PHIL packages
The open libraries and Symfony bundles of PHIL for PHP 8.5 and Symfony 8.2: 86 packages published on Packagist, in 11 families; each page is generated from the package's own README and documentation, and leads to its GitHub repository and its Packagist page.
News
November 11, 2026 — The PHIL UX kit at 0.3.0-alphaThe PHIL UX kit and phil-ux move to 0.3.0-alpha, and phil/ux-kit becomes a Symfony bundle. Image and Picture preload the main image; Picture and Logo offer a variant for the dark theme and a still image when motion is reduced; the credit, licence and origin of an image are written under its caption. Two recipes join: Gallery, a grid of images, and Lightbox, which enlarges an image in a dialog. An image from another host is shown only when the configuration allows that host. See the demo .
All the news
Foundations
Traits and attributes that make PHP enums easier to list, compare, describe and group into sets.
Point at any record of your application by its kind and identifier, such as page:42.
The few types every bounded context shares: identifiers, domain events, errors, command and query buses.
Know where each resource is used, and refuse to delete one that something still needs.
A trash for deleted pages and other resources: restore them, or purge them after a set time.
Text and content
UJO (Universal JSON Output) documents as values you can trust: read strictly, checked block by block, rendered as safe HTML.
Markdown, BBCode, MediaWiki, DokuWiki, Creole, UJO, HTML or plain text, turned into HTML that is safe to show.
Real quotation marks, dashes, French spaces and soft hyphens in your HTML, in every language, without touching the markup.
What changed between two texts, word by word, paragraph by paragraph, or block by block — shown in HTML or listed.
Code in 24 languages coloured on the server, as plain HTML spans any stylesheet can theme.
A block editor for Symfony forms, in Stimulus controllers, that writes UJO (Universal JSON Output) documents checked on the server.
One writer per block: edit leases, presence and block saves pushed through Mercure, for Symfony applications.
Footnotes and margin notes for UJO (Universal JSON Output) documents, on screen and in print.
Content warnings for games, books, articles and events, and the themes each reader folds or hides.
Tags and a translated category tree for any kind of resource, with form types to edit them.
Web and search
URL slugs made from titles and names, as a type that accepts nothing else.
Web addresses as normalised values, with their kind detected: Facebook, YouTube, Mastodon, a website.
QR codes drawn as SVG or PNG by PHP alone, with no service and no image library.
Navigation menus and breadcrumbs for Symfony, with the visitor's current page marked.
Redirects for Symfony, managed from an administration and resolved only when nothing else answered.
Sitemap XML for search engines, built from checked pages and cut to the protocol's limits.
The schema.org graph of a page as values: nodes from every part of a site, merged by @id, checked, and printed as one JSON-LD script element.
The /.well-known/ addresses of a Symfony site, each turned on in its configuration.
Cache whole pages in Varnish or a CDN, and purge exactly the ones an edit changes.
PHIL UX
PHIL UX kit for the Symfony UX Toolkit: the same recipes as the Shadcn kit, styled with phil-ux, installed with ux:install --kit.
phil-ux, the CSS framework of PHIL: real, mostly classless CSS with --phil-* tokens, light and dark.
Security
Let people style their pages without letting their CSS run code, load what it should not, or leave its frame.
Let people upload and paste SVG images without letting them run code, load what they should not, or embed another document.
Spot spam in a form submission without a captcha, in plain PHP.
Tell a robot from a human in the browser, and let only that one word out.
Tell people how guessable their password is, refuse the ones already leaked, and give them good ones.
Every uploaded file through an antivirus before anyone else can open it.
Every route has an access rule, or says why it is public: checked in continuous integration, before it ships.
Data
Amounts of money as exact integers in a known currency, with no float anywhere.
Several taxes on one sale, each computed on the same base and itemised to the cent.
Phone numbers read as people type them, checked against their country's plan, and formatted.
Repeating dates from an RFC 5545 rule: read it, check it, write it, list its occurrences.
A place's opening hours, and whether it is open right now.
Postal addresses checked and written the way each country writes them.
Coordinates, distances and bounding boxes as PHP values, and geocoding through the provider you pick.
Integration
Sign and verify webhooks that any Standard Webhooks library can send or check.
One circuit breaker per third party: calls stop at once when it keeps failing, and resume when it recovers.
Know what every message on your bounce mailbox says, and what to do about the address it names.
Operations
Turn a feature off without a deploy, run an A/B test, and force a failing third party's circuit open.
Safer Symfony console commands
Release notes and news that Doctrine migrations send to chat once a run is over.
Back a database and its media files up, encrypted and rotated, restore them behind a guard, and prove that they restore.
The surveillance of a Symfony site: its health, a maintenance mode, the heartbeats of its scheduled tasks and its Messenger queues.
Shared development tooling for PHIL and Tilttek packages: quality-tool configurations, Composer scripts, documentation checks and the package skeleton.
A "write to us" page for Symfony, protected from spam without a captcha.
Messaging handles read, shown and linked per service: WhatsApp, Telegram, Signal, Matrix and more.
A voting engine: ballots checked against the rules of their poll, and counted into standings.
The core of bookings: a resource, its slots, its rules, its conflicts and its reminders.
The check-in of an event or a venue: a code read at a door, decided at once, recorded once, online or offline.
The core of listings: a classified ad, a job offer, a search for partners — written, moderated, answered and expired by the same rules.
Open Badges 3.0 that anyone can verify: issued, signed, baked into the image, revoked, endorsed and gathered in a learner record.
Print and reports
What a font file says about itself — its names, its weight, its embedding licence — and the @font-face rule to serve it.
What a printer would refuse, before the file reaches it.
The mockups a shop shows and the print files a printer receives, drawn from the same layers.
One template and one design give every product of a catalogue: each SKU, its price, its channels and its artworks.
Charts drawn as SVG on the server, from the configuration a chart editor already writes.
Dashboards and reports for Symfony applications: figures contributed by any bundle, charts drawn without a script, reports exported, scheduled and delivered.
