Patching cadence
This page is for administrators, hosting teams and project managers responsible for keeping a public site up to date. Vulnerability management usually requires known vulnerabilities to be patched within set times. Exponential and its extensions are Composer packages with immutable releases; the routine below follows 13.15 Keeping up to date.
Contents
What to watch
| Component | How to see what is new |
|---|---|
| Exponential and its extensions | composer outdated; the changelogs (doc/changelogs/); GitHub releases |
| Composer dependencies | composer audit lists known vulnerabilities in the locked dependencies |
| PHP, database server, operating system | your distribution's or vendor's security notices |
| Velocity's engine and FrankenPHP | engine releases; FrankenPHP's version and checksums are pinned in velocity.ini [FrankenPHPSettings] |
| request-shield (if used) | its releases |
The project's CI does not run a dependency vulnerability scan (Security standards: Known gaps),
so composer audit is your job.
How Exponential releases
- 6.0 is the maintained line; fixes go to
mainand out with the next 6.0.x release (SECURITY.md). - Release tags are never changed; a fix is always a new version.
- Each release carries a changelog and, where needed, upgrade notes (Upgrading).
A routine
| When | Do |
|---|---|
| weekly | composer outdated and composer audit on the production lock file; read security notices |
| monthly (or at once for security fixes) | update in a copy, test, then production |
| after every update | file consistency check, smoke test, audit verify |
Update steps, from the installation guide:
- In a copy of the site:
composer update <package>, run the database updates the release names, then./console exp:velocity deploy --allow-root-user(or autoloads, cache clear and a PHP-FPM reload by hand). - Test the main editor tasks and the public pages; run your accessibility and security spot checks.
- Repeat on production in a maintenance window (Maintenance mode).
- Setup > Upgrade check: file consistency and database consistency (The upgrade check).
./console exp:audit verify --allow-root-user.
Keep composer.lock in version control so production installs exactly what you tested.
Records to keep
- date, versions before and after, who updated;
composer auditoutput before and after;- file consistency result;
- for security fixes: the time from release to production, against your policy's target.
Related pages
- 13.15 Keeping up to date
- Upgrading
- Updates and upgrades for website creators
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.
Become an Exponential Partner
Partners share their information, provide funding, contribute back and develop the products with us, and that is how Exponential grows. A partner website and dashboard are planned for mid-2027: please become a partner today to speed up our growth rate and land new features faster.