Is there a way in Magento 2 to check the applied patch status?

Just like we can check the patch status in Magereport in Magento 1?


TL;DR Check the composer.lock file in Magento 2 to see if the latest version of magento/product-community-edition is currently installed.

Security report tools

First of all, let me explain that Magereport, and also Magento's own security scan, work from the "outside". These tools fire requests at your Magento installations just like a browser. The guys that have built these tools have found specific tests to run to see if you have applied certain patches, because these patches should have introduced a change in the code viewable from the outside (certain JS code, post requests + response, file accessibility/availability).

Now there are patches that can't be checked from the outside, simply because nothing that was changed is detectable from the outside. So to see if patches are installed, you should go to your installation's source (FTP, SFTP, SSH, Git...) and check it there.

Magento 2 status

Magento 2 doesn't have patches in the form of patch files, but in the form of new application versions. So there is nowhere to check for "applied patch status" because there are no patches.

If security issues have been detected and patched (solved) by Magento, then they will release new versions of each supported Magento 2 version. At the time of writing, versions 2.0.17, 2.1.11 and 2.2.2 are the latest versions (see release notes 2.0.x, 2.1.x and 2.2.x).

You should check the composer.json file (or composer.lock file) in your Magento 2 installation and see which version of the magento/product-community-edition (or magento/product-enterprise-edition) is in there to see which version is currently installed.

| improve this answer | |
  • "Magento 2 doesn't have patches in the form of patch files, but in the form of new application " - I have seen Magento 2 downloadable patch files. It is there. Please check my answer. But I am not sure about magereport.com or Magento security scan tool. – Kalyan Chakravarthi V Feb 8 '18 at 14:08
  • 2
    Hi Kalyan, these are indeed patches from a while ago. 3 out of 4 of these patches are to patch the updater or some part that would block you from upgrading to a new version. So the actual platform (security) updates and new features are still packed into new versions which you should upgrade through Composer or download as full new release. The 4th patch is a hotfix for the ones that could not wait for the 2.1.7 release... I think that would have been a 1 time action from Magento, they'll never do that again... – 7ochem Feb 8 '18 at 14:35

Magereport portal also provide security patches information for Magento 2.

| improve this answer | |
  • It doesn't... It can read your M2 version (range), but it still shows all the M1 checks, that will be green of course, because it is not an M1 shop... – 7ochem Dec 21 '17 at 10:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.