chore(deps): update dependency typo3/cms-backend to v14 [security] - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
typo3/cms-backend (source)	^12.0 || ^13.0 -> ^14.0

GitHub Vulnerability Alerts

CVE-2025-59014

An uncaught exception in the Bookmark Toolbar of TYPO3 CMS versions 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 lets administrator‑level backend users trigger a denial‑of‑service condition in the backend user interface by saving manipulated data in the bookmark toolbar.

CVE-2025-59017

Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.

CVE-2025-59019

Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database tables stored within the users' web mounts without having access to them.

---

Release Notes

TYPO3-CMS/backend (typo3/cms-backend)

v14.0.0

Compare Source

v13.4.21

Compare Source

v13.4.20

Compare Source

v13.4.19

Compare Source

v13.4.18

Compare Source

v13.4.17

Compare Source

v13.4.16

Compare Source

v13.4.15

Compare Source

v13.4.14

Compare Source

v13.4.13

Compare Source

v13.4.12

Compare Source

v13.4.11

Compare Source

v13.4.10

Compare Source

v13.4.9

Compare Source

v13.4.8

Compare Source

v13.4.7

Compare Source

v13.4.6

Compare Source

v13.4.5

Compare Source

v13.4.4

Compare Source

v13.4.3

Compare Source

v13.4.2

Compare Source

v13.4.1

Compare Source

v13.4.0

Compare Source

v13.3.1

Compare Source

v13.3.0

Compare Source

v13.2.1

Compare Source

v13.1.1

Compare Source

v13.1.0

Compare Source

v13.0.1

Compare Source

v13.0.0

Compare Source

v12.4.40

Compare Source

v12.4.39

Compare Source

v12.4.38

Compare Source

v12.4.37

Compare Source

---

Configuration

📅 Schedule: Branch creation - "" in timezone Europe/Berlin, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: composer.lock

Command failed: composer update typo3/cms-backend:14.0.0 --with-dependencies --ignore-platform-req ext-intl --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins --minimal-changes
./composer.lock is present but ignored as the "lock" config option is disabled.
Cannot update only a partial set of packages without a lock file present. Run `composer update` to generate a lock file.

[coderabbitai]

Important

Review skipped

Ignore keyword(s) in the title.

⛔ Ignored keywords (1)

• chore(deps)

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}