That's fair. Then I think we still need to fix the composer.json in the patch...

That's fair. Then I think we still need to fix the composer.json in the patch (there isn't one) and an updated composer.lock. I could be wrong but I don't see how we got the modified composer.lock as in the patch. Was it manually edited?