Download the PHP package webidea24/magento-composer-patches without Composer

On this page you can find all versions of the php package webidea24/magento-composer-patches. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Informations about the package magento-composer-patches

Magento Composer Patches

This package distributes Magento Open Source security patches through Composer patch configuration.

Table of contents

Install patches in a Magento project

Overview

webidea24/magento-composer-patches selects the patches for the installed Magento Open Source version and writes their remote URLs into the project's Composer patch configuration. This makes monthly Magento security updates available without maintaining package-specific patch files in every project.

The package does not apply patches itself. cweagans/composer-patches applies the URLs written by this package.

Requirements

Allow this plugin in the Magento project's root composer.json:

For cweagans/composer-patches, configure a dedicated patch file when desired:

What this package provides

How it works

WEBIDEA provides ready-to-use Composer patch files at https://patches.webidea.dev/security/magento/.

The sync command uses the following flow:

  1. It determines the installed Magento version from Composer.
  2. It downloads the version-specific metadata from <origin-base-url>/<magento-version>/meta.json.
  3. It uses the listed patch paths to automatically merge the matching URLs into extra.patches-file or, when no patch file is configured, directly into extra.patches of the root composer.json.
  4. cweagans/composer-patches applies these URLs during the following composer install or composer update.

Generated entries start with [webidea24/magento-composer-patches]. This prefix identifies the entries maintained by this package, so synchronization and removal leave project-maintained patches untouched.

Included security updates

Security updates: September 2026

Security hotfix: APSB26-146

Magento Open Source version Included
2.4.6-p15 ✅
2.4.7-p10 ✅
2.4.8-p5 ✅
2.4.9 ✅
Patch 2026-09-001 (APSB26-138)
Magento Open Source version Included
2.4.6-p15 ✅
2.4.7-p10 ✅
2.4.8-p5 ✅
2.4.9 ✅

Security updates: August 2026

Patch 2026-08-001 (APSB26-92)
Magento Open Source version Included
2.4.6-p15 ✅
2.4.7-p10 ✅
2.4.8-p5 ✅
2.4.9 ✅

Security updates: July 2026

Patch 2026-07-001 (APSB26-73)
Magento Open Source version Included
2.4.6-p15 ✅
2.4.7-p10 ✅
2.4.8-p5 ✅
2.4.9 ✅

Install

Install the package in the Magento project:

The final composer install is required so cweagans/composer-patches applies the newly synchronized URLs immediately.

Configuration

By default, metadata and patch files are read from:

Use a different patch server by setting extra.composer-magento-patches.patch-base-url in the Magento project's root composer.json:

If extra.patches-file is configured, the command merges into that JSON file. Without it, the command merges directly into extra.patches of the root composer.json.

Remove generated patch URLs

This removes generated URLs but does not undo already applied package changes. Run the normal Composer workflow for cweagans/composer-patches afterwards.

Troubleshooting

Provide patches

Use your own patch server

Any static HTTP(S) server can host the generated files. The configured base URL must expose this structure:

Projects select the server with extra.composer-magento-patches.patch-base-url. This makes it possible to publish an internally reviewed patch set or to use a mirror instead of the WEBIDEA server.

Generate patch artifacts

Run the build command in this repository:

The source patches below magento-patches/<magento-version>/ are split into one file per affected Composer package. Paths inside each generated patch are relative to that package, without the vendor/<vendor>/<package>/ prefix. The generated output is:

For patch fragments outside vendor/, the build resolves the selected Magento version with Composer and reads the resulting extra.map entries from its temporary composer.lock. No Magento vendor directory is installed. The build uses the public Mage-OS Composer mirror and requires network access.

Build output is generated and intentionally not committed.

Publish patch artifacts

Upload the complete contents of .build/patches to the root of the configured patch server while preserving the directory structure. Upload the patch files and their version-specific meta.json together; a project can only synchronize patches that are both listed in metadata and reachable at the listed path.

The included GitHub Actions workflow runs for changes below magento-patches/ and deploys the generated output over SSH. Configure these repository secrets before enabling it:

Patch metadata format

Each Magento-version directory contains its own meta.json:

name identifies one security patch. Each file record specifies its Composer package and its full path relative to the patch-server root, including the Magento version.

fingerprint is the first eight characters of the SHA-256 hash of the generated patch content. A changed patch gets a new URL and therefore cannot be served from a stale cache.

Add a patch before it is available on the WEBIDEA server

Patch source files are maintained and announced in this repository. If a required patch has not yet been published on the WEBIDEA server, you can publish it through your own patch server:

  1. Add the combined diff below magento-patches/<magento-version>/.
  2. Run composer run build-patches.
  3. Review the generated package patches and meta.json.
  4. Upload .build/patches to your patch server.
  5. Configure consuming projects with that server's patch-base-url and run composer magento-patches:sync.

Limitations

All versions of magento-composer-patches with dependencies

PHP Build Version
Package Version
No informations.
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package webidea24/magento-composer-patches contains the following files

Loading the files please wait ...