PHPackages                             vardot/varbase-patches - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Utility & Helpers](/categories/utility)
4. /
5. vardot/varbase-patches

ActiveComposer-plugin[Utility & Helpers](/categories/utility)

vardot/varbase-patches
======================

List of needed patches for Varbase used packages with Composer Patches.

11.0.19(4d ago)475.5k↓11.8%78GPL-2.0-or-laterPHPPHP >=8.1

Since Apr 2Pushed 2d ago4 watchersCompare

[ Source](https://github.com/Vardot/varbase-patches)[ Packagist](https://packagist.org/packages/vardot/varbase-patches)[ RSS](/packages/vardot-varbase-patches/feed)WikiDiscussions 11.0.x Synced 2d ago

READMEChangelog (10)Dependencies (15)Versions (432)Used By (8)

Varbase Patches
===============

[](#varbase-patches)

[![Total Downloads](https://camo.githubusercontent.com/4f0d16dd32d337fde95a60ca9c53d94769868bd2d42d64f781388c222766c4fe/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f64742f766172646f742f766172626173652d706174636865732e737667)](https://packagist.org/packages/vardot/varbase-patches)[![License](https://camo.githubusercontent.com/6b2748e8a68f74270448d3ddc87d81ca06ba53dc5b1569e641f4e21c89a8418b/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f6c2f766172646f742f766172626173652d706174636865732e737667)](LICENSE)

List of needed patches for Varbase used packages with Composer Patches.

Composer plugin and curated patch list for [Varbase](https://www.drupal.org/project/varbase). Built on top of [`cweagans/composer-patches`](https://github.com/cweagans/composer-patches) v2 with three additions that v2 dropped or never had:

- **Wildcard** `ignore-dependency-patches` (e.g. `drupal/*`).
- **Allowlist** `allowed-dependency-patches` — only listed packages contribute dependency-declared patches. Defaults to `["vardot/varbase-patches"]`.
- **`patches-ignore`** restored from cweagans v1 — drop a specific URL declared by a given dependency.

Plus two Composer commands to convert remote merge-request URLs into local timestamped patch files (`./patches/--YYYY-MM-DD----mr-.patch`).

Quick start
-----------

[](#quick-start)

```
composer require vardot/varbase-patches:~11.0.0
```

```
{
  "config": {
    "allow-plugins": {
      "cweagans/composer-patches": true,
      "vardot/varbase-patches": true
    }
  },
  "extra": {
    "enable-patching": true,
    "composer-exit-on-patch-failure": true,
    "composer-patches": {
      "allowed-dependency-patches": [
        "vardot/varbase-patches",
        "vardot/drupal-core-patches"
      ]
    },
    "patches": {}
  }
}
```

```
composer install
```

Result: only patches declared by `vardot/varbase-patches` (and your project's own `extra.patches`) apply. Patches declared by other dependencies are skipped — no more aborted installs from stale third-party `.patch` URLs.

Versions
--------

[](#versions)

BranchDrupal coreUse with`11.0.x``~11.3.0`Varbase `~11.0.0`, Drupal 11`10.1.x``~11.3.0`Varbase `~10.1.0``10.0.x``~10.6.0`Varbase `~10.0.0``9.2.x``~10.6.0`Varbase `~9.2.0``9.1.x``~10.6.0`Varbase `~9.1.0``no-patches`n/aPlugin only, manage your own listThe `patches` branch carries patch files only — do not require it.

Drupal Core Patches
-------------------

[](#drupal-core-patches)

Drupal **core** patches are managed in a dedicated package, [`vardot/drupal-core-patches`](https://github.com/Vardot/drupal-core-patches), so Varbase can always track the latest Drupal core release while keeping core patches separate from contrib patches.

`vardot/varbase-patches` **requires** `vardot/drupal-core-patches`. The core-patches package stores the curated Drupal core patches with **one git branch per Drupal core `major.minor`** — `10.4.x`, `10.5.x`, `10.6.x`, `11.1.x`, `11.2.x`, `11.3.x`, `11.4.x`, `12.0.x` — plus a flat `patches` branch that holds the actual `.patch` files. Each `drupal-core-patches` release `require`s `drupal/core ~.0`, so Composer automatically selects the patch set that matches the Drupal core version installed in your project.

On this branch `vardot/varbase-patches` requires:

```
{
  "require": {
    "vardot/drupal-core-patches": "~11 || ~12"
  }
}
```

> **Note:** `vardot/drupal-core-patches` is a **metapackage** — a storage for Drupal core patches — **not** a Composer plugin. The only Varbase patch *plugin* is `vardot/varbase-patches`. List `vardot/drupal-core-patches` only under `extra.composer-patches.allowed-dependency-patches`, and **never** under `config.allow-plugins`.

Composer commands
-----------------

[](#composer-commands)

The plugin registers two Composer commands to convert remote GitLab merge-request URLs in your patch lists into local timestamped `.patch` files under `./patches/`. They replace the Drush commands previously shipped in `varbase_core` (see [docs/migration-from-drush.md](docs/migration-from-drush.md)).

### Clean up the root `composer.json` file

[](#clean-up-the-root-composerjson-file)

- **Name:** `varbase-patches:cleanup:patches`
- **Aliases:** `var-ccup`
- **Description:** Detects any merge request patches in the root `composer.json` `extra.patches` block, downloads them to the local `./patches/` folder with a timestamped filename, and updates the root `composer.json` to use the local patch file.

```
composer varbase-patches:cleanup:patches
```

or

```
composer var-ccup
```

### Clean up the external `patches-file` JSON file

[](#clean-up-the-external-patches-file-json-file)

- **Name:** `varbase-patches:cleanup:patches-file`
- **Aliases:** `var-ccupf`
- **Description:** Detects any merge request patches in the JSON file referenced by `extra.patches-file`, downloads them to the local `./patches/` folder with a timestamped filename, and rewrites the patches-file JSON to use the local patch file.

```
composer varbase-patches:cleanup:patches-file
```

or

```
composer var-ccupf
```

Handling Varbase Patches Ignoring
---------------------------------

[](#handling-varbase-patches-ignoring)

To exclude a specific patch declared by `vardot/varbase-patches` (e.g. when you want to replace it with an improved version, or skip it entirely), add a `patches-ignore` block to your root `composer.json`:

```
{
  "extra": {
    "patches-ignore": {
      "vardot/varbase-patches": {
        "drupal/recaptcha": {
          "fix: #3588269 Make Drupal8Post::submit() compatible with parent":
          "https://git.drupalcode.org/project/recaptcha/-/commit/68b0f86d1e930ed78f795a97a2fc207be35b3260.diff"
        }
      }
    }
  }
}
```

Schema: `{ "": { "": { "": "" } } }`. Matching is done by URL — the description string is informational. A flat array of URLs (`{ "": { "": ["", ...] } }`) is also accepted.

This is the v1-style `patches-ignore` from `cweagans/composer-patches`, restored by this plugin on top of v2.

### Ignoring Drupal Core Patches

[](#ignoring-drupal-core-patches)

`vardot/drupal-core-patches` is an ordinary dependency that contributes patches through the dependency resolver, so the same `patches-ignore` block controls it — use `vardot/drupal-core-patches` as the **source** package and `drupal/core` as the **target**:

```
{
  "extra": {
    "patches-ignore": {
      "vardot/drupal-core-patches": {
        "drupal/core": {
          "Issue #3606822: ContainerBuilder synthetic kernel on install": "https://git.drupalcode.org/project/drupal/-/merge_requests/16159.patch"
        }
      }
    }
  }
}
```

Matching is by URL string, the same as for `vardot/varbase-patches`.

### Filename convention

[](#filename-convention)

```
[package name]--[Date]--[issue number]--[MR number].patch

```

Examples:

- `drupal-core--2026-05-10--3539178--mr-12890.patch`
- `ctools--2026-05-10--3572317--mr-85.patch`
- `redirect--2026-05-10--2879648--mr-109.patch`

Documentation
-------------

[](#documentation)

- [Overview](docs/README.md)
- [Installation](docs/installation.md)
- [Configuration](docs/configuration.md)
- [Commands](docs/commands.md)
- [Architecture](docs/architecture.md)
- [Migration from Drush](docs/migration-from-drush.md)
- [Troubleshooting](docs/troubleshooting.md)

External:

AI assistant context
--------------------

[](#ai-assistant-context)

This repository ships its own AI-assistant context so contributors get the same project conventions as core maintainers:

- [`AGENTS.md`](AGENTS.md) — vendor-neutral entry point. Works with any AI coding assistant (Claude Code, Cursor, Codex, Aider, Continue.dev, Copilot Workspace, …).
- [`CLAUDE.md`](CLAUDE.md) — Claude Code-specific entry point.
- [`.claude/agents/varbase-patches.md`](.claude/agents/varbase-patches.md) — Claude sub-agent.
- [`.claude/skills/composer-patches/SKILL.md`](.claude/skills/composer-patches/SKILL.md), [`.claude/skills/patch-management/SKILL.md`](.claude/skills/patch-management/SKILL.md) — Claude skills.

Requirements
------------

[](#requirements)

- PHP `>=8.1`
- `composer-plugin-api ^2.0`
- `cweagans/composer-patches ~2.0`

License
-------

[](#license)

GPL-2.0-or-later. See [LICENSE](LICENSE).

Maintainer
----------

[](#maintainer)

[Vardot](https://www.drupal.org/vardot) —

###  Health Score

61

—

FairBetter than 98% of packages

Maintenance99

Actively maintained with recent releases

Popularity38

Limited adoption so far

Community27

Small or concentrated contributor base

Maturity70

Established project with proven stability

 Bus Factor1

Top contributor holds 95.7% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~2 days

Total

422

Last Release

4d ago

Major Versions

9.1.89 → 10.0.1352026-06-27

10.1.76 → 11.0.172026-06-27

9.2.93 → 11.0.182026-06-28

9.1.x-dev → 10.0.x-dev2026-06-28

10.1.x-dev → 11.0.192026-06-30

### Community

Maintainers

![](https://avatars.githubusercontent.com/u/1641992?v=4)[Rajab Natshah](/maintainers/Natshah)[@Natshah](https://github.com/Natshah)

---

Top Contributors

[![Natshah](https://avatars.githubusercontent.com/u/1641992?v=4)](https://github.com/Natshah "Natshah (378 commits)")[![Arman-Ammar](https://avatars.githubusercontent.com/u/162977761?v=4)](https://github.com/Arman-Ammar "Arman-Ammar (5 commits)")[![ahmad-abbad](https://avatars.githubusercontent.com/u/20436730?v=4)](https://github.com/ahmad-abbad "ahmad-abbad (4 commits)")[![n-ghunaim](https://avatars.githubusercontent.com/u/74855113?v=4)](https://github.com/n-ghunaim "n-ghunaim (3 commits)")[![Mohammad-Fayoumi](https://avatars.githubusercontent.com/u/39179574?v=4)](https://github.com/Mohammad-Fayoumi "Mohammad-Fayoumi (2 commits)")[![Ahmaadkhader](https://avatars.githubusercontent.com/u/111915313?v=4)](https://github.com/Ahmaadkhader "Ahmaadkhader (2 commits)")[![abdallahaltanna](https://avatars.githubusercontent.com/u/78039972?v=4)](https://github.com/abdallahaltanna "abdallahaltanna (1 commits)")

---

Tags

composerdrupalpatchescomposer-patchesvarbasedrupal patchesvarbase patches

### Embed Badge

![Health badge](/badges/vardot-varbase-patches/health.svg)

```
[![Health](https://phpackages.com/badges/vardot-varbase-patches/health.svg)](https://phpackages.com/packages/vardot-varbase-patches)
```

###  Alternatives

[helsingborg-stad/municipio

A bootstrap theme for creating municipality sites.

4028.5k10](/packages/helsingborg-stad-municipio)[drupal/core-composer-scaffold

A flexible Composer project scaffold builder.

5445.2M564](/packages/drupal-core-composer-scaffold)[farmos/farmos

A web-based farm record keeping application.

1.3k7.1k1](/packages/farmos-farmos)[altis/core

Core module for Altis

19228.0k3](/packages/altis-core)[drupal/core-project-message

Adds a message after Composer installation.

2124.7M203](/packages/drupal-core-project-message)[vardot/varbase-project

Project template for Varbase distribution.

5362.5k](/packages/vardot-varbase-project)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)