TYPO3 v15 dev-main snapshot ()

2026-08-10 22:31:09 +02:00
commit af8cc155b5
6818 changed files with 642608 additions and 0 deletions
@@ -0,0 +1,38 @@
+.. include:: /Includes.rst.txt
+
+.. _deprecation-107931-1775647667:
+
+============================================================
+Deprecation: #107931 - Lowlevel DatabaseIntegrityCheck class
+============================================================
+
+See :issue:`107931`
+
+Description
+===========
+
+The class :php:`\TYPO3\CMS\Lowlevel\Integrity\DatabaseIntegrityCheck` has been
+deprecated and will be removed in TYPO3 v15.0.
+
+The class is no longer used internally by TYPO3 and should not be relied upon
+by extensions.
+
+Impact
+======
+
+Using :php-short:`\TYPO3\CMS\Lowlevel\Integrity\DatabaseIntegrityCheck` will trigger
+a PHP :php:`E_USER_DEPRECATED` error. The class will be removed in TYPO3 v15.0.
+
+Affected installations
+======================
+
+TYPO3 installations with extensions that use
+:php-short:`\TYPO3\CMS\Lowlevel\Integrity\DatabaseIntegrityCheck` directly.
+
+Migration
+=========
+
+Extensions that rely on this class should implement the necessary functionality
+themselves.
+
+.. index:: PHP-API, FullyScanned, ext:lowlevel
@@ -0,0 +1,56 @@
+.. include:: /Includes.rst.txt
+
+.. _deprecation-109107-1772108218:
+
+=============================================
+Deprecation: #109107 - CacheAction key "href"
+=============================================
+
+See :issue:`109107`
+
+Description
+===========
+
+The :php:`CacheAction` array key :php:`href` used in cache action definitions
+provided by the
+:php:`\TYPO3\CMS\Backend\Backend\Event\ModifyClearCacheActionsEvent` has been
+deprecated in favor of :php:`endpoint`. The new key name better reflects the purpose of
+this field, which is used as an AJAX endpoint URL. The value must be a
+:php:`string`.
+
+Impact
+======
+
+Cache action arrays that contain an :php:`href` rather than an :php:`endpoint` key
+will trigger a PHP :php:`E_USER_DEPRECATED` notice.
+:php:`TYPO3\CMS\Backend\Backend\ToolbarItems\ClearCacheToolbarItem` will automatically
+migrate :php:`href` to :php:`endpoint` at runtime to maintain backward compatibility.
+
+Support for the :php:`href` key will be removed in TYPO3 v15.0.
+
+Affected installations
+======================
+
+Any installation that has extensions which register custom cache actions with
+:php-short:`\TYPO3\CMS\Backend\Backend\Event\ModifyClearCacheActionsEvent` and
+provide an action URL in the :php:`href` array key.
+
+Migration
+=========
+
+Replace the :php:`href` key with :php:`endpoint` in any cache action array
+returned from a :php-short:`\TYPO3\CMS\Backend\Backend\Event\ModifyClearCacheActionsEvent` listener.
+
+..  code-block:: diff
+
+    $event->addCacheAction([
+        'id' => 'my_custom_cache',
+    -   'href' => $uriBuilder->buildUriFromRoute('ajax_my_cache_clear'),
+    +   'endpoint' => (string)$uriBuilder->buildUriFromRoute('ajax_my_cache_clear'),
+        'iconIdentifier' => 'actions-system-cache-clear',
+        'title' => 'Clear my cache',
+        'description' => 'Optional description',
+        'severity' => 'notice',
+    ]);
+
+.. index:: Backend, PHP-API, ext:backend, NotScanned
@@ -0,0 +1,127 @@
+..  include:: /Includes.rst.txt
+
+..  _deprecation-109438-1774951763:
+
+====================================================
+Deprecation: #109438 - ext_tables.php in extensions
+====================================================
+
+See :issue:`109438`
+
+Description
+===========
+
+Extensions that still ship an :file:`ext_tables.php` file will now trigger
+a PHP :php:`E_USER_DEPRECATED` error when the file is loaded during
+a non-cached request or cache warm-up.
+
+The :file:`ext_tables.php` file was historically used to register backend
+modules, page doktypes, user settings, and other runtime configuration.
+All of these use cases now have dedicated alternatives in modern TYPO3:
+
+*  Backend modules: :file:`Configuration/Backend/Modules.php`
+*  Backend routes: :file:`Configuration/Backend/Routes.php`
+*  User settings: :file:`Configuration/TCA/Overrides/be_users.php`
+   (see :issue:`108843`)
+*  Page doktype allowed record types: :file:`Configuration/TCA/Overrides/pages.php`
+   (see :issue:`108557`)
+
+Impact
+======
+
+A PHP :php:`E_USER_DEPRECATED` error is triggered for every third-party
+extension that still provides an :file:`ext_tables.php` file whenever
+:file:`ext_tables.php` files are loaded without caching, for example during
+cache warm-up or in a development context.
+
+Support for :file:`ext_tables.php` will be removed in TYPO3 v15.0.
+
+Affected installations
+======================
+
+All installations with third-party extensions that still ship an
+:file:`ext_tables.php` file.
+
+Migration
+=========
+
+Move all registration from :file:`ext_tables.php` to the appropriate
+configuration files.
+
+User settings
+-------------
+
+User settings previously registered via
+:php:`TYPO3\CMS\Core\Utility\ExtensionManagementUtility::addFieldsToUserSettings()` in
+:file:`ext_tables.php` should now be registered via
+:php:`TYPO3\CMS\Core\Utility\ExtensionManagementUtility::addUserSetting()` in
+:file:`Configuration/TCA/Overrides/be_users.php`.
+
+Before:
+
+..  code-block:: php
+    :caption: ext_tables.php
+
+    use TYPO3\CMS\Core\Utility\ExtensionManagementUtility;
+
+    $GLOBALS['TYPO3_USER_SETTINGS']['columns']['myCustomSetting'] = [
+        'type' => 'check',
+        'label' => 'LLL:EXT:my_ext/Resources/Private/Language/locallang.xlf:myCustomSetting',
+    ];
+    ExtensionManagementUtility::addFieldsToUserSettings(
+        'myCustomSetting',
+        'after:emailMeAtLogin'
+    );
+
+
+After:
+
+..  code-block:: php
+    :caption: Configuration/TCA/Overrides/be_users.php
+
+    use TYPO3\CMS\Core\Utility\ExtensionManagementUtility;
+
+    ExtensionManagementUtility::addUserSetting(
+        'myCustomSetting',
+        [
+            'label' => 'LLL:EXT:my_ext/Resources/Private/Language/locallang.xlf:myCustomSetting',
+            'config' => [
+                'type' => 'check',
+                'renderType' => 'checkboxToggle',
+            ],
+        ],
+        'after:emailMeAtLogin'
+    );
+
+Page doktype allowed record types
+----------------------------------
+
+Page doktypes previously registered via :php:`PageDoktypeRegistry->add()` in
+:file:`ext_tables.php` should now use the TCA option
+:php:`allowedRecordTypes` in :file:`Configuration/TCA/Overrides/pages.php`.
+
+Before:
+
+..  code-block:: php
+    :caption: ext_tables.php
+
+    \TYPO3\CMS\Core\Utility\GeneralUtility::makeInstance(
+        \TYPO3\CMS\Core\DataHandling\PageDoktypeRegistry::class
+    )->add(116, [
+        'allowedTables' => ['tt_content', 'my_custom_record'],
+    ]);
+
+After:
+
+..  code-block:: php
+    :caption: Configuration/TCA/Overrides/pages.php
+
+    $GLOBALS['TCA']['pages']['types']['116']['allowedRecordTypes'] = [
+        'tt_content',
+        'my_custom_record',
+    ];
+
+Once all registrations have been moved, the :file:`ext_tables.php` file
+can be removed from the extension.
+
+..  index:: PHP-API, NotScanned, ext:core
@@ -0,0 +1,56 @@
+..  include:: /Includes.rst.txt
+
+..  _deprecation-109517-1744105201:
+
+==========================================================================================
+Deprecation: #109517 - PSR-14 event :php:`TYPO3\CMS\Setup\Event\AddJavaScriptModulesEvent`
+==========================================================================================
+
+See :issue:`109517`
+
+Description
+===========
+
+The PSR-14 event
+that is dispatched in the :guilabel:`User Settings`
+panel to allow injection of custom JavaScript methods has
+been deprecated:
+
+*  :php:`TYPO3\CMS\Setup\Event\AddJavaScriptModulesEvent`
+
+With the integration of `EXT:setup` into `EXT:backend` (see
+:ref:`important-109517-1744105200`) this event is now superseded
+by:
+
+*  :php:`TYPO3\CMS\Backend\Event\AddUserSettingsJavaScriptModulesEvent`
+
+For better dual version compatibility, no deprecation is emitted
+when using the legacy event location.
+
+Migration to the new event can be done by just replacing its
+new name. For details, see :ref:`important-109517-1744105200-AddJavaScriptModulesEvent`.
+
+Impact
+======
+
+Using the old event will work as before in TYPO3 v14 but will
+be removed with TYPO3 v15.0.
+
+To keep listeners working, the new event
+:php-short:`TYPO3\CMS\Backend\Event\AddUserSettingsJavaScriptModulesEvent`
+must be utilized instead.
+
+Affected installations
+======================
+
+Instances and extensions that register a PSR-14 listener on
+:php-short:`TYPO3\CMS\Setup\Event\AddJavaScriptModulesEvent`.
+
+Migration
+=========
+
+See :ref:`important-109517-1744105200-AddJavaScriptModulesEvent`.
+The new event name and class namespace can be used with no further
+functional changes.
+
+..  index:: Backend, PHP-API, NotScanned, ext:backend
@@ -0,0 +1,121 @@
+.. include:: /Includes.rst.txt
+
+.. _deprecation-109519-1775665165:
+
+=============================================================
+Deprecation: #109519 - BackendUtility item list label methods
+=============================================================
+
+See :issue:`109519`
+
+Description
+===========
+
+The following methods in
+:php:`\TYPO3\CMS\Backend\Utility\BackendUtility` have been deprecated:
+
+- :php:`getLabelFromItemlist()`
+- :php:`getLabelFromItemListMerged()`
+- :php:`getLabelsFromItemsList()`
+
+Their logic has been moved to the new
+:php:`\TYPO3\CMS\Core\Schema\SchemaLabelResolver` class, which
+provides proper dependency injection support.
+
+Impact
+======
+
+Calling these methods will trigger a PHP :php:`E_USER_DEPRECATED`
+error. The methods will be removed in TYPO3 v15.0.
+
+Affected installations
+======================
+
+TYPO3 installations with extensions that call
+:php:`BackendUtility::getLabelFromItemlist()`,
+:php:`BackendUtility::getLabelFromItemListMerged()` or
+:php:`BackendUtility::getLabelsFromItemsList()`.
+
+Migration
+=========
+
+Replace calls to :php:`\TYPO3\CMS\Backend\Utility\BackendUtility::getLabelFromItemlist()`
+with :php:`\TYPO3\CMS\Core\Schema\SchemaLabelResolver->getLabelForFieldValue()`.
+
+Before:
+
+.. code-block:: php
+
+    use TYPO3\CMS\Backend\Utility\BackendUtility;
+
+    $label = BackendUtility::getLabelFromItemlist(
+        $table, $column, $value, $row
+    );
+
+After:
+
+.. code-block:: php
+
+    use TYPO3\CMS\Core\Schema\SchemaLabelResolver;
+
+    $label = $this->schemaLabelResolver->getLabelForFieldValue(
+        $table, $column, $value, $row
+    );
+
+Replace calls to :php:`\TYPO3\CMS\Backend\Utility\BackendUtility::getLabelFromItemListMerged()`
+with :php:`\TYPO3\CMS\Core\Schema\SchemaLabelResolver->getLabelForFieldValue()`.
+
+Before:
+
+.. code-block:: php
+
+    use TYPO3\CMS\Backend\Utility\BackendUtility;
+
+    $label = BackendUtility::getLabelFromItemListMerged(
+        $pageId, $table, $column, $value, $row
+    );
+
+After:
+
+.. code-block:: php
+
+    use TYPO3\CMS\Backend\Utility\BackendUtility;
+    use TYPO3\CMS\Core\Schema\SchemaLabelResolver;
+
+    $columnTsConfig = BackendUtility::getPagesTSconfig($pageId)
+        ['TCEFORM.'][$table . '.'][$column . '.'] ?? [];
+    $label = $this->schemaLabelResolver->getLabelForFieldValue(
+        $table, $column, $value, $row, $columnTsConfig
+    );
+
+Replace calls to :php:`BackendUtility::getLabelsFromItemsList()`
+with :php:`\TYPO3\CMS\Core\Schema\SchemaLabelResolver->getLabelsForFieldValues()`.
+Note that the new method returns an array of raw labels instead of a
+comma-separated translated string — callers must handle translation
+and joining themselves.
+
+Before:
+
+.. code-block:: php
+
+    use TYPO3\CMS\Backend\Utility\BackendUtility;
+
+    $labels = BackendUtility::getLabelsFromItemsList(
+        $table, $column, $keyList, $columnTsConfig, $row
+    );
+
+After:
+
+.. code-block:: php
+
+    use TYPO3\CMS\Core\Schema\SchemaLabelResolver;
+
+    $labels = $this->schemaLabelResolver->getLabelsForFieldValues(
+        $table, $column, $keyList, $row, $columnTsConfig
+    );
+    $translatedLabels = implode(
+        ', ',
+        array_map($languageService->sL(...), $labels)
+    );
+
+.. index:: PHP-API, FullyScanned, ext:backend
@@ -0,0 +1,64 @@
+..  include:: /Includes.rst.txt
+
+..  _deprecation-109523-1775680564:
+
+==============================================================================
+Deprecation: #109523 - GeneralUtility::isOnCurrentHost() without PSR-7 request
+==============================================================================
+
+See :issue:`109523`
+
+Description
+===========
+
+Calling :php:`\TYPO3\CMS\Core\Utility\GeneralUtility::isOnCurrentHost()` without
+providing a PSR-7 :php:`\Psr\Http\Message\ServerRequestInterface` as the
+second argument is deprecated.
+
+The method previously resolved the current host via
+:php:`\TYPO3\CMS\Core\Utility\GeneralUtility::getIndpEnv()`,
+which hides an implicit dependency on server globals. The method signature has been
+extended to accept an explicit PSR-7 request object, which should be passed instead.
+
+Impact
+======
+
+A PHP :php:`E_USER_DEPRECATED` error is triggered when
+:php:`\TYPO3\CMS\Core\Utility\GeneralUtility::isOnCurrentHost()` is called without a
+:php-short:`\Psr\Http\Message\ServerRequestInterface` argument.
+
+Affected installations
+======================
+
+All installations with third-party extensions that call
+:php:`\TYPO3\CMS\Core\Utility\GeneralUtility::isOnCurrentHost()` with
+only one argument.
+
+Migration
+=========
+
+Pass the current PSR-7 request as the second argument to
+:php:`\TYPO3\CMS\Core\Utility\GeneralUtility::isOnCurrentHost()`.
+
+Before:
+
+..  code-block:: php
+
+    use TYPO3\CMS\Core\Utility\GeneralUtility;
+
+    $isOnCurrentHost = GeneralUtility::isOnCurrentHost($url);
+
+After:
+
+..  code-block:: php
+
+    use Psr\Http\Message\ServerRequestInterface;
+    use TYPO3\CMS\Core\Utility\GeneralUtility;
+
+    $isOnCurrentHost = GeneralUtility::isOnCurrentHost($url, $request);
+
+The PSR-7 request is available in various places, for example as an argument
+in controller actions, via :php:`$GLOBALS['TYPO3_REQUEST']` in legacy contexts,
+and via :php-short:`\Psr\Http\Message\ServerRequestInterface` method parameters.
+
+..  index:: PHP-API, FullyScanned, ext:core
@@ -0,0 +1,71 @@
+..  include:: /Includes.rst.txt
+
+..  _deprecation-109529-1775733107:
+
+==========================================================
+Deprecation: #109529 - Page module section markup events
+==========================================================
+
+See :issue:`109529`
+
+Description
+===========
+
+The PSR-14 events that allow listeners to inject HTML before or after
+content elements have been rendered inside a backend layout column have been
+deprecated and will be removed in TYPO3 v15.0:
+
+*   :php:`\TYPO3\CMS\Backend\View\Event\BeforeSectionMarkupGeneratedEvent`
+*   :php:`\TYPO3\CMS\Backend\View\Event\AfterSectionMarkupGeneratedEvent`
+*   :php:`\TYPO3\CMS\Backend\View\Event\AbstractSectionMarkupGeneratedEvent`
+
+The accompanying methods :php:`GridColumn::getBeforeSectionMarkup()` and
+:php:`GridColumn::getAfterSectionMarkup()` have also been deprecated.
+
+These events were introduced in TYPO3 v10.3 alongside the legacy
+:php:`PageLayoutView` class to enrich backend layout columns with custom
+markup. They expose raw HTML strings as a column-level extension point
+and force every refactoring of the page module to keep emitting that
+markup at exactly the same position in the DOM. This makes it impossible
+to keep them stable across versions while improving the page module:
+ongoing work to rebuild the page module and its drag, drop and paste
+behavior cannot proceed without locking the column's internal structure
+to whatever the events happened to assume. Removing the events is a
+prerequisite for that work.
+
+The only listener that still consumed the event in the core,
+:php:`PageLayoutViewDrawEmptyColposContent`, has been removed. Its job —
+showing a placeholder block for backend layout cells that do not have a
+configured :php:`colPos` — is now performed in the Fluid template
+:file:`PageLayout/Grid/Column.fluid.html` via an :php:`{column.unassigned}`
+condition. No extension action is required for this case.
+
+Impact
+======
+
+Calling
+:php:`\TYPO3\CMS\Backend\View\Event\AbstractSectionMarkupGeneratedEvent::setContent()`
+from a listener will trigger a deprecation-level log entry. The classes and the
+two :php:`GridColumn` getters will be removed in TYPO3 v15.0.
+
+Existing listeners will keep functioning in TYPO3 v14: the dispatch sites
+in :php:`GridColumn` still fire the events and the Fluid partials still
+render the resulting :php:`{column.beforeSectionMarkup}` and
+:php:`{column.afterSectionMarkup}` strings.
+
+Affected installations
+======================
+
+Instances and extensions that register a PSR-14 listener on
+:php-short:`\TYPO3\CMS\Backend\View\Event\BeforeSectionMarkupGeneratedEvent` or
+:php-short:`\TYPO3\CMS\Backend\View\Event\AfterSectionMarkupGeneratedEvent`, or that call
+:php:`GridColumn::getBeforeSectionMarkup()` /
+:php:`GridColumn::getAfterSectionMarkup()`.
+
+Migration
+=========
+
+There is no direct replacement. Listeners that decorated backend layout
+columns through these events should be removed.
+
+..  index:: Backend, PHP-API, NotScanned, ext:backend
@@ -0,0 +1,51 @@
+.. include:: /Includes.rst.txt
+
+.. _deprecation-109544-1775761298:
+
+=============================================================================
+Deprecation: #109544 - GeneralUtility::sanitizeLocalUrl() needs PSR-7 request
+=============================================================================
+
+See :issue:`109544`
+
+Description
+===========
+
+Calling :php:`\TYPO3\CMS\Core\Utility\GeneralUtility::sanitizeLocalUrl()` without
+passing the current PSR-7 request as the second argument is deprecated. The method
+previously resolved host and site information via
+:php:`\TYPO3\CMS\Core\Utility\GeneralUtility::getIndpEnv()`, which falls back to server superglobals.
+Passing the request explicitly allows the method to read this information from
+:php:`\TYPO3\CMS\Core\Http\NormalizedParams` instead.
+
+
+Impact
+======
+
+Calling :php:`\TYPO3\CMS\Core\Utility\GeneralUtility::sanitizeLocalUrl()`
+with only one argument triggers a PHP :php:`E_USER_DEPRECATED` error.
+
+
+Affected installations
+======================
+
+All installations that call
+:php:`\TYPO3\CMS\Core\Utility\GeneralUtility::sanitizeLocalUrl()` without
+passing a :php:`\Psr\Http\Message\ServerRequestInterface` as the second argument.
+
+The extension scanner will detect affected usages as a strong match.
+
+
+Migration
+=========
+
+Pass the current PSR-7 request as the second argument:
+
+..  code-block:: diff
+
+    use TYPO3\CMS\Core\Utility\GeneralUtility;
+
+    - $url = GeneralUtility::sanitizeLocalUrl($url);
+    + $url = GeneralUtility::sanitizeLocalUrl($url, $request);
+
+.. index:: PHP-API, FullyScanned, ext:core
@@ -0,0 +1,56 @@
+..  include:: /Includes.rst.txt
+
+..  _deprecation-109548-1775851081:
+
+================================================================================
+Deprecation: #109548 - GeneralUtility::locationHeaderUrl() without PSR-7 request
+================================================================================
+
+See :issue:`109548`
+
+Description
+===========
+
+Calling :php:`\TYPO3\CMS\Core\Utility\GeneralUtility::locationHeaderUrl()` without
+providing a PSR-7 :php:`\Psr\Http\Message\ServerRequestInterface` as the second argument is deprecated.
+
+The method previously resolved the current host and request directory via
+:php:`\TYPO3\CMS\Core\Utility\GeneralUtility::getIndpEnv()`, which
+hides an implicit dependency on server globals. The method signature has been
+extended to accept an explicit PSR-7 request object, which should be passed instead.
+
+Impact
+======
+
+A PHP :php:`E_USER_DEPRECATED` error is triggered when
+:php:`\TYPO3\CMS\Core\Utility\GeneralUtility::locationHeaderUrl()` is called
+without a :php-short:`\Psr\Http\Message\ServerRequestInterface` argument.
+
+Affected installations
+======================
+
+All installations that call
+:php:`\TYPO3\CMS\Core\Utility\GeneralUtility::locationHeaderUrl()` without
+passing :php-short:`\Psr\Http\Message\ServerRequestInterface` as the second argument.
+
+The extension scanner will detect affected usages as a strong match.
+
+Migration
+=========
+
+Pass the current PSR-7 request as the second argument to
+:php:`\TYPO3\CMS\Core\Utility\GeneralUtility::locationHeaderUrl()`.
+
+..  code-block:: diff
+
+    use TYPO3\CMS\Core\Utility\GeneralUtility;
+    + use Psr\Http\Message\ServerRequestInterface;
+
+    - $url = GeneralUtility::locationHeaderUrl($path);
+    + $url = GeneralUtility::locationHeaderUrl($path, $request);
+
+The PSR-7 request is available in various places, for example as an argument
+in controller actions, via :php:`$GLOBALS['TYPO3_REQUEST']` in legacy contexts,
+and via :php-short:`\Psr\Http\Message\ServerRequestInterface` method parameters.
+
+..  index:: PHP-API, FullyScanned, ext:core
@@ -0,0 +1,62 @@
+..  include:: /Includes.rst.txt
+
+..  _deprecation-109551-1775924599:
+
+=======================================================
+Deprecation: #109551 - GeneralUtility::getIndpEnv()
+=======================================================
+
+See :issue:`109551`
+
+Description
+===========
+
+Method :php:`\TYPO3\CMS\Core\Utility\GeneralUtility::getIndpEnv()` has been deprecated.
+
+The method abstracts server environment variables and was used to obtain request-related
+data from PHP superglobals, such as the current host, URI, and site path. This information is
+reliably available via :php:`\TYPO3\CMS\Core\Http\NormalizedParams`, which is attached
+as an attribute to the PSR-7 request.
+
+
+Impact
+======
+
+Calling :php:`\TYPO3\CMS\Core\Utility\GeneralUtility::getIndpEnv()` triggers
+a PHP :php:`E_USER_DEPRECATED` error.
+
+
+Affected installations
+======================
+
+All installations that call
+:php:`\TYPO3\CMS\Core\Utility\GeneralUtility::getIndpEnv()` directly.
+
+The extension scanner will detect affected usages as a strong match.
+
+
+Migration
+=========
+
+Replace calls to :php:`\TYPO3\CMS\Core\Utility\GeneralUtility::getIndpEnv()` with the corresponding
+:php:`\TYPO3\CMS\Core\Http\NormalizedParams` getter. A
+:php-short:`\TYPO3\CMS\Core\Http\NormalizedParams` instance is available as an attribute of the PSR-7
+request:
+
+..  code-block:: php
+
+    // Before
+    use TYPO3\CMS\Core\Utility\GeneralUtility;
+
+    $siteUrl = GeneralUtility::getIndpEnv('TYPO3_SITE_URL');
+    $host = GeneralUtility::getIndpEnv('HTTP_HOST');
+
+    // After
+    use TYPO3\CMS\Core\Http\NormalizedParams;
+
+    /** @var NormalizedParams $normalizedParams */
+    $normalizedParams = $request->getAttribute('normalizedParams');
+    $siteUrl = $normalizedParams->getSiteUrl();
+    $host = $normalizedParams->getHttpHost();
+
+..  index:: PHP-API, FullyScanned, ext:core
@@ -0,0 +1,170 @@
+..  include:: /Includes.rst.txt
+
+..  _deprecation-109575:
+
+=======================================================================
+Deprecation: #109575 - Various ContentObjectRenderer properties/methods
+=======================================================================
+
+See :issue:`109575`
+
+Description
+===========
+
+Several properties and a methods of
+:php:`\TYPO3\CMS\Frontend\ContentObject\ContentObjectRenderer` have been
+deprecated.
+
+
+Properties
+----------
+
+:php:`ContentObjectRenderer->$lastTypoLinkResult`
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The property held the :php:`\TYPO3\CMS\Frontend\Typolink\LinkResultInterface`
+produced by the most recent :php:`createLink()` call. Relying on a
+side-effect property that is overwritten on every subsequent link call is
+fragile. Use the return value of :php:`createLink()` directly instead.
+
+
+:php:`ContentObjectRenderer->$currentRecordNumber` and :php:`ContentObjectRenderer->$parentRecordNumber`
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+These counters are incremented by :php:`ContentContentObject` and
+:php:`RecordsContentObject` while iterating over their record sets, and
+exposed to TypoScript via :typoscript:`getData cobj:parentRecordNumber`.
+They carry no known use case for third-party extensions and are
+deprecated.
+
+
+:php:`ContentObjectRenderer->$checkPid_badDoktypeList`
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The property was intended to cache a comma-separated list of page
+doctypes that should be excluded from link target checks, but it was
+never written to or read from any code path in TYPO3 itself.
+
+
+Methods
+-------
+
+:php:`ContentObjectRenderer->readFlexformIntoConf()`
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The method parses a FlexForm XML string or array into a flat TypoScript
+configuration array. It only covered the ``sDEF`` sheet and had no
+equivalent in TYPO3 core itself. Use
+:php:`\TYPO3\CMS\Core\Configuration\FlexForm\FlexFormTools::convertFlexFormContentToArray()`
+to decode FlexForm data, and map the result into your own configuration
+structure as needed.
+
+
+TypoScript getData type
+-----------------------
+
+The :typoscript:`cobj:parentRecordNumber` type for the
+:ref:`getData <t3tsref:data-type-gettext-cobj>` function is deprecated.
+It returned the value of :php:`$parentRecordNumber`, which is now
+deprecated.
+
+
+:php:`ContentObjectRenderer->getRequest()` fallback to :php:`$GLOBALS['TYPO3_REQUEST']`
+----------------------------------------------------------------------------------------
+
+The :php:`getRequest()` method falls back to :php:`$GLOBALS['TYPO3_REQUEST']` when no request
+had been set via :php:`setRequest()` before. This fallback has been deprecated. Third-party code that
+instantiates :php:`ContentObjectRenderer` must call :php:`setRequest(ServerRequestInterface $request)`
+before calling :php:`start()` or any other method that requires the request.
+
+
+Impact
+======
+
+Accessing :php:`$lastTypoLinkResult` or
+:php:`$checkPid_badDoktypeList`, calling :php:`readFlexformIntoConf()`,
+evaluating the :typoscript:`cobj:parentRecordNumber` getData type, or
+triggering the :php:`$GLOBALS['TYPO3_REQUEST']` fallback in
+:php:`getRequest()` all raise :php:`E_USER_DEPRECATED` errors at runtime.
+The fallback will additionally throw an exception in TYPO3 v15 when no
+request has been set.
+
+:php:`$currentRecordNumber` and :php:`$parentRecordNumber` carry only a
+docblock :php:`@deprecated` annotation for now — they remain functional
+and do not raise runtime errors.
+
+
+Affected installations
+======================
+
+Installations with extensions that:
+
+* Read :php:`$cObj->lastTypoLinkResult` after calling :php:`createLink()`
+* Read :php:`$currentRecordNumber`, :php:`$parentRecordNumber`, or
+  :php:`$checkPid_badDoktypeList`
+* Call :php:`$cObj->readFlexformIntoConf()`
+* Use the :typoscript:`cobj:parentRecordNumber` getData type in TypoScript;
+* Instantiate :php:`ContentObjectRenderer` without calling :php:`setRequest()` before :php:`start()`.
+
+The extension scanner detects usages of the deprecated properties as
+weak matches.
+
+
+Migration
+=========
+
+:php:`$lastTypoLinkResult`
+--------------------------
+
+Capture the return value of :php:`createLink()` directly:
+
+..  code-block:: php
+
+    // Before
+    $cObj->createLink($linkText, $conf);
+    $result = $cObj->lastTypoLinkResult;
+
+    // After
+    $result = $cObj->createLink($linkText, $conf);
+
+
+:php:`setRequest()` before :php:`start()`
+-----------------------------------------
+
+Call :php:`setRequest()` immediately after instantiation, before any other method:
+
+..  code-block:: php
+
+    // Before
+    $cObj = GeneralUtility::makeInstance(ContentObjectRenderer::class);
+    $cObj->start($data, $table);
+
+    // After
+    $cObj = GeneralUtility::makeInstance(ContentObjectRenderer::class);
+    $cObj->setRequest($request);
+    $cObj->start($data, $table);
+
+
+:php:`readFlexformIntoConf()`
+----------------------------
+
+Replace with :php:`FlexFormTools::convertFlexFormContentToArray()` and
+map the decoded array into the configuration structure as needed:
+
+..  code-block:: php
+
+    // Before
+    $conf = [];
+    $cObj->readFlexformIntoConf($flexFormXml, $conf);
+
+    // After
+    $conf = $this->flexFormTools->convertFlexFormContentToArray($flexFormXml);
+
+
+All other deprecated items
+--------------------------
+
+Remove all usages. None of the remaining deprecated properties, nor
+:typoscript:`cobj:parentRecordNumber` getData type have a replacement.
+
+..  index:: PHP-API, TypoScript, PartiallyScanned, ext:frontend
@@ -0,0 +1,49 @@
+..  include:: /Includes.rst.txt
+
+..  _important-109107-1772108218:
+
+=======================================================================
+Important: #109107 - Cache action endpoints should return JSON response
+=======================================================================
+
+See :issue:`109107`
+
+Description
+===========
+
+AJAX endpoints registered as custom cache actions via
+:php:`\TYPO3\CMS\Backend\Backend\Event\ModifyClearCacheActionsEvent` should
+return a JSON response containing :php:`success`, :php:`title`, and
+:php:`message` fields.
+
+The clear-cache toolbar now treats a missing or non-:php:`false` :php:`success`
+value as a successful operation and falls back to generic notification labels
+when :php:`title` or :php:`message` are absent. While this keeps older
+endpoints working without changes, providing explicit values gives users
+meaningful, context-specific feedback and ensures error conditions are surfaced
+correctly.
+
+..  hint::
+
+    Update any custom cache action endpoint to return a structured JSON
+    response:
+
+    .. code-block:: php
+
+       use TYPO3\CMS\Core\Http\JsonResponse;
+
+       // Success
+       return new JsonResponse([
+           'success' => true,
+           'title'   => $languageService->sL('myext.locallang:notification.success.title'),
+           'message' => $languageService->sL('myext.locallang:notification.success.message'),
+       ]);
+
+       // Failure
+       return new JsonResponse([
+           'success' => false,
+           'title'   => $languageService->sL('myext.locallang:notification.error.title'),
+           'message' => $languageService->sL('myext.locallang:notification.error.message'),
+       ]);
+
+..  index:: Backend, PHP-API, ext:backend, NotScanned
@@ -0,0 +1,129 @@
+..  include:: /Includes.rst.txt
+
+..  _important-109517-1744105200:
+
+==================================================================
+Important: #109517 - Setup extension merged into backend extension
+==================================================================
+
+See :issue:`109517`
+
+Description
+===========
+
+The system extension `setup` (`typo3/cms-setup`) existed for historical reasons
+as a separate package. It provided the "User Settings" backend module, where users
+could change their password, name, email, language, avatar and other personal
+preferences.
+
+In modern web applications a user profile module should never be optional, so
+the extension has been fully merged into the `backend` extension
+(`typo3/cms-backend`). The module is now always available when the backend is
+installed and can still be hidden for individual users via user TSconfig. The
+separate package is no longer needed and should not be referenced in new
+installations.
+
+For Composer-based installations
+--------------------------------
+
+The Composer package `typo3/cms-backend` now **replaces** `typo3/cms-setup`.
+This means:
+
+*   There is no need to require `typo3/cms-setup` in :file:`composer.json`
+    anymore. Existing references are resolved automatically because
+    `typo3/cms-backend` declares that it replaces the package.
+*   No manual action is required during an upgrade – Composer handles the
+    replacement transparently.
+*   New projects should **not** add `typo3/cms-setup` as a dependency.
+
+For class-based references
+--------------------------
+
+The following public classes have been moved and class aliases are in place for
+backwards compatibility:
+
+*   :php:`TYPO3\CMS\Setup\Event\AddJavaScriptModulesEvent`
+    → :php:`TYPO3\CMS\Backend\Event\AddUserSettingsJavaScriptModulesEvent`
+*   :php:`TYPO3\CMS\Setup\Form\Element\AvatarElement`
+    → :php:`TYPO3\CMS\Backend\Form\Element\AvatarElement`
+*   :php:`TYPO3\CMS\Setup\UserFunctions\UserSettingsItemsProcFunc`
+    → :php:`TYPO3\CMS\Backend\UserFunctions\UserSettingsItemsProcFunc`
+
+Extensions using the old class names will continue to work, but should be
+updated to the new namespaces.
+
+.. _important-109517-1744105200-AddJavaScriptModulesEvent:
+
+Moved event `AddJavaScriptModulesEvent`
+---------------------------------------
+
+A special case is :php:`TYPO3\CMS\Setup\Event\AddJavaScriptModulesEvent`. This file
+has been moved to :file:`typo3/sysext/backend/DeprecatedClasses/Setup/Event/AddJavaScriptModulesEvent.php`
+and is added as a specific PSR-4 autoload entry to the Core's :file:`composer.json`
+map, so that the legacy event can be dispatched properly. No deprecation
+message is emitted when dispatching this legacy event.
+
+In addition, a new event :php:`TYPO3\CMS\Backend\Event\AddUserSettingsJavaScriptModulesEvent`
+has been added with a distinguishing name. Both events are dispatched in TYPO3 v14,
+with the legacy event being deprecated and removed in TYPO3 v15
+(see :ref:`deprecation-109517-1744105201`).
+
+Extensions providing compatibility to two versions should proceed as below:
+
+.. _important-109517-1744105200-AddJavaScriptModulesEvent-v13:
+
+For compatibility with TYPO3 v13 and v14
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Only listen to the legacy event :php:`TYPO3\CMS\Setup\Event\AddJavaScriptModulesEvent`:
+
+..  code-block:: php
+    :caption: EXT:my_extension/Classes/Listener/SetupModuleListener.php
+    :emphasize-lines: 7,12
+
+    <?php
+    declare(strict_types=1);
+
+    namespace MyExtension\Listener;
+
+    use TYPO3\CMS\Core\Attribute\AsEventListener;
+    use TYPO3\CMS\Setup\Event\AddJavaScriptModulesEvent;
+
+    final class SetupModuleListener
+    {
+        #[AsEventListener('my-extension/setup-module-listener')]
+        public function __invoke(AddJavaScriptModulesEvent $event): void
+        {
+            $event->addJavaScriptModule('@my-extension/setupModule/some-file.js');
+        }
+    }
+
+.. _important-109517-1744105200-AddJavaScriptModulesEvent-v14:
+
+For compatibility with TYPO3 v14 and v15
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Only listen to the new event :php:`TYPO3\CMS\Backend\Event\AddUserSettingsJavaScriptModulesEvent`:
+
+..  code-block:: php
+    :caption: EXT:my_extension/Classes/Listener/SetupModuleListener.php
+    :emphasize-lines: 6,12
+
+    <?php
+    declare(strict_types=1);
+
+    namespace MyExtension\Listener;
+
+    use TYPO3\CMS\Backend\Event\AddUserSettingsJavaScriptModulesEvent;
+    use TYPO3\CMS\Core\Attribute\AsEventListener;
+
+    final class SetupModuleListener
+    {
+        #[AsEventListener('my-extension/setup-module-listener')]
+        public function __invoke(AddUserSettingsJavaScriptModulesEvent $event): void
+        {
+            $event->addJavaScriptModule('@my-extension/setupModule/some-file.js');
+        }
+    }
+
+..  index:: Backend, PHP-API, ext:backend, NotScanned
@@ -0,0 +1,34 @@
+..  include:: /Includes.rst.txt
+
+..  _important-109585-1776329549:
+
+====================================================================
+Important: #109585 - Serialized Credential Data in be_users settings
+====================================================================
+
+See :issue:`109585`
+
+Description
+===========
+
+The new mechanism of using serialized JSON data for storing
+backend user settings since TYPO3 14.2 has introduced a vulnerability
+that stored the "password" and "verify password" input data
+when changing a user's password inside the serialized user
+settings representation.
+
+These passwords are no longer stored in the database columns
+:sql:`be_users.uc` and :sql:`be_users.user_settings` anymore,
+but may exist in database records during the period where
+TYPO3 v14.2 was used.
+
+An upgrade wizard has been added that will remove these credentials
+from the serialized representation.
+
+This upgrade wizard will detect possible records that contain
+the string `"password` or `:"password` and then unserialize
+the data, remove the two fields and re-serialize the data. It
+is important to execute this wizard for safety. If the wizard
+does not show up, no serialized credential data is found.
+
+..  index:: Backend, PHP-API, ext:backend, NotScanned
@@ -0,0 +1,55 @@
+:template: changelogOverview.html
+
+..  include:: /Includes.rst.txt
+..  _changelog-14-3:
+
+============
+14.3 Changes
+============
+
+**Table of contents**
+
+..  contents::
+    :local:
+    :depth: 1
+
+Breaking Changes
+================
+
+None since TYPO3 v14.0 release.
+
+..  attention::
+
+    After TYPO3 v14.0, only new functionality with a solid migration path
+    can be added on top, with aiming for as little as possible breaking changes
+    after the initial v14.0 release on the way to LTS.
+
+Features
+========
+
+..  toctree::
+    :maxdepth: 1
+    :titlesonly:
+    :glob:
+
+    Feature-*
+
+Deprecation
+===========
+
+..  toctree::
+    :maxdepth: 1
+    :titlesonly:
+    :glob:
+
+    Deprecation-*
+
+Important
+=========
+
+..  toctree::
+    :maxdepth: 1
+    :titlesonly:
+    :glob:
+
+    Important-*