PHPackages                             mlocati/composer-patcher - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Utility & Helpers](/categories/utility)
4. /
5. mlocati/composer-patcher

ActiveComposer-plugin[Utility & Helpers](/categories/utility)

mlocati/composer-patcher
========================

A Composer plugin to patch Composer packages.

1.2.6(1y ago)7269.1k↓33%2[1 PRs](https://github.com/mlocati/composer-patcher/pulls)6MITPHPPHP >= 5.3.2CI passing

Since Oct 15Pushed 1y ago2 watchersCompare

[ Source](https://github.com/mlocati/composer-patcher)[ Packagist](https://packagist.org/packages/mlocati/composer-patcher)[ Docs](https://github.com/mlocati/composer-patcher)[ GitHub Sponsors](https://github.com/sponsors/mlocati)[ Fund](https://paypal.me/mlocati)[ RSS](/packages/mlocati-composer-patcher/feed)WikiDiscussions main Synced 2d ago

READMEChangelog (10)Dependencies (3)Versions (12)Used By (6)

[![Tests](https://github.com/mlocati/composer-patcher/actions/workflows/tests.yml/badge.svg)](https://github.com/mlocati/composer-patcher/actions/workflows/tests.yml)

composer-patcher
================

[](#composer-patcher)

Simple patches plugin for Composer. Applies a patch from a local or remote file to any package required with Composer.

Usage
-----

[](#usage)

Example composer.json:

```
{
    "require": {
        "mlocati/composer-patcher": "~1.0",
        "concrete5/core": "~8.4"
    },
    "extra": {
        "patches": {
            "concrete5/core": {
                "This is the patch description": "https://www.example.com/remote.patch",
                "This is another patch": "path/relative/to/this/package/local.patch"
            }
        },
        "patches-file": {
            "path/relative/to/this/package/patch-list.json"
        },
        "allow-subpatches": [
            "concrete5/core"
        ],
        "patch-errors-as-warnings": true,
        "patch-temporary-folder": "/var/tmp"
    }
}
```

If you use the `patches-file` configuration key, it must be a local or remote JSON file with this syntax:

```
{
    "patches": {
        "vendor/project": {
            "Patch description #1": "https://www.example.com/remote.patch",
            "Patch description #2": "path/relative/to/the/defining/package/local.patch"
        }
    }
}
```

Allowing patches to be applied from dependencies
------------------------------------------------

[](#allowing-patches-to-be-applied-from-dependencies)

You can use the `allow-subpatches` to let dependency packages install patches. It can be:

- `false` \[the default\] to prevent dependency packages from installing patches
- `true` to allow all dependency packages installing patches
- an array of package handles to whitelist the packages that can install patches

Using patches from HTTP URLs
----------------------------

[](#using-patches-from-http-urls)

Composer [blocks](https://getcomposer.org/doc/06-config.md#secure-http) you from downloading anything from HTTP URLs, you can disable this for your project by adding a `secure-http` setting in the config section of your `composer.json`. Note that the `config` section should be under the root of your `composer.json`.

```
{
    "config": {
        "secure-http": false
    }
}
```

However, it's always advised to setup HTTPS to prevent MITM code injection.

Patch levels
------------

[](#patch-levels)

In order to specify the level of a patch, you can use the extended form of the patch path. For example, if the patch level for a patch should be `-p4`, you can replace

```
{
    "patches": {
        "vendor/project": {
            "Patch description": "https://www.example.com/remote.patch",
        }
    }
}
```

with

```
{
    "patches": {
        "vendor/project": {
            "Patch description": {
                "path": "https://www.example.com/remote.patch",
                "levels": ["-p4"]
            }
        }
    }
}
```

It can be:

- `false` \[the default\] to prevent dependency packages from installing patches
- `true` to allow all dependency packages installing patches
- an array of package handles to whitelist the packages that can install patches

Target packages
---------------

[](#target-packages)

You can specify the package versions a patch should be applied to. To do so, simply specify the version in the package handle:

```
{
    "patches": {
        "vendor/project:1.1.3": {
            "Patch description": "https://www.example.com/remote.patch",
        }
    }
}
```

You can use the [Composer syntax](https://getcomposer.org/doc/articles/versions.md) to specify the applicable version(s).

Patches containing modifications to composer.json files
-------------------------------------------------------

[](#patches-containing-modifications-to-composerjson-files)

Because patching occurs *after* Composer calculates dependencies and installs packages, changes to an underlying dependency's `composer.json` file introduced in a patch will have *no effect* on installed packages.

If you need to modify a dependency's `composer.json` or its underlying dependencies, you cannot use this plugin. Instead, you must do one of the following:

- Work to get the underlying issue resolved in the upstream package.
- Fork the package and [specify your fork as the package repository](https://getcomposer.org/doc/05-repositories.md#vcs) in your root `composer.json`
- Specify compatible package version requirements in your root `composer.json`

Error handling
--------------

[](#error-handling)

You can use the `extra.patch-errors-as-warnings` configuration option to instruct `composer-patcher` what to do in case of errors. It can be:

- `true` \[the default\] to simply output an error message in case of errors
- `false` to exit composer in case of errors

Credits
-------

[](#credits)

A ton of this code is adapted or taken straight from [`cweagans/composer-patcher`](https://github.com/cweagans/composer-patcher).

Do you really want to say thank you?
------------------------------------

[](#do-you-really-want-to-say-thank-you)

You can offer me a [monthly coffee](https://github.com/sponsors/mlocati) or a [one-time coffee](https://paypal.me/mlocati) 😉

###  Health Score

46

—

FairBetter than 92% of packages

Maintenance46

Moderate activity, may be stable

Popularity40

Moderate usage in the ecosystem

Community20

Small or concentrated contributor base

Maturity64

Established project with proven stability

 Bus Factor1

Top contributor holds 94.6% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~266 days

Recently: every ~414 days

Total

10

Last Release

416d ago

PHP version history (2 changes)1.0.0PHP ^5.3.2 || ^7.0

1.2.0PHP >= 5.3.2

### Community

Maintainers

![](https://www.gravatar.com/avatar/6e9d7ece045fc89575e083ee4852edf31218df403c84f41a0de01863dae982f5?d=identicon)[mlocati](/maintainers/mlocati)

---

Top Contributors

[![mlocati](https://avatars.githubusercontent.com/u/928116?v=4)](https://github.com/mlocati "mlocati (53 commits)")[![bikerdave](https://avatars.githubusercontent.com/u/20645740?v=4)](https://github.com/bikerdave "bikerdave (2 commits)")[![KorvinSzanto](https://avatars.githubusercontent.com/u/1007419?v=4)](https://github.com/KorvinSzanto "KorvinSzanto (1 commits)")

---

Tags

plugincomposerpatcherpatchpatches

###  Code Quality

TestsPHPUnit

### Embed Badge

![Health badge](/badges/mlocati-composer-patcher/health.svg)

```
[![Health](https://phpackages.com/badges/mlocati-composer-patcher/health.svg)](https://phpackages.com/packages/mlocati-composer-patcher)
```

###  Alternatives

[ergebnis/composer-normalize

Provides a composer plugin for normalizing composer.json.

1.1k41.5M2.8k](/packages/ergebnis-composer-normalize)[vaimo/composer-patches

Applies a patch from a local or remote file to any package that is part of a given composer project. Patches can be defined both on project and on package level. Optional support for patch versioning, sequencing, custom patch applier configuration and patch command for testing/troubleshooting added patches.

3014.6M26](/packages/vaimo-composer-patches)[pyrech/composer-changelogs

Display changelogs after each composer update

5904.2M31](/packages/pyrech-composer-changelogs)[automattic/jetpack-autoloader

Creates a custom autoloader for a plugin or theme.

576.1M126](/packages/automattic-jetpack-autoloader)[sllh/composer-versions-check

Checks if packages are up to date to last major versions after update

2392.4M16](/packages/sllh-composer-versions-check)[netresearch/composer-patches-plugin

Composer patches plugin

80270.0k11](/packages/netresearch-composer-patches-plugin)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)