Decision

When using cweagans/composer-patches, patches will be specified in composer.json and not composer.patches.json. We will not use the patches-file configuration key. This ensures that composer validate lints the entire Composer configuration, including patches.

Consequences

Projects that have a separate patches file will need to inline their configuration. Given the clear benefits in having a valid Composer configuration, we view this as worthwhile for all existing and inherited projects.