What's security-only patch release and how to apply it?

Question

I noticed we have security-only patch releases, what's it and how to use it?

An example of these security-only patch releases, instead of having Magento 2.3.2 my client has installed Magento 2.3.3-p1.

Answer 1

Now you have the option to take a lighter security-only patch release when you need to, which lets you remain secure for as long as six months before picking up a full release.

Security patches use the Composer naming convention 2.3.3-px. Use Composer to specify a patch. For example, to download the Magento Commerce 2.3.2-p1 meta-package you can use:

composer require magento/product-community-edition=2.3.3-p1

The security-only patch will be based on the latest prior full patch release on our most recent release line to give you a possible upgrade path like this:

References:

Introducing the New Security-only Patch Release

Devdocs: Upgrade to a security-only patch release