Dependencies and security status

Note

This page translates the dependency report recorded on 9 October 2026. Its source is the unchanged German report at commit 7a3a39b. Historical findings are bound to its recorded package revisions. The separate current-resolution section below records the new audit; the translated historical report is preserved after that section.

Current patched Core resolution

On 9 October 2026, TYPO3 released 13.4.36 and 14.3.8. Both releases require enshrined/svg-sanitize 1.0.0, which fixes the three recorded SVG advisories. These patches are now the minimum Core versions in ^13.4.36 || ^14.3.8; compatible updates remain installable. The extension does not alias, replace or modify the framework's sanitizer dependency.

The pre-semantic-range review snapshot resolved full Core/Backend/Frontend/Fluid graphs for both patches with Guzzle 7.15.5 / Promises 2.5.3 / PSR7 2.13.1 and Guzzle 8.2.0 / Promises 3.0.2 / PSR7 3.1.0. All four graphs selected sanitizer 1.0.0, and their vulnerability audits reported zero advisory findings. Composer's advisory blocking remains enabled; active preparation and CI contain no ignored advisory IDs.

The security workflow resolves two isolated production dependency graphs from the actual root manifest, one for each supported Core major. Its preflight checks verify supported ranges and fixture consistency before matrix overrides. After resolution, the installed runtime check validates the actual Core parent API and the supported SDK minima, majors and capabilities before generating a CycloneDX SBOM. Each Core job preserves its own manifest, lock, SBOM and audit JSON. The audit fails on any vulnerability advisory or an unavailable audit service; abandoned-package metadata is reported separately. The recorded main run 37964357280 passes both production-graph jobs at e2e125f. This is a source-bound remote execution; later edits require new applicable checks before merge.

Core 13 still requires the abandoned upstream package doctrine/annotations and no replacement is declared. Its default Composer audit exits 1 solely for this maintenance warning. The explicit --abandoned=report policy preserves the warning and fails on any vulnerability advisory. Both Core 14 graphs also pass the default audit with exit 0. This distinction keeps maintenance status separate from known vulnerabilities; it does not certify the dependency graph for all uses.

Both official classic distributions now bundle Guzzle 8.2.0 / Promises 3.0.2 / PSR7 3.1.0 and sanitizer 1.0.0. Their tarball SHA256 values are verified against the official release notes. RequestFactory and GuzzleClientFactory sources are byte-identical to the previous Core patches; actual patched-Core runtime results are recorded in Patched Core snapshot before semantic ranges.

Active fixture manifests live under Build/Fixtures/. The original twelve manifests and twelve lock files remain byte-for-byte in the historical archive records and verified external source archive, with original-path and SHA256 mappings. They describe historical runs and are never active installation inputs. Historical audit output and Git history remain unchanged.

Historical Composer resolution

The recorded security core accepted three complete exact combinations before the semantic-range correction:

Guzzle 7.15.3 / Promises 2.5.2 / PSR-7 2.13.0, from the then-official classic Core archives.
Guzzle 7.15.5 / Promises 2.5.3 / PSR-7 2.13.1.
Guzzle 8.2.0 / Promises 3.0.2 / PSR-7 3.1.0.

There is no additional production package for the core. In addition to the Composer constraints, that historical runtime rejected unknown or mixed combinations before native send. The current semantic contract is described in Requirements and Semantic support and recorded proof. Minimal test locks are resolved with PHP 8.2 platform requirements; higher PHP versions do not replace checking the lower bound.

The recorded extension limited Core to 13.4.35 or 14.3.7. These Core versions were tested in four Composer bootstrap/RequestFactory instances and in their official complete classic distributions. The mapping accounts for complete distributions reporting typo3/cms, rather than typo3/cms-core, in the InstalledVersions catalogue. The extension therefore determines the Core revision through the actual TYPO3 version. The Vault patch applies to the base commit named in its manifest and adds no mandatory guard dependency to the existing project.

The recorded TYPO3/Vault test resolution contains enshrined/svg-sanitize 0.22.0 with three audit findings published on 8 October 2026: CVE-2026-107379, CVE-2026-107380 and CVE-2026-107381. The complete audit also lists the abandoned development tool symplify/rule-doc-generator-contracts. These findings are not new guard dependencies. The audit remains part of the recorded delivery; production acceptance of the affected complete dependency resolution is outstanding.

For the recorded isolated Core test instances, the three specific SVG advisory IDs were excepted during installation. These instances process no SVGs. The delivery's production manifests contain no such exceptions. The exception enables integration tests; it does not demonstrate safe SVG processing. At that revision, deployment acceptance required fixing or assessing the affected framework dependency against its actual use. The primary advisory sources are DTD crash, stored XSS and resolver denial of service.

libcurl and operating system

Multi-address pinning has a functional lower bound of libcurl 7.59.0, derived from the official CURLOPT_RESOLVE documentation. The software cannot determine from a version string alone which security fixes a distributor has backported.

The recorded local Ubuntu 24.04 execution used libcurl 8.5.0 from package 8.5.0-2ubuntu10.15. That revision matches the Noble fix listed in USN-8820-1. The notice was published on 24 September 2026. Package and changelog records remain in the historical runtime-security evidence. This demonstrates that package revision; it does not replace a later check of all vendor advisories.

The recorded PHP test images contain a different build: Alpine 3.24.2 with libcurl 8.22.0 and package revision 8.22.0-r0. The curl page for 8.22.0 listed no published vulnerabilities at the time of the recorded check. The version-specific JSON file is preserved as a downloaded original. This does not establish a general claim about other libcurl, OpenSSL or operating-system builds. Images are recorded by digest and by the actual executed PHP, OS and curl data.

Updates

Compatible transport updates resolve within the semantic ranges without a new extension release. Keep the project lock and vendor security updates current. The fixed fixtures preserve source-bound regression evidence; four floating native Core 13/14 and Guzzle 7/8 rows resolve the latest compatible graphs in pull requests and weekly scheduled CI.

Changes to supported majors, minima, handler APIs, allowed options or policy permissions require source review and the applicable policy, wire, Core and mutation tests. Hidden native retries are fenced by the public single-use factory rather than a private SDK counter. A successful resolution alone does not prove safe transport behavior.

New address data is updated from the documented primary sources during development and release, checked and supplied as a versioned corpus. The request path does not download security lists from the Internet.

The historical twelve-cell kernel matrix and three audited fixture locks retain their recorded sources. Current preparation is under Build/Fixtures/. No test arrangement installs a second HTTP Guard production library; the operational manual belongs to the extension.