# magento/quality-patches

> Provides quality patches for AdobeCommerce & Magento OpenSource

`composer require magento/quality-patches`

Canonical URL: https://packagento.com/magento/quality-patches

## At a glance

- **Vendor**: magento (https://packagento.com/magento.md)
- **Latest version**: 1.1.80 — released 2026-05-29
- **Pricing**: Free
- **Package type**: Magento 2 component
- **Status**: active, accepting new buyers

## Installation

Packagento is licence-gated, so even free packages need a licence on a project before Composer can resolve them.

1. **Sign in or create an account** at https://packagento.com/customer/account/.

2. **Add the package to your account.** Open https://packagento.com/magento/quality-patches and complete the free checkout. A licence is minted automatically.

3. **Create or pick a project, then activate the licence on it.**
   - Projects represent the Magento installs you deploy to. Manage them at https://packagento.com/projects/.
   - Activate the new licence on the project you'll deploy this package to. Activation is what generates the Composer credentials scoped to that project.

4. **Add the project credentials to your Magento codebase.**

   Grab the project's public + private key from https://packagento.com/projects/ (open the project, then its Credentials tab), and add them to `auth.json`:

   ```json
   {
     "http-basic": {
       "packagento.com": {
         "username": "ppk_live_...",
         "password": "psk_live_..."
       }
     }
   }
   ```

   Add the Packagento Composer repository to `composer.json`:

   ```json
   {
     "repositories": [
       { "type": "composer", "url": "https://packagento.com" }
     ]
   }
   ```

5. **Install and apply.**

   ```bash
   composer require magento/quality-patches:*
   bin/magento setup:upgrade
   bin/magento setup:di:compile
   bin/magento cache:flush
   ```

## What it does

Provides quality patches for AdobeCommerce & Magento OpenSource

## README

Welcome to the Quality Patches Tool!

### Overview

Quality Patches Tool is a command-line tool that delivers quality patches for Adobe Commerce and Magento Open Source. It allows you to:
- view the general information about the latest patches 
- apply patches
- revert  previously applied patches

Quality patches are provided by Adobe support and Magento OS community.

Here is [a full list of available patches](https://devdocs.magento.com/quality-patches/tool.html#patch-grid) in Quality Patches Tool.

### Installation 

**On-Prem Project**

```$ composer require magento/quality-patches```

**Cloud Project**

The [quality-patches](https://github.com/magento/quality-patches) package is a dependency for the [ece-tools](https://github.com/magento/ece-tools/) package starting from v.2002.1.2 and is installed or updated when you [update the ece-tools package version](https://devdocs.magento.com/cloud/project/ece-tools-update.html).

### Usage - On-Prem Project
> Make sure to test all patches in a pre-production environment. For the changes to be reflected, refresh the cache in the [Admin under System > Tools > Cache Management](https://docs.magento.com/user-guide/system/cache-management.html?_ga=2.172766563.1151974537.1596126236-1202073513.1559691283)
>
> Use ```$ ./vendor/bin/magento-patches``` script

**Status command**

Show information about available patches for current Magento version:

```$ ./vendor/bin/magento-patches status```

**Apply command**

Applies provided list of patches:

```$ ./vendor/bin/magento-patches apply MAGETWO-95591 MAGETWO-67097```

**Revert command**

Reverts provided list of patches:

```$ ./vendor/bin/magento-patches revert MAGETWO-95591 MAGETWO-67097```

Reverts all patches:

```$ ./vendor/bin/magento-patches revert --all```

### Usage - Cloud Project
> Make sure to test all patches in a pre-production environment. For Magento Cloud, new branches can be created with magento-cloud environment:branch <branch-name>
>
> Use ```$ ./vendor/bin/ece-patches``` script

#### Applying a patch
Add to .magento.env.yaml environment variable QUALITY_PATCHES with a list of patches to apply:
```
stage:
    build:
        QUALITY_PATCHES:
            - MCTEST-1002
            - MCTEST-1003
```
Commit and push updated .magento.env.yaml file into the remote branch. Patches will be applied during deploy process.

#### Apply patches manually in a local environment
You can apply patches manually in a local environment and test them before you deploy.

To apply patches manually:
1. Add to .magento.env.yaml environment variable QUALITY_PATCHES with a list of patches to apply
2. From the project root, apply the patches:
 `$ ./vendor/bin/ece-patches apply`
 Patches will be applied in the following order:
   - Cloud-required patches
   - Quality patches from .magento.env.yaml
   - Custom patches from the /m2-hotfixes directory.
3. Check with `./vendor/bin/ece-patches status` if the patch was applied 
4.  Clear the Magento cache `$ ./bin/magento cache:clean`

Test the patches, make any necessary changes to custom patches.

#### Revert patches in a local environment
You can revert patches in a local environment to clean instance:

```$ ./vendor/bin/ece-patches revert```

Patches will be reverted in the following order:
- Custom patches from the /m2-hotfixes directory.
- Magento-quality patches
- Cloud-required patches

### Status command information
**Status:**
- *Applied* - the patch is already applied
- *Not applied* - the patch is not applied 
- *N/A* - if the status of patch cannot be defined due to some conflicts

**Type:**
- *Optional* - all patches from [Quality Patches Tool](https://github.com/magento/quality-patches)  are optional for Cloud & On-Prem customers
- *Required* - all patches from [Cloud Patches](https://github.com/magento/magento-cloud-patches) are required for Cloud and optional for On-Prem customers
- *Deprecated* - patch is marked as deprecated (there is a recommendation to revert if it was applied)
- *Custom* - customer specific patches from m2-hotfixes folder (Cloud only)

**Details:**
- *Affected components* - show the list of affected components (magento-modules)
- *Required patches* - shows the list of required patches (dependencies)
- *Recommended replacement* - patch, that is recommended for replacement of deprecated patch

## Recent Versions

| Version | Released |
|---|---|
| 1.1.80 | 2026-05-29 |
| 1.1.79 | 2026-05-08 |
| 1.1.78 | 2026-04-14 |
| 1.1.77 | 2026-02-13 |
| 1.1.76 | 2026-01-29 |
| 1.1.75 | 2026-01-13 |
| 1.1.74 | 2025-11-20 |
| 1.1.73 | 2025-10-27 |
| 1.1.72 | 2025-10-16 |
| 1.1.71 | 2025-09-25 |

Showing 10 of 108 versions. Full release history on https://packagento.com/magento/quality-patches.

## Dependencies

### Require

| Package | Constraint |
|---|---|
| ext-json | * |
| magento/magento-cloud-patches | ^1.0.11 |
| php | ^8.1 |

### Require (dev)

| Package | Constraint |
|---|---|
| codeception/codeception | ^4.1 \|\| ^5.1 |
| codeception/module-asserts | ^1.2 \|\| ^3.0 |
| codeception/module-db | ^1.0 \|\| ^3.0 |
| codeception/module-phpbrowser | ^1.0 \|\| ^3.0 |
| codeception/module-rest | ^1.2 \|\| ^3.0 |
| composer/semver | @stable |
| consolidation/robo | ^1.2 \|\| ^2.0 \|\| ^3.0 |
| phpmd/phpmd | @stable |
| phpunit/phpunit | ^10.0 \|\| ^12.0 |
| squizlabs/php_codesniffer | ^3.0 |

## Quality

Latest release (1.1.80) fails the Packagento QA pipeline. Verdicts below are per-cell (Magento line × PHP version) for the matrixed tools, and run-once for the static / security tiers.


### Compatibility

Each Magento line is installed on its supported PHP versions, then the module is built (DI compile + static-content deploy). Cells show passed / failed / untested; staircase gaps render as `–`.

| Magento | PHP 8.2 | PHP 8.3 | PHP 8.4 | PHP 8.5 |
|---|---|---|---|---|
| 2.4.7 | Pass | Pass | – | – |
| 2.4.8 | – | Pass | Pass | – |
| 2.4.9 | – | – | not tested | not tested |


### Code Quality

Advisory checks against the module's source. Never affect the Compatibility verdict — a phpcs finding can't make a module incompatible.

#### Static Analysis

Coding standards (phpcs), mess detection (phpmd), copy-pasted code (cpd), PHP cross-version compatibility, composer.json validity. Each runs once for the whole module.

| Tool | Status | Findings | Summary |
|---|---|---|---|
| PHPCS | Fail | 44 | 4 errors, 40 warnings (ruleset: Magento2) — 7 auto-fixable with phpcbf |
| PHPMD | Warning | 12 | 12 rule violations (MissingImport:9, IfStatementAssignment:2, ExcessiveClassComplexity:1) |
| Cpd | Pass | 0 |  |
| Composer validate | Info | 1 | valid; 1 advisory note (composer validate --strict) |

#### PHPStan

Type-checks the module against a real Magento install. Re-runs per Magento + PHP version because resolvable symbols differ between releases.

| Magento | PHP 8.2 | PHP 8.3 | PHP 8.4 | PHP 8.5 |
|---|---|---|---|---|
| 2.4.7 | 17 | 17 | – | – |
| 2.4.8 | – | 18 | 18 | – |
| 2.4.9 | – | – | N/A | N/A |


### Tests

Unit and integration suites run per Magento + PHP cell. Test failures speak to the module's behaviour, not its compatibility with a line, so they're reported here separately.

#### Unit Tests

| Magento | PHP 8.2 | PHP 8.3 | PHP 8.4 | PHP 8.5 |
|---|---|---|---|---|
| 2.4.7 | N/A | N/A | – | – |
| 2.4.8 | – | N/A | N/A | – |
| 2.4.9 | – | – | N/A | N/A |

#### Integration Tests

| Magento | PHP 8.2 | PHP 8.3 | PHP 8.4 | PHP 8.5 |
|---|---|---|---|---|
| 2.4.7 | N/A | N/A | – | – |
| 2.4.8 | – | N/A | N/A | – |
| 2.4.9 | – | – | N/A | N/A |


### Security

Dependency-advisory audit (composer audit) plus a source malware scan. A malware detection fails the version outright.

| Tool | Status | Findings | Summary |
|---|---|---|---|
| Composer audit | Pass | 0 |  |
| Malware scan | Pass | 0 |  |

## Licence and pricing

Free. A licence is still minted on checkout and bound to your project for Composer access — no payment step.

Refundable within 14 days of first purchase via https://packagento.com/account/refunds/.

## Install via Claude Code or any MCP client

The Packagento MCP server can run the licence + project + Composer steps above in one tool call:

```
purchase_and_install_packages(
  composer_names=["magento/quality-patches"],
  project_id="proj_xxx"
)
```

This handles cart, checkout, licence minting, project activation, and writes auth.json credentials. Connect a client with `claude mcp add packagento https://mcp.packagento.com`. Full setup at https://packagento.com/docs/mcp-setup.

## Vendor

magento is a Magento 2 vendor on Packagento. See https://packagento.com/magento.md for their full catalogue.