Deprecation: #100887 - Deprecation of useNonce argument in f:asset:css and f:asset:script view helpers 

Description 

The useNonce argument on the f:asset.script and f:asset.css ViewHelpers has been renamed to csp to better reflect its purpose (controlling Content-Security-Policy hash/nonce collection rather than nonce usage specifically).

Similarly, the 'useNonce' asset option key accepted by \TYPO3\CMS\Core\Page\AssetCollector::addJavaScript() and \TYPO3\CMS\Core\Page\AssetCollector::addStyleSheet() has been replaced by 'csp'.

Impact 

Passing useNonce as a ViewHelper argument or as an AssetCollector option key will trigger a deprecation-level log entry in TYPO3 v14. These usages are scheduled for removal in TYPO3 v15.

Affected installations 

Installations with Fluid templates using <f:asset.script useNonce="1"> or <f:asset.css useNonce="1">, and extensions calling AssetCollector::addJavaScript() or AssetCollector::addStyleSheet() with ['useNonce' => true].

Migration 

Replace the useNonce argument with csp in Fluid templates:

<!-- Before -->
<f:asset.script identifier="my-script"
    src="EXT:my_ext/Resources/Public/JavaScript/foo.js"
    useNonce="1" />

<!-- After -->
<f:asset.script identifier="my-script"
    src="EXT:my_ext/Resources/Public/JavaScript/foo.js"
    csp="1" />

Replace the 'useNonce' option key with 'csp' in PHP:

// Before
$assetCollector->addJavaScript('my-script', $src, [], ['useNonce' => true]);

// After
$assetCollector->addJavaScript('my-script', $src, [], ['csp' => true]);

The PageRenderer methods addJsInlineCode(), addJsFooterInlineCode(), and addCssInlineBlock() retain their $useNonce parameter names for backward compatibility; no migration is required for callers of these methods.