Bump symfony/ux-live-component from 2.36.0 to 3.4.0

[dependabot]

Bumps symfony/ux-live-component from 2.36.0 to 3.4.0.

Release notes

Sourced from symfony/ux-live-component's releases.

v3.4.0

Changelog (symfony/ux-live-component@v3.3.0...v3.4.0)

• bug #3730 Fix broken assets/tsconfig.json reference breaking webpack 5.109+ builds (@​zalesak)

v3.3.0

Changelog (symfony/ux-live-component@v3.2.0...v3.3.0)

• bug #3676 Avoid 500 errors on malformed hydration payloads (@​Amoifr)
• bug #3688 Fix data-loading scanner ignoring data-live-ignore subtrees (@​Amoifr)
• bug #3690 Fix support for nullable collection properties on component (@​rogierknoester)

v3.2.0

Changelog (symfony/ux-live-component@v3.1.0...v3.2.0)

• no significant changes

v3.1.0

Changelog (symfony/ux-live-component@v3.0.0...v3.1.0)

• security #557 Require X-Requested-With header to prevent CSRF (@​Kocal)
• security #cve-2026-49208 Parse format-less date LiveProps strictly with RFC 3339 (@​Kocal)
• security #cve-2026-49209 Cap the number of actions per _batch request (@​Kocal)
• security #cve-2026-49210 Reject malicious child component tags (@​Kocal)
• security #cve-2026-49212 Bind HMAC checksum to component name and slot (@​Kocal)
• feature #3432 Improve form validation error messages in exceptions (@​PierreCapel)
• bug #3566 Make LiveComponentSubscriber safe-by-default (@​Kocal)
• bug #3508 Fix dynamic template resolution when using "loading" attribute (@​xDeSwa)
• feature #3442 Use aria-busy attribute during component re-render (@​Amoifr)

v3.0.0

Changelog (symfony/ux-live-component@v2.34.0...v3.0.0)

• feature #3452 Remove compatibility layer with Symfony PropertyInfo <7.1 (@​Kocal)
• feature #3453 Update minimum required Symfony version to 7.4 (@​Kocal)
• feature #3450 Upgrade minimum required PHP version to 8.4 (@​Kocal)
• feature #3407 Allow Symfony UX 3.x packages (@​Kocal)
• bug #3398 Post-merge fixes for 3.x (@​Kocal)
• bug #3187 Add phpunit.dist.xml in .gitattributes (@​Kocal)
• bug #3182 Drop Symfony PHPUnit Bridge in favor of PHPUnit >= 11.0 (@​Kocal)
• feature #3051 Remove deprecations (@​smnandre)
• feature #2998 Upgrade minimum required PHP version to 8.2 (@​Kocal)
• feature #2996 Update minimum required Symfony version to ^6.4 (@​Kocal)

Changelog

Sourced from symfony/ux-live-component's changelog.

CHANGELOG

3.5

• Add LiveResponse::downloadUrl() and LiveResponse::downloadFile() to trigger a file download from a LiveAction, pointing the browser at a URL or sending the contents with the response, while the component keeps its state
• Add LiveResponse::remove() to take a component off the page from a LiveAction, instead of re-rendering it: the root element is removed and the Stimulus controller disconnects, and the server skips the render entirely

3.1

• Fix dynamic template resolution when using the loading attribute on a deferred component
• Use aria-busy attribute during component re-render
• Include field paths and violation messages in UnprocessableEntityHttpException thrown by submitForm() when validation fails
• Change how the Live Component request checksum is computed (security fix). BC note: users with a payload signed before the upgrade will need to reload their page.
• Require the X-Requested-With: XMLHttpRequest request header on LiveComponent check. See section 2.36 below for details.

3.0

• Minimum required Symfony version is now 7.4
• Minimum required PHP version is now 8.4
• Remove csrf argument from AsLiveComponent in favor of same-origin/CORS
• Remove compatibility layer with Symfony PropertyInfo <7.1
• Remove LegacyLivePropMetadata

2.36

• Reject malicious child component tags during rendering to prevent crafted component names from being rendered (security fix).

• Cap the number of actions allowed per _batch request to prevent abuse (security fix).

• Parse format-less date LiveProps strictly using RFC 3339 to avoid lenient date parsing of attacker-controlled values (security fix).

• Change how the Live Component request checksum is computed (security fix). BC note: users with a payload signed before the upgrade will need to reload their page.

• Require the X-Requested-With: XMLHttpRequest request header on LiveComponent requests, in addition to the existing Accept: application/vnd.live-component+html check, to prevent CSRF. The Accept header alone is CORS-safelisted and offers no protection against cross-origin requests crafted with fetch().

  BC break (minor): clients calling LiveComponent endpoints cross-origin must now add X-Requested-With to their CORS Access-Control-Allow-Headers allow-list. The bundled Stimulus controller already sends this header, so standard usage is unaffected.

2.35

• Allow Symfony UX 3.x packages

2.33

... (truncated)

Commits

• bb7a955 Fix issue #3728
• 120e6be bug #3676 [LiveComponent] Avoid 500 errors on malformed hydration payloads (A...
• 09f8a63 bug #3688 [LiveComponent] Fix data-loading scanner ignoring data-live-ignore ...
• d369255 bug #3690 [LiveComponent] Fix support for nullable collection properties on c...
• 0d0c75b [LiveComponent] Support nullable collection properties on component
• 54c37b4 Merge branch '2.x' into 3.x
• 4814fac Bump npm packages to v2.36.2
• 67c0707 [LiveComponent] Fix data-loading scanner ignoring data-live-ignore subtrees
• 0baaf91 Merge branch '2.x' into 3.x
• 976729a Bump npm packages to v2.36.1
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #102.