Drupal Website Patches

Web Patches shows the patches declared for your site, and the ignored ones, right in the admin UI.

Composer applies the patches, through cweagans/composer-patches and the webship/patches plugin. This module does not apply, download or write patches, and it never fetches a URL. It reads the same declarations and rules Composer reads, so a site owner can see what is patched without opening a terminal.

Features

• Patching sources: the declaration files, and every installed package that declares patches, marked Allowed or Not allowed with the reason.
• Patch lock: whether patches.lock.json matches the declarations, with the differences and the command that fixes them.
• Patches: every declared patch, linked to its drupal.org project, issue and merge request.
• Ignored patches: every patch that is not applied, and why (not in the allowlist, matched by an ignore rule, or listed in patches-ignore).
• A settings form at Configuration > Development > Web Patches to pick the sources and a custom patches file.

Why? Some contrib modules ship their own extra.patches pointing at stale or third party URLs, and a curated patch set changes with every release. Composer knows what it applied, but that lives in lock files and build logs. Web Patches puts it on one report page.

Both permissions are restricted, since the report shows server paths and package versions. Requires Drupal core ^11.1.

Documentation

Full documentation with screenshots: project.pages.drupalcode.org/webpatches

Works with

• cweagans/composer-patches v2 (it reads the v1 keys too)
• webship/patches: the Webship curated patch list and Composer plugin
• webship/drupal-patches: the Webship curated Drupal core patches, one branch per core minor