A change of $defaultExtensions or $autowireExcludedClasses kept the compiled container, even in
debug mode, because the dependency check does not track them. Arguments of the extensions stay
out of the key, as they may hold objects such as RobotLoader.

0ec20b85-dc24-4d97-9312-acfe1af71d86

%baseUrl% is resolved from the IRequest service and Container::getParameters() evaluates every
dynamic parameter, so a container without that service threw MissingServiceException. %baseUrl%
is an empty string there now.

0ec20b85-dc24-4d97-9312-acfe1af71d86

Without vendor/ it knows nothing of the classes of the libraries, so a call of a deprecated method passes unnoticed.

Previously such a key was silently ignored.

Its state was silently skipped by Presenter::getGlobalState().

In the most typical flow - flashMessage() followed by redirect() - the template
was created just to be thrown away, which builds a whole Latte\Engine instance.
The messages are written to the session first and into the template only if it
already exists; a template created later gets them from the template factory,
which reads the flashes from the session on its own.

ReflectionClass::getAttributes() does not return attributes of parent classes,
so a rule placed on a common ancestor (a typical #[Requires(sameOrigin: true)]
on BaseAdminPresenter) was silently not enforced in its descendants. Attributes
are now collected along the whole ancestor chain; a rule explicitly set in a
descendant overrides the same rule of its ancestors.

This reverts commit cda17f460d020b0f042364d4e140742022a7e94d.

See https://forum.nette.org/cs/35528-stejne-pojmenovany-parametr-akce-presenteru-a-persistentni-odlisne-chovani-v-nette-2-0-oproti-aktualnimu#p221742

BC break: Property must be nullable, ie: #[Persistent] public ?int $foo

Their content is text that the browser does not parse as HTML, so the empty
comment separating braces was displayed and corrupted the value, e.g. a {{ }}
in a submitted form (#409). The content now gets the subType rcdata, printed
by HtmlHelpers::escapeRcData() without touching braces.

A block placed in <textarea> or <title> has the content type html/rcdata,
which contextual filters now see instead of html; |stripHtml and |stripTags
accept it.

Vue, petite-vue and AngularJS read the DOM after the browser has decoded
entities, so the &#123; that escapeText() used for a single brace did not
protect anything: {$a}{$b} with '{' and '{7*7}}' produced a live {{ }}, and so
did '{{{' because strtr() replaced only non-overlapping pairs. A brace followed
by another one or ending the string, and a leading one, is now separated by an
empty comment; a brace in the middle stays as it is.

escapeRawHtml() for <script type="text/template"> did not separate braces at
all, so Vue evaluated {{ }} from a variable there.

Creating a formatter costs about 7 µs, formatting with an existing one 0.3 µs.
The rounding mode is now set in a single place.

In {include}, {embed}, {extends}, {layout} and {import} the arguments are
bound to parameters by position and by name, so in {include block, name: $a, $b}
the positional $b takes position 0 and overrides $name. PHP forbids such a call;
Latte now triggers E_USER_DEPRECATED and will throw in the next minor version.
Arrays of n:attr and n:class are not affected.

Since 3.1, a null value of an attribute means the attribute is omitted. URL
attributes were an exception: the checkUrls pass appends |checkUrl, which
converts null to '', so <a href={$url}> with null rendered href="". That
makes the element a link to the current page.

The pass now appends the filter as nullsafe ?|checkUrl, so null skips it and
the attribute is dropped. With migration warnings, the change is reported like
for other attributes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

With Feature::MigrationWarnings, a plain srcdoc value that renders as a different
document now than before (it contains '<' or a character reference) triggers
a warning suggesting to wrap trusted HTML in Latte\Runtime\Html. Text such as
'a & b' renders the same document as before and stays quiet; so does an Html
object, whose tags were stripped before and are kept now. |accept silences it.

It covers dynamic attributes (srcdoc={$x}, srcdoc="{$x}") and n:attr. A mixed
value like srcdoc="<p>{$x}</p>" is escaped by code the Escaper emits, which has
no access to feature flags, so it does not warn.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

The value of srcdoc is an HTML document: the browser attribute-decodes it and
then parses the result as HTML. Latte escaped it like any other attribute, so
<iframe srcdoc="<p>{$x}</p>"> with $x = '<script>...</script>' rendered
&lt;script&gt;, which decodes to a live <script>. An iframe without sandbox
shares the parent's origin, so this was an XSS.

srcdoc now gets its own html/attr/html context: a value is escaped as HTML text
first and as an attribute second (HtmlHelpers::escapeHtmlAttr). This covers the
static attribute, the dynamic attribute srcdoc={$x}, n:attr and blocks or
templates included into srcdoc.

An Html object is encoded only once, so trusted markup keeps its tags;
previously they were stripped.

BC break: trusted HTML passed as a plain string is now displayed as text. Wrap
it in Latte\Runtime\Html (or use |noescape).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

A member written without parentheses is read, also as a link of a chain:
@foo::getBar()::baz reads the property baz instead of calling baz(), and
@foo::bar::getBaz() reads bar before it calls getBaz(). ::$name is a static
property (@foo::$bar, Foo::$bar, @foo::getBar()::$baz), a name starting with
a capital letter is a constant, and an undefined constant Foo::BAR is an error
instead of a string. A method written without parentheses fails with a hint
to add them.

In setup, @foo::$bar = value assigns the static property as well; a property
of another service is assigned by @foo::bar = value.

Expression nodes extend Expression and no longer carry getEntity() or mutable
$arguments. A setup step may be any Expression, typed() and tagged() complete
to ServiceCollection.