README

Reusable Composer plugin for centrally managing Magento security patches across multiple Magento projects.

The package integrates with cweagans/composer-patches v2 through its resolver capability. A consuming project's root composer.json only needs to require this package and Composer Patches; patch definitions stay in this central package.

{
  "require": {
    "sixbysix/magento-security-patches": "^1.0",
    "cweagans/composer-patches": "^2.0"
  }
}

How It Works

Composer Patches v2 supports third-party resolvers through cweagans\Composer\Capability\Resolver\ResolverProvider. This package implements that supported extension point and contributes only the patch definitions applicable to the current dependency graph.

Applicability is evaluated from Composer packages and versions:

CE/base patch sets match magento/product-community-edition or magento/product-enterprise-edition at the configured release.
EE patch sets require magento/product-enterprise-edition.
B2B patch sets require magento/extension-b2b.

No patch definitions are injected into the consuming project's root composer.json. Composer Patches continues to own patches.lock.json.

Generated patch URLs are raw VCS URLs pinned to the installed sixbysix/magento-security-patches source reference. They are deliberately not local files under the consuming project's vendor directory, because Composer Patches may need to download locked patches for Magento packages before this plugin package has been extracted during a clean install.

Supported Security Releases

Supported security releases are defined by the registry files in resources/patches and their package-targeted patch files under patches.

APSB26-73
APSB26-92

Project-root Adobe patch paths such as lib/web/underscore.js are represented as patches against magento/magento2-base, because that Composer package owns those files in Composer-installed Magento projects.

Commands

composer security-patches:list
composer security-patches:status
composer security-patches:why APSB26-92

status reports detected Magento edition/version, detected B2B version, applicable registry entries, and whether applicable entries are present in patches.lock.json.

After adding or updating central patch metadata, refresh the consuming project's Composer Patches lock:

composer patches-relock
composer patches-repatch

Do the same once immediately after the first installation if cweagans/composer-patches created patches.lock.json before this plugin was installed.

Adding A Bulletin

Add package-targeted patch files under patches/<BULLETIN>/....
Add a JSON registry file under resources/patches/<BULLETIN>.json.
Use requires for package constraints that must all match.
Use requiresAny when equivalent package identities can satisfy the same patch set, such as CE/base patches applying to either Open Source or Commerce.
Include sha256 for each patch file.
Run composer test.

Example entry:

{
  "id": "APSB26-92-248p5-CE",
  "bulletin": "APSB26-92",
  "label": "CE / 2.4.8-p5",
  "requiresAny": [
    { "magento/product-community-edition": "2.4.8-p5" },
    { "magento/product-enterprise-edition": "2.4.8-p5" }
  ],
  "patches": [
    {
      "package": "magento/module-customer",
      "file": "patches/APSB26-92/2-4-8-p5-aug-2026/2.4.8-p5_aug_2026/248p5-2026-08-001-CE/magento_module-customer.patch",
      "sha256": "ff68d28c04c741892f8c75006e1f8260f18a8ed355b2d1c3b3d113f87bfd46e4"
    }
  ]
}

The matching engine is generic. Future entries can target third-party packages, for example:

{
  "requires": {
    "amasty/module-shopby": "<2.21.4"
  }
}

Troubleshooting

Composer Patches v2 commands require Composer >=2.6.0. If composer patches-relock fails with Call to undefined method ... requireComposer(), upgrade the Composer phar used by the project and run the command again.
If an expected patch is missing, run composer security-patches:why APSB26-92 and check the installed package versions.
If status says an applicable patch is missing, regenerate patches.lock.json with composer patches-relock.
If patches.lock.json contains /vendor/sixbysix/magento-security-patches, regenerate it with composer patches-relock; vendor-local patch URLs are not clean-install safe.
If Composer Patches fails applying a patch, treat it as a deployment blocker. This package does not swallow patch failures.
Unsupported Magento versions intentionally receive no inferred patch set.

Patch Provenance

Patch files in this repository are maintained as package-targeted Composer patch files for the security bulletins listed in resources/patches. Keep bulletin identifiers, affected package constraints, and patch checksums current when adding or restructuring patch files.

See docs/architecture.md for integration details.

sixbysix / magento-security-patches

Maintainers

Package info

Statistics

Security