htmx 4.0.0 makes attribute inheritance explicit and renames every event

Sources: announcement, discussion
Summary: The release names three breaking changes. Attributes are no longer inherited by default and need an :inherited suffix, which the team calls the largest upgrade burden and which silently breaks CSRF headers set on a parent element, events move to an htmx:phase:action shape so htmx:beforeRequest becomes htmx:before:request with the htmx:xhr:* events gone after internals moved from XMLHttpRequest to fetch() and the htmx:validation:* events replaced by native form validation, and history now re-fetches on back navigation rather than caching pages in localStorage. New features are built-in morph swaps and an hx-partial tag for multi-target responses, npm latest stays on the 2.x line with 4.0 published under next until early 2027, htmx 2 stays supported, and npx htmx.org@4.0.0 upgrade-check flags the sites that need changing.
Why it matters: Removing default inheritance can drop a CSRF header set on a parent element with no error raised, which is the failure the upgrade check exists to find.
Follow-up: Track whether 4.0 takes the npm latest tag in early 2027 as stated.