README

This package distributes Magento Open Source security patches through Composer patch configuration.

Install patches in a Magento project
Provide patches

Install patches in a Magento project

Overview

webidea24/magento-composer-patches selects the patches for the installed Magento Open Source version and writes their remote URLs into the project's Composer patch configuration. This makes monthly Magento security updates available without maintaining package-specific patch files in every project.

The package does not apply patches itself. cweagans/composer-patches applies the URLs written by this package.

Requirements

PHP 8.1 or later
Composer 2
Magento Open Source with magento/product-community-edition
An exact installed Magento version for which patch metadata is available
An installed cweagans/composer-patches package

Allow this plugin in the Magento project's root composer.json:

composer config allow-plugins.webidea24/magento-composer-patches true

For cweagans/composer-patches, configure a dedicated patch file when desired:

{
    "extra": {
        "patches-file": "_patches/composer.patches.json"
    }
}

What this package provides

composer magento-patches:sync downloads the metadata for the installed Magento version and merges its patch URLs.
composer magento-patches:remove removes only URLs generated by this package.
The repository contains the source patches and the build process for publishing package-specific patch files.

How it works

WEBIDEA provides ready-to-use Composer patch files at https://patches.webidea.dev/security/magento/.

The sync command uses the following flow:

It determines the installed Magento version from Composer.
It downloads the version-specific metadata from <origin-base-url>/<magento-version>/meta.json.
It uses the listed patch paths to automatically merge the matching URLs into extra.patches-file or, when no patch file is configured, directly into extra.patches of the root composer.json.
cweagans/composer-patches applies these URLs during the following composer install or composer update.

Generated entries start with [webidea24/magento-composer-patches]. This prefix identifies the entries maintained by this package, so synchronization and removal leave project-maintained patches untouched.

Included security updates

Security update: August 2026

Patch 2026-08-001

Magento Open Source version	Included
`2.4.6-p15`	✅
`2.4.7-p10`	✅
`2.4.8-p5`	✅
`2.4.9`	✅

Security update: July 2026

Patch 2026-07-001

Magento Open Source version	Included
`2.4.6-p15`	✅
`2.4.7-p10`	✅
`2.4.8-p5`	✅
`2.4.9`	✅

Install

Install the package in the Magento project:

composer require webidea24/magento-composer-patches
composer magento-patches:sync
composer install

The final composer install is required so cweagans/composer-patches applies the newly synchronized URLs immediately.

Configuration

By default, metadata and patch files are read from:

https://patches.webidea.dev/security/magento/

Use a different patch server by setting extra.composer-magento-patches.patch-base-url in the Magento project's root composer.json:

{
    "extra": {
        "composer-magento-patches": {
            "patch-base-url": "https://patches.example.com/magento"
        }
    }
}

If extra.patches-file is configured, the command merges into that JSON file. Without it, the command merges directly into extra.patches of the root composer.json.

Remove generated patch URLs

composer magento-patches:remove

This removes generated URLs but does not undo already applied package changes. Run the normal Composer workflow for cweagans/composer-patches afterwards.

Troubleshooting

Verify the installed Magento version with composer show magento/product-community-edition.
Check that <origin-base-url>/<magento-version>/meta.json is publicly reachable.
Confirm that both this package and cweagans/composer-patches are allowed in config.allow-plugins.
Run composer install after every successful sync when patches must be applied immediately.

Provide patches

Use your own patch server

Any static HTTP(S) server can host the generated files. The configured base URL must expose this structure:

<patch-base-url>/<magento-version>/meta.json
<patch-base-url>/<magento-version>/<patch-name>/<module>-<fingerprint>.patch

Projects select the server with extra.composer-magento-patches.patch-base-url. This makes it possible to publish an internally reviewed patch set or to use a mirror instead of the WEBIDEA server.

Generate patch artifacts

Run the build command in this repository:

composer run build-patches

The source patches below magento-patches/<magento-version>/ are split into one file per affected Composer package. Paths inside each generated patch are relative to that package, without the vendor/<vendor>/<package>/ prefix. The generated output is:

.build/patches/<magento-version>/<patch-name>/<module>-<fingerprint>.patch
.build/patches/<magento-version>/meta.json

For patch fragments outside vendor/, the build resolves the selected Magento version with Composer and reads the resulting extra.map entries from its temporary composer.lock. No Magento vendor directory is installed. The build uses the public Mage-OS Composer mirror and requires network access.

Build output is generated and intentionally not committed.

Publish patch artifacts

Upload the complete contents of .build/patches to the root of the configured patch server while preserving the directory structure. Upload the patch files and their version-specific meta.json together; a project can only synchronize patches that are both listed in metadata and reachable at the listed path.

The included GitHub Actions workflow runs for changes below magento-patches/ and deploys the generated output over SSH. Configure these repository secrets before enabling it:

PATCH_DEPLOY_SSH_PRIVATE_KEY and PATCH_DEPLOY_SSH_KNOWN_HOSTS: SSH deployment credentials.
PATCH_DEPLOY_SSH_HOST, PATCH_DEPLOY_SSH_PORT, PATCH_DEPLOY_SSH_USER, and PATCH_DEPLOY_SSH_PATH: deployment target.

Patch metadata format

Each Magento-version directory contains its own meta.json:

{
    "patches": [
        {
            "name": "247p10-2026-07-001-CE",
            "files": [
                {
                    "package": "magento/module-quote",
                    "path": "2.4.7-p10/247p10-2026-07-001-CE/magento-module-quote-8f3a2c1d.patch"
                }
            ]
        }
    ]
}

name identifies one security patch. Each file record specifies its Composer package and its full path relative to the patch-server root, including the Magento version.

fingerprint is the first eight characters of the SHA-256 hash of the generated patch content. A changed patch gets a new URL and therefore cannot be served from a stale cache.

Add a patch before it is available on the WEBIDEA server

Patch source files are maintained and announced in this repository. If a required patch has not yet been published on the WEBIDEA server, you can publish it through your own patch server:

Add the combined diff below magento-patches/<magento-version>/.
Run composer run build-patches.
Review the generated package patches and meta.json.
Upload .build/patches to your patch server.
Configure consuming projects with that server's patch-base-url and run composer magento-patches:sync.

Limitations

Files outside vendor/ require a matching Composer extra.map entry for the selected Magento version. Other project-root fragments are ignored.
Moving a file between Composer packages is not supported.
The patch server must make both the version-specific metadata and every listed patch file available.

webidea24 / magento-composer-patches

Maintainers

Package info

Statistics

Security