I noticed we have security-only patch releases, what's it and how to use it?

An example of these security-only patch releases, instead of having Magento 2.3.2 my client has installed Magento 2.3.3-p1.


Now you have the option to take a lighter security-only patch release when you need to, which lets you remain secure for as long as six months before picking up a full release.

Security patches use the Composer naming convention 2.3.3-px. Use Composer to specify a patch. For example, to download the Magento Commerce 2.3.2-p1 meta-package you can use:

composer require magento/product-community-edition=2.3.3-p1

The security-only patch will be based on the latest prior full patch release on our most recent release line to give you a possible upgrade path like this:

Magento security-only patch release


Introducing the New Security-only Patch Release

Devdocs: Upgrade to a security-only patch release

  • does this mean that Magento no longer will provide patches in a regular format like .patch files? – underser Dec 15 '20 at 9:09
  • Hi @underser, they didn't stop the patches. – Rafael Corrêa Gomes Dec 15 '20 at 15:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.