---
title: "Dependencies and security status"
manual: "HTTP Guard"
version: "main"
permalink: "https://docs.typo3.org/permalink/netresearch/nr-http-guard:dependency-report@main"
source: "Development/Dependencies.rst"
rendered: "2026-10-18T14:31:38+00:00"
---

# Dependencies and security status {#dependency-report}

> [!NOTE]
> This page translates the dependency report recorded on 9 October 2026.
> Its source is the unchanged
> [German report at commit 7a3a39b](https://github.com/netresearch/typo3_http_guard/blob/7a3a39bbaa763eb876ff4c9cdc743b689c557590/docs/Abhaengigkeiten.md).
> Historical findings are bound to its recorded package revisions.
> The separate current-resolution section below records the new audit;
> the translated historical report is preserved after that section.

## Current patched Core resolution {#dependency-report-current}

On 9 October 2026, TYPO3 released
[13.4.36](https://get.typo3.org/release-notes/13.4.36) and
[14.3.8](https://get.typo3.org/release-notes/14.3.8). Both releases require
`enshrined/svg-sanitize` **1.0.0**, which fixes the three recorded
SVG advisories. These patches are now the minimum Core versions in
`^13.4.36 || ^14.3.8`; compatible updates remain installable.
The extension does not alias, replace or modify the framework's sanitizer
dependency.

The pre-semantic-range review snapshot resolved full
Core/Backend/Frontend/Fluid graphs for both patches with Guzzle 7.15.5 /
Promises 2.5.3 / PSR7 2.13.1 and Guzzle 8.2.0 / Promises 3.0.2 / PSR7 3.1.0.
All four graphs selected sanitizer 1.0.0, and their vulnerability audits
reported **zero advisory findings**. Composer's advisory blocking
remains enabled; active preparation and CI contain no ignored advisory IDs.

The security workflow resolves two isolated production dependency graphs
from the actual root manifest, one for each supported Core major. Its
preflight checks verify supported ranges and fixture consistency before
matrix overrides. After resolution, the installed runtime check validates
the actual Core parent API and the supported SDK minima, majors and
capabilities before generating a CycloneDX SBOM. Each Core job preserves its own manifest,
lock, SBOM and audit JSON. The audit fails on any vulnerability advisory or
an unavailable audit service; abandoned-package metadata is reported
separately. The recorded main run
[37964357280](https://github.com/netresearch/typo3_http_guard/actions/runs/37964357280)
passes both production-graph jobs at `e2e125f`. This is a source-bound
remote execution; later edits require new applicable checks before merge.

Core 13 still requires the abandoned upstream package
`doctrine/annotations` and no replacement is declared. Its default
Composer audit exits 1 solely for this maintenance warning. The explicit
`--abandoned=report` policy preserves the warning and fails on any
vulnerability advisory. Both Core 14 graphs also pass the default audit
with exit 0. This distinction keeps maintenance status separate from known
vulnerabilities; it does not certify the dependency graph for all uses.

Both official classic distributions now bundle Guzzle 8.2.0 / Promises
3.0.2 / PSR7 3.1.0 and sanitizer 1.0.0. Their tarball SHA256 values are
verified against the official release notes. RequestFactory and
GuzzleClientFactory sources are byte-identical to the previous Core patches;
actual patched-Core runtime results are recorded in
[Patched Core snapshot before semantic ranges](https://docs.typo3.org/permalink/netresearch/nr-http-guard:verification-current-core@main).

Active fixture manifests live under `Build/Fixtures/`. The original
twelve manifests and twelve lock files remain byte-for-byte in the
[historical archive records](https://github.com/netresearch/typo3_http_guard/blob/3f929ae8794ca04ab3dd25627e94d601a2db23e0/evidence/packaging/composer-locks/README.md)
and verified external source archive, with original-path and SHA256 mappings.
They describe historical runs and are never active installation inputs.
Historical audit output and Git history remain unchanged.

## Historical Composer resolution {#dependency-report-composer}

The recorded security core accepted three complete exact combinations before
the semantic-range correction:

-   Guzzle 7.15.3 / Promises 2.5.2 / PSR-7 2.13.0, from the then-official
    classic Core archives.
-   Guzzle 7.15.5 / Promises 2.5.3 / PSR-7 2.13.1.
-   Guzzle 8.2.0 / Promises 3.0.2 / PSR-7 3.1.0.

There is no additional production package for the core. In addition to the
Composer constraints, that historical runtime rejected unknown or mixed
combinations before native send. The current semantic contract is described
in [Requirements](https://docs.typo3.org/permalink/netresearch/nr-http-guard:installation-requirements@main) and [Semantic support and recorded proof](https://docs.typo3.org/permalink/netresearch/nr-http-guard:verification-semantic-support@main). Minimal test locks are resolved with PHP 8.2 platform
requirements; higher PHP versions do not replace checking the lower bound.

The recorded extension limited Core to 13.4.35 or 14.3.7. These Core versions
were tested in four Composer bootstrap/RequestFactory instances and in
their official complete classic distributions. The mapping accounts for
complete distributions reporting `typo3/cms`, rather than
`typo3/cms-core`, in the InstalledVersions catalogue. The extension
therefore determines the Core revision through the actual TYPO3 version.
The Vault patch applies to the base commit named in its manifest and adds
no mandatory guard dependency to the existing project.

The recorded TYPO3/Vault test resolution contains
`enshrined/svg-sanitize` 0.22.0 with three audit findings published
on 8 October 2026: CVE-2026-107379, CVE-2026-107380 and CVE-2026-107381.
The complete audit also lists the abandoned development tool
`symplify/rule-doc-generator-contracts`. These findings are not new
guard dependencies. The audit remains part of the recorded delivery;
production acceptance of the affected complete dependency resolution is
outstanding.

For the recorded isolated Core test instances, the three specific SVG advisory
IDs were excepted during installation. These instances process no SVGs.
The delivery's production manifests contain no such exceptions. The
exception enables integration tests; it does not demonstrate safe SVG
processing. At that revision, deployment acceptance required fixing or
assessing the affected framework dependency against its actual use.
The primary advisory sources are
[DTD crash](https://github.com/advisories/GHSA-v383-3rw5-q8rf),
[stored XSS](https://github.com/advisories/GHSA-9rjx-3jch-6vjf)
and
[resolver denial of service](https://github.com/advisories/GHSA-m9xh-6747-9r6f).

## libcurl and operating system {#dependency-report-platform}

Multi-address pinning has a functional lower bound of libcurl 7.59.0,
derived from the
[official CURLOPT_RESOLVE documentation](https://curl.se/libcurl/c/CURLOPT_RESOLVE.html).
The software cannot determine from a version string alone which security
fixes a distributor has backported.

The recorded local Ubuntu 24.04 execution used libcurl 8.5.0 from package
`8.5.0-2ubuntu10.15`. That revision matches the Noble fix listed in
[USN-8820-1](https://ubuntu.com/security/notices/USN-8820-1).
The notice was published on 24 September 2026. Package and changelog
records remain in the [historical runtime-security evidence](https://github.com/netresearch/typo3_http_guard/blob/3f929ae8794ca04ab3dd25627e94d601a2db23e0/evidence/runtime-security/ubuntu-curl-changelog.txt).
This demonstrates that package revision; it does not replace a later check
of all vendor advisories.

The recorded PHP test images contain a different build: Alpine 3.24.2 with
libcurl 8.22.0 and package revision 8.22.0-r0. The
[curl page for 8.22.0](https://curl.se/docs/vuln-8.22.0.html)
listed no published vulnerabilities at the time of the recorded check.
The
[version-specific JSON file](https://curl.se/docs/vuln-8.22.0.json)
is preserved as a downloaded original. This does not establish a general
claim about other libcurl, OpenSSL or operating-system builds. Images are
recorded by digest and by the actual executed PHP, OS and curl data.

## Updates {#dependency-report-updates}

Compatible transport updates resolve within the semantic ranges without a
new extension release. Keep the project lock and vendor security updates
current. The fixed fixtures preserve source-bound regression evidence; four
floating native Core 13/14 and Guzzle 7/8 rows resolve the latest compatible
graphs in pull requests and weekly scheduled CI.

Changes to supported majors, minima, handler APIs, allowed options or policy
permissions require source review and the applicable policy, wire, Core and
mutation tests. Hidden native retries are fenced by the public single-use
factory rather than a private SDK counter. A successful resolution alone
does not prove safe transport behavior.

New address data is updated from the documented primary sources during
development and release, checked and supplied as a versioned corpus. The
request path does not download security lists from the Internet.

The historical [twelve-cell kernel matrix](https://github.com/netresearch/typo3_http_guard/blob/3f929ae8794ca04ab3dd25627e94d601a2db23e0/verification/evidence/extension-matrix/README.md)
and [three audited fixture locks](https://github.com/netresearch/typo3_http_guard/blob/3f929ae8794ca04ab3dd25627e94d601a2db23e0/verification/dependencies/combined-kernel/README.md)
retain their recorded sources. Current preparation is under
`Build/Fixtures/`. No test arrangement installs a second HTTP Guard
production library; the operational manual belongs to the extension.