Download the PHP package deployecommerce/magento-community-patches without Composer

On this page you can find all versions of the php package deployecommerce/magento-community-patches. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Informations about the package magento-community-patches

Magento Community Patches

Beta. This package is new and we are still ironing out bugs. Try it on a staging environment before production, check the install output, and please open an issue if anything looks wrong.

deployecommerce/magento-community-patches is a Composer plugin. It applies Adobe's official security patches for Magento Open Source automatically every time you run composer install or composer update.

Magento Open Source only. Composer will not install this package on an Adobe Commerce project. See Adobe Commerce projects.

The plugin reads the installed version of magento/magento2-base, selects the patches published for that version, and applies them with git apply in the order Adobe's prerequisites require. A patch that is already applied is skipped. A patch that can neither be applied nor recognised as already applied stops the install with an error, so a half-patched project never goes unnoticed.

Adobe Commerce projects

Adobe Commerce needs Adobe's Commerce patches, which this package does not ship, so it refuses to run on an Adobe Commerce project, meaning one with magento/product-enterprise-edition installed. You will see one of two failures.

Composer cannot resolve your requirements. The package declares a conflict with magento/product-enterprise-edition, so composer require and composer update stop before anything is downloaded or changed:

The plugin stops before patching. If the package is installed anyway, for example from a lock file written before the conflict existed, the plugin fails the install before it changes any file:

In both cases the fix is the same. Remove this package and use Adobe's own:

Then run vendor/bin/ece-patches apply from your root scripts, as shown in the next section.

If your project is Magento Open Source and you still see either failure, something requires magento/product-enterprise-edition. composer why magento/product-enterprise-edition shows what.

Projects that also use magento/magento-cloud-patches

The plugin works alongside magento/magento-cloud-patches (often installed by magento/quality-patches) and never fights it over the same files:

To get everything applied on every install, run ece-patches from your root composer.json. The plugin always runs after the root package's own scripts:

Copyright and licensing

The patch files in patches/ are Adobe's work and Adobe owns the copyright in them. They are Adobe's Magento Open Source isolated security patches, redistributed byte-for-byte as Adobe publishes them, under the Open Software License 3.0 (OSL-3.0) that Magento Open Source is released under. A full copy of the licence is in LICENSE.txt.

Each patch has a sibling .sha256 file. Its hash must equal the sha256 Adobe publishes for that patch in the Adobe patch registry. You can check every file yourself:

A public page compares every shipped patch with Adobe's registry and is rebuilt within an hour of any change to the registry: https://deployecommerce.github.io/magento-community-patches/. Any mismatch opens an issue on this repository.

The plugin code in src/ was written by Deploy Ecommerce and is also licensed under OSL-3.0.

This project is not affiliated with, endorsed by or supported by Adobe. "Adobe", "Adobe Commerce" and "Magento" are trademarks of Adobe Inc.

Why this package exists

Adobe's magento/magento-cloud-patches package is how Adobe Commerce projects receive security patches automatically. Magento Open Source projects relied on it as well, because magento/quality-patches pulls it in. That route is no longer open to Magento Open Source:

This package uses Adobe's published patches directly, checks every one against Adobe's own registry hash, and applies them through a Composer plugin, so installing the package is all a project has to do.

What is included

Only patches that meet every one of these conditions are shipped:

A patch is published only for the versions in its registry entry that are public Magento Open Source releases. Adobe Commerce, B2B and entitlement-restricted patches are never included, and patches that fail any check are never downloaded.

patches/ and patches.json are generated by a scheduled sync against Adobe's registry (tools/bin/sync), so they should not be edited by hand.

How patches get here

Everything is automated from Adobe's public patch registry; nothing is added by hand.

  1. Sync (every 15 minutes, .github/workflows/sync.yml): tools/bin/sync reads the registry, applies the checks above, downloads only the patches that pass, and opens a pull request with the new .patch and .sha256 files and the regenerated patches.json. If Adobe ever changes the bytes of a patch it already published, the sync stops and asks for a human review instead of overwriting it.
  2. CI (.github/workflows/ci.yml): runs the tests on PHP 8.1 to 8.5, re-checks every patch against the live registry (tools/bin/verify), and applies each release's full patch sequence to pristine Magento Open Source files from the Mage-OS mirror (tools/bin/apply-test).

  3. Release (.github/workflows/release.yml): merging to main tags a release. Adding or removing patches is a minor release, anything else a patch release. Each release carries patches-manifest.sha256 and a GitHub build provenance attestation:

  4. Hash page (.github/workflows/pages.yml): rebuilt on every push to main, and hourly whenever Adobe's registry has changed since the last build.

All versions of magento-community-patches with dependencies

PHP Build Version
Package Version
Requires php Version ^8.1
composer-plugin-api Version ^2.0
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package deployecommerce/magento-community-patches contains the following files

Loading the files please wait ...