Anyone who's spent time in a mature PHP codebase knows the pain: a third-party Composer package has a bug or a missing feature, upstream is slow to merge your PR (or unresponsive entirely), and you need a fix today. The usual answers — forking the package, monkey-patching at runtime, or manually editing files in vendor/ that get blown away on the next composer install — are all terrible in their own ways.

vendor-patches takes a cleaner approach. It's a framework-agnostic CLI and Composer plugin that lets you:

• Generate a patch from local edits you've made to a file inside vendor/
• Apply those patches automatically after every composer install or composer update
• Revert patches cleanly when the upstream fix lands
• Track the status of every patch — applied, drifted, obsolete — so you always know what modifications your dependency tree is carrying

The "framework-agnostic" bit matters. There are existing tools tied to specific ecosystems (Drupal has composer-patches, for instance), but this one aims to work in any PHP project — Laravel, Symfony, Slim, a plain script, whatever. That broadens the audience considerably.

Who benefits? Anyone maintaining a long-lived PHP application with pinned dependencies. Consultants who inherit legacy codebases full of "don't touch that vendor directory" folklore. Teams running slightly modified versions of abandoned packages. Anyone who's ever committed vendor/ to git out of desperation.

The status-tracking feature is the standout. Most patch-management workflows fall apart because nobody knows what's been modified after a few years of turnover. Having a first-class "here's every patch, here's whether it still applies cleanly" report turns a hidden liability into visible, auditable technical debt.