Thanks Thomas!

We tweaked this a bit to remove the "set as default" mention from the versionadded directive. These directives should only contain the usual "XXX feature was introduced in Symfony YYY" because we delete them in new major Symfony versions and we don't want to lose any important information. Thanks!

I don't think this change is correct. By default, CSRF is stateful. It's only stateless when configuring the token id as stateless using stateless_token_ids. This is precisely what is documented in the next sentence and example from the one edited here.

@wouterj Isn't that what the recipe is doing (see link above)?

This should be reverted indeed. The doc is not about what recipes do, but about what can be done (with or without recipes)

While merging I added this:

Stateless CSRF tokens are enabled by default in applications using :ref:`Symfony Flex <symfony-flex>`.

Is this OK, or should we still revert this merge?

.. versionadded:: 7.2

Stateless anti-CSRF protection was introduced in Symfony 7.2.

Traditionally, CSRF tokens are stateful, meaning they're stored in the session.
However, some token IDs can be declared as stateless using the
stateless_token_ids option. Stateless CSRF tokens are enabled by default
in applications using :ref:Symfony Flex <symfony-flex>.

works for me, thanks.