Changelog Since Symfony 8.1.3

• bug #65193 [RateLimiter] Cap the burst size and the duration computed from it (@cs278)
• bug #65183 [Intl] Honor the expiry date of currencies that have no start date (@sadiqk2)
• bug #65184 [Form] Distinguish active_at from not_active_at in the CurrencyType choice list cache (@sadiqk2)
• bug #65191 [PhpUnitBridge] Don't return a non-callable from getPhpUnitErrorHandler() (@sadiqk2)
• bug #65187 [HttpFoundation] Treat a UriSigner expiration of 0 as a date, not as no expiry (@sadiqk2)
• bug #65180 [HttpKernel] Fix failing reset methods preventing later services from resetting (@javiereguiluz)
• bug #64982 [PropertyInfo] Do not report a non-public mutator as writable (@nicolas-grekas)
• bug #65174 [Tui] Keep ANSI codes ordered when slicing across a color change (@smnandre)
• bug #65177 [HttpClient] Fix GuzzleHttpHandler crashing with guzzlehttp/guzzle ^8.0 (@peter17)
• bug #65128 [Mime] Escape backslashes in Address::getEncodedName() (@munzzyy)
• bug #65154 [ObjectMapper] Fix target property mappings dropped when the source carries metadata (@ousamabenyounes)
• bug #65167 [Serializer] Align union member order between the legacy and TypeInfo paths (@ousamabenyounes)
• bug #65172 [DependencyInjection] Don't keep partially-configured shared services when their setup fails (@javiereguiluz)
• bug #65169 [DoctrineBridge] fix compatibility with DBAL < 4.5 (@xabbuh)
• minor #65165 [Form][Validator] Added missing Slovak translations (@dtokos)
• bug #65150 [Tui] Render raw HTML in MarkdownWidget instead of dropping it (@lazerg)
• bug #65141 [ObjectMapper] Skip nested mapping when no target fits the destination property type (@lazerg)
• bug #65131 [FrameworkBundle] Fix "cache:clear" failing when the cache dir is rebuilt concurrently (@ousamabenyounes)
• bug #65142 [ObjectMapper] Fix the class-level mapping of another target being applied (@lazerg)
• bug #65149 [DependencyInjection] Resolve factories on "service_container" against the concrete container class (@lazerg)
• bug #65116 [Lock] Fix a released read lock letting a new read lock through while a write lock is held (@Zombaya)
• bug #65133 [DependencyInjection] Fix ParameterBag::clear() leaving stale deprecations and resolution state (@javiereguiluz)
• bug #65122 [Messenger] Re-send original payload when retrying undecodable messages (@SystematicCZ)
• bug #65125 [Serializer] Fix FILTER_BOOL breaking union type denormalization (@eliot488995568)
• bug #65120 [DependencyInjection] Fix #[Autoconfigure] being processed twice for PSR-4-discovered abstract types (@javiereguiluz)
• bug #65113 [DependencyInjection] Fix instantiating a lazy proxy for an inline definition (@nicolas-grekas)
• bug #65112 [DependencyInjection] Fix misleading error messages for invalid "proxy" tags (@nicolas-grekas)
• bug #65111 [DependencyInjection] Fix generating one proxy class per set of "proxy" tags (@nicolas-grekas)
• bug #65109 [DependencyInjection] Honor the interface passed to #[Lazy] (@nicolas-grekas)
• bug #65105 [Uid] Fix the weak-secret guard in Uuid47Transformer for secrets longer than 16 bytes (@semx)
• bug #65091 [DoctrineBridge] Close all expired connections in the idle listener (@RobLogtenberg-Pay)
• bug #65085 [Messenger] Stop the PostgreSQL transport from blocking the worker loop (@bzajacc)
• bug #65095 [WebProfilerBundle] Avoid a flash of unstyled content in the debug toolbar (@wayne530)
• bug #65100 [Translation][Lokalise] Send filter_filenames as a JSON array (@nicolas-grekas)
• bug #65099 [Mailer][Sendgrid] Map the processed event to RECEIVED (@nicolas-grekas)
• bug #65032 [JsonStreamer] Fix escaping, float precision and error reporting when writing JSON (@ousamabenyounes)
• minor #65097 [Form][Validator] Review Lithuanian (lt) translations (@MariusVarna)
• bug #65093 [Cache][Messenger] Restore compatibility with ext-redis 5 (@nicolas-grekas)
• minor #65070 [Notifier][Telegram] Document how to build a multi-row inline keyboard (@nicolas-grekas)
• bug #65034 [Mailer][Resend] Handle the email.failed and email.suppressed webhook events (@alexisLefebvre)
• bug #65065 [Console] Fix column widths when a row spans columns (@wazum)
• bug #65062 [Mime] Fix corrupted CID references when one is a prefix of another (@MarcinOrlowski)
• bug #65066 [Mailer] Fix rewriting cid references of inline parts for Mailgun (@nicolas-grekas)
• bug #64696 [Config] Generate unsealed array shapes for any normalizers (@ousamabenyounes)
• bug #65060 [TwigBridge][WebProfilerBundle] Fix compatibility with Twig 4 (@nicolas-grekas)
• bug #65058 [PropertyAccess] Fix caching of null read info (@javiereguiluz)
• bug #65059 [Translation] Fix fuzzy translations and multi-line msgctxt in PO files (@javiereguiluz)
• minor #65055 [Validator] Review Serbian (sr_Latn) translations (@milanqtx)
• minor #65054 [Validator] Review Serbian (sr_Cyrl) translations (@milanqtx)
• bug #65041 [Validator] Fix File constraint skipping the mime type check when extensions and mimeTypes have no common value (@nicolas-grekas)
• minor #65048 [VarExporter] cache result of hasOctalControlChars (@alexisLefebvre)
• bug #65049 [Translation] Do not split ICU messages on pipes in PoFileDumper (@nicolas-grekas)
• bug #65052 [PropertyInfo] Revert "bug #64990 Do not trigger legacy Type deprecat… (@nicolas-grekas)

Changelog Since Symfony 7.4.15

• bug #65193 [RateLimiter] Cap the burst size and the duration computed from it (@cs278)
• bug #65183 [Intl] Honor the expiry date of currencies that have no start date (@sadiqk2)
• bug #65184 [Form] Distinguish active_at from not_active_at in the CurrencyType choice list cache (@sadiqk2)
• bug #65191 [PhpUnitBridge] Don't return a non-callable from getPhpUnitErrorHandler() (@sadiqk2)
• bug #65187 [HttpFoundation] Treat a UriSigner expiration of 0 as a date, not as no expiry (@sadiqk2)
• bug #65180 [HttpKernel] Fix failing reset methods preventing later services from resetting (@javiereguiluz)
• bug #64982 [PropertyInfo] Do not report a non-public mutator as writable (@nicolas-grekas)
• bug #65128 [Mime] Escape backslashes in Address::getEncodedName() (@munzzyy)
• bug #65154 [ObjectMapper] Fix target property mappings dropped when the source carries metadata (@ousamabenyounes)
• bug #65167 [Serializer] Align union member order between the legacy and TypeInfo paths (@ousamabenyounes)
• bug #65172 [DependencyInjection] Don't keep partially-configured shared services when their setup fails (@javiereguiluz)
• bug #65169 [DoctrineBridge] fix compatibility with DBAL < 4.5 (@xabbuh)
• minor #65165 [Form][Validator] Added missing Slovak translations (@dtokos)
• bug #65141 [ObjectMapper] Skip nested mapping when no target fits the destination property type (@lazerg)
• bug #65131 [FrameworkBundle] Fix "cache:clear" failing when the cache dir is rebuilt concurrently (@ousamabenyounes)
• bug #65142 [ObjectMapper] Fix the class-level mapping of another target being applied (@lazerg)
• bug #65116 [Lock] Fix a released read lock letting a new read lock through while a write lock is held (@Zombaya)
• bug #65133 [DependencyInjection] Fix ParameterBag::clear() leaving stale deprecations and resolution state (@javiereguiluz)
• bug #65125 [Serializer] Fix FILTER_BOOL breaking union type denormalization (@eliot488995568)
• bug #65120 [DependencyInjection] Fix #[Autoconfigure] being processed twice for PSR-4-discovered abstract types (@javiereguiluz)
• bug #65113 [DependencyInjection] Fix instantiating a lazy proxy for an inline definition (@nicolas-grekas)
• bug #65112 [DependencyInjection] Fix misleading error messages for invalid "proxy" tags (@nicolas-grekas)
• bug #65111 [DependencyInjection] Fix generating one proxy class per set of "proxy" tags (@nicolas-grekas)
• bug #65109 [DependencyInjection] Honor the interface passed to #[Lazy] (@nicolas-grekas)
• bug #65091 [DoctrineBridge] Close all expired connections in the idle listener (@RobLogtenberg-Pay)
• bug #65095 [WebProfilerBundle] Avoid a flash of unstyled content in the debug toolbar (@wayne530)
• bug #65100 [Translation][Lokalise] Send filter_filenames as a JSON array (@nicolas-grekas)
• bug #65099 [Mailer][Sendgrid] Map the processed event to RECEIVED (@nicolas-grekas)
• bug #65032 [JsonStreamer] Fix escaping, float precision and error reporting when writing JSON (@ousamabenyounes)
• minor #65097 [Form][Validator] Review Lithuanian (lt) translations (@MariusVarna)
• bug #65093 [Cache][Messenger] Restore compatibility with ext-redis 5 (@nicolas-grekas)
• minor #65070 [Notifier][Telegram] Document how to build a multi-row inline keyboard (@nicolas-grekas)
• bug #65034 [Mailer][Resend] Handle the email.failed and email.suppressed webhook events (@alexisLefebvre)
• bug #65065 [Console] Fix column widths when a row spans columns (@wazum)
• bug #65062 [Mime] Fix corrupted CID references when one is a prefix of another (@MarcinOrlowski)
• bug #65066 [Mailer] Fix rewriting cid references of inline parts for Mailgun (@nicolas-grekas)
• bug #64696 [Config] Generate unsealed array shapes for any normalizers (@ousamabenyounes)
• bug #65060 [TwigBridge][WebProfilerBundle] Fix compatibility with Twig 4 (@nicolas-grekas)
• bug #65058 [PropertyAccess] Fix caching of null read info (@javiereguiluz)
• bug #65059 [Translation] Fix fuzzy translations and multi-line msgctxt in PO files (@javiereguiluz)
• minor #65055 [Validator] Review Serbian (sr_Latn) translations (@milanqtx)
• minor #65054 [Validator] Review Serbian (sr_Cyrl) translations (@milanqtx)
• bug #65041 [Validator] Fix File constraint skipping the mime type check when extensions and mimeTypes have no common value (@nicolas-grekas)
• minor #65048 [VarExporter] cache result of hasOctalControlChars (@alexisLefebvre)
• bug #65049 [Translation] Do not split ICU messages on pipes in PoFileDumper (@nicolas-grekas)
• bug #65052 [PropertyInfo] Revert "bug #64990 Do not trigger legacy Type deprecat… (@nicolas-grekas)
• minor #65046 [VarExporter] Detect the null byte rendering instead of pinning a PHP version (@nicolas-grekas)
• bug #65036 [HttpClient] Revert " Strip Proxy-Authorization on cross-authority redirects" (@GrahamCampbell)

The Problem: Macros Are Too Forgiving

Take the form helper that almost every project has a variant of:

{% macro input(name, value, type, size) %}
    <input type="{{ type|default('text') }}" name="{{ name }}"
           value="{{ value|e }}" size="{{ size|default(20) }}"/>
{% endmacro %}

Now, be honest: how many of these calls have you shipped at some point?

{% import 'forms.html.twig' as forms %}

{# "name" is missing: it silently becomes null #}
{{ forms.input() }}

{# "sise" is a typo: it is silently swallowed and the size is lost #}
{{ forms.input('username', sise: 30) }}

{# one argument too many: it silently lands in a magic "varargs" variable #}
{{ forms.input('username', '', 'text', 20, 42) }}

None of them raises an error. All of them render broken HTML that you have to spot by eye, often in production. I am partly to blame: macros have been lenient since the very first version of Twig, and the leniency even had a certain charm: a macro never complained, it always rendered something. But something is rarely what you want from a form helper, and the price shows in every macro out there: bodies sprinkled with |default() filters because no argument can be trusted to be there.

Functions and filters have always been strict about their arguments; macros were the only Twig callables that accepted anything. Twig 4.0 closes that gap.

Required Arguments

In Twig 4.0, a macro argument works like a PHP function argument: it is required unless it declares a default value.

{% macro input(name, value = '', type = 'text', size = 20) %}
    <input type="{{ type }}" name="{{ name }}"
           value="{{ value|e }}" size="{{ size }}"/>
{% endmacro %}

{# Error: Value for argument "name" is required for macro "input". #}
{{ forms.input() }}

To keep an argument optional, give it an explicit default value (= null reproduces the old behavior). The signature now tells the whole story: reading the definition is enough to know which arguments you must pass and which ones you may omit. And because defaults live in the signature, the body no longer needs defensive |default() calls.

Explicit Variadic Arguments

Today, every macro is implicitly variadic: extra arguments are collected into a reserved varargs variable that no signature mentions; you either know it exists or you don't. Twig 4.0 replaces this magic with an explicit opt-in, using the same ... notation as PHP:

{% macro tag(element, ...attrs) %}
    <{{ element }}
    {%- for name, value in attrs %} {{ name }}="{{ value }}"{% endfor -%}
    >
{% endmacro %}

{# renders <input type="text" name="username"> #}
{{ html.tag('input', type: 'text', name: 'username') }}

The variadic argument collects both extra positional and extra named arguments, which makes patterns like the HTML attributes helper above natural to write. It must be the last argument, and you pick its name, so the signature documents that the macro accepts an open-ended argument list. A macro that does not declare a variadic argument rejects extra arguments, like a function does.

The explicit syntax already works in Twig 3.29, so you can adopt it today; a macro that relies on the implicit varargs variable keeps working as-is once it declares ...varargs.

Calls Look Like Calls

Referencing a macro and calling it have always been blurred together: Twig quietly calls a macro referenced without parentheses, and accepts parentheses in places where nothing is called. Twig 4.0 separates the two usages. Calling a macro requires parentheses:

{# Twig 3.x renders the macro as if you had written forms.input() #}
{# Twig 4.0: Omitting parentheses when calling a macro is not
   allowed; add parentheses after the macro name. #}
{{ forms.input }}

And testing whether a macro exists rejects them, because the defined test inspects the macro itself, it does not call it:

{# Twig 4.0 #}
{% if forms.input is defined %}...{% endif %}

{# deprecated in 3.29: this reads as "is the result of the call
   defined?", which is not what the test checks #}
{% if forms.input() is defined %}...{% endif %}

Clear Errors Instead of Broken Output

With strict resolution, every calling mistake that used to corrupt your output now fails with a precise message:

• Value for argument "name" is required for macro "input".
• Unknown argument "sise" for macro "input".
• Too many arguments for macro "input".
• Argument "name" is defined twice for macro "input".

This is the same experience you already get when miscalling a function or a filter; a typo now shows up during development instead of shipping as an empty attribute. Definitions get the same cleanup: macro names become case-sensitive in 4.0, so calling forms.Input() no longer resolves the input macro; defining the same macro twice in one template, which today silently keeps the last definition, becomes a syntax error; and a macro tag must now sit at the root of a template, not nested inside an if or another tag.

A More Capable Macro Toolbox

The overhaul does not come alone.

Dynamic macro names, added in Twig 3.28: the macro to call can now be computed at runtime by wrapping an expression in parentheses after the dot operator:

{% set field = widget.multiline ? 'textarea' : 'input' %}
{{ forms.(field)('description') }}

Deprecating a macro: this one is not new, but it completes the toolbox. Shared macro libraries can evolve their API the same way PHP libraries do, by placing the deprecated tag at the top of a macro body; a deprecation notice is triggered whenever the macro is called:

{% macro input(name, value = '') %}
    {% deprecated 'The "input" macro is deprecated, use "field" instead.' %}
    <input name="{{ name }}" value="{{ value|e }}"/>
{% endmacro %}

The Upgrade Path

As usual, Twig 3.29 triggers a deprecation for every macro call and definition that will break in 4.0. All the fixes work on 3.29, so an application that runs deprecation-free is ready for Twig 4.0, where macros finally behave like the functions they always looked like.

The Problem: One Environment, Two Trust Levels

The historical sandbox shares everything with your application. To render one untrusted template, you enable sandbox mode on your main environment and remember to disable it afterwards:

use Twig\Extension\SandboxExtension;

$sandboxExtension = $twig->getExtension(SandboxExtension::class);
$sandboxExtension->enableSandbox();

try {
    echo $twig->render('newsletter.twig', $context);
} finally {
    $sandboxExtension->disableSandbox();
}

The documentation recommended a dedicated environment, and careful developers created one by hand. But the API never asked for one. I wrote that design, and for a long time I found it good enough: one environment, one switch.

Sharing, though, is precisely what you do not want at a security boundary. An untrusted template could load any template known to the application loader when loading templates was allowed by the policy. It saw every registered global, including your app variable, and inherited every extension, filter, function and test used by your application. The security policy had to compensate for an environment that was never designed for untrusted code.

Twig 4.0 gives sandboxed templates a dedicated environment, with no shared state to toggle and no application configuration inherited by accident.

An Environment of Their Own

The new model fits in one sentence: you craft an environment for untrusted templates, and a Sandbox takes ownership of it:

use Twig\Environment;
use Twig\Loader\ArrayLoader;
use Twig\Sandbox\Sandbox;
use Twig\Sandbox\SecurityPolicy;

$sandboxEnvironment = new Environment(
    new ArrayLoader($newsletterTemplates),
    ['cache' => '/var/cache/newsletters'],
);

$policy = new SecurityPolicy(
    allowedTags: ['if', 'for'],
    allowedFilters: ['escape', 'upper', 'date'],
);
$policy->setStrict(true);

$sandbox = new Sandbox($sandboxEnvironment, $policy);

echo $sandbox->render('newsletter.twig', ['name' => 'Fabien']);

// or render a template held as a string, straight from your database
echo $sandbox->createTemplate($newsletter->getBody())->render([
    'name' => 'Fabien',
]);

The environment must be fresh and dedicated to the sandbox. Passing one that has already rendered a template or already has a SandboxExtension throws a LogicException instead of creating a half-isolated setup. Never pass your application environment: the sandbox takes ownership of it and renders all of its templates in sandbox mode.

Sandbox implements SandboxInterface. Type-hint the interface when you inject a sandbox into an application service.

Each argument answers one question. The environment loader defines which templates exist. Its built-in and registered extensions, filters, functions, tests and globals define the available capabilities. The policy decides which of those capabilities may execute, and which methods and properties may be accessed on context objects.

There is no mode to toggle and no state to restore. Everything rendered through a Sandbox is sandboxed: render(), display() and stream(), their block counterparts renderBlock(), displayBlock() and streamBlock(), and the templates returned by createTemplate(). And because your application environment is not involved, a trusted render happening in the middle of a sandboxed one is not sandboxed. Isolation works in both directions.

Strict by Default

Twig's 4.0 SecurityPolicy no longer has the historical exceptions that implicitly allowed some tags, functions and tests. Anything that is not in an allow-list is denied, except for built-ins that Twig marks as always safe in a sandbox. The setStrict(true) call opts into those rules on Twig 3.29; it is a harmless no-op on Twig 4.0, so the same setup works on both versions.

What happens when a template author reaches beyond the policy or the dedicated loader? Twig reports the exact capability or template involved:

• Filter "json_encode" is not allowed in "newsletter.twig" at line 1.
• Calling "delete" method on a "Customer" object is not allowed in "profile.twig" at line 1.
• Template "admin/config.html.twig" is not defined in "page.twig" at line 1.

The last error comes from the loader, not the policy. Templates are not another allow-list: include, extends and their friends can only resolve names through the sandbox environment's loader.

One boundary remains worth spelling out. The sandbox restricts what template source can express; PHP code invoked by an allowed filter, function or extension still runs with full PHP capabilities. Only register callables that are safe with attacker-chosen arguments, and enforce CPU and memory limits outside Twig when resource exhaustion is a concern.

Untrusted Fragments in Trusted Pages

The classic CMS scenario is a trusted page embedding user-authored blocks. For that, register the SandboxBridgeExtension and inject the sandbox lazily into its runtime:

use Twig\Extension\SandboxBridgeExtension;
use Twig\Runtime\SandboxBridgeRuntime;
use Twig\RuntimeLoader\FactoryRuntimeLoader;

$twig->addExtension(new SandboxBridgeExtension());
$twig->addRuntimeLoader(new FactoryRuntimeLoader([
    SandboxBridgeRuntime::class => fn () => new SandboxBridgeRuntime(
        $sandbox,
    ),
]));

Your trusted template can then call render_sandboxed():

{# page.html.twig, a trusted template rendered by your application #}
<article>
    {{ render_sandboxed(
        'block-' ~ block.id,
        {title: page.title},
        'html',
    ) }}
</article>

The context mapping is the complete context passed to the sandboxed template; variables from the trusted template are not copied implicitly. The third argument declares the escaping strategy for which the result is safe. Unlike |raw, this keeps the result safe only in HTML and lets Twig escape it when used in another context, such as JavaScript.

The strategy must be a non-empty literal string other than all. It does not sanitize the fragment: declaring html means that HTML written by the untrusted template author may reach the response, which should be an explicit application decision.

The Upgrade Path

Twig 3.29 deprecates the sandboxed argument of include() and the legacy SandboxExtension methods, completing the path started by earlier 3.x deprecations. Their replacements, the Sandbox class and render_sandboxed() function, work on 3.29, so a setup that no longer uses legacy APIs is ready for Twig 4.0.

Bootstrap 5.3 Kit

Contributed by Simon André and Hugo Alliaume in #3713

Bootstrap users previously had to turn the framework's markup into reusable Twig components themselves. The new Bootstrap kit provides 25 ready-to-use recipes based on Bootstrap 5.3, including accordions, alerts, cards, carousels, dropdowns, modals, navigation bars, pagination, toasts and tooltips.

Install each recipe on demand with the Toolkit command:

$ php bin/console ux:install alert --kit bootstrap

The installed Twig components use the familiar Bootstrap options and classes:

<twig:Alert color="success" heading="Profile updated" dismissible>
    Your account settings have been saved.
</twig:Alert>

The components are copied into your application, where you can use them as-is or customize their markup and behavior. Toolkit also includes the kit-level Bootstrap dependency when installing any of these recipes.

Design-System-Agnostic Toolkit Recipes

Contributed by Kevin Bond in #3707 , #3725 and #3740

Common interface behaviors are often rebuilt in every application because they don't belong to a specific design system. The new common Toolkit kit provides five unstyled recipes that you can install and customize in your project:

• post-link submits a link as a form, with optional method spoofing, CSRF protection and a confirmation prompt;
• logout-link builds on post-link to log users out securely with a POST request;
• closeable removes an element immediately, after a delay or automatically;
• clipboard copies a value or an element's content and supports several kinds of success feedback;
• tooltip provides accessible hover, focus, click and manual tooltips positioned with Floating UI.

Install recipes independently with the Toolkit command:

$ php bin/console ux:install clipboard --kit common

The installed controller can then be used directly in your templates:

<div data-controller="clipboard">
    <code data-clipboard-target="source">php bin/console cache:clear</code>
    <button type="button" data-action="clipboard#copy">
        <span data-clipboard-target="idle">Copy</span>
        <span data-clipboard-target="success" hidden>Copied!</span>
    </button>
</div>

Because the recipes ship without presentation styles, they work with any CSS framework or your own design system.

Self-Documenting Toolkit Recipes

Contributed by Hugo Alliaume in #3718

Before Symfony UX 3.4, a recipe lived in the Symfony UX repository while its documentation was a Twig template in the ux.symfony.com repository. Adding a recipe or reorganizing its examples split the work almost equally between the two repositories.

Recipes now ship a self-contained README.md next to their implementation. Toolkit renders it as HTML or portable Markdown, including installation instructions, live examples and generated API references. In practice, about 99% of recipe work can now happen in the Symfony UX repository; the generic rendering layer in ux.symfony.com accounts for the remaining 1%.

Stimulus Controller API References

Contributed by Kevin Bond in #3724 and #3733

Recipes that only ship a Stimulus controller had no generated API reference. Toolkit can now document the complete public API of a controller from @value, @target, @css-class, @outlet and @action tags in its docblock:

/**
 * @value  autoClose  Delay before the notification closes.
 * @target timerbar   Element that displays the remaining time.
 * @action close      Removes the notification.
 */
export default class extends Controller {
    static values = { autoClose: Number };
    static targets = ['timerbar'];

    close() {
        this.element.remove();
    }
}

Toolkit generates the matching attributes, types and descriptions in the API reference. Its linter also checks that the tags agree with the controller, so the code remains the source of truth.

Kit-Level Dependencies

Contributed by Simon André in #3719

Dependencies shared by every recipe in a kit were declared in the kit manifest but omitted when installing an individual recipe. The installer now includes these Composer, npm and importmap dependencies automatically.

Kit authors can therefore declare a library once instead of repeating it in every recipe manifest:

{
    "name": "Bootstrap",
    "dependencies": {
        "npm": ["bootstrap@^5.3.0"],
        "importmap": [
            "bootstrap",
            "bootstrap/dist/css/bootstrap.min.css"
        ]
    }
}

Dynamic Twig Component Names

Contributed by andreybotanic in #3395

Dynamic component selection previously required the component() function, which cannot define component blocks. The {% component %} tag now accepts a parenthesized expression, combining dynamic selection with props and blocks:

{% for tab in dashboard.tabs %}
    {% component (tab.componentName) with {loading: 'lazy'} %}
        {% block loadingContent %}
            <p>Loading {{ tab.label }}...</p>
        {% endblock %}
    {% endcomponent %}
{% endfor %}

Parentheses distinguish an expression from a literal component name. For example, {% component Alert %} still renders the component named Alert, while {% component (componentName) %} resolves the name from the current context.

Persistent On-Demand Icons

Contributed by Hugo Alliaume in #3741

The icon lock command cannot discover names that are built dynamically, which can leave production dependent on the Iconify API. Enable the new iconify.auto_lock option in development to save every on-demand icon the first time it is rendered:

# config/packages/ux_icons.yaml
when@dev:
    ux_icons:
        iconify:
            auto_lock: true

Browsing the application now writes those icons to assets/icons/. Commit the generated files so production can serve them locally without contacting Iconify.

Translator Is Now Stable

Contributed by Hugo Alliaume in #3716

Symfony UX Translator has been available for three years and its API has stabilized. It is no longer marked as experimental, so applications can use Symfony translations from JavaScript and TypeScript with the regular Symfony backward compatibility expectations.

React and Vue Support for Modern Bundlers

Contributed by Hugo Alliaume in #3714

React and Vue controller registration previously expected Webpack's require.context(). Both integrations now accept import.meta.glob(), which makes them work naturally with Vite and Rsbuild through Symfony Reprise:

import { registerReactControllerComponents } from '@symfony/ux-react';
import { registerVueControllerComponents } from '@symfony/ux-vue';

registerReactControllerComponents(
    import.meta.glob('./react/controllers/**/*.{jsx,tsx}', { eager: true })
);

registerVueControllerComponents(
    import.meta.glob('./vue/controllers/**/*.vue')
);

React components must be imported eagerly. Vue supports both eager imports and lazy loading. Existing Webpack Encore applications can continue using require.context() unchanged.

Full Changelog

• #3740 [Toolkit][Common] Add clipboard and tooltip recipes (@kbond)
• #3733 [Toolkit] Document Stimulus controller CSS classes and outlets in the API reference (@kbond)
• #3741 [Icons] Add auto_lock to persist on-demand icons (@Kocal)
• #3395 [TwigComponent] Support component tag names from expressions (@andreybotanic)
• #3736 [Toolkit] Rework and normalize usage of attributes.defaults() in kit components (@seb-jean, @Kocal)
• #3735 Add sync-packages.php to normalize package .gitattributes files (@Kocal)
• #3730 Fix broken assets/tsconfig.json reference affecting Webpack 5.109 and later (@zalesak)
• #3734 [Toolkit] Remove the height preview option (@Kocal)
• #3724 [Toolkit] Document Stimulus controllers in the recipe API reference (@kbond)
• #3725 [Toolkit][Common] Add the closeable recipe (@kbond)
• #3716 [Translator] Make the component non-experimental (@Kocal)
• #3713 [Toolkit] Add the Bootstrap Toolkit kit (@smnandre, @Kocal)
• #3720 [Toolkit] Fix suggested frontend installation commands (@smnandre)
• #3719 [Toolkit] Support kit-level dependencies (@smnandre)
• #3721 [Toolkit] Require the correct twig/html-extra version for html_attr_* filters (@Kocal)
• #3718 [Toolkit] Add a documentation rendering layer so kits can describe themselves (@Kocal)
• #3714 [React][Vue] Add support for import.meta.glob() through Symfony Reprise (@Kocal)
• #3707 [Toolkit][Common] Add the common kit with logout-link and post-link recipes (@kbond)
• #3710 [Toolkit][Shadcn] Fix Table:Cell and Table:Head class attribute merging (@stephen-lewis)
• #3709 [Toolkit] Add the ClassMergeSpacingChecker to the linter (@Kocal)