Changes in patches are not recognised in project dependency dependencies

[jaapjan]

Given you have a project composer.json file like this:

{
    "name": "project/base",
    "require": {
        "project/dependency-1": "^1.0"
    }

Given project/dependency-1 version 1.0 has this composer.json file:

{
    "name": "project/dependency-1",
    "require": {
        "project/dependency-2": "^1.0"
    },
    "patches": {
            "project/dependency-2": {
                "patch 1": "https://x.y/patch.patch"
            }
     }

Then when you update project/dependency-1 to version 1.1 and include a new patch this patch, e.g. like this:

{
    "name": "project/dependency-1",
    "require": {
        "project/dependency-2": "^1.0"
    },
    "patches": {
            "project/dependency-2": {
                "patch 1": "https://x.y/patch.patch",
                "patch 2": "https://x.y/patch-2.patch"
            }
     }

is not recognised by project/base when doing a composer update project/dependency-1 --with-all-dependencies.

The work-around is to remove the directory project/dependency-1 first from your vendor folder and then running the composer update command again.

We encountered this issue in https://github.com/goalgorilla/open_social/pull/1185 I'm wondering if this is actually a bug or if this is how it is supposed to work?

[jaapjan]

I'm curious to hear the thoughts of the maintainer on this.

[oyvind-stromsvik]

This works for me, but not consistently on the first try.

If I update project/dependency-1 to a new version where I've added a new patch and then run composer update project/dependency-1 --with-dependencies then sometimes it notices the new patch and applies it and sometimes it doesn't. If it doesn't I have to run composer update nothing afterwards and then it usually notices and applies the new patch, but if it doesn't I just have to run composer update nothing again until it does. It's not what I'd call dependable, but I've had the same issue where it would not recognize patches before I moved patches out into dependencies as well, maybe not as often though.

I'm just now starting to move patches out into dependencies rather than have them all in the project composer.json because it was getting hard to manage so I only have a few hours of experience with this, but it seems to work without me having to remove the directory first at least.

Edit: I should also note that I added enable-patching (https://github.com/cweagans/composer-patches#allowing-patches-to-be-applied-from-dependencies) to both my project composer.json and my depedency composer.json. Before I added it to my depedency composer.json I couldn't get this to work at all.

[tomasnorre]

Wouldn't your need

"extra": {
      "enable-patching": true
  }

To have patches from dependencies applied? https://github.com/cweagans/composer-patches#allowing-patches-to-be-applied-from-dependencies

[nick-vanpraet]

Yes, enable-patching is enabled for us as well (otherwise it would never pick up dependency patches at all) and we're encountering the same issue.

Example:

We have a Drupal 8 distribution, with a composer.json and .lock file. Our dependencies have patches. We made sure all the patches applied correctly, and are present under patches_applied in the .lock file. When creating a new Drupal instance with this distribution, running "composer install" does not result in all the patches being applied. Running composer install a second time immediately afterwards does result in all the patches being applied.

The patches that aren't applied appear to be dependencies of dependencies. To be exact: our distribution requires an install profile, which in turn requires contrib modules. The patches from the install profile apply, the ones from contrib don't (the first time).

So my best guess is it's gathering patches too early? Before the full dependency list has been created?

[davereid-pfg]

Well the problem is when that project that needs to have the additional patch isn't updated in the composer update as per https://github.com/cweagans/composer-patches/issues/376 and https://github.com/cweagans/composer-patches/issues/411

[cweagans]

main doesn't do dependency patch resolution out of the box anymore.