlyType and HiddenFieldsCsrfType (and therefore CsrfOnlyFormFactory and the csrf_action_form() Twig function) now throw a LogicException when the form is built without Symfony's form CSRF extension (form.type_extension.csrf: symfony/security-csrf missing, framework.csrf_protection: false or framework.form.csrf_protection: false). Before, both types declared their own csrf_protection / csrf_token_id defaults, so a direct createForm(CsrfOnlyType::class, …) rendered no token and isValid() accepted any cross-site POST (the factory only failed by accident, with an UndefinedOptionsException on csrf_field_name). An explicit csrf_protection: false remains the caller's opt-out. New Nowo\FormKitBundle\Form\CsrfProtectionGuard; see UPGRADING and SECURITY.

Added

• Developer tooling: make release-check now runs check-no-raw-html-form (REQ-TWIG-005) after the Twig extra gate; the check allowlists only the two form-theme files (form/_locale_tabs.html.twig, demo nowo_special_fields_form_theme.html.twig).

Changed

• Demo: translations, kit_api_patterns, multistep and the shared _form_sections_loop partial render the form body through the rendered-aware child loop ({% for child in form %} + not child.rendered + form_row(child)) instead of field-by-field rows / form_rest / an unguarded loop; same fields, names and layout (REQ-TWIG-003 / REQ-TWIG-005).
• Docs: USAGE section "Rendering forms in Twig" states the Symfony Form / child-loop rule and that hosts and demos must not reintroduce raw <form> / <input> (REQ-TWIG-005 rule 9).

What's Changed

• chore(deps): bump nowo-tech/ui-kit-bundle from 2.5.3 to 2.7.0 by @dependabot[bot] in #49
• chore(deps): bump nowo-tech/phpstan-frankenphp from 1.3.0 to 1.3.2 by @dependabot[bot] in #50
• fix(security): CSRF action forms fail closed without the form CSRF extension by @HecFranco in #51

Full Changelog: v2.13.3...v2.14.0