Magento 2 security patching workflow
How the three Floor Giants stores go from an Adobe security bulletin to a patched production site in under an hour, and where the process came from.
A process that depended on one person
Adobe publishes Magento security patches on a schedule and sometimes off it. When I arrived at Floor Giants each of the three stores was patched by hand. Someone would download the patch, apply it on their own machine, test what they could and push it up. It took most of a day and it depended on one person being free that day.
What I brought from We Are JH
I had built a patch process before, at We Are JH between 2022 and 2025, where a patch went from bulletin to production in under two hours across the client sites. I rebuilt it for the Floor Giants stores. The rules are the same. Nothing in vendor/ is ever edited. Every vendor fix is a composer patch under patches/<vendor>/<module>/ and registered in composer-patches.json, and every patch gets a line in .github/ISSUES.md pointing at the upstream issue so we know what to re-check on the next upgrade.
How the team runs it
The team runs it. A patch is applied in Warden locally, checked against the store, pushed to a branch and deployed with Deployer on the two stores that have it. The third store does not have Deployer yet, so its releases take longer. Two stores are on 2.4.7-p10 and PHP 8.2 and UK Discount Flooring is on 2.4.8-p5 and PHP 8.3, so the same fix sometimes needs two versions and that is the part that still costs time.
Where it stands
A security patch now reaches production in under an hour from the bulletin. We now have automated CI and testing across all three stores. The release tooling still differs between them; getting Deployer onto the third store would make that part of the process more consistent.
Related reading
- Magento 2 relaunch: theme, caching and releases
- Magento 2 checkout: LCP from 5.8s to 1.6s
- How to investigate a slow Magento 2 checkout
- Hyvä migration planning and backend architecture
If you have a Magento setup with a similar problem, get in touch.