✨ New Features

• Support for PHP 8.6
• Support for nette/neon 4.0: configuration files are read the same way as with 3.x, which keeps working
• #[SensitiveParameter] now hides arrays and other non-scalar arguments too, so database credentials passed as an array no longer show up in Tracy's source snippets
• Nette\DI\Definitions\Definition now lives at Nette\DI\Definition; the old name keeps working as an alias

💥 Breaking Changes

• Locator definitions are checked at compile time. Every reference must match a get*() or create*() method of the interface, and every method with a non-nullable return type must have its reference. A typo in a key now fails compilation with a message naming the reference or method, where it used to compile and throw MissingServiceException only on the first call. Fix the key, or make the method's return type nullable if the service is truly optional. Interfaces with a generic get($name) are exempt.
• Service names may no longer contain __, which is reserved for encoding dots in the names of generated methods.

🐛 Bug Fixes

• Locator methods with an acronym work with the natural key: getPDO() finds the reference pdo (and still pDO), the same for getURL(), getDB() and the like
• Container::createInstance() and callMethod() pass the actual value to a scalar parameter marked #[SensitiveParameter]
• getServiceDescriptors() reports a service named PDO under its real name instead of pDO

The container stops being a black box. This release adds a first-class introspection API, a PSR-11 bridge, and – finally – containers that actually reload themselves in long-running processes instead of silently serving a stale build forever. A handful of quiet misconfigurations were also promoted to loud errors.

✨ New Features

• Containers now reload themselves in long-running processes. Until now, auto-rebuild only ever helped the next request: PHP cannot redeclare a class that is already loaded, so a queue worker, a dev server, a CLI tool or an MCP server kept serving the very first compiled container for the rest of its life, no matter how many times the configs changed and the file on disk was regenerated. With auto-rebuild on, ContainerLoader now gives every build a fresh class name (Container_<key>_<hash>) and, on every load(), checks the compiled file's content rather than merely whether it has just been regenerated, so a rebuild done by another process over the same cache (a web request while your worker runs) is picked up as well. A process simply gets a new container instance whenever its configuration changed, with no restart. Without auto-rebuild nothing changes: production still compiles once and never looks back.
• New Container::getServiceDescriptors() – a read-only snapshot of every registered service (name, type, autowiring, tags, aliases, and the instance if it exists), in definition order, without instantiating anything. Tools that until now read the container's private properties through Closure::bind() and scanned createService* methods by reflection can drop the tricks; the Tracy panel already has.
• New Nette\Bridges\DIPsr\PsrContainer – wrap your container and hand it to any library that speaks PSR-11. get() resolves both service names and autowired types, with ambiguity reported rather than guessed.
• A service produced by a factory can autowire itself in its own setup, so @self and self-typed arguments work there like anywhere else.

🐛 Bug Fixes

• Windows users: writing the compiled container no longer fails intermittently with "Access is denied" when antivirus or an opcache handle holds the target file for a moment – the rename is briefly retried, and the opcache handle is dropped first. Other platforms behave exactly as before.
• addService() refuses a name already taken by a factory, matching the existing behavior for instances. The counterpart: removeService() now removes factories too, so a name freed by removeService() is genuinely free.

⚡ Performance

• Registering a definition no longer scans every existing definition to check for a case-insensitive name clash; an index does it in constant time. Containers with thousands of services notice.

A maintenance release laser-focused on type safety. Static analysis is now mandatory in CI, the codebase ships richer native and PHPDoc types, and the Tracy DI panel got a cleaner Latte rewrite. No behavioral changes – just a sturdier foundation for everything built on top.

• Native types – tightened parameter and return types across Compiler, ContainerLoader, ServiceDefinition and friends
• ContainerPanel – Tracy panel template rewritten with n:attributes for noticeably cleaner Latte syntax
• PHPStan-clean codebase – wide-ranging cleanup across DI internals so the whole tree passes strict analysis
• Richer PHPDoc – improved @param, @return and class descriptions across Compiler, Container, ContainerBuilder, Resolver, Helpers, definitions and extensions, giving IDEs and static analyzers far more to work with
• Better generic types – sharpened PHPDoc generics in autowiring, container builder, definitions and resolver

• support for PHP 8.5
• optimized global function calls
• used generics for Container::createInstance() (#323)

• implemented support for lazy services in PHP 8.4
• Resolver: restrictions for named parameters have been removed
• Resolver: triggers error when reference is called with arguments

• support for PHP 8.4
• md5 replaced with xxHash
• fixed ReflectionParameter::getDefaultValue() error #315

• Container: refactoring
• NeonAdapter: resolving of constants and enums moved here from filterArguments() (BC break)
• Container::getServiceType() ignores dynamically added services (BC break)
• Container::getByType() fixed cooperation with dynamic factory #314
• Resolver: better exception when normalizeEntity() fails due to service replacement
• Revert "LocatorDefinition: deprecated support for create($name) method (BC break)"

• PhpGenerator: DTO and DateTime are not suspicious objects #306 #308
• NeonAdapter: fixed to string conversion #307
• Compiler::loadDefinitionsFromConfig() expands parameters (after 3399312)

• requires PHP 8.1
• uses PHP 8.1 features
• Sensitive parameters are put in markers /sensitive{/ and /}/
• added support for first-class callable syntax in NEON
• SearchExtension: added 'exclude -> files'
• ServicesExtension: locator supports Statement (#294)

changes

• Resolver: only optional parameters are autowired with default value (BC break)
• generated accessors/factories must have defined return type (BC break)
• %parameters% is deprecated (BC break)
• LocatorDefinition: deprecated support for create($name) method (BC break)
• PhpGenerator: warns about suspicious dumping of objects

• ParametersExtension: exports both statements and dynamic parameters, preloads only the latter
• allowed %foo.bar% expansion of Statement
• SearchExtension: also searches for accessors
• Resolver::autowireArgument() fixed handling of new-initializer with typehint #302
• InjectExtension: added type checking
• NeonAdapter::removeUnderscoreVisitor() checks if key doesn't exist