Change in behaviour in category menu (with v14.0.3): links for subcategories of hidden categories also displayed

[sypets]

Bug Report

It seems the behaviour for category menu (sys_category, not tags) changed from news v13.0.2 to v14.0.0 to now include links to subcategories of hidden categories.

I am not sure if this is actually a bug or intentional. If intentional, editors need to make sure they not just deactivate a sys_category but also deactivate their descendants if using the category menu.

Reproduce

1. Create a few nested sys_category records such as:

categories/
└── my_category
    ├── my_HIDDEN_subcategory  (this category is hidden=1)
    │   └── my_NOT_HIDDEN_subcategory_of_hidden   (this category is not hidden)
    └── my_subcategory

2. Now add the news content element "News category menu" [news_categorylist] to a page
3. in the content element select the top category only my_category
4. View the page, test with news v13.0.2 and compare with news v14.0.3

Current Behavior

In v14.0.3 links for the following categories are displayed:

• my_NOT_HIDDEN_subcategory_of_hidden => should not
• my_category => ok
• my_subcategory => ok

Expected behavior/output

Show only the categories that are not hidden and not descendants of hidden categories:

• my_category => ok
• my_subcategory => ok

Environment

• TYPO3 version(s): 13.4.29-dev
• news version: 14.0.3
• Is your TYPO3 installation set up with Composer (Composer Mode): reproducable with both
• OS: Linux

Possible Solution
Either restore previous behavior or clarify this is intended.

Personally, I would also like to see an option in the flexform of the category menu where you can select whether to create category links only for the selected categories or also recursively for subcategories. It is my understanding the parent category will link to list of news which will also show news for subcategories but we may not want links for the subcategories.

Additional context

Also, after updating to v14.0.3, an exception was thrown because of the new behaviour AND some of the child sys_category records did not contain a slug. This could be fixed by regenerating slugs for sys_category with the following extension:

composer require internetgalerie/ig-slug
php vendor/bin/typo3 ig_slug:update sys_category

Exception:

Parameter "b5328cd702ab53e1ee8275c963410e1" for route "tx_news_pi1_2" must match ".+" ("" given) to generate a corresponding URL.

in /var/www/mysite/vendor/symfony/routing/Generator/UrlGenerator.php line 179

175 if (!$optional || $important || !\array_key_exists($varName, $defaults) || (null !== $mergedParams[$varName] && (string) $mergedParams[$varName] !== (string) $defaults[$varName])) {
176     // check requirement (while ignoring look-around patterns)
177     if (null !== $this->strictRequirements && !preg_match('#^(?:'.preg_replace('/\(\?(?:=|<=|!|<!)((?:[^()\\\\]+|\\\\.|\((?1)\))*)\)/', '', $token[2]).')$#i'.(empty($token[4]) ? '' : 'u'), $mergedParams[$token[3]] ?? '')) {
178         if ($this->strictRequirements) {
179             throw new InvalidParameterException(strtr($message, ['{parameter}' => $varName, '{route}' => $name, '{expected}' => $token[2], '{given}' => $mergedParams[$varName]]));
                        }