I need to understand this new Magento 2 patches.

So I see that security patches are released as 2.3.3-p1.

Let's say my version is Magento 2.3.2. And Magento has released 2.3.2-p1, 2.3.3-p1, 2.3.4-p1, 2.3.5-p1 so far. Is that mean I need to apply only one patch ie. 2.3.2-p1 or all of these?


I see that for composer installation they have introduced a new way of getting the patch. https://devdocs.magento.com/guides/v2.3/install-gde/composer.html#example---security-patch .

composer create-project --repository-url=https://repo.magento.com/ magento/project-enterprise-edition=2.3.2-p1 <install-directory-name>

Just trying to understand how it will work on the already installed instance? Will it create a new project (create-project)?

I believe I need to apply the patch with this instead:

composer require magento/product-enterprise-edition=2.3.3-p1 --no-update


So is this the process of applying patches after 2.3.3?

composer require magento/product-community-edition=2.3.3-p1 --no-update
composer update
bin/magento setup:upgrade //do I need to run this on security only patch/updates
bin/magento setup:di:compile
bin/magento setup:static:content:deploy

Especially do I need to run bin/magento setup:upgrade on security only patches/updates?

  • do not get mislead with this, you must upgrade to the latest version, using patches only is wrong way. – MagenX Apr 29 '20 at 7:52
  • Have you checked this? community.magento.com/t5/Magento-DevBlog/… – Adarsh Khatri May 5 '20 at 5:20
  • yes i know, but this is the caveat here, if your version is 2.3.3 - then you already need to upgrade to 2.3.5 and then 2.3.5-p1. security is good, but overall optimization introduced in 2.3.5 is much better. you need to keep your shop upgradable in time. – MagenX May 5 '20 at 8:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.