Recap: TYPO3 Developer Days 2023 in Karlsruhe

The journey by train turned out to be – let's say – exciting. While I arrived at noon for a TYPO3 Business Control Committee meeting, Sebastian and Christian joined me in the evening. Like last year, the train journey already offered the first unplanned surprises. We had dinner together in a nearby club restaurant – some other participants had the same idea, so all tables in the restaurant were occupied by the TYPO3 community. (is)

This year's Developer Days took place – as the two previous editions – in Karlsruhe at the GenoHotel. These were the largest Developer Days in Karlsruhe, and some of the 353 participants even had to stay in hotels outside the city. Although the conference area was well filled, there was enough space for discussions and working together on topics. There was even a quiet room where one could retreat if necessary. New was an additional – not quite so quiet – room where you could let off steam with a round of air hockey between the programme points.

The Developer Days are an English-speaking conference. Although 80% of the participants came from the DACH region, all talks and official communication were in English. (is)

Along with the announced major features, TYPO3 v12 brings quite a few smaller innovations that can still be helpful in everyday life.

Jigal van Hemert compiled a selection for us, covering everything from configurations and templating to API changes. Interesting for some of our projects is the new "Country Select" ViewHelper, which allows a very flexible setup of a country select field, for example in contact forms. The ViewHelper is based on Debian's ISO code list, which is now delivered as a CountryProvider class in TYPO3 Core. It will make outdated approaches like static_info_tables finally obsolete in the long run.

He also called attention to the Magic Methods in Extbase repositories (findBy<Property>()), which are now deprecated. (sk)

Slides: Little Gems in TYPO3 v12

Learning from mistakes – this was the motto of my talk "TYPO3 Mysteries": I presented different problem cases and the participants had to guess the cause. It was quite exciting to see how people approached the problems differently in search of the cause of the error.

The guessing game was a lot of fun for me as the quizmaster. According to the feedback I received: the participants agree. I hope the talk was also an encouragement for others to share about their own mistakes and what was learnt. To be continued! (is)

Thursday evening was the coding night again. Last year we worked mainly on our extension picturecredits (stay tuned), this year I wanted to start working on TYPO3.You can't always criticise without delivering something ;-)

Thanks to the Contribution Guide, the demo installation for core development including the complete development toolchain was set up in just under an hour. To get started, I admittedly chose some somewhat clearer tickets and initially concentrated on fixing bugs. In some cases, I even found problems hidden in such old code that I assume the bug must have already been present in several TYPO3 versions in this form. After submitting a patch, it was thankfully accepted very quickly, so that in the evening I was able to record not only my first core patch, but also my first core merge. Now, of course, it's time to stay on track and check the issue tracker every now and then to see if there are any suitable new tasks. (cs)

One of the few talks I was able to watch. I was particularly interested in the topic because we already use Varnish as a caching proxy for many projects to increase performance. In the talk, Sascha Nowak presented a new Varnish extension for TYPO3 (https://github.com/netlogix/nxvarnish), which supports Edge Side Includes (ESI). This makes it a little easier to include dynamic content in static pages, as this can already be done on the server side. Furthermore, the extension uses cache tags instead of URLs to mark the elements in the cache. So invalidation of content is even possible if the URL has changed or there are several URLs for the same content.

I already have a project in mind where I will take a closer look at this extension... (is)

In this highly entertaining (and once again well-attended) talk, Benjamin Kott showed what's possible with CSS these days. Last year, some of the features shown were still under development. By now, many of them are supported by all modern browsers, so nothing prevents their practical use in customer projects.

The presented features included container queries, the has() selector, color-mix functions, and text clipping.

I can only recommend everyone to install Benji's demo and click through the illustrative examples. (sk)

Demo: GitHub: benjaminkott/moderncss-demos

The most important feature by far in TYPO3 v12 in my opinion: the implementation of the HTTP Security Header "Content-Security-Policy" (short: CSP) directly in TYPO3! If used correctly, the CSP can effectively prevent cross-site scripting.

Expect the following features:

• Feature flags to enable CSP handling for backend and/or frontend.
• A policy builder to set up (via YAML and PHP) and extend the CSP header (e.g. via extensions).
• A backend module that lists violations of CSP directives (filterable by scope)

Oliver Hader, who was also responsible for the implementation, not only presented the CSP and the new configurations during his talk. Above all, he raised questions: How do we developers use a CSP in practice? The TYPO3 Core Team needs our feedback to extend the new CSP feature for TYPO3 v13 and to correct it, if necessary.

For example: TYPO3 can now generate nonces ("numbers used once") to allow dynamically generated JavaScript blocks in the CSP. This random number has to be regenerated on every page load. This has an impact on caching in the frontend: the page is still cached, but behaves like a COA_INT, which can lead to a somewhat longer page load time.
A possible alternative would be to calculate hashes for the inline scripts. This could still be done after the page is rendered, which would allow it to be cached. We will continue to follow this topic with interest.

Findings, feature requests and other feedback can be reported at forge.typo3.org. (sk)

Video: YouTube: Content Security Policy - Concept, Strategies & Pitfalls
CSP-Simulator: GitHub: ohader/csp-simulator

As we were invited to the wedding of our colleague Dennis, we left early on Saturday morning. The Deutsche Bahn treated us kindly this time – we arrived in time for the wedding ceremony! It was a very nice and successful celebration, which we would not have wanted to miss. 🍾

Consequently, we did not attend the talks on Saturday. I will therefore watch the presentation "Let's talk about accessibility in a real-life experience" by Franziska Sgoff in the recorded livestream.

Andreas Fernandez' talk "TYPO3 Backend JS in 2023", along with "Introduction to JavaScript Import Maps" by Benjamin Franzke, were not recorded, so I'm very grateful for the explanatory slides with code examples. (sk)

Slides: TYPO3 Backend JS in 2023
Slides: Introduction to JavaScript Import Maps

The TYPO3 Developer Days 2023 showed us that the TYPO3 community is very active and attracts many (new) developers. The content and quality of the topics in the talks were consistently good. There has been a clear upward trend in recent years, which is also related to the increasing professionalisation of the product and the community. We are happy that we can work with and on TYPO3.

By the way: The improvements Sebastian and Christian worked on at the coding night are already part of the TYPO3 core and were published with the release 12.4.5.