magento2-patch-workflow

A single bash script for applying Magento 2 security patches with cweagans/composer-patches v2.

Patches live in the shop's own git repository. There is no wrapper Composer package, no path repository, no symlink into vendor/, and no extra.patches block in composer.json.

patches/<release>/*.patch      the patch files, as the upstream repo ships them
patches/<release>/source.json   upstream fragment, kept for its descriptions
patches.json                    generated, one entry per patch with a sha256
patches.lock.json               generated by Composer, the authoritative list

patches.json is picked up automatically, because v2 defaults extra.composer-patches.patches-file to exactly that filename.

Install

Per shop, from the Magento root:

mkdir -p tools
curl -fsSL https://raw.githubusercontent.com/Siteation/magento2-patch-workflow/main/patches \
  -o tools/patches
chmod +x tools/patches
curl -fsSL https://raw.githubusercontent.com/Siteation/magento2-patch-workflow/main/patch-workflow.html \
  -o tools/patch-workflow.html

Commit both files. Afterwards, tools/patches update fetches the latest of each.

Requires php, composer, patch, curl, and (for find and add) the gh CLI.

Use

# local
tools/patches find qoliber/magento-open-source-VULN-39341
tools/patches add  qoliber/magento-open-source-VULN-39341 2026-09-001/cweagans/2.4.9
tools/patches apply
# test the shop, then commit patches/ patches.json patches.lock.json

# live
git pull && tools/patches deploy

Command	What it does
find <owner/repo>	List the patch folders in a repo matching this shop's Magento version
add <url|owner/repo> [path] [as]	Download a release into patches/, then sync
import <vendor/package>	Pull patches out of an installed wrapper package, one time migration
sync	Rebuild patches.json from patches/, then relock
apply	sync, composer patches-repatch, verify
verify	Reverse apply every locked patch as a dry run. Exit 2 if any is missing
status	Releases in the store, generated files, where locked patches came from
remove <release>	Drop a release and re-sync
deploy	install, repatch, verify, setup:upgrade, di:compile, static content, cache flush
update	Fetch the latest tool and doc

tools/patch-workflow.html is the full write up, including the parts that bite.

The one thing worth knowing

A plain composer install only patches packages it actually reinstalls. Add a patch without touching composer.lock and there is nothing to install, so nothing is patched, and nothing complains. composer patches-repatch deletes the patched packages first, which forces it. That is why apply and deploy both run repatch and then verify against the code on disk.

Where patches come from

qoliber republishes each Adobe isolated security release split per Composer package, in both cweagans and vaimo flavours. Take the cweagans/ folder.

• magento-open-source-VULN-39341
• APSB26-92-patches
• 2026-07-001-CE-cweagans-patches

Licence

MIT