Released version 3.2.0

BC break:

• RequestFactory: removed HTTP authentication credential from Url to prevent leak it (#211 #215)

$httpRequest->getUrl()->getUser() + getPassword()
// changed to 
[$user, $pass] = $httpRequest->getBasicCredentials();

New features:

• Request: added getBasicCredentials()
• Url, UrlImmutable: added getDefaultPort()
• RequestFactory::getHeaders() recreates Authorization header
• support for full_path upload (#207 #212)
• HttpExtension: dynamic options cookiePath, cookieDomain, cookieSecure (#216)
• constants are PascalCase

Deprecations:

• IRequest::getRemoteHost() is silently deprecated (#218)
• SessionSection: magic accessors & ArrayAccess are silently deprecated
• Session::getIterator() is deprecated

Released version 3.1.7

• support for PHP 8.2
• Request::getReferer() is deprecated #210
• cs

Released version 3.1.6

• added Request::getOrigin()
• RequestFactory: support for PHP built-in web server nette-examples/user-authentication#3
• coding style

Released version 3.1.5

• SessionExtension: added values 'always' & 'never' for option 'autoStart'
• Session: option 'autoStart' controls auto start on reading or writing (BC break)
• Session: added autoStart() to prevent session files from being created when the session id is spoofed
• SessionSection: remove() is not writing operation
• SessionSection: added methods set(), get(), remove()
• Session: refactoring
• Session: cleaning is done in __destruct
• Session: don't send session cookie twice
• Session: don't regenerate ID in readAndClose mode
• Session: added events $onStart & $onBeforeWrite
• Session: fixed condition in clean()

Released version 3.0.7

• SessionExtension: default is autoStart = false to avoid creating new session files if the session_id is spoofed (BC break)
• SessionSection: added methods set(), get(), remove()
• Session: don't send session cookie twice
• Session: don't regenerate ID in readAndClose mode
• Session: fixed condition in clean()

Released version 3.1.2

• support for PHP 8.1
• HttpExtension: added option 'disableNetteCookie' #205
• Session: fixed option 'readAndClose' #206
• Session: fixed condition in destroy() (#204)
• RequestFactory: urlFilters replaces only double // to single
• RequestFactory: strips trailing . from host

Released version 3.0.6

• HttpExtension: added option 'disableNetteCookie' #205
• Session: fixed option 'readAndClose' #206
• Session: fixed condition in destroy() (#204)
• RequestFactory: urlFilters replaces only double // to single
• RequestFactory: strips trailing . from host
• Helpers: nette-samesite is resent at each request
• IResponse: added constants SAME_SITE_*
• ScriptUrl: Fix class extendability (#187) (#188)

Released version 3.1.1

• added Response::sendAsFile()
• SessionSection: __get() returns reference (#191)(#192)
• Url: IDN domain automatically convert to UTF-8. (#190)

For the details you can have a look at the diff.

Released version 3.1.0

• requires PHP 7.2
• Response::setCookie() default $sameSite is 'Lax' (BC break)
• Response::setCookie() prevents an inappropriate combination of path and domain
• Response: deprecated $cookieHttpOnly
• Request::getFile() accepts array of keys and returns FileUpload|null (BC break)
• FileUpload::getImageSize() returns only [x, y] values (BC break)
• UrlImmutable: added withQueryParameter()
• Url: silently deprecated getBasePath(), getBaseUrl(), getRelativeUrl()
• UserStorage is deprecated by Nette\Bridges\SecurityHttp\SessionStorage

Session & Cookies

• Session: default sameSite is 'Lax' (BC break)
• SessionExtension: option session.cookieSecure is deprecated, http.cookieSecure is used (BC break)
• SessionExtension: checks that cookieSamesite is Lax|Strict|None (BC break)
• SessionSection: can read data when session is closed
• Session: deprecated getCookieParameters() triggers E_USER_DEPRECATED
• HttpExtension: added options cookiePath & cookieDomain
• HttpExtension: cookieSecure is by default 'auto' (BC break)
• cookie nette-samesite renamed to _nss

Released version 2.4.12

compatible with PHP 8.0