Upgrading

Upgrading to Version 3.3

the automatic CSRF protection switched from isSameSite() to isFrom(FetchSite::SameOrigin) and became stricter: requests coming from subdomains no longer pass
thanks to that, addProtection() is no longer needed, because the automatic protection covers the same cases; omit it in new forms and feel free to remove it from the existing ones

Why tokens in the session are no longer necessary is explained in the article Quarter Century of CSRF.

getValues() returns only the validated controls; if you need the values of all controls regardless of validation, use the new method getUntrustedValues()
the $values passed to the onSuccess and onClick handlers likewise contain only the validated controls
standalone forms are automatically protected against CSRF by a cookie with the SameSite flag; you can allow submission from another origin using allowCrossOrigin()
the Form::URL rule now completes a missing protocol with https instead of http
Form::addImage() was renamed to addImageButton()
Checkbox::getSeparatorPrototype() was renamed to getContainerPrototype()
forms no longer create the $_form variable in templates

More about these changes in the article News in Nette Forms 3.1.

all form controls are optional by default now (this change was introduced in Nette 2.4), so you can remove setRequired(false)
be sure to update netteForms.js to version 3 (npm install nette-forms)
ChoiceControl::$checkAllowedValues and MultiChoiceControl::$checkAllowedValues have been replaced by the method checkDefaultValue()

if a control has a rule via addRule() (i.e. it is effectively mandatory), you must also mark it as mandatory via setRequired(); also, setRequired(false) now makes the control optional, which replaces addCondition($form::FILLED) branches
the validators Form::EMAIL, URL and INTEGER automatically change the HTML type attribute to email, url, and number respectively
negative validation rules are deprecated; the alternative for ~Form::FILLED is Form::BLANK, and ~Form::EQUAL can be replaced with Form::NOT_EQUAL
the internal parameter do is now sent via POST as _do to avoid a collision
the internal underscored variables such as $_form are deprecated
remember to update netteForms.js

internal filtering methods such as Nette\Forms\Controls\TextBase::filterFloat were removed
internal validation methods such as TextBase::validateFloat were moved to Nette\Forms\Validator, as was Rules::$defaultMessages
Buttons and Hidden fields are generated without an HTML ID; if you want an ID, set it via setHtmlId()
RadioList items are generated without an ID too; you can enable it via $radioList->generateId = true
filters added via TextBase::addFilter() are processed during validation, and you can now add filters to conditions: $input->addCondition(...)->addFilter(...)