Last year I took over a maintenance of the Magento 2 Commerce site. One of first tasks was adjusting the site to meet industry standards as it was a bit messy. The whole content of vendor/ directory was kept in the repository and there were about 30 patch files placed in the site root, without any information which were applied and in which order. Most of them looked as provided by M2 support. I needed to clean this up – to figure out which patches are applied, in which order they are applied and finally find a way allowing me to remove vendor/ from the repository and to be able to apply patches dynamically, during the deployment.
This was a challenging task – I needed to keep comparing the vendor/ contents with the version of this directory coming from clean Magento 2 site, and then keep applying patches until directories were the same. I was able to do this, it proved that about 25 of these patches were really applied.
Recently I wrote a blog post explaining how to deal with the second part of this challenge – check Rocket Web blog to see how to apply Magento 2 core patches.