Composer - how to track changes to packages

Question

What's the best way to track (my own) changes to Composer packages and then merge those with later updates to the packages themselves?

These are changes/customizations that I've made to a package that are specific to a given project.

I'm currently just committing the /vendor folder to my VCS and then merging/updating my changes there, but I imagine there's a better way?

Should I just be using svn:externals or Git submodules for this kind of thing?

Answer 1

There are basically only two options if the external software you use does not offer the feature you need:

1. Offer a patch to be included in the official version so that you are able to use the feature you wanted directly inside the external software.
2. Modify your way of including the software so that the feature is added by YOUR code, and use the external software unaltered.

The third way would be to constantly modifying the new versions of the external software to your liking, but this will end in maintenance hell. You seem to do this, but you shouldn't.

Both svn externals or git submodules are additionally a bad way to deal with this, especially if you want to use Composer to maintain your dependencies.

So the right way is to create a package yourself that depends on another external package and adds the feature you want. You can then use Composer exclusively to manage dependencies. Maintenance is easy, because the dependency on the external package can be tied to one single version if needed, or be relaxed to a range of versions, as long as your modification is compatible.

Should you enncounter a new external version that is incompatible with your modification, you can create a new version of your package that depends on the new version but not the old one, and recreate the modification. Updating your main software to the new version of your modification will automatically try to fetch the newer version of the external software as well, or will decline to install your newer modification because another package depends on the older external version.