Composer Patches 2.0.0 Launches with Lock File, Git Patching, and Plugin API

Staff Reporter

Composer Patches 2.0.0 has been officially released, introducing structural updates to improve reliability, extensibility, and integration with Composer’s core systems for PHP projects across communities like Drupal, TYPO3, Magento, and Yii.

This major update introduces a new patches.lock.json file that ensures reproducible builds by recording patch definitions and SHA-256 checksums. Every patch applied is now locked and validated, offering stronger consistency for development teams and CI environments.

The plugin now uses git apply instead of the traditional patch command, avoiding issues caused by OS-level inconsistencies. Even for packages not cloned from Git, the plugin will initialize a Git repo to enable uniform patching behavior.

Composer Patches also debuts a plugin API through Composer capabilities, enabling third-party tools to extend patch resolution, downloading, and application workflows. The system now emits lifecycle events, allowing developers to hook into custom logic.

Improved Composer integration brings support for HTTP proxies, honors the secure-http flag, and adjusts behavior when alternate composer.json files are used. The once-removed dependency patch resolution feature has been restored after community feedback.

Comprehensive new documentation is available at docs.cweagans.net, covering patch definitions, workflows, and upgrade guidance from the 1.x series.

Developed by Cameron Eagans, Composer Patches 2.0.0 is available on GitHub and Packagist. Users are encouraged to contribute, sponsor, or reach out for consulting on advanced patch management needs.

Composer

Update

PHP

Open Source

Git

Note: The vision of this web portal is to help promote news and stories around the Drupal community and promote and celebrate the people and organizations in the community. We strive to create and distribute our content based on these content policy. If you see any omission/variation on this please reach out to us at #thedroptimes channel on Drupal Slack and we will try to address the issue as best we can.