build(deps): bump the composer group across 1 directory with 2 updates

[dependabot]

Bumps the composer group with 2 updates in the / directory: symfony/ux-icons and symfony/ux-toolkit.

Updates symfony/ux-icons from 2.32.0 to 2.36.1

Release notes

Sourced from symfony/ux-icons's releases.

v2.36.1

Changelog (symfony/ux-icons@v2.36.0...v2.36.1)

• security #cve-2026-55877 Sanitize Iconify SVG output and unify icon creation (@​Kocal)

v2.36.0

Changelog (symfony/ux-icons@v2.35.0...v2.36.0)

• no significant changes

v2.35.0

Changelog (symfony/ux-icons@v2.34.0...v2.35.0)

• feature #3407 Allow Symfony UX 3.x packages (@​Kocal)

v2.34.0

Changelog (symfony/ux-icons@v2.33.0...v2.34.0)

• no significant changes

v2.33.0

Changelog (symfony/ux-icons@v2.32.0...v2.33.0)

• bug #3355 Fix CI (@​Kocal)
• feature #3324 Add support for suffixes (@​seb-jean)

Changelog

Sourced from symfony/ux-icons's changelog.

2.36.1

• Sanitize rendered SVG icons (Iconify bodies and local files) to prevent XSS. Removed from icon output:

  • Elements: <script>, <foreignObject>, <iframe>, <object>, <embed>, <handler>
  • SMIL animation elements (<animate>, <set>, <animateTransform>, <animateMotion>) when they target an on*, href or xlink:href attribute
  • CDATA sections and processing instructions (otherwise re-serialized as raw HTML)
  • Event-handler attributes (on*, e.g. onload, onclick) on every element
  • href / xlink:href values with a non-allowlisted scheme such as javascript:, vbscript:, data:text/html or data:image/svg+xml (allowed: http(s), mailto, tel, data:image/* raster, fragments and relative URLs)

  <style> elements are kept (so light/dark-mode theming keeps working), with their event-handler attributes stripped and </style> breakouts dropped.

  Clear your icon cache after upgrading so already-cached icons are re-sanitized.

2.35

• Allow Symfony UX 3.x packages

2.33

• Add support for suffixes

2.30

• Ensure compatibility with PHP 8.5

2.29.0

• Add Symfony 8 support

2.25.0

• Improve DX when symfony/http-client is not installed.

2.24.0

• Add xmlns attribute to icons downloaded with Iconify, to correctly render icons browser as an external file, in SVG editors, and in files explorers or text editors previews. It may breaks your pipeline if you assert on ux_icon() or <twig:ux:icon> output in your tests, and forgot to lock your icons. We recommend you to lock your icons before upgrading to UX Icons 2.24. We also suggest you to to force-lock your icons after upgrading to UX Icons 2.24, to add the attribute xmlns to your icons already downloaded from Iconify.

2.20.0

• Add aliases configuration option to define icon alternative names.
• Add support for int and float attribute values in <twig:ux:icon />.
• Add support for Icon sets, configurable with icon_sets option.

2.19.0

• Add ignore_not_found option to silence error during rendering if the icon is not found.

... (truncated)

Commits

• 567f33d [Icons] Sanitize SVG output and unify icon creation
• 8f910e9 Drop PR warning and auto-closing on subtree splits
• f413a43 [Chartjs][Icons][Map][Native][Notify][React][Svelte][Toolkit][Turbo][TwigComp...
• b587495 Fix CI
• 0042610 [Icons] Add support for suffixes
• 834c5b4 Drop Biome.js for oxfmt and oxlint
• 52be3ee Run PHP-CS-Fixer (no_useless_else & static_lambda)
• See full diff in compare view

Updates symfony/ux-toolkit from 2.32.0 to 2.36.1

Release notes

Sourced from symfony/ux-toolkit's releases.

v2.36.1

Changelog (symfony/ux-toolkit@v2.36.0...v2.36.1)

• security #cve-2026-55878 Harden recipe installer against path traversal (@​Kocal)

v2.36.0

Changelog (symfony/ux-toolkit@v2.35.0...v2.36.0)

• no significant changes

v2.35.0

Changelog (symfony/ux-toolkit@v2.34.0...v2.35.0)

• feature #3368 Add kit Flowbite 4.0 base (@​DcgRG)
• feature #3421 Add Toggle (@​zairigimad)
• feature #3407 Allow Symfony UX 3.x packages (@​Kocal)
• feature #3409 Embrace html_attr_type from twig/html-extra:^3.24 to correctly merge trigger's attributes (@​Kocal)

v2.34.0

Changelog (symfony/ux-toolkit@v2.33.0...v2.34.0)

• no significant changes

v2.33.0

Changelog (symfony/ux-toolkit@v2.32.0...v2.33.0)

• feature #3356 Add Tabs recipe (@​DcgRG)
• bug #3376 Fix initial "open" state for AlertDialog and Dialog (Sylvain Gagnot)
• bug #3373 (Shadcn] Fix Tooltip's wrapper when re-rendered by LiveComponent (Sylvain Gagnot)
• bug #3355 Fix CI (@​Kocal)
• bug #3348 Fix tailwind_merge parentheses and simplify attributes … (@​seb-jean)
• bug #3345 Rewrite @prop documentation to normalize Defaults to ... (@​Kocal)
• bug #3343 Improve @prop and @block annotations description (@​Kocal)
• feature #3326 Update Avatar component (@​ker0x, @​Kocal)
• feature #3318 Update Alert CSS class, add Alert:Action component (@​ker0x)
• feature #3321 Add Tooltip component (@​Kocal)
• feature #3292 Add Accordion component (@​daFish)
• bug #3320 Fix Field demo code (@​Kocal)
• feature #3299 Rework recipes docs/examples (@​Kocal)
• bug #3300 Fix text color in dark mode for AlertDialog/Dialog components (@​Kocal)
• bug #3291 Fix text color of Badge destructive variant (@​Jibbarth)
• feature #3282 Prepare base for recipe type Block (@​jeremyFreeAgent)
• bug #3280 Fix compatibility issues with Symfony 8 and spatie/phpunit-snapshot-assertions (@​Kocal)
• bug #3278 Fix recipe name display when asking for what alternative recipe to install (@​jeremyFreeAgent)
• bug #3277 fix getRecipes method with type (@​jeremyFreeAgent)

Changelog

Sourced from symfony/ux-toolkit's changelog.

2.36.1

• Harden recipe installer against path traversal (security fix).

2.35

• [Flowbite] Add Flowbite v4 kit
• [Shadcn] Add toggle recipe
• [Shadcn] Use html_attr_type filter from twig/html-extra:^3.24 for composable trigger attributes
• [Shadcn] Rename trigger_attrs to alert_dialog_trigger_attrs in AlertDialog:Trigger
• [Shadcn] Rename trigger_attrs to dialog_trigger_attrs in Dialog:Trigger
• [Shadcn] Rename close_attrs to dialog_close_attrs in Dialog:Close
• [Shadcn] Rename trigger_attrs to tooltip_trigger_attrs in Tooltip:Trigger
• Allow Symfony UX 3.x packages

2.33.0

• [Shadcn] Add accordion recipe
• [Shadcn] Add tabs recipe
• [Shadcn] Add tooltip recipe
• [Shadcn] Rework templates of alert recipe
• [Shadcn] Rework templates of avatar recipe
• [Shadcn] Rework templates of badge recipe
• [Shadcn] Rework templates of button recipe
• [Shadcn] Rework templates of card recipe
• [Shadcn] Rework templates of input-group recipe
• [Shadcn] Rework templates of table recipe
• [Shadcn] Rework templates of textarea recipe
• [Shadcn] Add Avatar:Badge component
• [Shadcn] Add Avatar:Fallback component
• [Shadcn] Add Avatar:Group component
• [Shadcn] Add Avatar:GroupCount component
• [Shadcn] Add Alert:Action component
• [Shadcn] Remove Avatar:Text component

2.29.0

• Add Symfony 8 support

2.25

• Package added

Commits

• f137855 [UX][Icons] Add missing changelog entry
• ce2a369 [Toolkit] Harden recipe installer against path traversal
• bcc3ebf Drop PR warning and auto-closing on subtree splits
• a3f7d89 Tweaks
• 4343e8e [Toolkit][Flowbite] Add Tabs component
• 9f0f556 [Toolkit][Flowbite] Add Radio component
• 3a60316 [Toolkit][Flowbite] Add Pagination component
• 2068fed [Toolkit][Flowbite] Add Button group component
• 4b6660c [Toolkit][Flowbite] Add Modal component
• 8e9fdba [Toolkit][Flowbite] Add Spinner component
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.