Figure out how to manage patches with cweagans/composer-patches 2.x (or alternative)

[joeparsons]

What is the problem that we want to solve?

The maintainer of cweagans/composer-patches has announced that the 2.0.0 version of his composer-patches plugin will no longer provide dependency patch resolution (i.e. discovering and applying patches defined by dependencies rather than in the root level composer.json file). https://www.cweagans.net/2023/07/dependency-patch-resolution/

We currently rely heavily on this feature of composer-patches 1.x since we maintain most of our patches in the az-digital/az_quickstart repo which is used as a dependency in project-specific composer.json files (e.g. az-digital/az-quickstart-scaffolding and az-digital/az-quickstart-pantheon).

We'll need to figure out a plan for how to deal with this change. Some high-level options include:

• Continue using composer-patches 1.x (which will stop being supported soon after 2.0.0 is released)
• Create our own composer plugin that extends composer-patches 2.x to restore the dependency resolution functionality (or find a new composer plugin that extends composer-patches in this way)
• Consider finding an alternative to cweagans/composer-patches

[joeparsons]

2023-07-26 Meeting discussion

@tadean pointed out that we don't actually need the full functionality provided by composer-patches. We really only need to apply patches from the az-digital/az_quickstart package so maintaining that functionality specifically might not be too complicated.

@trackleft Pointed out that some of our other az-digital projects also add patches (e.g. az-digital/az_google_cse)

[joeparsons]

Promising new update from cweagans! https://www.cweagans.net/2024/02/update-on-dependency-patch-resolution/