symfony/ux-icons

Changelog (v3.3.0...v3.4.0)

• feature #3741 Add auto_lock to persist on-demand icons (@Kocal)

• Add iconify.auto_lock option to persist "on demand" icons to the local icon directory as they are rendered

Changelog (v3.2.0...v3.3.0)

• no significant changes

Changelog (v3.1.0...v3.2.0)

• security #cve-2026-55877 Sanitize Iconify SVG output and unify icon creation (@Kocal)

• Sanitize rendered SVG icons (Iconify bodies and local files) to prevent XSS. See section 2.36.1 below for details

Changelog (v3.0.0...v3.1.0)

• no significant changes

Changelog (v2.34.0...v3.0.0)

• feature #3453 Update minimum required Symfony version to 7.4 (@Kocal)
• feature #3450 Upgrade minimum required PHP version to 8.4 (@Kocal)
• feature #3407 Allow Symfony UX 3.x packages (@Kocal)
• bug #3398 Post-merge fixes for 3.x (@Kocal)
• bug #3187 Add phpunit.dist.xml in .gitattributes (@Kocal)
• bug #3182 Drop Symfony PHPUnit Bridge in favor of PHPUnit >= 11.0 (@Kocal)
• feature #2998 Upgrade minimum required PHP version to 8.2 (@Kocal)
• feature #2996 Update minimum required Symfony version to ^6.4 (@Kocal)

• Minimum required Symfony version is now 7.4
• Minimum required PHP version is now 8.4

Changelog (v2.36.0...v2.36.1)

• security #cve-2026-55877 Sanitize Iconify SVG output and unify icon creation (@Kocal)

• Sanitize rendered SVG icons (Iconify bodies and local files) to prevent XSS. Removed from icon output:

  • Elements: <script>, <foreignObject>, <iframe>, <object>, <embed>, <handler>
  • SMIL animation elements (<animate>, <set>, <animateTransform>, <animateMotion>) when they target an on*, href or xlink:href attribute
  • CDATA sections and processing instructions (otherwise re-serialized as raw HTML)
  • Event-handler attributes (on*, e.g. onload, onclick) on every element
  • href / xlink:href values with a non-allowlisted scheme such as javascript:, vbscript:, data:text/html or data:image/svg+xml (allowed: http(s), mailto, tel, data:image/* raster, fragments and relative URLs)

  <style> elements are kept (so light/dark-mode theming keeps working), with their event-handler attributes stripped and </style> breakouts dropped.

  Clear your icon cache after upgrading so already-cached icons are re-sanitized.

Changelog (v2.35.0...v2.36.0)

• no significant changes

Changelog (v2.34.0...v2.35.0)

• feature #3407 Allow Symfony UX 3.x packages (@Kocal)

Changelog (v2.33.0...v2.34.0)

• no significant changes

Changelog (v2.32.0...v2.33.0)

• bug #3355 Fix CI (@Kocal)
• feature #3324 Add support for suffixes (@seb-jean)

• Add Symfony 8 support

• Improve DX when symfony/http-client is not installed.

• Add xmlns attribute to icons downloaded with Iconify, to correctly render icons browser as an external file, in SVG editors, and in files explorers or text editors previews. It may breaks your pipeline if you assert on ux_icon() or <twig:ux:icon> output in your tests, and forgot to lock your icons. We recommend you to lock your icons before upgrading to UX Icons 2.24. We also suggest you to to force-lock your icons after upgrading to UX Icons 2.24, to add the attribute xmlns to your icons already downloaded from Iconify.

• Add aliases configuration option to define icon alternative names.
• Add support for int and float attribute values in <twig:ux:icon />.
• Add support for Icon sets, configurable with icon_sets option.

• Add ignore_not_found option to silence error during rendering if the icon is not found.

• Add component