What changes with TYPO3 14.3.1 and 13.4.29 — both 12 May 2026 releases for operators

TL;DR

Two parallel maintenance releases, no security advisory, one PHP-relevant must-do change and several backend quality-of-life fixes.

TYPO3 14.3.1

Memory limit raised to 256/512 MB, drag-and-drop in the pagetree reliable again, scheduler logs no longer per task execution, page cache invalidation on project-path change, clean encryption-key during setup, many form/FormEngine fixes, CI migration from Codeception to Playwright.

TYPO3 13.4.29

Backport of f:render.text (Fluid ViewHelper for text rendering), Composer 2.9.7, Fluid Standalone 4.6.1, drag-and-drop fix (shared with 14er), scheduler corrections, imageMagickExec precedence fix, several TypoScript stability fixes.

No security update

Both versions are explicitly declared “bugfix and maintenance release”. No TYPO3 core CVE in this release cycle.

 

Three sentences for operators: The memory-limit lift in 14.3.1 is the only must-do change with external effect on PHP configuration. Drag-and-drop and scheduler logging are operational reliefs noticeable immediately in production. The f:render.text backport in 13.4.29 is worth knowing for site-package maintainers because it makes Fluid templates more consistent.

Context for these releases

TYPO3 14.3.1 is the first maintenance iteration on the 14.3 line. The 14er line is not yet an LTS version — that will be 14.4 — but 14.3 is the line on which the core team is preparing the next LTS. 13.4.29 is the running LTS line and receives regular bugfix maintenance until the next LTS supersedes it.

Both releases shipped on the same day (12 May 2026) — the joint TYPO3 news ticket speaks of “maintenance releases published”. Important: neither the official TYPO3 news page nor the release notes list a security advisory number. In the current May cycle this is a pause from the 8 May CVE block; none of the commit logs carry a [SECURITY] tag.

Anyone still on 14.3.0 or 13.4.28 gets no database migration with the update — the upgrade path is composer update typo3/cms-* --with-dependencies plus a single cache flush.

TYPO3 14.3.1 — the most important bugfixes

14.3.1 contains around 90 commits since 14.3.0. We group by impact.

Memory limit raised (must-do)

Commit e8387fb0a47 raises TYPO3's recommended PHP memory limit: 256 MB minimum, 512 MB recommended. This is not a hard version requirement but an official recommendation. Anyone still on 128 MB will see increasing errors in backend modules under load (Install Tool, image crop, large pagetrees). Concretely: before the update run php -i | grep memory_limit and raise it in the container PHP config, php.ini or .user.ini/.htaccess (mod_php).

Drag-and-drop usable again in long pagetree views

Commit c31f5414bd8 fixes a regression in the page module view where drag-and-drop became unusable on very long lists. Anyone running large sites with many content elements per page will feel this immediately.

Scheduler — three fixes

• 7fbff9eeb93 — The scheduler no longer logs every single task execution. Sub-minute schedulers benefit substantially.
• d64f8b97ab2 — Tasks can reliably update their own execution again.
• 607313c3f3f — Undefined array key task_group in the task form fixed.

Setup and encryption key

Commit 96f69e1f334 ensures the encryption key is actually set during initial setup. In some configurations it remained empty and had to be added manually. Commit b17c5e85aeb moves package setup to the end of the setup phase — relevant for Composer distributions checking for a clean setup completion.

Form framework — stability bundle

Four bugfixes in ext:form: duplicate <br> removed from deny-tags (dbdc26e49e6), improved deletion confirmation when removing forms (7cbc58473cc), fluidAdditionalAttributes cleaned up when a field is set optional (72876bda838), avatar upload in user settings works again with partitioned field names (4a38385df11).

Frontend, routing and cache

• b8a5f2fed90 — Site route matching for slugs identical to the site path is correct again.
• 74519b0fb1b — Calculated cache lifetimes above 24 hours are now valid.
• 62275b71af6 — Page cache invalidated when the project path changes (relevant for container setups with changing mount points).
• 8494a04bc80 — LinkResult type correctly set to page for page links.
• fece7a3ca52 — Menu data processors now honour if conditions.

TypoScript stability

• 6077b85063f — Empty reference output in TypoScript prevented.
• a9900a55684 — Multibyte characters in TypoScript handled correctly.
• 3603a7db34c — Condition matcher always has tree available.

Install Tool, backend UX, developer-relevant

Three Install Tool fixes: no more crash on login warning email (77b10c59269), auto-generated install tool password no longer printed garbled (41b50e628c2), cache compression option tolerates non-bool values (f691d5b2fb0). Backend UX: relaxed size constraints in the page creation wizard (350d91db56e), button group vertical alignment restored (6b50b4ac0ff), extension settings save button more visible (0688c51a687). Plus around 12 commits migrating CI from Codeception to Playwright — the Codeception pipeline is removed (649719a5060) and the testing framework moves to Playwright sharding (a50cee2476c). Also worth noting: DataHandler no longer reports a false-positive “version of a version” (27665e6de14), public folder allowed again in classic mode (770c5383930), PageInformation loses its experimental flag (a6b8e264882).

TYPO3 13.4.29 — the most important bugfixes and the only feature

13.4.29 contains around 30 commits since 13.4.28. Shorter, more focused, with an interesting feature-backport decision.

The only feature: f:render.text backport

Commit 8cd458abac4 backports the Fluid ViewHelper f:render.text from the 14er line into 13er LTS. It makes Fluid templates more consistent: instead of different constructs for “render this text with variable substitution” there is now the direct f:render.text form in 13.4 as well. Anyone maintaining site packages for both TYPO3 lines in parallel can run a unified templating style.

Drag-and-drop fix (shared with 14.3.1)

Commit ddac158c5e4 is the backport of the drag-and-drop fix for long pagetree views.

Composer and Fluid updates

• 47b16738012 — Composer update to 2.9.7.
• d9b156f6317 — Fluid Standalone update to 4.6.1.

TypoScript stability (shared with 14er)

• d000a936049 — Empty reference output prevented.
• 1acb4681598 — Multibyte characters handled correctly.
• 9e843def85f — SysTemplateTreeBuilder handles nullable Set TypoScript correctly.

Backend UX and frontend

• 6ad9ae2992f — returnUrl handling in PageLayoutController streamlined.
• 1c340dcfab7 — Grid column width in language comparison mode correct.
• 39290a9fe7c — PreviewUriBuilder::withRootLine returns the modified object.
• 20fabd4cf3f — Site route matching for identical slugs (shared fix with 14er).
• 301b3fdc504 — isSubMenu no longer excludes link pages from menu children.

Image processing, logging and files

Commit 4d658b18a05 corrects operator precedence in imageMagickExec. Sounds small, but matters — wrong precedence in an image pipeline can cause missed conversions. Log rotation respects max files = 0 correctly (a4c1fa9f3aa), package cache identifier combines mtime and filesize (b1b7a6fa847), IRRE/files toggle switch for invertStateDisplay correct (9b22afc1d88).

Extbase / DomainObject

• c3eb0c99e48 — DomainObjectInterface is no longer @internal. Anyone implementing against it in their own extensions (and getting an internal warning) can now do so cleanly.
• b70d592678c — DI issues during DatabaseCompare mitigated.

What changed for security?

Short answer: nothing.

Both release notes explicitly declare “bugfix and maintenance release”. There is no security advisory number in this cycle, no [SECURITY] tag in the commit logs, and the joint news statement speaks only of maintenance. Anyone searching the TYPO3 mailing lists or the official security feed for a May advisory matching the 12 May 2026 release will find none.

That does not mean these updates are unimportant. The memory limit lift and the backend stability fixes are operationally relevant. But the urgency is “normal maintenance window”, not “emergency patch”. Anyone with a planned maintenance window in the next one to two weeks can fit these updates in cleanly.

Who is affected?

Three profiles with different priority:

Profile A — Active 14.3 operators

If you are on 14.3.0, plan 14.3.1 as a standard maintenance update. Main motivation: adjust to the new memory limit recommendation, eliminate the drag-and-drop regression, relieve scheduler logs. No emergency, but the next sensible maintenance window is the right place.

Profile B — LTS operators on 13.4

If you still sit on 13.4.28 or older, take 13.4.29 — mainly for the f:render.text backport (for site-package maintainers), the imageMagickExec precedence fix and DI improvements. Also no emergency.

Profile C — Site-package and extension maintainers

The CI migration from Codeception to Playwright in 14.3.1 is relevant for your own acceptance test suites. If you maintain testing-framework-based tests, look at the new examples in core before the next TYPO3 major drops the old Codeception constructs.

 

Anyone on 14.0, 14.1 or 14.2 should move to 14.3 in any case — these interim versions no longer receive maintenance.

Operator recommendation

Maintenance releases deserve discipline, not drama. Order:

Operational decision block

If you are on TYPO3 14.3.0 and Composer-managed — then

roll 14.3.1 in the next regular maintenance window (not an emergency). Check PHP memory limit beforehand and raise to at least 256 MB, ideally 512 MB.

If you are on TYPO3 13.4.28 and under LTS — then

plan 13.4.29 in the same maintenance iteration. Check whether the f:render.text backport lets your site packages use the ViewHelper instead of workarounds.

If you write your own high-frequency scheduler tasks — then

review log volume after the update; with 14.3.1 the noise drops noticeably, which may shift monitoring thresholds.

If you maintain your own acceptance tests against typo3/testing-framework — then

look at the migrated Playwright tests in core before 14.3.1; Codeception will not be maintained in the medium term.

If you run a container-managed setup with changing project paths — then

the page-cache invalidation fix in 14.3.1 is relevant; flush the cache fully once after the update.

 

Quick check before the update

# Check PHP memory limit
php -i | grep memory_limit

# Check TYPO3 version
vendor/bin/typo3 --version

# Simulate composer update
composer update typo3/cms-* --with-dependencies --dry-run

# After the update: flush cache
vendor/bin/typo3 cache:flush

What we deliberately do not do

• No weekend emergency rollout. Both releases are pure maintenance. We push them into the next regular window.
• No database migration without checking. The release notes say “no database updates necessary” — we verify per site with vendor/bin/typo3 upgrade:list and have it in writing.
• No 13.4-to-14.3 upgrade combined with this maintenance update. A major upgrade gets its own window, its own test base and its own rollback path.

What we actually do at Moselwal

Our TYPO3 stack strategy runs two lines in parallel: moselwal.de and ole-hartwig.eu run on 14.x (currently 14.3.x), while we support 13.4 LTS for customers depending on the contract base.

Moselwal customers are already updated

We roll TYPO3 maintenance releases out to our customer installations automatically as soon as they are released — without you having to file a ticket as a customer. 14.3.1 and 13.4.29 shipped on 12 May 2026 and were deployed to all Moselwal-operated installations the same day. Caches flushed, smoke tests done, Sentry and uptime alerts green. You don't need to do anything. If you want to know which TYPO3 version your installation is running, you find it in the backend under System → Configuration → TYPO3_CONF_VARS or just ask us.

For ourselves

• 14.3.0 → 14.3.1 is rolled in our next maintenance iteration. We use the update to also raise the PHP memory limit per container to 512 MB (the FrankenPHP worker mode benefits anyway).
• The drag-and-drop fix is a relief — the page module view on moselwal.de is often long because of our TOC and spine structure.
• Our scheduler runs sub-minute for multiple mini tasks (RSS feed rebuild, semantic-delivery refresh). The log volume drop is measurable.
• On CI we are watching the Playwright migration — our moselwal/sitepackage-base tests still run against the old acceptance pipeline; that migrates in the next quarter.

For customers on 13.4

• 13.4.29 is added wherever possible to the same maintenance iteration in which we run Composer updates anyway.
• f:render.text goes into our moselwal/content-blocks-collection templates where we previously combined <f:format.raw> with subselects — a clean unification.

Conclusion

TYPO3 14.3.1 and 13.4.29 are classical maintenance releases — no headline, no security emergency, but a handful of changes noticeable in daily operations. The memory limit lift is the only must-do for the PHP configuration. The drag-and-drop fix and the scheduler log relief are the biggest wins for editorial and operations. The f:render.text backport in 13.4.29 is the elegant gesture showing the LTS line gets not only bugfixes but selected consistency improvements as well.

Anyone running both lines puts the updates into the next regular maintenance window. Anyone on older maintenance levels takes the release as a trigger for the next due roll-up. And anyone still stuck on 14.0, 14.1 or 14.2 should set 14.3.x as a required target — these interim versions no longer receive maintenance.