Magento 2. How can I properly extend vendor/composer/installed.json?

Question

• I assume that installed.json contains all the dependencies needed for Magento.
• How can I properly extend vendor/composer/installed.json?

Context:

• Magento has a hard dependency on one of the libraries, more specifically a specific version of a third party module msp/recaptcha:2.0.2. I want to update it to 2.1.2.
• Now if it were a softer dependency (~2.0.2) I could have done so from composer.json as described in the answer of this question

By this point it should be clear what I need to achieve and why. Please ask for any more details if needed. Thanks.

Answer 1

Depends what you mean by extend.

Certainly this route works.

So remove original via composer

    "replace": {
        "msp/recaptcha": "*"
    },

composer install

Package operations: 0 installs, 0 updates, 1 removal
  - Removing msp/recaptcha (2.0.2)
Removing Msp/Recaptcha

https://github.com/magento/magespecialist_ReCaptcha/tree/v2.1.2

Extract 2.1.2 to app/code/MSP/ReCaptcha

php bin/magento setup:upgrade

Check setup_module table and MSP_ReCaptcha entry says 1.5.0.

Matches what's in code

https://github.com/magento/magespecialist_ReCaptcha/blob/v2.1.2/etc/module.xml#L24

Site seems functional. That's good enough for me. I'm now in control of this extension.