TYPO3 13.4.28

Release Notes

Version 13.4.28

Release Notes for TYPO3 CMS 13.4.28

This document contains information about TYPO3 CMS 13.4.28 which was released on 14.04.2026.

Get TYPO3 13.4.28 now

News

This version is a bugfix and maintenance release.

Read TYPO3 13.4.28 Release News

Checksums of TYPO3 13.4.28

SHA256

ed4b563521025f289db5e62496c60a83e6a117a8ff9d8e601cb32e200d3199b0 typo3_src-13.4.28.tar.gz
2dd27e7c4af0caec1d2eee957f0885dfa83134ca783463bf031ad45bbff7cc98 typo3_src-13.4.28.zip

SHA1

e727306f87790ba12ea26026709f53ed4e63910b typo3_src-13.4.28.tar.gz
cd1a440d956ea3378fc4d6fd01867dbca0abc78b typo3_src-13.4.28.zip

MD5

bd3d288b49aad7ea46a088ba549626bf typo3_src-13.4.28.tar.gz
fff0a74fe42e1d047846f334968c9a74 typo3_src-13.4.28.zip

Package Signatures

TYPO3 Release Packages (the downloadable tarballs and zip files) as well as Git tags are signed using PGP signatures during the automated release process. Besides that, MD5 and SHA2-256 hashes are being generated for these files. Find more details on verifying signatures and hashes in the infrastructure guide.

Download GPG signed release README.md file

Example of verifying integrity of tar.gz package of current release:

wget --content-disposition https://get.typo3.org/13.4.28/tar.gz
wget --content-disposition https://get.typo3.org/13.4.28/tar.gz.sig
gpg --verify typo3_src-13.4.28.tar.gz.sig typo3_src-13.4.28.tar.gz

Upgrading

The usual upgrading procedure applies. No database updates are necessary. It might be required to clear all caches; the "important actions" section in the TYPO3 Install Tool offers the accordant possibility to do so.

Changes

Here is a list of what was fixed since 13.4.27:

  • 2026-04-14 1ccabda762f [RELEASE] Release of TYPO3 13.4.28 (thanks to Oliver Hader)
  • 2026-04-14 ce890339ca8 [TASK] Fix known vulnerable npm dev dependencies (thanks to Oliver Hader)
  • 2026-04-13 408efeec90b [TASK] Update PHPStan to v2.1.47 (thanks to Garvin Hicking)
  • 2026-04-13 53aee0cb719 [BUGFIX] Add index for content_from_pid in pages table (thanks to Ravi Sachaniya)
  • 2026-04-13 ee4eb1a63f2 [BUGFIX] Derive workspace preview handling from event context (thanks to Matthias Vogel)
  • 2026-04-13 f90816ad73c [TASK] Update to TypeScript v6 (thanks to Benjamin Franzke)
  • 2026-04-11 48431b9c429 [BUGFIX] Respect DBAL serverVersion in getPlatformServerVersion() (thanks to Rico Sonntag)
  • 2026-04-09 785117c0b0a [BUGFIX] Avoid using null as array offset (thanks to Markus Klein)
  • 2026-04-09 681caaa818d [BUGFIX] Allow pid 0 in tableDef for cache config (thanks to Ravi Sachaniya)
  • 2026-04-09 ded18741090 [BUGFIX] Add category_perms on group data initialization (thanks to Oliver Bartsch)
  • 2026-04-09 fd6061d2861 [BUGFIX] Prevent focus loss when clicking on color field (thanks to Dennis Purisevic)
  • 2026-04-08 d303613a7a0 [BUGFIX] Respect Site::isTypoScriptRoot() in BackendConfigurationManager (thanks to Sebastian Michaelsen)
  • 2026-04-07 802bf650927 [DOCS] Consistent linking to ViewHelper reference (thanks to Simon Praetorius)
  • 2026-04-02 0bf533adc46 [BUGFIX] Add missing JS module in RecordLinkHandler (thanks to Georg Ringer)
  • 2026-04-01 24f667a041c [BUGFIX] Prevent error if request has no TypoScript attribute (thanks to Achim Fritz)
  • 2026-04-01 b26a5178290 [DOCS] Provide correct site set example of ext:seo (thanks to Josef Glatz)
  • 2026-03-31 c8ad498edda [BUGFIX] Provide context to the ElementInformationController's hook (thanks to Xavier Perseguers)
  • 2026-03-31 3b583f8bf6d [TASK] Raise doctrine/dbal to v4.4 (thanks to Stefan Bürk)
  • 2026-03-31 72180a78081 [TASK] Update phpstan to 2.1.45 (thanks to Anja Leichsenring)
  • 2026-03-30 848e7a75be9 [TASK] Speed up PolymorphicDeserializer::parseClassNames() (thanks to Oliver Hader)
  • 2026-03-30 2919d870796 [BUGFIX] Properly evaluate '--create-site' in CLI SetupCommand (thanks to Garvin Hicking)
  • 2026-03-28 11e25723cb4 [TASK] Improve naming in MvcPropertyMappingConfigurationServiceTest (thanks to Torben Hansen)
  • 2026-03-28 18beaaa9783 [TASK] Clarify usage recommendation for GeneralUtility::makeInstance (thanks to Elias Häußler)
  • 2026-03-28 fee0ebead2f [TASK] Allow output configuration for phpstan runs of runTests.sh (thanks to Anja Leichsenring)
  • 2026-03-27 f602bb7a1ae [BUGFIX] Set request on form when built via ArrayFormFactory (thanks to Can Adrian Karadag)
  • 2026-03-26 c74098e4418 [TASK] Update to NodeJS 24 LTS (thanks to Benjamin Franzke)
  • 2026-03-26 21b181cf235 [DOCS] Mention reaction type listing in configuration module (thanks to Anja Leichsenring)
  • 2026-03-25 99ad223452c [TASK] Update PHPStan to v2.1.43 (thanks to Garvin Hicking)
  • 2026-03-23 dbd164f9864 [TASK] Show severity as text in System Status Update (thanks to Stephan Großberndt)
  • 2026-03-23 f06fe38b7d6 [BUGFIX] Avoid null array offset in FlexFormFieldValues (thanks to Nikita Hovratov)
  • 2026-03-22 ce6946ceadf [BUGFIX] Set tstamp in DatabaseWriter for sys_log (thanks to Sebastian Michaelsen)
  • 2026-03-22 76598b751b4 [BUGFIX] Exclude missing files from FAL metadata extraction batch (thanks to Sebastian Michaelsen)
  • 2026-03-20 4b24cd9ee3f [DOCS] Correct typo in ConfigureTypo3.rst (thanks to Bernd Wilke)
  • 2026-03-18 3130ce0ea71 [DOCS] Set correct emphasized line in SummaryPage docs (thanks to Riccardo De Contardi)
  • 2026-03-18 11e196a91e7 [BUGFIX] Use strict empty check for HTTP header values (thanks to Oliver Hader)
  • 2026-03-17 6a767a69a7b [TASK] Skip two more system environment checks on CLI (thanks to Garvin Hicking)
  • 2026-03-16 830e549ecdd [TASK] Update PHPStan to v2.1.41 (thanks to Garvin Hicking)
  • 2026-03-16 02283c14819 [BUGFIX] Use empty stepType in variant conditions when currentPage is null (thanks to Josua Vogel)
  • 2026-03-14 868e6a42a4f [BUGFIX] Avoid using null as array offset (thanks to Markus Klein)
  • 2026-03-14 eddeeb0c079 [BUGFIX] Exclude disabled form elements from GridRow column class calculation (thanks to Josua Vogel)
  • 2026-03-13 7e8a6273c77 [BUGFIX] Fix IRRE usecombination elementBrowserEnabled evaluation (thanks to Benjamin Franzke)
  • 2026-03-13 478f6a86d94 [BUGFIX] Avoid error when visiting page with non-existing language (thanks to Nikita Hovratov)
  • 2026-03-13 39e4780e714 [TASK] Update Fluid Standalone to 4.6.0 (thanks to Simon Praetorius)
  • 2026-03-13 4508dac1bf1 [BUGFIX] Respect integrityStatus option in redirects:cleanup command (thanks to Peter Kraume)
  • 2026-03-12 698a713e219 [BUGFIX] Respect disabled pages in form navigation (thanks to Mathias Brodala)
  • 2026-03-11 983432e6222 [TASK] Make GreedyDatabaseBackend more sophisticated (thanks to Nikita Hovratov)
  • 2026-03-10 30ae044d96f [BUGFIX] Properly persist ENV variables in site config (rootPageId) (thanks to Rozbeh Chiryai Sharahi)
  • 2026-03-10 fb4c65b78d6 [TASK] Prevent redundant hmac calculation in EXT:felogin password reset (thanks to Simon Schaufelberger)
  • 2026-03-10 494b9057e9f [TASK] Set TYPO3 version to 13.4.28-dev (thanks to Oliver Hader)