Skip to content
BranchesTags

Latest commit

 

History

2 Commits

Folders and files

NameName
Last commit message
Last commit date
cweagans
cweagans
 
 
vaimo
vaimo
 
 
.gitignore
.gitignore
 
 
README.md
README.md
 
 

Repository files navigation

APSB26-92-cwygaon-patches

Adobe Commerce / Magento Open Source 2026-08-001 Isolated security patches (August 2026, APSB26-92), packaged for composer patch plugins in two flavours.

cweagans/   per-package patches for cweagans/composer-patches
vaimo/      Adobe's original patches, unmodified, for vaimo/composer-patches

These patches are cumulative. The August 2026 Isolated patches build on the July 2026 ones. Apply the matching July 2026 patches first, then these. Within a release line you must also already be on the latest security-only patch release (-p) — see the Adobe KB article.

Which flavour should I use?

cweagans/ vaimo/
Plugin cweagans/composer-patches vaimo/composer-patches
Patch files Adobe's patch split per composer package Adobe's original file, untouched
Applied from each package's install dir (-p1) the project root ("cwd": "project")
lib/web/underscore.js routed into magento/magento2-base; needs a reinstall so the file is re-copied to the project root patched directly at project root — the copy Magento actually serves
vendor/bin/patch-status omitted (outside any package) included, exactly as Adobe ships it
Fidelity to Adobe security fixes complete, two delivery caveats byte-identical

If you already use vaimo/composer-patches, prefer vaimo/ — it applies Adobe's file as-is from the project root, so both of the cweagans/ caveats below simply do not arise.

Supported versions

Magento / Adobe Commerce Directory Patch sets
2.4.6-p15 2-4-6-p15-aug-2026/2.4.6-p15_aug_2026/ 142p10-2026-08-001-B2B, 152p5-2026-08-001-B2B, 246p15-2026-08-001-CE, 246p15-2026-08-001-EE
2.4.7-p10 2-4-7-p10-aug-2026/2.4.7-p10_aug_2026/ 142p10-2026-08-001-B2B, 152p5-2026-08-001-B2B, 247p10-2026-08-001-CE, 247p10-2026-08-001-EE
2.4.8-p5 2-4-8-p5-aug-2026/2.4.8-p5_aug_2026/ 153-2026-08-001-B2B, 248p5-2026-08-001-CE, 248p5-2026-08-001-EE
2.4.9 2-4-9-aug-2026/2.4.9_aug_2026/ 153-2026-08-001-B2B, 249-2026-08-001-CE, 249-2026-08-001-EE

(the same version/set layout exists under both cweagans/ and vaimo/)

B2B patch sets are named after the B2B extension version they target (e.g. 142p10 = B2B 1.4.2-p10, 152p5 = B2B 1.5.2-p5, 153 = B2B 1.5.3) — pick the one matching the magento/extension-b2b version installed in your project. The B2B sets shipped by Adobe for multiple Magento versions are byte-identical; they are kept under each Magento version directory for convenience.

Adobe also publishes August Isolated patches for the Extended Support lines 2.4.5-2026-jul and 2.4.4-2026-jul. Those are out of scope for this repository.

What the August patches change

Component Packages touched
CE module-cms, module-customer, module-review, plus lib/web/underscore.js
EE module-gift-registry, module-versions-cms (2.4.7-p10 and newer)
B2B module-company, module-company-graph-ql

magento/module-company's etc/di.xml is touched by both the July and the August B2B patch, so the July → August order is mandatory for B2B.

cweagans/ — cweagans/composer-patches

All paths inside these patch files are relative to each package's install directory (vendor/<vendor>/<package>), so they apply with the default -p1.

Usage

  1. Copy the patch-set directory for your Magento version into your project:

    cp -r cweagans/2-4-9-aug-2026/2.4.9_aug_2026/249-2026-08-001-CE <your-project>/patches/

  2. Merge the matching snippet below into the extra section of your project's composer.json, keeping your July entries alongside them. Recommended safety flag:

    "extra": {
    "composer-exit-on-patch-failure": true
}

  3. Re-install the affected packages so the patches get applied (cweagans/composer-patches does not re-patch already installed packages):

    composer reinstall magento/magento2-base 'magento/module-*'

    or remove vendor/ and run composer install.

  4. Recompile and redeploy (bin/magento setup:di:compile, bin/magento setup:static-content:deploy, cache flush).

Caveats specific to this flavour

  • lib/web/underscore.js — Adobe patches this at the project root. composer-patches can only patch packages, so the hunk is routed into magento/magento2-base, which also carries the file. In a composer install the project-root lib/web/underscore.js is a separate copy, placed there by magento/magento-composer-installer from extra.map, and that root copy is the one Magento serves (DirectoryList::LIB_WEB => 'lib/web', relative to BP). So patching only vendor/ is not enough on its own.

    It does work out through a normal install: cweagans patches on POST_PACKAGE_INSTALL, while the installer deploys on POST_INSTALL_CMD at the end of the run, so the patched file is what gets copied — provided your root composer.json has "magento-force": "override" in extra (standard in Magento projects; without it the installer throws "Target already exists" instead of replacing the file).

    After deploying, verify the root copy really carries the fix:

    grep -c 'hasOwnProperty' lib/web/underscore.js
diff lib/web/underscore.js vendor/magento/magento2-base/lib/web/underscore.js

    If the two differ, the deploy step did not run — use composer install on a clean vendor/ rather than composer reinstall.

  • vendor/bin/patch-status — Adobe's patch also ships this single-file PHP reporting tool, used to detect applied security patches. It lives outside any composer package, so it cannot be delivered this way and is omitted here. All actual security fixes are included. Use the vaimo/ flavour, or Adobe's original archive, if you need that tool.

  • File-mode-only changes (e.g. module-company/etc/di.xml in the B2B 1.5.2-p5 patch, 100755 → 100644) are preserved as git extended headers; git apply (which composer-patches tries first) handles them, patch(1) ignores them harmlessly.

composer.json snippets

2.4.6-p15 — 142p10-2026-08-001-B2B (Adobe Commerce B2B)

Patch files: cweagans/2-4-6-p15-aug-2026/2.4.6-p15_aug_2026/142p10-2026-08-001-B2B/

{
    "patches": {
        "magento/module-company-graph-ql": {
            "142p10-2026-08-001-B2B security patch": "patches/142p10-2026-08-001-B2B/magento_module-company-graph-ql.patch"
        },
        "magento/module-company": {
            "142p10-2026-08-001-B2B security patch": "patches/142p10-2026-08-001-B2B/magento_module-company.patch"
        }
    }
}

2.4.6-p15 — 152p5-2026-08-001-B2B (Adobe Commerce B2B)

Patch files: cweagans/2-4-6-p15-aug-2026/2.4.6-p15_aug_2026/152p5-2026-08-001-B2B/

{
    "patches": {
        "magento/module-company-graph-ql": {
            "152p5-2026-08-001-B2B security patch": "patches/152p5-2026-08-001-B2B/magento_module-company-graph-ql.patch"
        },
        "magento/module-company": {
            "152p5-2026-08-001-B2B security patch": "patches/152p5-2026-08-001-B2B/magento_module-company.patch"
        }
    }
}

2.4.6-p15 — 246p15-2026-08-001-CE (Magento Open Source / Adobe Commerce (CE))

Patch files: cweagans/2-4-6-p15-aug-2026/2.4.6-p15_aug_2026/246p15-2026-08-001-CE/

{
    "patches": {
        "magento/magento2-base": {
            "246p15-2026-08-001-CE security patch": "patches/246p15-2026-08-001-CE/magento_magento2-base.patch"
        },
        "magento/module-cms": {
            "246p15-2026-08-001-CE security patch": "patches/246p15-2026-08-001-CE/magento_module-cms.patch"
        },
        "magento/module-customer": {
            "246p15-2026-08-001-CE security patch": "patches/246p15-2026-08-001-CE/magento_module-customer.patch"
        },
        "magento/module-review": {
            "246p15-2026-08-001-CE security patch": "patches/246p15-2026-08-001-CE/magento_module-review.patch"
        }
    }
}

2.4.6-p15 — 246p15-2026-08-001-EE (Adobe Commerce (EE))

Patch files: cweagans/2-4-6-p15-aug-2026/2.4.6-p15_aug_2026/246p15-2026-08-001-EE/

{
    "patches": {
        "magento/module-gift-registry": {
            "246p15-2026-08-001-EE security patch": "patches/246p15-2026-08-001-EE/magento_module-gift-registry.patch"
        }
    }
}

2.4.7-p10 — 142p10-2026-08-001-B2B (Adobe Commerce B2B)

Patch files: cweagans/2-4-7-p10-aug-2026/2.4.7-p10_aug_2026/142p10-2026-08-001-B2B/

{
    "patches": {
        "magento/module-company-graph-ql": {
            "142p10-2026-08-001-B2B security patch": "patches/142p10-2026-08-001-B2B/magento_module-company-graph-ql.patch"
        },
        "magento/module-company": {
            "142p10-2026-08-001-B2B security patch": "patches/142p10-2026-08-001-B2B/magento_module-company.patch"
        }
    }
}

2.4.7-p10 — 152p5-2026-08-001-B2B (Adobe Commerce B2B)

Patch files: cweagans/2-4-7-p10-aug-2026/2.4.7-p10_aug_2026/152p5-2026-08-001-B2B/

{
    "patches": {
        "magento/module-company-graph-ql": {
            "152p5-2026-08-001-B2B security patch": "patches/152p5-2026-08-001-B2B/magento_module-company-graph-ql.patch"
        },
        "magento/module-company": {
            "152p5-2026-08-001-B2B security patch": "patches/152p5-2026-08-001-B2B/magento_module-company.patch"
        }
    }
}

2.4.7-p10 — 247p10-2026-08-001-CE (Magento Open Source / Adobe Commerce (CE))

Patch files: cweagans/2-4-7-p10-aug-2026/2.4.7-p10_aug_2026/247p10-2026-08-001-CE/

{
    "patches": {
        "magento/magento2-base": {
            "247p10-2026-08-001-CE security patch": "patches/247p10-2026-08-001-CE/magento_magento2-base.patch"
        },
        "magento/module-cms": {
            "247p10-2026-08-001-CE security patch": "patches/247p10-2026-08-001-CE/magento_module-cms.patch"
        },
        "magento/module-customer": {
            "247p10-2026-08-001-CE security patch": "patches/247p10-2026-08-001-CE/magento_module-customer.patch"
        },
        "magento/module-review": {
            "247p10-2026-08-001-CE security patch": "patches/247p10-2026-08-001-CE/magento_module-review.patch"
        }
    }
}

2.4.7-p10 — 247p10-2026-08-001-EE (Adobe Commerce (EE))

Patch files: cweagans/2-4-7-p10-aug-2026/2.4.7-p10_aug_2026/247p10-2026-08-001-EE/

{
    "patches": {
        "magento/module-gift-registry": {
            "247p10-2026-08-001-EE security patch": "patches/247p10-2026-08-001-EE/magento_module-gift-registry.patch"
        },
        "magento/module-versions-cms": {
            "247p10-2026-08-001-EE security patch": "patches/247p10-2026-08-001-EE/magento_module-versions-cms.patch"
        }
    }
}

2.4.8-p5 — 153-2026-08-001-B2B (Adobe Commerce B2B)

Patch files: cweagans/2-4-8-p5-aug-2026/2.4.8-p5_aug_2026/153-2026-08-001-B2B/

{
    "patches": {
        "magento/module-company-graph-ql": {
            "153-2026-08-001-B2B security patch": "patches/153-2026-08-001-B2B/magento_module-company-graph-ql.patch"
        },
        "magento/module-company": {
            "153-2026-08-001-B2B security patch": "patches/153-2026-08-001-B2B/magento_module-company.patch"
        }
    }
}

2.4.8-p5 — 248p5-2026-08-001-CE (Magento Open Source / Adobe Commerce (CE))

Patch files: cweagans/2-4-8-p5-aug-2026/2.4.8-p5_aug_2026/248p5-2026-08-001-CE/

{
    "patches": {
        "magento/magento2-base": {
            "248p5-2026-08-001-CE security patch": "patches/248p5-2026-08-001-CE/magento_magento2-base.patch"
        },
        "magento/module-cms": {
            "248p5-2026-08-001-CE security patch": "patches/248p5-2026-08-001-CE/magento_module-cms.patch"
        },
        "magento/module-customer": {
            "248p5-2026-08-001-CE security patch": "patches/248p5-2026-08-001-CE/magento_module-customer.patch"
        },
        "magento/module-review": {
            "248p5-2026-08-001-CE security patch": "patches/248p5-2026-08-001-CE/magento_module-review.patch"
        }
    }
}

2.4.8-p5 — 248p5-2026-08-001-EE (Adobe Commerce (EE))

Patch files: cweagans/2-4-8-p5-aug-2026/2.4.8-p5_aug_2026/248p5-2026-08-001-EE/

{
    "patches": {
        "magento/module-gift-registry": {
            "248p5-2026-08-001-EE security patch": "patches/248p5-2026-08-001-EE/magento_module-gift-registry.patch"
        },
        "magento/module-versions-cms": {
            "248p5-2026-08-001-EE security patch": "patches/248p5-2026-08-001-EE/magento_module-versions-cms.patch"
        }
    }
}

2.4.9 — 153-2026-08-001-B2B (Adobe Commerce B2B)

Patch files: cweagans/2-4-9-aug-2026/2.4.9_aug_2026/153-2026-08-001-B2B/

{
    "patches": {
        "magento/module-company-graph-ql": {
            "153-2026-08-001-B2B security patch": "patches/153-2026-08-001-B2B/magento_module-company-graph-ql.patch"
        },
        "magento/module-company": {
            "153-2026-08-001-B2B security patch": "patches/153-2026-08-001-B2B/magento_module-company.patch"
        }
    }
}

2.4.9 — 249-2026-08-001-CE (Magento Open Source / Adobe Commerce (CE))

Patch files: cweagans/2-4-9-aug-2026/2.4.9_aug_2026/249-2026-08-001-CE/

{
    "patches": {
        "magento/magento2-base": {
            "249-2026-08-001-CE security patch": "patches/249-2026-08-001-CE/magento_magento2-base.patch"
        },
        "magento/module-cms": {
            "249-2026-08-001-CE security patch": "patches/249-2026-08-001-CE/magento_module-cms.patch"
        },
        "magento/module-customer": {
            "249-2026-08-001-CE security patch": "patches/249-2026-08-001-CE/magento_module-customer.patch"
        },
        "magento/module-review": {
            "249-2026-08-001-CE security patch": "patches/249-2026-08-001-CE/magento_module-review.patch"
        }
    }
}

2.4.9 — 249-2026-08-001-EE (Adobe Commerce (EE))

Patch files: cweagans/2-4-9-aug-2026/2.4.9_aug_2026/249-2026-08-001-EE/

{
    "patches": {
        "magento/module-gift-registry": {
            "249-2026-08-001-EE security patch": "patches/249-2026-08-001-EE/magento_module-gift-registry.patch"
        },
        "magento/module-versions-cms": {
            "249-2026-08-001-EE security patch": "patches/249-2026-08-001-EE/magento_module-versions-cms.patch"
        }
    }
}

vaimo/ — vaimo/composer-patches

These are Adobe's original, unmodified patch files. Their paths are relative to the project root (vendor/magento/..., lib/web/..., vendor/bin/...), so they are declared with "cwd": "project" — vaimo applies them from the project root, exactly where Adobe intended.

Because of that, this flavour is byte-identical to Adobe's release: the real project-root lib/web/underscore.js is patched, and vendor/bin/patch-status is created.

Usage

  1. Copy the patch files for your Magento version into your project:

    cp vaimo/2-4-9-aug-2026/2.4.9_aug_2026/249-2026-08-001-CE.patch <your-project>/patches/

  2. Merge the matching snippet below into extra.patches in your project's composer.json. The "*" key is vaimo's bundle target — one patch file spanning several packages; targets lists the packages vaimo resets before applying it.

  3. Apply:

    composer patch:apply

    or simply composer install / composer update.

  4. Recompile and redeploy (bin/magento setup:di:compile, bin/magento setup:static-content:deploy, cache flush).

Note that "cwd": "project" means vaimo writes to paths under vendor/ directly. Keep the patch declarations in composer.json so the fixes are re-applied on every install — a bare composer install on a clean vendor/ would otherwise drop them.

composer.json snippets

2.4.6-p15 — 142p10-2026-08-001-B2B (Adobe Commerce B2B)

Patch file: vaimo/2-4-6-p15-aug-2026/2.4.6-p15_aug_2026/142p10-2026-08-001-B2B.patch

{
    "patches": {
        "*": {
            "142p10-2026-08-001-B2B security patch": {
                "source": "patches/142p10-2026-08-001-B2B.patch",
                "cwd": "project",
                "targets": [
                    "magento/module-company",
                    "magento/module-company-graph-ql"
                ]
            }
        }
    }
}

2.4.6-p15 — 152p5-2026-08-001-B2B (Adobe Commerce B2B)

Patch file: vaimo/2-4-6-p15-aug-2026/2.4.6-p15_aug_2026/152p5-2026-08-001-B2B.patch

{
    "patches": {
        "*": {
            "152p5-2026-08-001-B2B security patch": {
                "source": "patches/152p5-2026-08-001-B2B.patch",
                "cwd": "project",
                "targets": [
                    "magento/module-company",
                    "magento/module-company-graph-ql"
                ]
            }
        }
    }
}

2.4.6-p15 — 246p15-2026-08-001-CE (Magento Open Source / Adobe Commerce (CE))

Patch file: vaimo/2-4-6-p15-aug-2026/2.4.6-p15_aug_2026/246p15-2026-08-001-CE.patch

{
    "patches": {
        "*": {
            "246p15-2026-08-001-CE security patch": {
                "source": "patches/246p15-2026-08-001-CE.patch",
                "cwd": "project",
                "targets": [
                    "magento/module-cms",
                    "magento/module-customer",
                    "magento/module-review"
                ]
            }
        }
    }
}

2.4.6-p15 — 246p15-2026-08-001-EE (Adobe Commerce (EE))

Patch file: vaimo/2-4-6-p15-aug-2026/2.4.6-p15_aug_2026/246p15-2026-08-001-EE.patch

{
    "patches": {
        "*": {
            "246p15-2026-08-001-EE security patch": {
                "source": "patches/246p15-2026-08-001-EE.patch",
                "cwd": "project",
                "targets": [
                    "magento/module-gift-registry"
                ]
            }
        }
    }
}

2.4.7-p10 — 142p10-2026-08-001-B2B (Adobe Commerce B2B)

Patch file: vaimo/2-4-7-p10-aug-2026/2.4.7-p10_aug_2026/142p10-2026-08-001-B2B.patch

{
    "patches": {
        "*": {
            "142p10-2026-08-001-B2B security patch": {
                "source": "patches/142p10-2026-08-001-B2B.patch",
                "cwd": "project",
                "targets": [
                    "magento/module-company",
                    "magento/module-company-graph-ql"
                ]
            }
        }
    }
}

2.4.7-p10 — 152p5-2026-08-001-B2B (Adobe Commerce B2B)

Patch file: vaimo/2-4-7-p10-aug-2026/2.4.7-p10_aug_2026/152p5-2026-08-001-B2B.patch

{
    "patches": {
        "*": {
            "152p5-2026-08-001-B2B security patch": {
                "source": "patches/152p5-2026-08-001-B2B.patch",
                "cwd": "project",
                "targets": [
                    "magento/module-company",
                    "magento/module-company-graph-ql"
                ]
            }
        }
    }
}

2.4.7-p10 — 247p10-2026-08-001-CE (Magento Open Source / Adobe Commerce (CE))

Patch file: vaimo/2-4-7-p10-aug-2026/2.4.7-p10_aug_2026/247p10-2026-08-001-CE.patch

{
    "patches": {
        "*": {
            "247p10-2026-08-001-CE security patch": {
                "source": "patches/247p10-2026-08-001-CE.patch",
                "cwd": "project",
                "targets": [
                    "magento/module-cms",
                    "magento/module-customer",
                    "magento/module-review"
                ]
            }
        }
    }
}

2.4.7-p10 — 247p10-2026-08-001-EE (Adobe Commerce (EE))

Patch file: vaimo/2-4-7-p10-aug-2026/2.4.7-p10_aug_2026/247p10-2026-08-001-EE.patch

{
    "patches": {
        "*": {
            "247p10-2026-08-001-EE security patch": {
                "source": "patches/247p10-2026-08-001-EE.patch",
                "cwd": "project",
                "targets": [
                    "magento/module-gift-registry",
                    "magento/module-versions-cms"
                ]
            }
        }
    }
}

2.4.8-p5 — 153-2026-08-001-B2B (Adobe Commerce B2B)

Patch file: vaimo/2-4-8-p5-aug-2026/2.4.8-p5_aug_2026/153-2026-08-001-B2B.patch

{
    "patches": {
        "*": {
            "153-2026-08-001-B2B security patch": {
                "source": "patches/153-2026-08-001-B2B.patch",
                "cwd": "project",
                "targets": [
                    "magento/module-company",
                    "magento/module-company-graph-ql"
                ]
            }
        }
    }
}

2.4.8-p5 — 248p5-2026-08-001-CE (Magento Open Source / Adobe Commerce (CE))

Patch file: vaimo/2-4-8-p5-aug-2026/2.4.8-p5_aug_2026/248p5-2026-08-001-CE.patch

{
    "patches": {
        "*": {
            "248p5-2026-08-001-CE security patch": {
                "source": "patches/248p5-2026-08-001-CE.patch",
                "cwd": "project",
                "targets": [
                    "magento/module-cms",
                    "magento/module-customer",
                    "magento/module-review"
                ]
            }
        }
    }
}

2.4.8-p5 — 248p5-2026-08-001-EE (Adobe Commerce (EE))

Patch file: vaimo/2-4-8-p5-aug-2026/2.4.8-p5_aug_2026/248p5-2026-08-001-EE.patch

{
    "patches": {
        "*": {
            "248p5-2026-08-001-EE security patch": {
                "source": "patches/248p5-2026-08-001-EE.patch",
                "cwd": "project",
                "targets": [
                    "magento/module-gift-registry",
                    "magento/module-versions-cms"
                ]
            }
        }
    }
}

2.4.9 — 153-2026-08-001-B2B (Adobe Commerce B2B)

Patch file: vaimo/2-4-9-aug-2026/2.4.9_aug_2026/153-2026-08-001-B2B.patch

{
    "patches": {
        "*": {
            "153-2026-08-001-B2B security patch": {
                "source": "patches/153-2026-08-001-B2B.patch",
                "cwd": "project",
                "targets": [
                    "magento/module-company",
                    "magento/module-company-graph-ql"
                ]
            }
        }
    }
}

2.4.9 — 249-2026-08-001-CE (Magento Open Source / Adobe Commerce (CE))

Patch file: vaimo/2-4-9-aug-2026/2.4.9_aug_2026/249-2026-08-001-CE.patch

{
    "patches": {
        "*": {
            "249-2026-08-001-CE security patch": {
                "source": "patches/249-2026-08-001-CE.patch",
                "cwd": "project",
                "targets": [
                    "magento/module-cms",
                    "magento/module-customer",
                    "magento/module-review"
                ]
            }
        }
    }
}

2.4.9 — 249-2026-08-001-EE (Adobe Commerce (EE))

Patch file: vaimo/2-4-9-aug-2026/2.4.9_aug_2026/249-2026-08-001-EE.patch

{
    "patches": {
        "*": {
            "249-2026-08-001-EE security patch": {
                "source": "patches/249-2026-08-001-EE.patch",
                "cwd": "project",
                "targets": [
                    "magento/module-gift-registry",
                    "magento/module-versions-cms"
                ]
            }
        }
    }
}

About

No description, website, or topics provided.

Resources

Readme
Activity
Custom properties

Stars

3 stars

Watchers

0 watching

Forks

1 fork
Report repository

Releases

Packages

Contributors