Magento Cloud Patches release notes

The Magento Cloud Patches package provides a set of patches which improve the integration of all Magento versions with Cloud environments and supports quick delivery of critical fixes.

The magento-cloud-patches package is a dependency for the ece-tools package and is installed and updated when you install or update the ece-tools package. You can also use and manage the magento-cloud-patches as a stand-alone package to apply patches to a Magento Commerce project that is not on the Cloud platform. These release notes describe the latest improvements to this package.

The magento-cloud-patches package uses the following version sequence: <major>.<minor>.<patch>.

See Apply patches to learn how to apply Magento patches and hot fixes to your Magento Commerce Cloud project.

v1.0.1

We have included all Magento Open Source 2.x patches from the Magento Technical resources in the magento-cloud-patches v1.0.1 release. If you copied any patches into your project previously, remove them to avoid conflicts.

This release includes the following updates:

• Updated patches to include all available patches for Magento Open Source 2.x–Updated the magento-cloud-patches package to include all Magento Open Source 2.x patches available on the Magento Download page. If you copied any Magento Open Source patches into your Magento Commerce Cloud project previously, remove them to avoid conflicts.

• Updated patch for Elasticsearch catalog pagingation fix –Replaced the Elasticsearch catalog pagination patch delivered in magento-cloud-patches v1.0 with a more effective fix.

Catalog pagination does not work on Elasticsearch 6.x

• Updated the Magento Page Builder patches–In Magento Cloud Patches 1.0.0, we bundled Page Builder patches to address a known Page Builder remote code execution (RCE) vulnerability, with the initial fix based on Magento 2.3.3. We have updated these patches with a more stable implementation based on Magento 2.3.4., which includes multiple optimizations for fixing the issue.

  If you have the magento-cloud-patches 1.0.0 package, you are still protected from the Page Builder RCE vulnerability issues. If you update to magento-cloud-patches 1.0.1 or later, you have a better implementation of the same fix.

v1.0.0

This is the first release of the magento/magento-cloud-patches package, which is a new dependency for the ece-tools package version 2002.0.22 or later releases.

This release includes the following patches and critical fixes:

• Page Builder security patches for 2.3.1.x and 2.3.2.x releases–Fixes an issue in Page Builder preview that allows unauthenticated users to access some templating methods that can be used to trigger arbitrary code execution over the network (RCE) resulting in global information leaks. This issue can occur when using unsupported versions of Page Builder with Magento Commerce versions 2.3.1 and 2.3.2.

• MSI patches–Fixes issues that caused indexing errors and performance issues when using default inventory settings for managing stock.

• Backward Compatibility of new Mail Interfaces-Fixes a backward incompatibility issue caused by the Magento\Framework\Mail\EmailMessageInterface PHP interface introduced in Magento Commerce v2.3.3. In the scope of this patch, the new EmailMessageInterface inherits from the old MessageInterface, and Magento Commerce core modules are reverted to depend on MessageInterface.

• Catalog pagination does not work on Elasticsearch 6.x–Fixes a critical issue with search result pagination that affects customers using Elasticsearch 6.x as the catalog search engine.