Mage-OS 1.3.1: Important security update

We are excited to announce the release of Mage-OS Distribution 1.3.1, another step in the building of the definitive open source e-commerce platform!

Mage-OS 1.3.1 is built on Magento Open Source 2.4.8-p2, and includes an important security update from Magento Open Source that was released just this morning.

This update fixes vulnerability CVE-2025-54236, by applying the official Adobe security patch to Mage-OS. There are no other changes from Mage-OS 1.3.0.

Security Bulletin: APSB25-88
Magento Security Patch: Action Required: Critical Security Update Available for Adobe Commerce  (APSB25-88)

Please update any Mage-OS instances to version 1.3.1 as soon as possible to prevent security issues.

composer require mage-os/product-community-edition:1.3.1
bin/magento setup:upgrade

If you have Magento or Adobe Commerce, you will need to apply the Adobe security patch available through the link above.

Want to participate?

Are you interested in contributing to Mage-OS, or have a bug or improvement you’d like to make? We welcome pull requests at https://github.com/mage-os/mageos-magento2!

If you have a bigger project in mind, please join Discord and chat about your idea. We’d be delighted to hear from you, and help figure out how your idea best fits into Mage-OS!

Installing Mage-OS

You can create a new Mage-OS project with the following SSH command:

composer create-project --repository-url=https://repo.mage-os.org/ mage-os/project-community-edition .

After a successful composer download, you will need to run the installer. Please see DevDocs: Installation Guide for Mage-OS

Moving to Mage-OS

If you are already using Magento 2.4 and PHP 8.2+, you can change to Mage-OS by running the following in SSH:

composer config repositories.0 composer https://repo.mage-os.org/ &&
    composer require mage-os/product-community-edition --no-update &&
    composer remove magento/product-community-edition magento/composer-dependency-version-audit-plugin magento/composer-root-update-plugin --no-update &&
    composer remove sebastian/comparator --dev --no-update &&
    composer update --no-plugins --with-all-dependencies

We strongly recommend updating to the latest Magento version (currently 2.4.8) before changing to Mage-OS, to minimize issues.

Your specific situation may require additional changes to your composer.json file. Generally this will involve changing magento/ package names to mage-os/, or updating dependency versions.