Previously such a key was silently ignored.

Its state was silently skipped by Presenter::getGlobalState().

In the most typical flow - flashMessage() followed by redirect() - the template
was created just to be thrown away, which builds a whole Latte\Engine instance.
The messages are written to the session first and into the template only if it
already exists; a template created later gets them from the template factory,
which reads the flashes from the session on its own.

ReflectionClass::getAttributes() does not return attributes of parent classes,
so a rule placed on a common ancestor (a typical #[Requires(sameOrigin: true)]
on BaseAdminPresenter) was silently not enforced in its descendants. Attributes
are now collected along the whole ancestor chain; a rule explicitly set in a
descendant overrides the same rule of its ancestors.

This reverts commit cda17f460d020b0f042364d4e140742022a7e94d.

See https://forum.nette.org/cs/35528-stejne-pojmenovany-parametr-akce-presenteru-a-persistentni-odlisne-chovani-v-nette-2-0-oproti-aktualnimu#p221742

BC break: Property must be nullable, ie: #[Persistent] public ?int $foo

Their content is text that the browser does not parse as HTML, so the empty
comment separating braces was displayed and corrupted the value, e.g. a {{ }}
in a submitted form (#409). The content now gets the subType rcdata, printed
by HtmlHelpers::escapeRcData() without touching braces.

A block placed in <textarea> or <title> has the content type html/rcdata,
which contextual filters now see instead of html; |stripHtml and |stripTags
accept it.

Vue, petite-vue and AngularJS read the DOM after the browser has decoded
entities, so the &#123; that escapeText() used for a single brace did not
protect anything: {$a}{$b} with '{' and '{7*7}}' produced a live {{ }}, and so
did '{{{' because strtr() replaced only non-overlapping pairs. A brace followed
by another one or ending the string, and a leading one, is now separated by an
empty comment; a brace in the middle stays as it is.

escapeRawHtml() for <script type="text/template"> did not separate braces at
all, so Vue evaluated {{ }} from a variable there.

Creating a formatter costs about 7 µs, formatting with an existing one 0.3 µs.
The rounding mode is now set in a single place.

In {include}, {embed}, {extends}, {layout} and {import} the arguments are
bound to parameters by position and by name, so in {include block, name: $a, $b}
the positional $b takes position 0 and overrides $name. PHP forbids such a call;
Latte now triggers E_USER_DEPRECATED and will throw in the next minor version.
Arrays of n:attr and n:class are not affected.

Since 3.1, a null value of an attribute means the attribute is omitted. URL
attributes were an exception: the checkUrls pass appends |checkUrl, which
converts null to '', so <a href={$url}> with null rendered href="". That
makes the element a link to the current page.

The pass now appends the filter as nullsafe ?|checkUrl, so null skips it and
the attribute is dropped. With migration warnings, the change is reported like
for other attributes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

With Feature::MigrationWarnings, a plain srcdoc value that renders as a different
document now than before (it contains '<' or a character reference) triggers
a warning suggesting to wrap trusted HTML in Latte\Runtime\Html. Text such as
'a & b' renders the same document as before and stays quiet; so does an Html
object, whose tags were stripped before and are kept now. |accept silences it.

It covers dynamic attributes (srcdoc={$x}, srcdoc="{$x}") and n:attr. A mixed
value like srcdoc="<p>{$x}</p>" is escaped by code the Escaper emits, which has
no access to feature flags, so it does not warn.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

The value of srcdoc is an HTML document: the browser attribute-decodes it and
then parses the result as HTML. Latte escaped it like any other attribute, so
<iframe srcdoc="<p>{$x}</p>"> with $x = '<script>...</script>' rendered
&lt;script&gt;, which decodes to a live <script>. An iframe without sandbox
shares the parent's origin, so this was an XSS.

srcdoc now gets its own html/attr/html context: a value is escaped as HTML text
first and as an attribute second (HtmlHelpers::escapeHtmlAttr). This covers the
static attribute, the dynamic attribute srcdoc={$x}, n:attr and blocks or
templates included into srcdoc.

An Html object is encoded only once, so trusted markup keeps its tags;
previously they were stripped.

BC break: trusted HTML passed as a plain string is now displayed as text. Wrap
it in Latte\Runtime\Html (or use |noescape).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

A member written without parentheses is read, also as a link of a chain:
@foo::getBar()::baz reads the property baz instead of calling baz(), and
@foo::bar::getBaz() reads bar before it calls getBaz(). ::$name is a static
property (@foo::$bar, Foo::$bar, @foo::getBar()::$baz), a name starting with
a capital letter is a constant, and an undefined constant Foo::BAR is an error
instead of a string. A method written without parentheses fails with a hint
to add them.

In setup, @foo::$bar = value assigns the static property as well; a property
of another service is assigned by @foo::bar = value.

Expression nodes extend Expression and no longer carry getEntity() or mutable
$arguments. A setup step may be any Expression, typed() and tagged() complete
to ServiceCollection.

- %parameters%
- three ... dots
- @inject & @var