sixbysix/magento-security-patches

Central Composer Patches resolver for Magento security patches.

1.0.0 2026-08-13 22:54 UTC

Requires

• php: >=8.1
• composer: >=2.6.0
• composer-plugin-api: ^2.0
• ext-json: *
• cweagans/composer-patches: ^2.0

Requires (Dev)

• phpmd/phpmd: ^2.15
• phpstan/phpstan: ^2.2
• squizlabs/php_codesniffer: ^4.0

MIT

Published on Packagist.org on 2026-08-13 22:00 UTC

README

Reusable Composer plugin for centrally managing Magento security patches across multiple Magento projects.

The package integrates with cweagans/composer-patches v2 through its resolver capability. A consuming project's root composer.json only needs to require this package and Composer Patches; patch definitions stay in this central package.

{
  "require": {
    "sixbysix/magento-security-patches": "^1.0",
    "cweagans/composer-patches": "^2.0"
  }
}

How It Works

Composer Patches v2 supports third-party resolvers through cweagans\Composer\Capability\Resolver\ResolverProvider. This package implements that supported extension point and contributes only the patch definitions applicable to the current dependency graph.

Applicability is evaluated from Composer packages and versions:

• CE/base patch sets match magento/product-community-edition or magento/product-enterprise-edition at the configured release.
• EE patch sets require magento/product-enterprise-edition.
• B2B patch sets require magento/extension-b2b.

No patch definitions are injected into the consuming project's root composer.json. Composer Patches continues to own patches.lock.json.

Supported Security Releases

Supported security releases are defined by the registry files in resources/patches and their package-targeted patch files under patches.

• APSB26-73
• APSB26-92

Project-root Adobe patch paths such as lib/web/underscore.js are represented as patches against magento/magento2-base, because that Composer package owns those files in Composer-installed Magento projects.

Commands

composer security-patches:list
composer security-patches:status
composer security-patches:why APSB26-92

status reports detected Magento edition/version, detected B2B version, applicable registry entries, and whether applicable entries are present in patches.lock.json.

After adding or updating central patch metadata, refresh the consuming project's Composer Patches lock:

composer patches-relock
composer patches-repatch

Do the same once immediately after the first installation if cweagans/composer-patches created patches.lock.json before this plugin was installed.

Adding A Bulletin

1. Add package-targeted patch files under patches/<BULLETIN>/....
2. Add a JSON registry file under resources/patches/<BULLETIN>.json.
3. Use requires for package constraints that must all match.
4. Use requiresAny when equivalent package identities can satisfy the same patch set, such as CE/base patches applying to either Open Source or Commerce.
5. Include sha256 for each patch file.
6. Run composer test.

Example entry:

{
  "id": "APSB26-92-248p5-CE",
  "bulletin": "APSB26-92",
  "label": "CE / 2.4.8-p5",
  "requiresAny": [
    { "magento/product-community-edition": "2.4.8-p5" },
    { "magento/product-enterprise-edition": "2.4.8-p5" }
  ],
  "patches": [
    {
      "package": "magento/module-customer",
      "file": "patches/APSB26-92/2-4-8-p5-aug-2026/2.4.8-p5_aug_2026/248p5-2026-08-001-CE/magento_module-customer.patch",
      "sha256": "ff68d28c04c741892f8c75006e1f8260f18a8ed355b2d1c3b3d113f87bfd46e4"
    }
  ]
}

The matching engine is generic. Future entries can target third-party packages, for example:

{
  "requires": {
    "amasty/module-shopby": "<2.21.4"
  }
}

Troubleshooting

• Composer Patches v2 commands require Composer >=2.6.0. If composer patches-relock fails with Call to undefined method ... requireComposer(), upgrade the Composer phar used by the project and run the command again.
• If an expected patch is missing, run composer security-patches:why APSB26-92 and check the installed package versions.
• If status says an applicable patch is missing, regenerate patches.lock.json with composer patches-relock.
• If Composer Patches fails applying a patch, treat it as a deployment blocker. This package does not swallow patch failures.
• Unsupported Magento versions intentionally receive no inferred patch set.

Patch Provenance

Patch files in this repository are maintained as package-targeted Composer patch files for the security bulletins listed in resources/patches. Keep bulletin identifiers, affected package constraints, and patch checksums current when adding or restructuring patch files.

See docs/architecture.md for integration details.