v3.5.1

Changelog (v3.5.0...v3.5.1)

• bug #3892 [Map] Add missing support for Symfony 8.2's standalone AssetMapperBundle (@Kocal)
• bug #3891 [Pagination] Add missing support for Symfony 8.2's standalone AssetMapperBundle (@Kocal)

v3.5.0

Changelog (v3.4.0...v3.5.0)

• minor #3890 [Toolkit][Shadcn] Drop the dead height option from recipe previews (@Kocal)
• feature #3889 [Toolkit][Shadcn] Add message recipe (@ker0x)
• feature #3872 [Toolkit][Shadcn] Add questionnaire recipe (@ker0x)
• feature #3883 [Toolkit][Shadcn] Add date-picker recipe (@ker0x)
• minor #3888 [Map] Make the Google Maps browser test resilient (@smnandre)
• feature #3855 [Toolkit][Shadcn] Add calendar recipe (@ker0x)
• feature #3796 [Toolkit] Read prop and block docs from Twig documentation comments (@Kocal)
• feature #3814 [Autocomplete][Cropperjs][Dropzone][LiveComponent][StimulusBundle][Toolkit][TwigComponent] Add support for Twig 4.x (@Kocal)
• feature #3821 [Icons][Map] Render attributes through twig/html-extra's html_attr() logic (@Kocal)
• feature #3820 [TwigComponent] Render component attributes through twig/html-extra's html_attr() (@Kocal)
• feature #3870 [Toolkit][Shadcn] Add bubble recipe (@ker0x)
• bug #3880 [LiveComponent] Handle paths beginning with double slash in LiveUrlSubscriber (@mbuliard)
• feature #3876 [Icons] Add IconFinderInterface to create custom finders to lock icons (@pierredup)
• bug #3887 [Toolkit][Shadcn] Document accessibility, fix <dialog>-based recipies accessibility, and improve right-to-left layouts (@Kocal)
• feature #3871 [Toolkit][Shadcn] Add marker recipe (@ker0x)
• feature #3869 [Toolkit][Shadcn] Add attachment recipe (@ker0x)
• feature #3884 [Toolkit][Shadcn] Add carousel recipe (@Kocal)
• bug #3878 [Toolkit][Shadcn] Fix the rich colors of Sonner recipe (@Kocal)
• feature #3868 [LiveComponent] Upgrade Idiomorph to 0.7.4 (@smnandre)
• feature #3858 [Autocomplete] Add a max_options option to control how many options the dropdown displays (@Kocal)
• feature #3882 [Autocomplete][Chartjs][Cropperjs][Dropzone][LiveComponent][Map][Notify][React][StimulusBundle][Turbo][Vue] Update TypeScript's target to es2022 (@Kocal)
• minor #3881 [Autocomplete] Make search test fixtures deterministic (fix flakky) (@smnandre)
• feature #3867 [StimulusBundle] Detect the standalone AssetMapper bundle (@smnandre)
• bug #3851 [Toolkit] Fix ux:install reporting the source path of the installed files (@ker0x)
• bug #3860 [Toolkit] Restore the "available since" note on recipe install steps (@Kocal)
• feature #3849 [StimulusBundle] Make StimulusHelper autowirable and document PHP usage (@Kocal)
• bug #3847 [Turbo] Fix broadcasting an entity whose identifier is made of associations (@Kocal)
• minor #3846 [Translator] Cover the parent locale fallback in the dumper tests (@Kocal)
• bug #3843 [Dropzone] Fix the drop zone appearing empty when the same file is dropped again (@Kocal)
• bug #3842 [Toolkit][Flowbite] Rename the modal Stimulus controller to avoid a collision with Flowbite (@Kocal)
• bug #3518 [TwigComponent] Fix PreLexer confusing {# inside output expressions with comments (@Amoifr)
• feature #3441 [Autocomplete] Decouple from Doctrine ORM - support any data source (@Prometee)
• feature #3679 [Cropperjs] Upgrade to Intervention Image v4 and make the image driver configurable (@deluxetom)
• feature #3684 Allow for multiple file uploads at once (@Dooij)
• feature #3763 [Autocomplete] Translate the optgroup labels returned by the AJAX endpoint (@kira0269)
• bug #3836 [TwigComponent] Fix null-safe operator in component tag props (@alireza-aminzadeh)
• bug #3827 [TwigComponent] Treat a prop explicitly passed as null as defined (@Kocal)
• minor #3823 [LiveComponent] Use test stubs instead of mocks (@smnandre)
• bug #3832 Remove vulnerable extract-zip dependency (@smnandre)
• bug #3831 [CI] Pin DOCtor-RST container image (@smnandre)
• bug #3829 [React] Update E2E dependencies (@smnandre)
• feature #3753 [Pagination] Add new UX Pagination component (@smnandre)
• feature #3773 [LiveComponent] Add LiveResponse::remove() to trigger component deletion (@smnandre)
• feature #3817 [CalendarLink] Derive a stable ICS UID from the event content (@Kocal)
• feature #3816 [CalendarLink] Make DTSTAMP deterministic via the Clock component (@Kocal)
• feature #3818 [CalendarLink] Anchor timed events to their time zone with TZID and VTIMEZONE (@Kocal)
• feature #3826 [CalendarLink] Make IcsBuilder internal (@Kocal)
• minor #3819 [Autocomplete] Translated 'Add placeholder' to Italian (@luigif)
• feature #3469 [Toolkit][Shadcn] Add sidebar recipe (@Amoifr)
• feature #3804 [Toolkit][Shadcn] Add form recipe (@Kocal)
• feature #3806 [Toolkit][Shadcn] Add drawer recipe (@Kocal)
• feature #3805 [Toolkit][Shadcn] Add sheet recipe (@Kocal)
• feature #3807 [Toolkit][Shadcn] popover: honor [autofocus] and skip hidden inputs when focusing content (@Kocal)
• feature #3803 [Toolkit][Shadcn] Focus the first form field when a dialog opens (@Kocal)
• feature #3481 [Toolkit][Shadcn] Add slider recipe (@Kocal)
• feature #3480 [Toolkit][Shadcn] Add scroll-area recipe (@Kocal)
• feature #3802 [Toolkit][Shadcn] Remove typography recipe (@Kocal)
• feature #3479 [Toolkit][Shadcn] Add native-select recipe (@Amoifr)
• feature #3801 [Toolkit][Shadcn] Add navigation-menu recipe (@Kocal)
• feature #3232 [Toolkit][Shadcn] Add DropdownMenu component (@Kocal)
• feature #3487 [Toolkit][Shadcn] Add popover recipe (@Kocal)
• bug #3791 [LiveComponent] Fix proxy turning "toJSON" and "then" protocol probes into server actions (@Amoifr)
• bug #3798 [Toolkit][Shadcn] Fix the hover-card usage example crashing on a plain HTML trigger (@Amoifr)
• feature #3795 [TwigComponent] Capture prop documentation comments (@Kocal)
• feature #3486 [Toolkit][Shadcn] Add menubar recipe (@Kocal)
• feature #3483 [Toolkit][Shadcn] Add input-otp recipe (@Kocal)
• minor #3777 [LiveComponent] Cache the attribute-method lookups per component class (@Kocal)
• bug #3762 [TwigComponent] Fix twig:blockquote is not a block (@smnandre)
• minor #3779 [Map] Render each UX icon once instead of once per marker (@Kocal)
• minor #3783 [StimulusBundle] Stop watching the DOM once every lazy controller is loaded (@Kocal)
• minor #3776 [TwigComponent] Reduce per-character work in the pre-lexer scan loops (@Kocal)
• minor #3784 [Translator] Cache the RegExp compiled by strtr() (@Kocal)
• minor #3786 [LiveComponent] Skip the bracket pipeline for plain model names (@Kocal)
• minor #3781 [StimulusBundle] Speed up Stimulus name normalization (@Kocal)
• minor #3775 [TwigComponent] Fix quadratic scanning in TwigPreLexer::consume() (@Kocal)
• minor #3780 [Toolkit] Stop re-walking the filesystem on every Recipe::getFiles() (@Kocal)
• minor #3785 [TwigComponent] Build the exposed properties without a generator (@Kocal)
• minor #3782 [Icons] Cut per-render allocations in IconRenderer::renderIcon() (@Kocal)
• bug #3764 [TwigComponent] Fix { verbatim } pre-lexing (@smnandre)
• feature #3771 [Icons] Migrate to modern \Dom\XMLDocument API (@Kocal)
• feature #3699 [TwigComponent] Add dynamic component support for HTML-syntax (@seb-jean)
• feature #3596 [Toolkit] Finalize support for Blocks, add Shadcn's login-01 and login-02 blocks (@seb-jean)
• feature #3760 [Toolkit] Migrate Tailwind kits to the tailwind_classes mergeable idiom (@Kocal)
• feature #3756 [TwigComponent] Support MergeableInterface in ComponentAttributes (@Kocal)
• minor #3758 Upgrade pnpm to 11.21.0 (@Kocal)
• bug #3749 [Toolkit] Restore the filename above installation code blocks (filename code options) (@Kocal)

v3.4.0

Changelog (v3.3.0...v3.4.0)

• feature #3740 [Toolkit][Common] Add clipboard and tooltip recipes (@kbond)
• feature #3733 [Toolkit] Document Stimulus controller CSS classes and outlets in the API reference (@kbond)
• feature #3741 [Icons] Add auto_lock to persist on-demand icons (@Kocal)
• feature #3395 [TwigComponent] Support component tag names from expressions and component objects (@andreybotanic)
• feature #3736 [Toolkit] Rework and normalize usage of attributes.defaults() in kits components (@seb-jean, @Kocal)
• minor #3735 Add sync-packages.php to normalize packages .gitattributes (@Kocal)
• bug #3730 Fix broken assets/tsconfig.json reference breaking webpack 5.109+ builds (@zalesak)
• minor #3734 [Toolkit] Remove height preview option (@Kocal)
• feature #3724 [Toolkit] Document Stimulus controllers in the recipe API reference (@kbond)
• feature #3725 [Toolkit][Common] Add closeable recipe (@kbond)
• feature #3716 [Translator] Make the component non-experimental (@Kocal)
• feature #3713 [Toolkit] Boostrap Toolkit (@smnandre, @Kocal)
• bug #3720 [Toolkit] Fix suggested frontend installation commands (@smnandre)
• feature #3719 [Toolkit] Support kit-level dependencies (@smnandre)
• bug #3721 [Toolkit] Require the correct twig/html-extra version for html_attr_* filters (@Kocal)
• feature #3718 [Toolkit] Add a documentation rendering layer so kits can describe themselves (@Kocal)
• feature #3714 [React][Vue] Add support for import.meta.glob() (Symfony Reprise) (@Kocal)
• feature #3707 [Toolkit][Common] Add the common kit with logout-link and post-link recipes (@kbond)
• bug #3710 [Toolkit][Shadcn] Fix Table:Cell and Table:Head class attibutes merging (@stephen-lewis)
• feature #3709 [Toolkit] Add ClassMergeSpacingChecker checker to the linter (@Kocal)

v3.3.0

Changelog (v3.2.0...v3.3.0)

• feature #3705 [StimulusBundle] Add support for Symfony Reprise (@Kocal)
• feature #3702 [StimulusBundle] Support preserved /*! stimulusFetch: 'lazy' */ syntax (@IndraGunawan)
• bug #3703 [StimulusBundle] Sort custom controllers to keep the generated loader deterministic (@Amoifr)
• bug #3676 [LiveComponent] Avoid 500 errors on malformed hydration payloads (@Amoifr)
• bug #3688 [LiveComponent] Fix data-loading scanner ignoring data-live-ignore subtrees (@Amoifr)
• bug #3690 [LiveComponent] Fix support for nullable collection properties on component (@rogierknoester)
• feature #3700 [Toolkit] Resolve ux:install recipe name case-insensitively and suggest alternatives (@Kocal)
• feature #3696 [Toolkit][Shadcn] Dismiss the tooltip on scroll and resize, and stop it from intercepting pointer events while hidden (@Kocal)
• feature #3694 [Toolkit] Refactor (again) but improve @prop and @block comments format (@Kocal)
• bug #3685 [Autocomplete] Fix LIKE ESCAPE clause breaking search on PostgreSQL (@Amoifr)
• feature #3477 [Shadcn] Add Sonner (@makraz)
• minor #3693 [Toolkit] Make component rendering snapshots independent from the libxml version (@Kocal)
• feature #3482 [Toolkit][Shadcn] Add Combobox (@makraz)

v2.36.2

Changelog (v2.36.1...v2.36.2)

• bug #3685 [Autocomplete] Fix LIKE ESCAPE clause breaking search on PostgreSQL (@Amoifr)

v3.2.0

Changelog (v3.1.0...v3.2.0)

• security #cve-2026-55877 [Icons] Sanitize Iconify SVG output and unify icon creation (@Kocal)
• security #cve-2026-55878 [Toolkit] Harden recipe installer against path traversal (@Kocal)
• bug #3682 [Toolkit][Shadcn] Fix position and phantom text-node in tooltip recipe (@Kocal)
• feature #3602 [TwigComponent] Allow standalone usage with any PSR-11 container (@guillaume-sainthillier)
• bug #3673 [Encore] Pin vue to <3.5.36 to workaround broken upstream publish (@Kocal)
• bug #3672 [Toolkit][Flowbite4] Fix linting issues (@Kocal)
• feature #3671 [Toolkit] Allow declaring kit-global dependencies in kit manifest (@Kocal)
• bug #3659 [Toolkit] Consider recipe deps in StimulusControllerChecker (@Kocal)
• feature #3655 [Toolkit] Add lint kit command and CI lint workflow (@Kocal)
• bug #3652 [Toolkit][Shadcn] Fix manifest dependencies (@seb-jean)
• feature #3600 [TwigComponent] Expose pre/embedded render methods on ComponentRendererInterface (@treztreiz)
• bug #3614 [Turbo] Conflict with Mercure >=0.7.0 <0.7.2 (@Kocal)
• feature #3611 [Native] Rename ux-native:dump command to ux:native:build-configs (@Kocal)

v2.36.1

Changelog (v2.36.0...v2.36.1)

• security #cve-2026-55877 [Icons] Sanitize Iconify SVG output and unify icon creation (@Kocal)
• security #cve-2026-55878 [Toolkit] Harden recipe installer against path traversal (@Kocal)

v3.1.0

Changelog (v3.0.0...v3.1.0)

• security #557 [LiveComponent] Require X-Requested-With header to prevent CSRF (@Kocal)
• security #cve-2026-49216 [Autocomplete] Fix XSS via unescaped AJAX response data (@Kocal)
• security #cve-2026-49208 [LiveComponent] Parse format-less date LiveProps strictly with RFC 3339 (@Kocal)
• security #cve-2026-49209 [LiveComponent] Cap the number of actions per _batch request (@Kocal)
• security #cve-2026-49210 [LiveComponent] Reject malicious child component tags (@Kocal)
• security #cve-2026-49212 [LiveComponent] Bind HMAC checksum to component name and slot (@Kocal)
• security #cve-2026-49211 [Autocomplete] Escape LIKE wildcards in the search query (@Amoifr)
• feature #3601 [Translator] Add ux:translator:warm-cache command (@Kocal)
• feature #3432 [LiveComponent] Improve form validation error messages in exceptions (@PierreCapel)
• feature #3455 Use twig.safe_class tag and move setLexer to TwigComponentPass (@GromNaN)
• feature #3586 [Toolkit][Shadcn] Align button-group with shadcn reference (@seb-jean)
• feature #3589 [Toolkit][Shadcn] Align toggle-group with shadcn reference (@seb-jean)
• feature #3587 [Toolkit][Shadcn] Align hover-card with shadcn reference (@seb-jean)
• feature #3584 [Toolkit][Shadcn] Align collapsible with shadcn reference (@seb-jean)
• feature #3561 [Toolkit][Shadcn] Align table with shadcn reference (@seb-jean)
• feature #3563 [Toolkit][Shadcn] Align skeleton with shadcn reference (@seb-jean)
• feature #3583 [Toolkit][Shadcn] Align dialog with shadcn reference (@seb-jean)
• feature #3585 [Toolkit][Shadcn] Align empty with shadcn reference (@seb-jean)
• bug #3566 [LiveComponent] Make LiveComponentSubscriber safe-by-default (@Kocal)
• feature #3591 [Toolkit][Shadcn] Align switch with shadcn reference (@seb-jean)
• feature #3592 [Toolkit][Shadcn] Align field with shadcn reference (@seb-jean)
• feature #3593 [Toolkit][Shadcn] Align radio-group with shadcn reference (@seb-jean)
• feature #3594 [Toolkit][Shadcn] Align input-group with shadcn reference (@seb-jean)
• feature #3590 [Toolkit][Shadcn] Align input with shadcn reference (@seb-jean)
• feature #3559 [Toolkit][Shadcn] Align item with shadcn reference (@seb-jean)
• feature #3574 [Toolkit][Shadcn] Align label with shadcn reference (@seb-jean)
• feature #3573 [Toolkit][Shadcn] Align spinner with shadcn reference (@seb-jean)
• feature #3576 [Toolkit][Shadcn] Align checkbox with shadcn reference (@seb-jean)
• feature #3577 [Toolkit][Shadcn] Align progress with shadcn reference (@seb-jean)
• feature #3581 [Toolkit][Shadcn] Align kbd with shadcn reference (@seb-jean)
• feature #3553 [Toolkit][Shadcn] Align alert-dialog with shadcn reference (@seb-jean)
• feature #3551 [Toolkit][Shadcn] Align accordion with shadcn reference (@seb-jean)
• feature #3539 [Toolkit][Shadcn] Align separator with shadcn reference (@seb-jean)
• feature #3552 [Toolkit][Shadcn] Align alert with shadcn reference (@seb-jean)
• feature #3554 [Toolkit][Shadcn] Align aspect-ratio with shadcn reference (@seb-jean)
• feature #3555 [Toolkit][Shadcn] Align avatar with shadcn reference (@seb-jean)
• feature #3556 [Toolkit][Shadcn] Align badge with shadcn reference (@seb-jean)
• feature #3557 [Toolkit][Shadcn] Align breadcrumb with shadcn reference (@seb-jean)
• feature #3558 [Toolkit][Shadcn] Align button with shadcn reference (@seb-jean)
• feature #3564 [Toolkit][Shadcn] Align pagination with shadcn reference (@seb-jean)
• feature #3567 [Toolkit][Shadcn] Align tabs with shadcn reference (@seb-jean)
• feature #3568 [Toolkit][Shadcn] Align tooltip with shadcn reference (@seb-jean)
• feature #3569 [Toolkit][Shadcn] Align textarea with shadcn reference (@seb-jean)
• feature #3570 [Toolkit][Shadcn] Align resizable with shadcn reference (@seb-jean)
• bug #3565 [Autocomplete] Use hash_equals() to compare the extra_options checksum (@Amoifr)
• feature #3560 [Toolkit][Shadcn] Align toggle with shadcn reference (@seb-jean)
• feature #3538 [Toolkit][Shadcn] Align card with shadcn reference (@seb-jean)
• feature #3505 [Turbo] Add <turbo-mercure-stream-source> custom element (@seb-jean)
• feature #3531 [Toolkit] Add version-added key in toolkit manifest (@MrYamous)
• feature #3460 [CalendarLink] Add component (@zairigimad)
• bug #3508 [LiveComponent] Fix dynamic template resolution when using "loading" attribute (@xDeSwa)
• bug #3500 [TwigComponent] Include attribute name in null value error message (@IndraGunawan)
• feature #3527 [Toolkit][Shadcn] Rework collapsible recipe to use provide()/inject() (@Kocal)
• feature #3526 [Toolkit][Shadcn] Rework tooltip recipe to use provide()/inject() (@Kocal)
• feature #3525 [Toolkit][Shadcn] Rework alert-dialog recipe to use provide()/inject() (@Kocal)
• feature #3524 [Toolkit][Shadcn] Rework dialog recipe to use provide()/inject() (@Kocal)
• feature #3523 [Toolkit][Shadcn] Rework accordion recipe to use provide()/inject() (@Kocal)
• feature #3528 [Toolkit][Shadcn] Rework toggle-group recipe to use provide()/inject() (@Kocal)
• feature #3521 [Toolkit][Shadcn] Rework tabs recipe to use provide()/inject() (@Kocal)
• feature #3512 [TwigComponent] Add provide() and inject() Twig functions (@Kocal)
• feature #3478 [Toolkit][Shadcn] Add hover-card recipe (@Amoifr)
• feature #3485 [Toolkit][Shadcn] Add resizable recipe (@Amoifr)
• feature #3462 [Turbo] Add TurboFrame service to detect Turbo Frame requests (@seb-jean)
• feature #3439 [Turbo] Add minimal frame layout template (@seb-jean)
• feature #3464 [Toolkit][Shadcn] Add radio-group, collapsible, typography and toggle-group recipes (@Amoifr)
• feature #3442 [LiveComponent] Use aria-busy attribute during component re-render (@Amoifr)
• feature #3459 [Toolkit][Flowbite] add Dropdown and Avatar component (@DcgRG)

v2.36.0

Changelog (v2.35.0...v2.36.0)

• security #557 [LiveComponent] Require X-Requested-With header to prevent CSRF (@Kocal)
• security #cve-2026-49216 [Autocomplete] Fix XSS via unescaped AJAX response data (@Kocal)
• security #cve-2026-49208 [LiveComponent] Parse format-less date LiveProps strictly with RFC 3339 (@Kocal)
• security #cve-2026-49209 [LiveComponent] Cap the number of actions per _batch request (@Kocal)
• security #cve-2026-49210 [LiveComponent] Reject malicious child component tags (@Kocal)
• security #cve-2026-49212 [LiveComponent] Bind HMAC checksum to component name and slot (@Kocal)
• security #cve-2026-49211 [Autocomplete] Escape LIKE wildcards in the search query (@Amoifr)

3.0.0 : New Major Release! 🎉

Changelog (v2.35.0...v3.0.0)

• feature #3452 [LiveComponent] Remove compatibility layer with Symfony PropertyInfo <7.1 (@Kocal)
• feature #3453 Update minimum required Symfony version to 7.4 (@Kocal)
• feature #3450 Upgrade minimum required PHP version to 8.4 (@Kocal)
• feature #3433 [Cropper] Always apply rotation in Crop::getCroppedImage() and Crop::getCroppedThumbnail() (@MrYamous)
• bug #3398 Post-merge fixes for 3.x (@Kocal)
• feature #3186 [Autocomplete][Turbo] Remove BC layers for methods and parameters (@Kocal)
• bug #3191 Fix 2.x -> 3.x merge (@Kocal)
• bug #3187 Add phpunit.dist.xml in .gitattributes (@Kocal)
• bug #3182 Drop Symfony PHPUnit Bridge in favor of PHPUnit >= 11.0 (@Kocal)
• feature #3180 [StimulusBundle] Remove deprecations for 3.0 (@Kocal)
• feature #3179 [Vue] Remove deprecations for 3.0 (@Kocal)
• feature #3103 [Autocomplete] Remove deprecated code for 3.0 (@smnandre)
• feature #3115 [Map][Google] Upgrade @googlemaps/js-api-loader to ^2.0 (@Kocal)
• bug #3105 [TwigComponent] Remove dev-dependency on WebpackEncoreBundle (@Kocal)
• feature #3102 [Chartjs][Notify][React][Svelte] Remove StimulusHelper deprecation for 3.0 (@smnandre)
• feature #3101 [Vue] Remove deprecations for 3.0 (@smnandre)
• feature #3100 [Turbo] Remove deprecations for 3.0 (@smnandre)
• feature #3040 [TwigComponent][UX3] Remove deprecations (@smnandre)
• feature #3051 [LiveComponent][UX3] Remove deprecations (@smnandre)
• feature #3054 [Map] Remove deprecations from Map (@Kocal)
• feature #2998 Upgrade minimum required PHP version to 8.2 (@Kocal)
• feature #2996 Update minimum required Symfony version to ^6.4 (@Kocal)
• feature #2995 [TogglePassword] Remove package (@Kocal)
• feature #2994 [LazyImage] Remove package (@Kocal)
• feature #2993 [Typed] Remove package (@Kocal)
• feature #2985 [Swup] Remove package (@smnandre)