How to edit composer-loaded vendor code the right way (in PHP)?

Question

Problem

Sometimes composer-loaded dependencies are buggy or are missing something you need.

Question(s)

1.) Is it in general allowed to touch/edit anything that composer loaded ?

2.) If yes, then how to prevent these edit from being overwritten / generating conflicts with the next update

3.) If no, then what the way-to-go when edits of composer-loaded dependencies are needed ?

Answer 1

1. The simple answer is no.

2. You can edit the files, but the changes are not permanent.

3. You have to find a way to get the bug fixed. Available methods are:

   1. report the bug upstream, possibly with a suggested fix (patch or pull request), and wait for it to be included in a new version
   2. clone the original software, fix the bug there, and point to your cloned repository with your composer.json during the time for a) to happen. You might have to alias the dev-master branch (or whatever branch you used to fix the bug) as the next version to satisfy all dependencies.
   3. If the original project is unmaintained, you can think about re-publishing it under a new name, with the bug fixed, and stating in the composer.json that this new software replaces the old one. Please see my answer here for details.
   4. You could also switch to a different software that has less bugs.
   5. You could also try to patch the bug by extending the buggy class in your own codebase, or work around it in other means.