Skip to content

security Update dependency typo3/cms-core to v14 [SECURITY] - autoclosed - #39

Closed
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/packagist-typo3-cms-core-vulnerability
Closed

security Update dependency typo3/cms-core to v14 [SECURITY] - autoclosed#39
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/packagist-typo3-cms-core-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Jan 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
typo3/cms-core (source) ^12.0 || ^13.0 → ^14.0 age adoption passing confidence

TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool

CVE-2026-0859 / GHSA-7vp9-x248-9vr9

More information

Details

Problem

Local platform users who can write to TYPO3’s mail‑file spool directory can craft a file that the system will automatically deserialize without any class restrictions. This flaw allows an attacker to inject and execute arbitrary PHP code in the public scope of the web server.

The vulnerability is triggered when TYPO3 is configured with $GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport_spool_type'] = 'file'; and a scheduler task or cron job runs the command mailer:spool:send. The spool‑send operation performs the insecure deserialization that is at the core of this issue.

Solution

Update to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described.

Credits

Thanks to Vitaly Simonovich for reporting this issue, and to TYPO3 security team members Elias Häußler and Oliver Hader for fixing it.

References

Severity

  • CVSS Score: 5.2 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

TYPO3 CMS has Cross-Site Scripting in Indexed Search

CVE-2026-47348 / GHSA-cg75-qfg2-w9hj

More information

Details

Problem

Editors with access to create or modify page content were able to include HTML markup in page titles that were stored in the search index without sanitization. When displayed in frontend search results via the Indexed Search plugin, these titles were rendered without proper output encoding, resulting in a Cross-Site Scripting vulnerability.

Solution

Update to TYPO3 versions 13.4.31 LTS, 14.3.3 LTS that fix the problem described.

Credits

TYPO3 CMS thanks Jan Kahmen and Sanjay Singh Jhala for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it.

Resources

Severity

  • CVSS Score: 5.1 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

TYPO3 CMS: Broken Access Control in Media Module

CVE-2026-47351 / GHSA-q93m-25xv-94hh

More information

Details

Problem

Backend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view.

Solution

Update to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described.

Credits

TYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it.

Resources

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

TYPO3 CMS has Broken Access Control in its File Abstraction Layer

CVE-2026-49738 / GHSA-jf56-v8jc-jcc5

More information

Details

Problem

The path allowance check in GeneralUtility::isAllowedAbsPath() performed a plain string prefix comparison without requiring a directory separator boundary, causing a path like /var/www/html-other/secret.yaml to be incorrectly accepted as valid when the project root was /var/www/html. Administrator users with access to the File Abstraction Layer were able to create new file storage definitions pointing to directories outside the project root, bypassing this path check.

Solution

Update to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described.

Credits

TYPO3 CMS thanks Wolfgang Klinger for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it.

Resources

Severity

  • CVSS Score: 2.1 / 10 (Low)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

TYPO3 CMS has Broken Access Control in Backend API

CVE-2026-47352 / GHSA-2j54-93q2-3hjq

More information

Details

Problem

Authenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages.

Solution

Update to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described.

Credits

TYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it.

Resources

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

TYPO3 CMS has Insecure Deserialization via Core API

CVE-2026-49740 / GHSA-c78m-c52x-jgwp

More information

Details

Problem

TYPO3's cache frontend (VariableFrontend) and persistent key-value store (Registry) deserialized PHP payloads without integrity validation or class restrictions. An attacker with write access to the underlying storage backend (cache store or sys_registry database table) could inject a crafted serialized payload to trigger PHP Object Injection, potentially exploiting a gadget chain to achieve Remote Code Execution or other high-impact effects.

Exploiting this vulnerability requires direct local write access to the storage, such as the SQL database or file system.

Solution

Update to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described.

Credits

TYPO3 CMS thanks “z3rco”, Chowdhury Faizal Ahammed, Rick Larabee, Vitaly Simonovich, Nozomu Sasaki, Mert Akdag, “tikket”, Shafi Almutairi for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it.

Resources

Severity

  • CVSS Score: 6.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

TYPO3 CMS has Broken Access Control in its Media Module

CVE-2026-49742 / GHSA-chm7-4vch-h8vr

More information

Details

Problem

Backend users with file download permissions were able to download files from the fallback storage of the file abstraction layer (FAL) via the Media Module. Since the fallback storage resolves paths relative to the server's document root, this could expose sensitive files such as log files.

Solution

Update to TYPO3 versions 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described.

Credits

TYPO3 CMS thanks Hyunseo Shin for reporting this issue, and to TYPO3 security team member Torben Hansen for fixing it.

Resources

Severity

  • CVSS Score: 7.1 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

TYPO3 CMS has Broken Access Control in its Form Framework

CVE-2026-47346 / GHSA-hwvq-2w67-rvxp

More information

Details

Problem

Backend users with file write permissions were able to upload form definition files with mixed-case extensions (e.g., .FORM.YAML) to bypass the Form Framework's upload restriction. Maliciously crafted form definition files can be used to execute arbitrary SQL statements, allowing attackers to escalate privileges by creating administrative backend user accounts.

Solution

Update to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described.

Credits

TYPO3 CMS thanks Alexander Künzl for reporting this issue, and to TYPO3 core & security team members Oliver Hader and Benjamin Franzke for fixing it.

Resources

Severity

  • CVSS Score: 7.6 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

TYPO3 CMS has Broken Access Control in its DataHandler

CVE-2026-47350 / GHSA-qcmw-6rm2-5x78

More information

Details

Problem

Backend users were able to move records to a different page without having edit permissions on the source page.

Solution

Update to TYPO3 versions 13.4.31 LTS, 14.3.3 LTS that fix the problem described.

Credits

TYPO3 CMS thanks Hyunseo Shin for reporting this issue, and TYPO3 security team member Torben Hansen for fixing it.

Resources

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

TYPO3 CMS: Destructive Actions on File Mount Folders

CVE-2026-47343 / GHSA-3v8v-4wg6-r7qh

More information

Details

Problem

Non-privileged backend users with file mount access were able to perform write operations (move, delete, rename) on folders representing the root of an active file mount due to missing authorization restrictions.

Solution

Update to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described.

Credits

TYPO3 CMS thanks Arne Uplegger for reporting this issue, and TYPO3 security team member Elias Häußler for fixing it.

Resources

Severity

  • CVSS Score: 7.2 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

TYPO3 CMS has an Open Redirect Vulnerability via Core Utilities

CVE-2026-47347 / GHSA-3p42-w5ch-gg42

More information

Details

Problem

Applications that use GeneralUtility::sanitizeLocalUrl to allow only local URLs are vulnerable to open redirect attacks if the URL is used after it has passed the aforementioned sanitization checks. This enables attackers to redirect users to external content and carry out phishing attacks.

Solution

Update to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described.

Credits

TYPO3 CMS thanks Alexandre Romao for reporting this issue, and TYPO3 core & security team member Benjamin Franzke for fixing it.

Resources

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

TYPO3 CMS has Broken Access Control in the Recycler Module

CVE-2026-47349 / GHSA-f34x-rx2w-7pm3

More information

Details

Problem

Backend users with access to the Recycler module were able to restore soft-deleted records on pages or for tables they were not authorized to modify.

Solution

Update to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described.

Credits

TYPO3 CMS thanks Hyunseo Shin for reporting this issue, and TYPO3 security team member Elias Häußler for fixing it.

Resources

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

TYPO3 CMS has Broken Access Control in its Form Framework

CVE-2026-11607 / GHSA-pjpj-v387-x4vq

More information

Details

Problem

Backend users with access to the Form Framework were able to use files not ending in .form.yaml as form definitions, which were processed without denying the incorrect file extension. Maliciously crafted form definition files can be used to execute arbitrary SQL statements, allowing attackers to escalate privileges by creating administrative backend user accounts.

Solution

Update to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described.

Credits

TYPO3 CMS thanks “Ethan” for reporting this issue, and TYPO3 core & security team member Oliver Hader for fixing it.

Resources

Severity

  • CVSS Score: 7.6 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool

CVE-2026-0859 / GHSA-7vp9-x248-9vr9

More information

Details

Problem

Local platform users who can write to TYPO3’s mail‑file spool directory can craft a file that the system will automatically deserialize without any class restrictions. This flaw allows an attacker to inject and execute arbitrary PHP code in the public scope of the web server.

The vulnerability is triggered when TYPO3 is configured with $GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport_spool_type'] = 'file'; and a scheduler task or cron job runs the command mailer:spool:send. The spool‑send operation performs the insecure deserialization that is at the core of this issue.

Solution

Update to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described.

Credits

Thanks to Vitaly Simonovich for reporting this issue, and to TYPO3 security team members Elias Häußler and Oliver Hader for fixing it.

References

Severity

  • CVSS Score: 5.2 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

TYPO3-CMS/core (typo3/cms-core)

v14.0.0

Compare Source

v13.4.31

Compare Source

v13.4.30

Compare Source

v13.4.29

Compare Source

v13.4.28

Compare Source

v13.4.27

Compare Source

v13.4.26

Compare Source

v13.4.25

Compare Source

v13.4.24

Compare Source

v13.4.23

Compare Source

Configuration

📅 Schedule: (in timezone Europe/Berlin)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from konradmichalik as a code owner January 13, 2026 22:11
@renovate renovate Bot added the security label Jan 13, 2026
@renovate

renovate Bot commented Jan 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: composer.lock
Command failed: composer update typo3/cms-core:14.0.0 --with-dependencies --ignore-platform-req ext-* --ignore-platform-req lib-* --ignore-platform-req php --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins --minimal-changes
Loading composer repositories with package information
Dependency psr/http-message is also a root requirement. Package has not been listed as an update argument, so keeping locked at old version. Use --with-all-dependencies (-W) to include root dependencies.
Dependency symfony/translation is also a root requirement. Package has not been listed as an update argument, so keeping locked at old version. Use --with-all-dependencies (-W) to include root dependencies.
Dependency typo3fluid/fluid is also a root requirement. Package has not been listed as an update argument, so keeping locked at old version. Use --with-all-dependencies (-W) to include root dependencies.
Updating dependencies
Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Root composer.json requires typo3/cms-core ^14.0, found typo3/cms-core[v14.0.0, ..., v14.3.1] but these were not loaded, because they are affected by security advisories ("PKSA-rtck-8z1q-gn5s"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add them to the audit "ignore" config. To turn the feature off entirely, you can set "block-insecure" to false in your "audit" config.
  Problem 2
    - typo3/cms-backend is locked to version v13.4.22 and an update of this package was not requested.
    - typo3/cms-backend v13.4.22 requires typo3/cms-core 13.4.22 -> found typo3/cms-core[v13.4.22] but it conflicts with your root composer.json require (^14.0).
  Problem 3
    - typo3/cms-dashboard is locked to version v13.4.22 and an update of this package was not requested.
    - typo3/cms-dashboard v13.4.22 requires typo3/cms-core 13.4.22 -> found typo3/cms-core[v13.4.22] but it conflicts with your root composer.json require (^14.0).
  Problem 4
    - typo3/cms-extbase is locked to version v13.4.22 and an update of this package was not requested.
    - typo3/cms-extbase v13.4.22 requires typo3/cms-core 13.4.22 -> found typo3/cms-core[v13.4.22] but it conflicts with your root composer.json require (^14.0).
  Problem 5
    - typo3/cms-fluid is locked to version v13.4.22 and an update of this package was not requested.
    - typo3/cms-fluid v13.4.22 requires typo3/cms-core 13.4.22 -> found typo3/cms-core[v13.4.22] but it conflicts with your root composer.json require (^14.0).
  Problem 6
    - helhum/typo3-console is locked to version v8.3.1 and an update of this package was not requested.
    - helhum/typo3-console v8.3.1 requires typo3/cms-core ^11.5.26 || ^12.4.18 || ^13.1 || ^14.0 -> found typo3/cms-core[v11.5.26, ..., v11.5.41, v12.4.18, ..., v12.4.45, v13.1.0, ..., v13.4.29, v14.0.0, ..., v14.3.1] but these were not loaded, because they are affected by security advisories ("PKSA-rtck-8z1q-gn5s", "PKSA-ns26-fz7n-2jm8", "PKSA-pz1k-khnw-3j7j", "PKSA-rwv7-ff55-f18g", "PKSA-2ssc-6m7w-s9xh", "PKSA-q3vc-nbpk-d1gk", "PKSA-6d7x-2gs8-wr59", "PKSA-b5m3-ttcx-cz18", "PKSA-3gg2-48j5-46ky", "PKSA-tm11-834c-1wbq", "PKSA-443h-dk5w-qm2g", "PKSA-8vkj-4d3h-x586", "PKSA-7dr7-npxr-1nyj", "PKSA-prgj-sgzn-q6cs", "PKSA-zz7z-6zsy-d2hc", "PKSA-99mg-htb6-c272", "PKSA-h5xk-8nxx-znp4", "PKSA-d551-hdqh-5mmf", "PKSA-jbhx-knzt-5y6m", "PKSA-jp7z-h3vv-yr4s", "PKSA-83hy-ynvj-7pfq"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add them to the audit "ignore" config. To turn the feature off entirely, you can set "block-insecure" to false in your "audit" config.
  Problem 7
    - saschaegerer/phpstan-typo3 is locked to version 2.1.1 and an update of this package was not requested.
    - saschaegerer/phpstan-typo3 2.1.1 requires typo3/cms-core ^13.4.3 -> found typo3/cms-core[v13.4.3, ..., v13.4.29] but it conflicts with your root composer.json require (^14.0).
  Problem 8
    - typo3/cms-base-distribution is locked to version v13.4.1 and an update of this package was not requested.
    - typo3/cms-base-distribution v13.4.1 requires typo3/cms-core ^13.4 -> found typo3/cms-core[v13.4.0, ..., v13.4.29] but it conflicts with your root composer.json require (^14.0).
  Problem 9
    - typo3/cms-lowlevel is locked to version v13.4.22 and an update of this package was not requested.
    - typo3/cms-lowlevel v13.4.22 requires typo3/cms-core 13.4.22 -> found typo3/cms-core[v13.4.22] but it conflicts with your root composer.json require (^14.0).

Use the option --with-all-dependencies (-W) to allow upgrades, downgrades and removals for packages currently locked to specific versions.

@coderabbitai

coderabbitai Bot commented Jan 13, 2026

Copy link
Copy Markdown

Important

Review skipped

Ignore keyword(s) in the title.

⛔ Ignored keywords (1)
  • chore(deps)

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Comment @coderabbitai help to get the list of available commands and usage tips.

@renovate renovate Bot changed the title chore(deps): update dependency typo3/cms-core to v14 [security] chore(deps): update dependency typo3/cms-core to v14 [security] - autoclosed Mar 27, 2026
@renovate renovate Bot closed this Mar 27, 2026
@renovate
renovate Bot deleted the renovate/packagist-typo3-cms-core-vulnerability branch March 27, 2026 01:00
@renovate renovate Bot changed the title chore(deps): update dependency typo3/cms-core to v14 [security] - autoclosed chore(deps): update dependency typo3/cms-core to v14 [security] Mar 30, 2026
@renovate renovate Bot reopened this Mar 30, 2026
@renovate
renovate Bot force-pushed the renovate/packagist-typo3-cms-core-vulnerability branch 2 times, most recently from 8003f88 to 690646f Compare March 30, 2026 21:01
@renovate renovate Bot changed the title chore(deps): update dependency typo3/cms-core to v14 [security] chore(deps): update dependency typo3/cms-core to v14 [security] - autoclosed Apr 27, 2026
@renovate renovate Bot closed this Apr 27, 2026
@renovate
chore(deps): update dependency typo3/cms-core to v14 [security]
60a7249 
| datasource | package        | from    | to     |
| ---------- | -------------- | ------- | ------ |
| packagist  | typo3/cms-core | 13.4.22 | 14.0.0 |
@renovate renovate Bot changed the title chore(deps): update dependency typo3/cms-core to v14 [security] - autoclosed chore(deps): update dependency typo3/cms-core to v14 [security] Apr 27, 2026
@renovate renovate Bot reopened this Apr 27, 2026
@renovate
renovate Bot force-pushed the renovate/packagist-typo3-cms-core-vulnerability branch 2 times, most recently from 690646f to 60a7249 Compare April 27, 2026 21:32
@renovate renovate Bot changed the title chore(deps): update dependency typo3/cms-core to v14 [security] security Update dependency typo3/cms-core to v14 [SECURITY] Jun 4, 2026
@renovate renovate Bot changed the title security Update dependency typo3/cms-core to v14 [SECURITY] security Update dependency typo3/cms-core to v14 [SECURITY] - autoclosed Jun 25, 2026
@renovate renovate Bot closed this Jun 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@konradmichalik konradmichalik Awaiting requested review from konradmichalik konradmichalik is a code owner

Assignees

No one assigned

Labels

security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants