---
title: "Send fixes to the projects you depend on · Agent Wranglers"
url: https://agentwranglers.se/playbook/open-source/using-open-source/upstream-contributions
id: OSS-44
level: Recommended
applies: team
updated: 2026-10-27
build: a2a6bdfed830
tokens: 836
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Send fixes to the projects you depend on

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Using open source](https://agentwranglers.se/playbook/open-source/using-open-source.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: OSS-44
- Level: Recommended
- Chapter: [Using open source](https://agentwranglers.se/playbook/open-source/using-open-source.md)
- Rule: Write down who may contribute to outside open source projects on the company's behalf, and under which licence and sign-off. Every local patch to a dependency links to the upstream issue or pull request that would make it unnecessary.
- Check: The policy file exists and names an approver. A script finds every file in `patches/` and fails when one has no `Upstream:` line with a link to an issue or pull request.
- Applies when: The project has two or more developers.
- How: A patch kept only in your own tree must be carried by hand through every upgrade. It breaks on the day upstream changes the same lines. Sending it back removes that cost and helps the project you rely on. The policy says which projects need no approval and who checks for secrets and customer code before a change leaves. It also says whether staff sign contributor agreements. Patch tools such as `patch-package` or a `patches/` folder hold the local copy until the fix is released. Contributions follow the project's own rules, such as [Record each contributor's right to submit](https://agentwranglers.se/playbook/open-source/contributions/contributor-sign-off.md).

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
import { readFileSync, readdirSync } from 'node:fs';
const missing = readdirSync('patches').filter(file => !/^Upstream: https:\/\/\S+/m.test(readFileSync(`patches/${file}`, 'utf8')));
missing.forEach(file => console.log(`FAIL patches/${file} has no Upstream link`));
process.exit(missing.length ? 1 : 0);
```

### Python example

```python
import pathlib, re, sys
missing = [p.name for p in pathlib.Path("patches").iterdir()
           if not re.search(r"^Upstream: https://\S+", p.read_text(), re.M)]
for name in missing:
    print(f"FAIL patches/{name} has no Upstream link")
sys.exit(1 if missing else 0)
```

## Related rules

- OSS-9 [Record each contributor's right to submit](https://agentwranglers.se/playbook/open-source/contributions/contributor-sign-off.md) in Open source maintenance

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/open-source/using-open-source/upstream-contributions">Agent Wranglers open source maintenance playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Ship the licence texts and notices of every dependency you distribute](https://agentwranglers.se/playbook/open-source/using-open-source/dependency-notices.md)
- [Using open source](https://agentwranglers.se/playbook/open-source/using-open-source.md)