Bump symfony/ux-live-component from 2.35.0 to 2.36.0

[dependabot]

Bumps symfony/ux-live-component from 2.35.0 to 2.36.0.

Release notes

Sourced from symfony/ux-live-component's releases.

v2.36.0

Changelog (symfony/ux-live-component@v2.35.0...v2.36.0)

• security #557 Require X-Requested-With header to prevent CSRF (@​Kocal)
• security #cve-2026-49208 Parse format-less date LiveProps strictly with RFC 3339 (@​Kocal)
• security #cve-2026-49209 Cap the number of actions per _batch request (@​Kocal)
• security #cve-2026-49210 Reject malicious child component tags (@​Kocal)
• security #cve-2026-49212 Bind HMAC checksum to component name and slot (@​Kocal)

Changelog

Sourced from symfony/ux-live-component's changelog.

CHANGELOG

3.1

• Fix dynamic template resolution when using the loading attribute on a deferred component
• Use aria-busy attribute during component re-render
• Include field paths and violation messages in UnprocessableEntityHttpException thrown by submitForm() when validation fails
• Change how the Live Component request checksum is computed (security fix). BC note: users with a payload signed before the upgrade will need to reload their page.
• Require the X-Requested-With: XMLHttpRequest request header on LiveComponent check. See section 2.36 below for details.

3.0

• Minimum required Symfony version is now 7.4
• Minimum required PHP version is now 8.4
• Remove csrf argument from AsLiveComponent in favor of same-origin/CORS
• Remove compatibility layer with Symfony PropertyInfo <7.1
• Remove LegacyLivePropMetadata

2.36

• Reject malicious child component tags during rendering to prevent crafted component names from being rendered (security fix).

• Cap the number of actions allowed per _batch request to prevent abuse (security fix).

• Parse format-less date LiveProps strictly using RFC 3339 to avoid lenient date parsing of attacker-controlled values (security fix).

• Change how the Live Component request checksum is computed (security fix). BC note: users with a payload signed before the upgrade will need to reload their page.

• Require the X-Requested-With: XMLHttpRequest request header on LiveComponent requests, in addition to the existing Accept: application/vnd.live-component+html check, to prevent CSRF. The Accept header alone is CORS-safelisted and offers no protection against cross-origin requests crafted with fetch().

  BC break (minor): clients calling LiveComponent endpoints cross-origin must now add X-Requested-With to their CORS Access-Control-Allow-Headers allow-list. The bundled Stimulus controller already sends this header, so standard usage is unaffected.

2.35

• Allow Symfony UX 3.x packages

2.33

• Add fetch_credentials option to configure the fetch API credentials mode for cross-origin requests. This is useful when embedding a Live Component from a different domain that requires cookie-based authentication (e.g., JWT stored in cookies)

  Global configuration in config/packages/live_component.yaml:

... (truncated)

Commits

• a3fb5f2 Update CHANGELOGs for 2.36.0
• fe2fae7 [LiveComponent] Require X-Requested-With header to prevent CSRF
• 6d52997 security #cve-2026-49208 [LiveComponent] Parse format-less date LiveProps str...
• 1290480 security #cve-2026-49209 [LiveComponent] Cap the number of actions per `_batc...
• b3ab1c5 security #cve-2026-49210 [LiveComponent] Reject malicious child component tag...
• e207796 [LiveComponent] Bind HMAC checksum to component name and slot
• d7e30f4 [LiveComponent] Cap the number of actions per _batch request
• a3de56b [LiveComponent] Parse format-less date LiveProps strictly with RFC 3339
• 1d1ace2 [LiveComponent] Reject malicious child component tags
• 156c918 Update versions to 2.35.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.