New in Symfony 8.2: AssetMapper Improvements (Symfony Blog)

November 10, 2026 • Published by Javier Eguiluz
Symfony 8.2 is backed by:
AssetMapper lets you use modern JavaScript and CSS without a build step, relying on native browser features like import maps. Symfony 8.2 improves it in several areas: security of third-party packages, control over what the import map exposes, and a smoother development experience.
Subresource Integrity (SRI) lets browsers check that the files they download haven't been tampered with, by comparing them with a cryptographic hash that you provide. Symfony 8.2 adds a new option to generate these hashes for the resources of your import map:
The supported algorithms are sha256, sha384 and sha512. When this option is enabled, the importmap() Twig function adds the integrity key to the rendered import map and the integrity attribute to the modulepreload and stylesheet links:
Supply chain attacks usually target freshly published package versions. If you wait a few days before installing a new version, a compromised release has time to be detected and removed. Tools like npm, pnpm and yarn already provide this feature, and Symfony 8.2 adds it to AssetMapper:
With this option, the importmap:update command ignores the versions that are newer than the given age (and also prerelease versions and the ones above the latest tag). The importmap:outdated command shows the versions held back in a new Withheld column:
This check doesn't apply to importmap:require, so you can still install a recent version when you need an urgent upgrade. Keep in mind that, to know when each version was published, update checks now download the full npm metadata of each package, which is much larger than the abbreviated one used by default.
When you require a third-party package, AssetMapper downloads the ESM build that jsDelivr generates for it. Sometimes this generated build is broken, so Symfony 8.2 adds a --no-esm option to download the file published by the package as-is:
This adds an esm key to the package entry in importmap.php:
When using this option, you must pass the path of the file inside the package. AssetMapper also downloads the files imported with relative paths (e.g. import './chunk/calendar.js') and adds them to the import map. However, bare imports such as import { h } from 'preact' are not resolved, so you must require those packages yourself.
In production, AssetMapper reads the metadata files generated by the asset-map:compile command. If you ran that command on your local machine, the development environment also used those files, so your changes to the source assets were ignored until you removed the public/assets/ directory.
In Symfony 8.2, AssetMapper ignores the compiled metadata when the debug mode is enabled, so assets are always resolved from their source files in your development environment. The asset-map:compile command also displays a note to remind you about this behavior when you run it in debug mode.
The importmap() Twig function renders all the entries of importmap.php. In applications with several entrypoints, this means that a public page (e.g. the login page) reveals the entrypoints of other sections (e.g. the admin backend) and their dependencies.
Symfony 8.2 adds an option to only render the entries reachable from the entrypoints of the page:
The reachable entries include both static and dynamic imports, so lazy Stimulus controllers keep working. The only exception is dynamic imports whose specifier is a variable (e.g. import(someVariable)), which can't be traced. That's why this option is disabled by default.
The asset-map:compile command generates the manifest.json, importmap.json and entrypoint.*.json files in the public assets directory. They are only read by PHP, but they are publicly accessible because of their location. Symfony 8.2 adds an option to store them in any other directory:
The default value of this option doesn't change, so these files stay in the public assets directory unless you configure it.
❤️ Help the Symfony project!
As with any Open-Source project, contributing code or documentation is the most common way to help, but we also have a wide range of sponsoring opportunities.
💼 Backend Symfony Developer at iliad View Symfony jobs →
€33,000 / year Italy Remote + part-time onsite (Milano, Italy)
Check Code Performance in Dev, Test, Staging & Production
Peruse our complete Symfony & PHP solutions catalog for your web development needs.
Be safe against critical risks to your projects and businesses
Thanks Jan Christoph Beyer for being a Symfony contributor
1 commit • 8 lines changed
View all contributors that help us make Symfony
Be an active part of the community and contribute ideas, code and bug fixes. Both experts and newcomers are welcome.
Symfony™ is a trademark of Symfony SAS. All rights reserved.