If there’s a patch for one of our existing module versions, it is published as a branch following the naming convention 8.x-[module-version]-hotfix, e.g. 8.x-1.32-hotfix.

Composer requires versions based on branches to be prefixed with dev. As explained in their official documentation here. Since Drupal doesn’t officially support hotfixes for specific versions, you need to use the git repository of the module directly. Add the module repository to your composer.json file like so:

{
    "repositories":{
        "drupal/cms_content_sync":{
            "type": "git",
            "url": "https://git.drupalcode.org/project/cms_content_sync.git"
        },
        ...   
    },
    ...
    "require": {
        "drupal/cms_content_sync": "dev-8.x-1.32-hotfix",
        ...
    }
}


Sync Core

Sync Cores in the Cloud are automatically patched with hotfixes during regular maintenance.

If you are hosting the Sync Core yourself: updates to the Sync Core will keep their version, so just pulling the version again from the Docker registry will give you all hotfixes included.