GitHub (15 repos — all merged into main)

GitLab (6 repos — all merged into main)

Production DB refreshed (version-tracker recompute, 2026-04-22):

Upcoming automatic flip on 2026-04-30: 8 v12.4 projects will transition lts → elts when free maintenance ends. Re-run recompute to pick it up (no rescan needed).

Review findings applied

All bot-review findings (Gemini + Copilot) triaged and either fixed or skipped with rationale. Highlights:

• typo3-ddev-skill: fixed real integration bug — config.yaml and docker-compose.web.yaml were missing v14.{sitename} hostname and v14-data:/var/www/html/v14 volume. The install-v14 command would have succeeded but produced an unreachable + ephemeral installation.
• Cross-PR: dual v13+v14 PHP-attribute compatibility — the initial guidance (guard use statements with class_exists()) was technically wrong; attributes are declarative. Canonical polyfill-stub pattern now documented in typo3-conformance-skill/references/v13-v14-dual-compatibility.md and cross-referenced from typo3-extension-upgrade-skill and security-audit-skill.
• typo3-project-upgrade-skill: addUserSetting() belongs in ext_localconf.php (Setup-module API), not in Configuration/TCA/Overrides/be_users.php; fixed.
• typo3-conformance-skill: HashService replacement class canonicalized to TYPO3\CMS\Core\Crypto\HashService everywhere; addPlugin() + list_type → CType guidance corrected; grep regex escaping fixed.
• ~23 reviewer comments skipped as factually wrong — bots repeatedly claimed v14.3 cannot be the LTS (must be v14.4) and that PHP 8.5 / PHPUnit 12/13 don't exist. TYPO3 v14.3 LTS released 2026-04-21 per the official announcement; PHP 8.5 is shipped; PHPUnit 11.5.x / 12.3.x / 13.0.x all exist.

1. Platform requirements (v14.3)

Source: get.typo3.org/version/14.

DDEV is the canonical dev setup. Official quickstart:

ddev config --project-type=typo3 --docroot=public --webserver-type 'apache-fpm'
ddev composer create --no-install "typo3/cms-base-distribution:^14"
ddev composer install
ddev typo3 setup --server-type=apache --driver=mysqli --host=db --port=3306 --dbname=db --username=db --password=db

2. Dependency bumps (v13 → v14)

3. Breaking change map (v14.0 only — LTS freeze after that)

v14.0 has 98 breaking, 31 deprecation, 105 feature, 16 important changelog entries. v14.1, v14.2, v14.3 introduce zero breaking changes — only features + v15-preparation deprecations. That's the LTS promise in action.

The top categories to watch when upgrading an extension v13 → v14:

Frontend / TSFE collapse

• TypoScriptFrontendController class removed (#107831). $GLOBALS['TSFE'], $request->getAttribute('frontend.controller'), $contentObjectRenderer->getTypoScriptFrontendController() all gone. → Replace with $request->getAttribute('frontend.page.information') and PageRenderer::addHeaderData()/addFooterData().
• AfterCachedPageIsPersistedEvent no longer receives TSFE (#107831).
• _GET/_POST not reset to current request anymore (#108113).
• Global FE content link prefixing removed (#108114).
• CSS/JS concatenation + compression + comment stripping removed (#108055, #107944).
• HTTP response compression removed (#107943).
• AssetRenderer "external" property removed (#107927).

Fluid 5 (Breaking #108148)

• CDATA sections no longer stripped automatically.
• Variable names with leading _ forbidden.
• ViewHelpers must be strict-typed (typed args + return type).
• renderStatic() removed from AbstractViewHelper.
• Classes removed: Fluid\View\StandaloneView, TemplateView, AbstractTemplateView. → Use Core\View factories.
• Standalone overrideArgument + ViewHelperResolver helpers removed (#104223, #104463).

Extbase

• Docblock annotations namespace removed (#107229). PHP attributes only.
• Magic repository methods findByX/findOneByX/countByX removed (#105377). Use createQuery().
• Shorthand TYPO3.CMS.Extbase namespace removed.
• ValidatorInterface now requires setRequest()/getRequest() (#106056).
• PropertyMappingConfigurationInterface strong-typed (#101292).
• Argument uses strict types (#107777).
• config.tx_extbase.persistence.updateReferenceIndex toggle removed (#106041).
• Backend modules not in page context use only global TypoScript (#105728).

FAL / File handling (#106427, #107403, #107735)

• AbstractFile::getIdentifier()/setIdentifier() removed.
• rename()/copyTo()/moveTo() moved from AbstractFile to File.
• FolderInterface requires getSubFolder/getReadablePath/getFiles/searchFiles.
• FileNameValidator no longer accepts custom regex in __construct() (#105733).
• Folder->getSubFolder() throws FolderDoesNotExistException (#105920).
• Metadata extractor registration via registerExtractionService() removed (#107783). Implement MetadataExtractorInterface.
• Backend avatar provider registration via $GLOBALS removed (#107871). Use autoconfigure tag.
• LocalPreviewHelper + LocalCropScaleMaskHelper classes removed (#107403).
• sys_file_metadata field removal (#106503).

Cache (#107315)

• BackendInterface, PhpCapableBackendInterface, TransientBackendInterface, FrontendInterface strongly typed.
• AbstractBackend::__construct(array $options = []) (context parameter removed).
• FreezableBackendInterface removed (#107310).

TCA

• Plugin subtypes gone: subtype_value_field, subtypes_addlist, subtypes_excludelist (#105377).
• control.searchFields removed (#106972) — use configurable search TCA.
• control.is_static removed (#106863).
• eval=year removed (#98070).
• Value picker prepend/append modes removed (#107677).
• interface settings for list view removed (#106412).
• pages.url field removed (#17406) — use typolink page type.
• tt_content.list_type + tt_content.list gone — CType-only plugins (#105538).
• tt_content.imagewidth/imageheight now nullable (#68303).
• type=uuid uses Doctrine GUID type (#103141).
• Duplicate doktype restriction config removed (#106949).
• showitem strings use short-form references; core.form.tabs consolidated (#107789).
• Scheduler frequency moved to TCA (#107488) + DB storage format changed (#106532) + scheduler tasks become native TCA (#106739).

Backend / UI

• Modal migrated from Bootstrap to native <dialog> (#107443).
• "Database Relations" module removed (#97151).
• Reports interfaces removed; new native submodule overview (#107791).
• Button API reworked (#107884, #107823).
• DocHeader MetaInformation API deprecated (#107813).
• Backend layout data provider $GLOBALS registration removed (#107784).
• LoginProviderInterface::render() removed → implement modifyView().
• JS modules removed: @typo3/backend/document-save-actions.js, @typo3/backend/wizard.js, @typo3/t3editor/*.
• Workspace "Freeze Editing" removed (#107323).

DataHandler

• userid and admin properties removed (#107848).
• copyWhichTables, neverHideAtCopy, copyTree removed (#107856) — read from $BE_USER->uc.
• storeLogMessages removed (#106118).
• ISO 8601 date handling reworked (#105549).

EXT:form — 10 hooks removed (use PSR-14 events): afterBuildingFinished, beforeFormCreate, beforeFormDuplicate, beforeFormDelete, beforeFormSave, initializeFormElement, beforeRemoveFromParentRenderable, afterInitializeCurrentPage, afterSubmit, beforeRendering. Legacy form templates removed (#106596).

EXT:felogin

• Logout handling changed (#103910); redirect in logoutAction removed (#103913).
• exposeNonexistentUserInForgotPasswordDialog setting removed (#105863).

TypoLink / URLs

• TypolinkBuilder signature changed (#106405); new TypolinkBuilderInterface.
• AbstractTypolinkBuilder->build() deprecated.
• Sitemap GET parameters moved to namespace (#104422).
• doktype=shortcut random subpage option removed (#107654).

Install Tool / bootstrap

• typo3/install.php removed — integrated into backend routing (#107536, BC preserved).
• typo3/index.php legacy entry + composer.json setting removed.
• Environment::getComposerRootPath removed (#107482).
• composer.json required in classic mode (#108310) — installs without one stop detecting extensions.
• Extension title auto-populated from composer.json (#108304).
• Reference index check moved to Install Tool (#107629).

Security / crypto

• HMAC algorithm: SHA1 → SHA256 family (#106307).
• Extbase\Security\Cryptography\HashService removed (part of #105377). New symmetric cipher service (#108002).
• AuthenticationService static function parameter removed (#106869).
• AfterMailerInitializationEvent removed (#105809).
• MailMessage->send() removed (#108097).

The #105377 umbrella (the "deprecated functionality removed" sweep):

• Classes removed: HashService, StandaloneView, TemplateView, AbstractTemplateView, GenericViewResolver, SlugEnricher, DuplicationBehavior (now enum), InformationStatus, Enumeration, IconState, EnumType, FluidViewAdapter/Factory.
• Interfaces removed: PageRepositoryInitHook/GetPageHook, ViewResolverInterface, ContentObjectGetData/GetImageResource/OneSourceCollection/PostInit/StdWrap hooks.
• Static utilities gone: BackendUtility::getTcaFieldConfiguration/thumbCode, GeneralUtility::hmac, ExtensionManagementUtility::addPItoST43/addPageTSConfig/addUserTSConfig/getExtensionIcon, MathUtility::convertToPositiveInteger.
• TypoScript: <INCLUDE_TYPOSCRIPT:> removed → use @import.
• TSconfig: options.pageTree.backgroundColor removed.
• Class constants: Icon::SIZE_*, AbstractFile::FILETYPE_*, ExtensionUtility::PLUGIN_TYPE_PLUGIN.
• $GLOBALS['TYPO3_CONF_VARS']['BE']['defaultPageTSconfig'], defaultUserTSconfig removed.

4. v14.0 → v14.3 per-release headlines

5. v15 preparation — what's deprecated in v14.3

Direction is clear: v15 drives out superglobals in favor of injected PSR-7 request.

• ext_tables.php removal (#109438). Move to Configuration/Backend/Modules.php, Configuration/Backend/Routes.php, Configuration/TCA/Overrides/be_users.php (addUserSetting()), Configuration/TCA/Overrides/pages.php (allowedRecordTypes).
• ext_emconf.php deprecated (#108345) — all metadata in composer.json.
• GeneralUtility::getIndpEnv(), locationHeaderUrl(), sanitizeLocalUrl(), isOnCurrentHost() require PSR-7 request going forward.
• Various ContentObjectRenderer properties/methods (#109575).
• Bootstrap tab events (#109171).
• Form DatePicker element (#109152).
• Form file-based (YAML) storage (#108653) — DB is default.

6. LTS support windows (from release announcement)

7. Migration tooling (v13 → v14)

• Extension Scanner (core): matchers updated for Fluid 5 strictness, FAL strong-typing, cache interface strict-typing, and the full #105377 umbrella.
• TYPO3 Rector: 11 new v14 rules + 42 v13 carry-forwards. New CLI: --no-progress-bar, --only <rule>.
• TYPO3 Fractor (a9f/typo3-fractor): handles TypoScript, FlexForm XML, composer.json, .htaccess, ext_emconf → composer migration, ext_tables.php split-off helpers.
• PHPStan: saschaegerer/phpstan-typo3 and Rector bundle cover strict-types expectations across Cache/FAL.

Critical operational note: on any site that ran v14.2, the Important #109585 upgrade wizard must be executed after upgrade to v14.3 — password fields may be persisted serialized in be_users.uc/user_settings.

8. Content Blocks status

Content Blocks 2.x targets v14 as an external FriendsOfTYPO3 package — not yet in core. Planned core inclusion: v15 LTS. v14 ships supporting features: allowedRecordTypes per colPos (#108623), TCA type=country (#99911), record-type specific configuration.

B.1 Priority matrix

B.2 Per-skill gaps (what needs editing)

Each entry below is scoped to concrete files to edit. Absolute paths assume /home/sme/p/<repo>/main/.

B.3 Shared cross-cutting updates (apply to all TYPO3 skills)

1. Version matrices — replace "12, 13" with "12, 13, 14" everywhere. Default/recommended = v14.3 LTS (today's release; bugfix releases will be 14.3.1, 14.3.2, …).
2. PHP matrices — extend ceiling to 8.5 in examples; keep floor at 8.2 (unchanged).
3. Composer — ensure all examples honor typo3/cms-base-distribution:^14 as default.
4. Deprecation-of-deprecations — if a skill still references now-removed APIs as "deprecated", upgrade the phrasing to "removed in v14".
5. CSP / SRI — surface integrity+auto-SRI (#109187) and CSP-hash-over-nonce (#100887) as the new default in security refs.
6. Site Sets first — where skills discuss site config, lead with Site Sets (v13+, now canonical) and route enhancers in sets (#107837).
7. CKEditor 5 — v14's CKE is 47.x.
8. Testing Framework — branch 9.x supports both v13 and v14 — same branch, no matrix split needed.
9. XLF hygiene — 2-space indentation is the new norm (#107971).
10. ext_emconf/ext_tables — docs and checkpoints should flag both as "remove before v15" and provide the Configuration/Backend/*.php + composer.json-metadata replacements.

D.1 Node.js — >=24.14.0 <25.0.0, npm >=11.9.0

Source: TYPO3/typo3 core Build/package.json on main — engines block declares:

"engines": {
  "node": ">=24.14.0 <25.0.0",
  "npm": ">=11.9.0"
}

Note: Composer-installed typo3/cms-core strips the Build/ directory, so this file is not in the vendor tree — only in the source repo on GitHub.

D.2 Bootstrap — 5.3.2 (runtime JS), CSS banner still 5.1.3 (stale artifact)

Sources:

• Runtime JS banner at vendor/typo3/cms-core/Resources/Public/JavaScript/Contrib/bootstrap.js:6 → Bootstrap v5.3.2
• Build/package.json on main → "bootstrap": "^5.3.2", "@types/bootstrap": "^5.2.6"

Caveat: vendor/typo3/cms-backend/Resources/Public/Css/backend.css:16 still carries Bootstrap v5.1.3 — compiled CSS banner that wasn't refreshed. Authoritative runtime version is 5.3.2.

D.3 PHPUnit — ^11.2.5 || ^12.1.2 || ^13.0.2 via testing-framework 9.5.0

Source: packagist.org/packages/typo3/testing-framework.json — 9.5.0 (latest 9.x) requires:

"phpunit/phpunit": "^11.2.5 || ^12.1.2 || ^13.0.2"

Testing framework 9.x release chain: 9.0.0 → 9.0.1 → 9.0.2 → 9.0.3 → 9.1.0 → 9.1.1 → 9.1.2 → 9.2.0 → 9.2.1 → 9.3.0 → 9.4.0 → 9.5.0. Branch supports TYPO3 v13 and v14 from the same codebase.

D.4 v14 ELTS end date — not yet officially published

• typo3.com/products-services/extended-support-elts lists ELTS end dates for v10.4 (2027-04-30), v11.5 (2028-10-31), v12.4 (2030-04-30). It does not list v13 or v14 ELTS end dates.
• typo3.com/services/extended-support/elts-for-v14 → 404.
• Community-maintained: endoflife.date/typo3 publishes v14 ELTS end as 2032-06-30 (not officially confirmed).

Action: treat v14 ELTS as "announced 3 years after free-security end (2029-06-30)"; watch typo3.com for the official listing.

D.5 TYPO3 Rector v14 rules — 47 rules (46 in TYPO314/v0/ + 1 in v2/)

Source: github.com/sabbelasichon/typo3-rector/tree/main/rules/TYPO314 (via GitHub Contents API, 2026-04-21).

Invocation: vendor/bin/rector process --config rector.php after registering the TYPO314 set; individual rules can be targeted with --only ClassName (new in the v14 Rector release, see Community Budget Report).