This PR was merged into the main branch. Discussion ---------- Bump symfony/ux-icons from 2.35.0 to 2.36.1 Bumps [symfony/ux-icons](https://github.com/symfony/ux-icons) from 2.35.0 to 2.36.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/symfony/ux-icons/releases">symfony/ux-icons's releases</a>.</em></p> <blockquote> <h2>v2.36.1</h2> <p><strong>Changelog</strong> (<a href="https://github.com/symfony/ux-icons/compare/v2.36.0...v2.36.1">https://github.com/symfony/ux-icons/compare/v2.36.0...v2.36.1</a>)</p> <ul> <li>security #cve-2026-55877 Sanitize Iconify SVG output and unify icon creation (<a href="https://github.com/Kocal"><code>@Kocal</code></a>)</li> </ul> <h2>v2.36.0</h2> <p><strong>Changelog</strong> (<a href="https://github.com/symfony/ux-icons/compare/v2.35.0...v2.36.0">https://github.com/symfony/ux-icons/compare/v2.35.0...v2.36.0</a>)</p> <ul> <li>no significant changes</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/symfony/ux-icons/blob/3.x/CHANGELOG.md">symfony/ux-icons's changelog</a>.</em></p> <blockquote> <h2>2.36.1</h2> <ul> <li> <p>Sanitize rendered SVG icons (Iconify bodies and local files) to prevent XSS. Removed from icon output:</p> <ul> <li>Elements: <code><script></code>, <code><foreignObject></code>, <code><iframe></code>, <code><object></code>, <code><embed></code>, <code><handler></code></li> <li>SMIL animation elements (<code><animate></code>, <code><set></code>, <code><animateTransform></code>, <code><animateMotion></code>) when they target an <code>on*</code>, <code>href</code> or <code>xlink:href</code> attribute</li> <li>CDATA sections and processing instructions (otherwise re-serialized as raw HTML)</li> <li>Event-handler attributes (<code>on*</code>, e.g. <code>onload</code>, <code>onclick</code>) on every element</li> <li><code>href</code> / <code>xlink:href</code> values with a non-allowlisted scheme such as <code>javascript:</code>, <code>vbscript:</code>, <code>data:text/html</code> or <code>data:image/svg+xml</code> (allowed: <code>http(s)</code>, <code>mailto</code>, <code>tel</code>, <code>data:image/*</code> raster, fragments and relative URLs)</li> </ul> <p><code><style></code> elements are kept (so light/dark-mode theming keeps working), with their event-handler attributes stripped and <code></style></code> breakouts dropped.</p> <p>Clear your icon cache after upgrading so already-cached icons are re-sanitized.</p> </li> </ul> <h2>2.35</h2> <ul> <li>Allow Symfony UX 3.x packages</li> </ul> <h2>2.33</h2> <ul> <li>Add support for suffixes</li> </ul> <h2>2.30</h2> <ul> <li>Ensure compatibility with PHP 8.5</li> </ul> <h2>2.29.0</h2> <ul> <li>Add Symfony 8 support</li> </ul> <h2>2.25.0</h2> <ul> <li>Improve DX when <code>symfony/http-client</code> is not installed.</li> </ul> <h2>2.24.0</h2> <ul> <li>Add <code>xmlns</code> attribute to icons downloaded with Iconify, to correctly render icons browser as an external file, in SVG editors, and in files explorers or text editors previews. It <strong>may breaks your pipeline</strong> if you assert on <code>ux_icon()</code> or <code><twig:ux:icon></code> output in your tests, and forgot <a href="https://symfony.com/bundles/ux-icons/current/index.html#locking-on-demand-icons">to lock your icons</a>. We recommend you to <strong>lock</strong> your icons <strong>before</strong> upgrading to UX Icons 2.24. We also suggest you to to <strong>force-lock</strong> your icons <strong>after</strong> upgrading to UX Icons 2.24, to add the attribute <code>xmlns</code> to your icons already downloaded from Iconify.</li> </ul> <h2>2.20.0</h2> <ul> <li>Add <code>aliases</code> configuration option to define icon alternative names.</li> <li>Add support for <code>int</code> and <code>float</code> attribute values in <code><twig:ux:icon /></code>.</li> <li>Add support for Icon sets, configurable with <code>icon_sets</code> option.</li> </ul> <h2>2.19.0</h2> <ul> <li>Add <code>ignore_not_found</code> option to silence error during rendering if the icon is not found.</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/symfony/ux-icons/commit/567f33ddffc25504788abc61977565381e424ada"><code>567f33d</code></a> [Icons] Sanitize SVG output and unify icon creation</li> <li><a href="https://github.com/symfony/ux-icons/commit/8f910e973ff585d8c47581ce8bb90b0d7a3efc83"><code>8f910e9</code></a> Drop PR warning and auto-closing on subtree splits</li> <li>See full diff in <a href="https://github.com/symfony/ux-icons/compare/v2.35.0...v2.36.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=symfony/ux-icons&package-manager=composer&previous-version=2.35.0&new-version=2.36.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting ``@dependabot` rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - ``@dependabot` rebase` will rebase this PR - ``@dependabot` recreate` will recreate this PR, overwriting any edits that have been made to it - ``@dependabot` show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - ``@dependabot` ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - ``@dependabot` ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - ``@dependabot` ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/symfony/demo/network/alerts). </details> Commits ------- eaac2bb Bump symfony/ux-icons from 2.35.0 to 2.36.1