dkd/kula-audit

TYPO3 extension audit: upgrade readiness, vulnerabilities, and SBOM via Kula API

v1.0.0 2026-03-02 09:23 UTC

Requires

• php: ^8.1
• typo3/cms-backend: ^12.4 || ^13.0
• typo3/cms-core: ^12.4 || ^13.0

Suggests

• typo3/cms-dashboard: Required for the Dashboard widget

GPL-2.0-or-later

• dkd Internet Service GmbH

• security
• Audit
• typo3
• upgrade
• SBOM

README

Audit your TYPO3 installation directly from the backend: upgrade readiness, known vulnerabilities, and CycloneDX SBOM — powered by the Kula API.

Features

• CLI Command — vendor/bin/typo3 kula:audit reads composer.lock and checks against the Kula API
• Dashboard Widget — Traffic light overview (green/yellow/red) with package stats
• Backend Module — Full detail tables under Admin Tools with upgrade readiness and vulnerability data

Requirements

• TYPO3 12.4 or 13.x
• PHP 8.1+
• Access to a running Kula instance (default: https://app.kula-audit.de/api/audit)

Installation

composer require dkd/kula-audit

Then activate the extension in the TYPO3 Extension Manager or via CLI:

vendor/bin/typo3 extension:activate kula_audit

Configuration

Set the API URL and target TYPO3 version in config/system/settings.php or via the Settings module:

$GLOBALS['TYPO3_CONF_VARS']['EXTENSIONS']['kula_audit'] = [
    'apiUrl' => 'https://app.kula-audit.de/api/audit',
    'targetMajor' => 13,
];

Usage

CLI

# Run audit (uses 24h cache)
vendor/bin/typo3 kula:audit

# Force fresh check
vendor/bin/typo3 kula:audit --force

# JSON output (for CI/CD pipelines)
vendor/bin/typo3 kula:audit --json

Scheduler

The kula:audit command is schedulable via the TYPO3 Scheduler. Recommended frequency: once daily.

Dashboard

Add the "Extension Audit" widget to your TYPO3 Dashboard for a quick overview.

Backend Module

Find the full audit report under Admin Tools > Kula Audit.

License

GPL-2.0-or-later