2.0.0

Changes

nr-sync 2.0.0 requires TYPO3 13.4 and changes how the extension stores sync files, notifies target systems and serves its cache-clearing endpoint. Read the breaking changes before upgrading.

Breaking changes

• TYPO3 13.4 only. TYPO3 12.4 is no longer supported (@CybotTM in #47).
• Credential tables need a non-public storage. Dumps that contain be_users, fe_users or tx_scheduler_task are written only to a file storage that is not public. Create a non-public storage outside the web directory and set its uid in the new extension setting storageUid, on the source and the target systems; the backend users and scheduler modules show an error until then (@CybotTM in #65).
• FTP notification over TLS. The notification of a target system connects with FTP over TLS. For a server without TLS, set 'tls' => false in the notify array of the area configuration (@CybotTM in #65).
• Clear-cache endpoint for administrators only. A frontend request with ?nr-sync-clear-cache clears caches only for a logged-in backend administrator who passed MFA and meets BE.IPmaskList, BE.lockSSL and BE.adminOnly; every other request gets 403. The scheduler task SyncImportTask and the command sync:cache:clear are unaffected (@CybotTM in #65).

Security fixes

• Only administrators lock and unlock target systems, and the lock links in the wait list are shown only to them (@CybotTM in #65).
• A submitted sync form starts no sync while the sync module is locked (@CybotTM in #65).
• mysqldump and mysql read the database credentials from a temporary option file with mode 0600 instead of the command line, and no other option file (@CybotTM in #65).
• The FTP notification deletes its temporary trigger file (@CybotTM in #65).

Features

• Extension setting storageUid for the file storage of dump files and URL lists (@CybotTM in #65).
• PSR-14 events BeforeSyncEvent, AfterSyncEvent, ModifyMenuItemsEvent, ModifyTableListEvent and translations for 30 languages (@CybotTM).

Maintenance

• The release workflow runs on the repository's unprefixed version tags; 2.0.0 is the first release built, signed and published to TER and Packagist by it (@CybotTM in #65).
• CI on the shared TYPO3 extension workflows, Renovate for dependency updates, AGENTS.md and the security assurance document docs/SECURITY-ASSURANCE.md.

Full list of changes: CHANGELOG.md · 1.0.7...2.0.0

Installation

composer require netresearch/nr-sync

Publication status

• TER: extensions.typo3.org/extension/nr_sync — 2.0.0 verified
• Packagist: packagist.org/packages/netresearch/nr-sync — 2.0.0 verified
• Documentation: render pending — will appear at docs.typo3.org/p/netresearch/nr-sync/2.0/en-us/

Security

All release artifacts are signed with Sigstore keyless signing.

Verify signatures

cosign verify-blob \
  --bundle nr-sync-2.0.0.zip.sigstore.json \
  --certificate-identity-regexp "https://github.com/netresearch/.*" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  nr-sync-2.0.0.zip

Verify checksums

sha256sum -c checksums.txt

Software Bill of Materials (SBOM)

SBOMs are provided in both SPDX and CycloneDX formats for supply chain transparency.