Update guava/filament-icon-picker requirement from ^4.0 to ^4.0 || ^5.0

[dependabot]

Updates the requirements on guava/filament-icon-picker to permit the latest version.

Release notes

Sourced from guava/filament-icon-picker's releases.

v5.0.0

5.0.0 (2026-08-04)

⚠ BREAKING CHANGES

• fuse.js is replaced by @​leeoniya/ufuzzy.
• getSetJs(), getIconsJs() and getIconSvgJs() are removed; the package now registers two routes under the _icon-picker prefix.
• getIcon() now returns null for ids with no file, and icon labels drop the set prefix ("O academic cap", not "Heroicon o academic cap").
• CanBeCacheable is removed and cache config moved from icon-picker.cache.* to filament-icon-picker.cache.*.

Features

• cache icon listings server-side and rename the config namespace (233c742)
• sanitize uploaded svg icons and restrict icon labels (dff53e0)
• serve icons over token-authorized endpoints instead of Livewire (4beaf26)
• swap fuse.js for uFuzzy and batch svg fetching on the client (953904c)

Bug Fixes

• check that custom icons exist instead of matching the set prefix (3269661)
• correct PSR-4 violation in CanBeCacheable and tighten icon manager types (76a9dd9)
• enforce scope and allowed sets when resolving icons (e8c4e51)
• use one source of truth for the custom icon set id (bc4be45)

Performance

• resolve single icons by file lookup instead of listing the set (4904607)

Refactor

• centralize custom icon scope ids in IconScope (e8d8e44)

Changelog

Sourced from guava/filament-icon-picker's changelog.

5.0.0 (2026-08-04)

⚠ BREAKING CHANGES

• fuse.js is replaced by @​leeoniya/ufuzzy.
• getSetJs(), getIconsJs() and getIconSvgJs() are removed; the package now registers two routes under the _icon-picker prefix.
• getIcon() now returns null for ids with no file, and icon labels drop the set prefix ("O academic cap", not "Heroicon o academic cap").
• CanBeCacheable is removed and cache config moved from icon-picker.cache.* to filament-icon-picker.cache.*.

Features

• cache icon listings server-side and rename the config namespace (233c742)
• sanitize uploaded svg icons and restrict icon labels (dff53e0)
• serve icons over token-authorized endpoints instead of Livewire (4beaf26)
• swap fuse.js for uFuzzy and batch svg fetching on the client (953904c)

Bug Fixes

• check that custom icons exist instead of matching the set prefix (3269661)
• correct PSR-4 violation in CanBeCacheable and tighten icon manager types (76a9dd9)
• enforce scope and allowed sets when resolving icons (e8c4e51)
• use one source of truth for the custom icon set id (bc4be45)

Performance

• resolve single icons by file lookup instead of listing the set (4904607)

Refactor

• centralize custom icon scope ids in IconScope (e8d8e44)

Commits

• bedb0fa Merge pull request #80 from GuavaCZ/release-please--branches--main
• b37fdaa chore(main): release 5.0.0
• 449c031 Merge remote-tracking branch 'origin/main'
• 13f35a0 docs: point readme at the 5.x docs
• 3e18c7f docs: add 5.x documentation
• 2f15066 docs: document the icon endpoints and publishable config
• 953904c feat!: swap fuse.js for uFuzzy and batch svg fetching on the client
• 4beaf26 feat!: serve icons over token-authorized endpoints instead of Livewire
• 4904607 perf!: resolve single icons by file lookup instead of listing the set
• 233c742 feat!: cache icon listings server-side and rename the config namespace
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[what-the-diff]

PR Summary

• Updated package version restriction for guava/filament-icon-picker
  Now, the system can use version 4.0 or 5.0, improving flexibility and compatibility.