TYPO3 13.4.35

Release Notes

Version 13.4.35

Release Notes for TYPO3 CMS 13.4.35

This document contains information about TYPO3 CMS 13.4.35 which was released on 08.09.2026.

Get TYPO3 13.4.35 now

News

This version is a security release and contains an important security fix - read the corresponding security advisory here:

Read TYPO3 13.4.35 Release News

Checksums of TYPO3 13.4.35

SHA256

dd2d79db211cb8954a5f3a1f0cf2eb27a4a9057387e012fdd0bf779901f983e3 typo3_src-13.4.35.tar.gz
c52d799c6fd2a2240708325e37fbe5db227e4f7bef7dff858e63a5d289c85502 typo3_src-13.4.35.zip

SHA1

978bc378257b6d11ae987312ed015d6c95fde9f5 typo3_src-13.4.35.tar.gz
6441e537f37935bfd3593343c9b553788d62f1ca typo3_src-13.4.35.zip

MD5

f1009312573b3825f6cc2e5b19a4f6c7 typo3_src-13.4.35.tar.gz
91169d88d5f7261ba2c64530172c574b typo3_src-13.4.35.zip

Package Signatures

TYPO3 Release Packages (the downloadable tarballs and zip files) as well as Git tags are signed using PGP signatures during the automated release process. Besides that, MD5 and SHA2-256 hashes are being generated for these files. Find more details on verifying signatures and hashes in the infrastructure guide.

Download GPG signed release README.md file

Example of verifying integrity of tar.gz package of current release:

wget --content-disposition https://get.typo3.org/13.4.35/tar.gz
wget --content-disposition https://get.typo3.org/13.4.35/tar.gz.sig
gpg --verify typo3_src-13.4.35.tar.gz.sig typo3_src-13.4.35.tar.gz

Upgrading

The usual upgrading procedure applies. No database updates are necessary. It might be required to clear all caches; the "important actions" section in the TYPO3 Install Tool offers the accordant possibility to do so.

Changes

Here is a list of what was fixed since 13.4.34:

  • 2026-09-08 c758ca298e8 [RELEASE] Release of TYPO3 13.4.35 (thanks to Benni Mack)
  • 2026-09-08 1c63ce806d1 [SECURITY] Check page access in the localization endpoints (thanks to Benjamin Kott)
  • 2026-09-07 6c0f45a98a9 [BUGFIX] Preserve route target when MFA intercepts a route request (thanks to Benjamin Franzke)
  • 2026-09-07 ea5ae910df1 [DOCS] Mention the whitespace module for ckeditor (thanks to Anja Leichsenring)
  • 2026-09-07 c9ac96b14c3 [BUGFIX] Avoid stale deleted state on reprocessed files (thanks to Benni Mack)
  • 2026-09-04 aa6a5bdadce [TASK] Improve LinkValidator record lookup performance (thanks to Wouter Wolters)
  • 2026-09-04 2faa2a6dc1a [BUGFIX] Ensure admin access in "redirects:cleanup" command (thanks to Mathias Brodala)
  • 2026-09-04 1024ab28b3e [BUGFIX] Do not map value types as Extbase relations (thanks to Garvin Hicking)
  • 2026-09-03 f9dd53b6259 [BUGFIX] Show workspace indicator for page translation changes (thanks to Philipp Kitzberger)
  • 2026-09-02 fca4db52f75 [TASK] Raise doctrine/dbal to ~4.4.4 (thanks to Stefan Bürk)
  • 2026-09-02 7f4a85d9d9b [BUGFIX] Add SQLite JSON and UUID column declarations (thanks to Stefan Bürk)
  • 2026-09-02 63d14e0dab1 [BUGFIX] Reject indexes over undeclared columns (thanks to Stefan Bürk)
  • 2026-09-01 8e6e35bab0e [BUGFIX] Do not treat moved records as deleted in record history (thanks to Benni Mack)
  • 2026-09-01 e94ecd1fcb7 [TASK] Add tests for plugin Startingpoint override (thanks to Stefan Bürk)
  • 2026-09-01 0d6ef78a997 [BUGFIX] Skip inaccessible file references in FileCollector (thanks to Georg Ringer)
  • 2026-09-01 853c3cca6e9 [BUGFIX] Make Extbase QueryResult serializable again (thanks to Georg Ringer)
  • 2026-09-01 867bc723250 [TASK] Pass HTTP basic auth credentials in server response sub-requests (thanks to Georg Ringer)
  • 2026-09-01 43c1b40c510 [BUGFIX] Restrict allowed characters of pages cache tags (thanks to Georg Ringer)
  • 2026-08-31 53991228bbc [BUGFIX] Handle all PSR-3 log levels in TimeTracker (thanks to Benni Mack)
  • 2026-08-31 016699dfc72 [BUGFIX] Reduce queries when indexing many-to-many relations (thanks to Thomas Prangenberg)
  • 2026-08-31 385e2e2cac0 [BUGFIX] Chunk record processing in ReferenceIndex to prevent OOM (thanks to Mikel Wohlschlegel)
  • 2026-08-31 2e6dc941bdf [BUGFIX] Make CGL suites work in git worktrees (thanks to Benjamin Kott)
  • 2026-08-31 e831159c5d1 [BUGFIX] Provide error page to failsafe container (thanks to Stefan Bürk)
  • 2026-08-31 c6fa0044f49 [TASK] Update PHPStan to v2.2.10 (thanks to Elias Häußler)
  • 2026-08-31 85af56bbb04 [BUGFIX] Allow database names containing a dot in schema migration (thanks to Georg Ringer)
  • 2026-08-27 5bfc84007fe [BUGFIX] Support f:render.text for backend rich text (thanks to Matthias Vogel)
  • 2026-08-26 6cd7fb6bbc0 [BUGFIX] Delete only own scratch directories in unit tests (thanks to Stefan Bürk)
  • 2026-08-26 13b6e4990f9 [TASK] Use permalinks for documentation URLs (thanks to Elias Häußler)
  • 2026-08-25 06780cd42b1 [DOCS] Adjust links to project-home for all documentations (thanks to Richard Krikler)
  • 2026-08-24 9a08687ef15 [BUGFIX] Use TypoScript from request in ConfirmationFinisher (thanks to Rafael Kähm)
  • 2026-08-24 cc93bf21c3c [BUGFIX] Use TypoScript from request in CObjectViewHelper (thanks to Rafael Kähm)
  • 2026-08-24 adc0d4bd0da [TASK] Use the containerised CGL suite in AGENTS.md (thanks to Benjamin Kott)
  • 2026-08-23 c9c21e1b4cb [BUGFIX] Ignore tables that exist as views (thanks to Stefan Bürk)
  • 2026-08-23 d12ff41ee28 [TASK] Add AGENTS.md with repository guidelines for coding agents (thanks to Benni Mack)
  • 2026-08-23 9218d192f6f [BUGFIX] Avoid using null as array offset (thanks to Tim Kandel)
  • 2026-08-17 50cbcb5bef2 [DOCS] Update links in SECURITY.md (thanks to Elias Häußler)
  • 2026-08-17 2512c7e647d [TASK] Test QueryResult with objects instead of arrays (thanks to Oliver Klee)
  • 2026-08-14 09616d159de [BUGFIX] Avoid deadlock in console command tests (thanks to Stefan Bürk)
  • 2026-08-13 0372aac96b0 [BUGFIX] Cover translation lookup by a single index (thanks to Stefan Bürk)
  • 2026-08-13 2a99f5939d4 [TASK] Keep settled promise guard guzzle agnostic (thanks to Stefan Bürk)
  • 2026-08-13 7e94699e2cf [TASK] Stabilize browser based test suites (thanks to Stefan Bürk)
  • 2026-08-12 fccbd407d8d [TASK] Allow guzzlehttp/guzzle v8 to be installed (thanks to Benni Mack)
  • 2026-08-12 c049b25a319 [BUGFIX] Prevent PHP warning on invalid regex in replacement stdWrap (thanks to Georg Ringer)
  • 2026-08-12 71924950cc9 [BUGFIX] Prevent f:render.text errors without TCA record type (thanks to Matthias Vogel)
  • 2026-08-11 f4a150c651a [TASK] Use PHP 8.6 in CI integrity checks (thanks to Stefan Bürk)
  • 2026-08-11 2e19f9c05cc [TASK] Run unit tests with PHP 8.6 (thanks to Stefan Bürk)
  • 2026-08-11 e2b84649e42 [TASK] Set TYPO3 version to 13.4.35-dev (thanks to Oliver Hader)