NewYour coding agent can read the release notes before it upgrades.Set up the MCP server →
Packagist · #735 most downloaded on Packagist
Symfony Mercure Component
Last release today
07 Oct 2026
Release timing varies
gaps range from 8 days to 1.6 years
Nearly every release is documented
notes for 19 of 20 stable releases
Nothing withdrawn
no release was ever pulled
8 years old
20 releases · first in 2018
…(requires web-token/jwt-library 4.3, which deprecates signing with the polymorphic EdDSA algorithm)
Hub, FrankenPhpHub, MockHub and Jwt\LcobucciFactory use ProtocolVersion::V1 unless $protocolVersion is set; pass ProtocolVersion::Legacy to keep talking to a 0.x hub. This also changes the default cookie name to __Secure-mercure_access_token, the Twig mercure() query parameter to match, and the LcobucciFactory claims to authorization_details (which requires the iss, aud, sub and client_id claims)FrankenPhpHub::publish() now throws a Symfony\Component\Mercure\Exception\RuntimeException explaining what is missing when FrankenPHP's mercure_publish() function is not defined (e.g. under the CLI), instead of failing with a "Call to undefined function" errorEd25519 algorithm to Symfony\Component\Mercure\Jwt\WebTokenFactory (requires web-token/jwt-library 4.3, which deprecates signing with the polymorphic EdDSA algorithm)Debug\TraceableHub::getProvider() when the decorated hub does not implement itOne column per quarter.
…is dropped as a separate parameter); $publish is deprecated in favor of adding a Grant::ACTION_PUBLISH Grant to $grants , and passing null for $grants…
Symfony\Component\Mercure\ProtocolVersion, opt-in per hub, 0.x stays the default until Mercure hub 1.0 is tagged stable)HubInterface::getProtocolVersion() and HubInterface::getCookieName()Hub/FrankenPhpHub/MockHub constructor parameters $cookieName and $protocolVersion__Secure-mercure_access_token when a hub is configured for protocol 1.0 (mercureAuthorization stays the default for 0.x); the __Secure-/__Host- prefix contract itself is enforced by Symfony\Component\HttpFoundation\Cookie (symfony/symfony#65162); Authorization additionally fails early, with a hint to configure a prefix-less cookie name, when a prefixed name meets a plain-HTTP hub URL (where browsers would silently drop the cookie)authorization_details claim, an RFC 9068 access token, at+jwt) to Symfony\Component\Mercure\Jwt\LcobucciFactory, selected via its new $protocolVersion constructor parameterSymfony\Component\Mercure\Jwt\WebTokenFactory, a web-token/jwt-library-based alternative TokenFactoryInterface implementation for the Mercure protocol 1.0. It names algorithms by their JWA name (HS256, ES256, EdDSA, …), unlike LcobucciFactory's hmac.sha256 style, and supports RSA-PSS (PS256/PS384/PS512) and Ed25519 (EdDSA) on top of the HMAC/ECDSA/RSA algorithms both factories shareJose\Component\Signature\JWSBuilder and a Jose\Component\Core\JWK, so web-token/jwt-bundle's jose.jws_builder.* and jose.key.* services can be wired in directly; WebTokenFactory::fromSecret() and fromJwksUri() build both from a secret insteadWebTokenFactory::fromJwksUri(), fetching the signing key from a JSON Web Key Set (JWKS) endpoint instead of a static secret, useful when key material is rotated by an external key server; the selected key is not refreshed for the lifetime of the factory instance, see the method's docblock for the tradeoff under persistent-worker deploymentsTokenFactoryInterface::create()'s $subscribe/$publish parameters, and the Twig mercure() function's $topics parameter and subscribe/publish options, to be an associative array mapping a topic matcher type (exact, urlpattern, or a registered extension type) to a list of patterns, in addition to the existing flat topic listFactoryTokenProvider's $subscribe/$publish constructor parameters with $grants (a Grant[] list) and a new $additionalClaims parameter, both forwarded to the wrapped factorySymfony\Component\Mercure\Jwt\LcobucciFactory::create() now throws an InvalidArgumentException describing the 0.8 signature change when called with the pre-0.8 convention (non-Grant elements in $grants, or an integer-keyed $additionalClaims), instead of silently minting a token with dropped grants or a lost expSymfony\Component\Mercure\Jwt\DefaultClaimsTokenFactory, a TokenFactoryInterface decorator merging in a fixed set of claims (e.g. a hub's iss/aud/sub/client_id) so Authorization and the Twig mercure() function, which call HubInterface::getFactory() directly, get them without repeating them on every callSymfony\Component\Mercure\Jwt\Grant (actions/topics/payload), replacing TokenFactoryInterface::create()'s $subscribe/$publish parameters and the additionalClaims['mercure']['payload'] bag key; a single Grant can now carry both subscribe and publish actions over the same topics, producing one authorization_details entry instead of two, and a payload is validated (requires a topic, only meaningful with the subscribe action) instead of silently colliding with the legacy mercure claim's own use of the same keyAuthorization::createCookie()/setCookie() directly on Grant: $subscribe is renamed $grants and now also accepts a Grant[] list or a bare topic string, in addition to its previous flat-topic-list/matcher-map shapes ($payload folds into Grant's own constructor and is dropped as a separate parameter); $publish is deprecated in favor of adding a Grant::ACTION_PUBLISH Grant to $grants, and passing null for $grants is deprecated in favor of []. The $subscribe → $grants rename breaks named-argument calls using subscribe: specifically — positional calls and publish:/additionalClaims:/hub: named args are unaffected. The Twig mercure() function gains a matching grants option; its existing subscribe/publish/payload options are unaffected (translated internally the same way)MatcherInput::normalizeGrants(), the shared logic now backing both Authorization::$grants and the Twig grants option; besides Grant[] and the topic shorthands, it also accepts a list of Grant-shaped associative arrays (actions/topics/payload), letting contexts that can't construct a Grant object directly (e.g. a Twig template) still express multi-action or payload-bearing grantsSymfony\Component\Mercure\Jwt\LcobucciFactory no longer forces integer exp/iat/nbf under protocol 1.0; a resource server is expected to accept RFC 9068's NumericDate as either an integer or a float carrying sub-second precision, lcobucci/jwt's own defaultweb-token/jwt-library, needed by WebTokenFactory, requires itRevert lazy-loading the Twig extension to fix compatibility with Symfony 6.4
Compatibility with PHP 8.5
Add support for FrankenPHP's mercure_publish() function
mercure_publish() functionFix compatibility of last event ID with the latest version of the spec by @dunglas in #114
Allow symfony/deprecation-contracts v4
symfony/deprecation-contracts v4Compatibility with lcobucci/jwt 5.0
lcobucci/jwt 5.0Always set the Content-Type HTTP header to application/x-www-form-urlencoded when sending an update to the hub
Content-Type HTTP header to application/x-www-form-urlencoded when sending an update to the hubSymfony\Component\Mercure\Messenger\UpdateHandler now returns the ID of the published updatenull as $subscribe and $publish parameters in Symfony\Component\Mercure\Jwt\TokenFactoryInterfaceSymfony\Component\Mercure\Authorization::__construct() to set the SameSite cookie attributeAllow passing additional data to the mercure JWT claim when using Symfony\Component\Mercure\Token\LcobucciFactory
mercure JWT claim when using Symfony\Component\Mercure\Token\LcobucciFactorypassphrase argument to Symfony\Component\Mercure\Token\LcobucciFactory allowing the use of encrypted keyslastEventId option to the mercure() Twig function to set the Last-Event-ID query parameterSymfony\Component\Mercure\Authorization::createCookie()Symfony\Component\Mercure\Token\LcobucciFactory that results in a runtime error when using "ecdsa" algorithms, alongside "lcobucci/jwt:^4.0"Add mercure() Twig function to generate URLs of the hubs and set the authorization cookies
mercure() Twig function to generate URLs of the hubs and set the authorization cookiesAuthorization::setCookie() to ease setting authorization cookiesAuthorization::clearCookie() to remove the mercureAuthorization cookie from the browserAuthorization::createCookie() to allow subdomainsFull compatibility with PHP 7.1+
Set a default expiration for the JWT and the cookie when using the Authorization class
Authorization classFix MockHub::__construct() signature
MockHub::__construct() signatureDeprecated Jwt\StaticJwtProvider, use Jwt\StaticTokenProvider instead.
Symfony\Component\Mercure\Jwt\TokenProviderInterfaceSymfony\Component\Mercure\Jwt\TokenFactoryInterfaceSymfony\Component\Mercure\Jwt\StaticTokenProviderSymfony\Component\Mercure\Jwt\CallabkeTokenProviderSymfony\Component\Mercure\Jwt\LcobucciTokenFactorySymfony\Component\Mercure\Jwt\FactoryTokenProviderSymfony\Component\Mercure\Messenger\UpdateHandlerSymfony\Component\Mercure\HubSymfony\Component\Mercure\HubInterfaceSymfony\Component\Mercure\HubRegistrySymfony\Component\Mercure\DiscoverySymfony\Component\Mercure\AuthorizationJwt\StaticJwtProvider, use Jwt\StaticTokenProvider instead.PublisherInterface interface in favor of HubInterface.Publisher class in favor of Hub.Debug\TraceablePublisher class in favor of Debug\TraceableHub.* Compatibility with PHP 8
Compatibility with Mercure 0.10
Add TraceablePublisher to collect debug information
TraceablePublisher to collect debug informationPublisherInterfaceretry parameterUse the Symfony HttpClient component
Nothing published for this version
Your coding agent can read these notes before it upgrades. Set up the MCP server →