Added all patches locally to mitigate potential security issues:

cweagans/composer-patches#347

Note that patch paths are currently relative to the root composer.json,
so the paths start with "drupal/modules/omnipedia/". This will hopefully
be fixed in some fashion either when we open source or when a solution
to resolve the paths is found, whichever comes first.

omnipedia_user_import/composer.json

@@ -18,8 +18,8 @@
   "extra": {
     "patches": {
       "drupal/bulk_user_registration": {
-        "Allow Updating Existing Users [#3202593]: https://www.drupal.org/project/bulk_user_registration/issues/3202593#comment-14110991 ": "https://www.drupal.org/files/issues/2021-05-21/bulk_user_registration-update_existing_users-3202593-4.patch",
-        "Add hook_bulk_user_registration_user_postsave() [#3224168]: https://www.drupal.org/project/bulk_user_registration/issues/3224168 ": "https://git.drupalcode.org/project/bulk_user_registration/-/merge_requests/2.patch"
+        "Allow Updating Existing Users [#3202593]: https://www.drupal.org/project/bulk_user_registration/issues/3202593#comment-14110991": "drupal/modules/omnipedia/omnipedia_user_import/patches/drupal/bulk_user_registration/bulk_user_registration-update_existing_users-3202593-4.patch",
+        "Add hook_bulk_user_registration_user_postsave() [#3224168]: https://www.drupal.org/project/bulk_user_registration/issues/3224168#comment-14167127": "drupal/modules/omnipedia/omnipedia_user_import/patches/drupal/bulk_user_registration/merge-request-2-post-save-hook.patch"
       }
     }
   }

omnipedia_user_import/patches/drupal/bulk_user_registration/bulk_user_registration-update_existing_users-3202593-4.patch

@@ -0,0 +1,56 @@
+diff --git a/src/BulkUserRegistration.php b/src/BulkUserRegistration.php
+index 87961f1..5400e69 100644
+--- a/src/BulkUserRegistration.php
++++ b/src/BulkUserRegistration.php
+@@ -57,14 +57,18 @@ class BulkUserRegistration implements BulkUserRegistrationInterface {
+     $langcode = \Drupal::languageManager()->getDefaultLanguage()->getId();
+
+     /** @var \Drupal\user\UserInterface $user */
+-    $user = User::create();
+-    $user->setUsername($userData[self::FIELD_USER_NAME]);
+-    $user->setEmail($userData[self::FIELD_EMAIL]);
+-    $user->set('init', $userData[self::FIELD_EMAIL]);
+-    $user->set('langcode', $langcode);
+-    $user->set('preferred_langcode', $langcode);
+-    $user->set('preferred_admin_langcode', $langcode);
+-    $user->enforceIsNew();
++    $user = user_load_by_mail($userData[self::FIELD_EMAIL]);
++    if (!$user) {
++      $user = User::create();
++      $user->setUsername($userData[self::FIELD_USER_NAME]);
++      $user->setEmail($userData[self::FIELD_EMAIL]);
++      $user->set('init', $userData[self::FIELD_EMAIL]);
++      $user->set('langcode', $langcode);
++      $user->set('preferred_langcode', $langcode);
++      $user->set('preferred_admin_langcode', $langcode);
++      $user->enforceIsNew();
++    }
++
+     if (!$userData[self::FIELD_STATUS]) {
+       $user->block();
+     }
+diff --git a/src/Form/BulkUserImport.php b/src/Form/BulkUserImport.php
+index 99c4c90..df4a7f4 100644
+--- a/src/Form/BulkUserImport.php
++++ b/src/Form/BulkUserImport.php
+@@ -221,16 +221,14 @@ class BulkUserImport extends FormBase {
+       return;
+     }
+
+-    // This user already exists. Do not import.
+-    if (user_load_by_mail($userData[BulkUserRegistrationInterface::FIELD_EMAIL])) {
+-      return;
+-    }
++    // Check if user already exists.
++    $existing_user = user_load_by_mail($userData[BulkUserRegistrationInterface::FIELD_EMAIL]);
+
+     $user = \Drupal::service('bulk_user_registration')
+       ->createUser($userData, $defaultRole);
+
+-    // Notify user via mail.
+-    if ($user->isActive()) {
++    // Notify new user via mail.
++    if (!$existing_user && $user->isActive()) {
+       _user_mail_notify('register_no_approval_required', $user);
+     }
+

omnipedia_user_import/patches/drupal/bulk_user_registration/merge-request-2-post-save-hook.patch

@@ -0,0 +1,55 @@
+From 9c04251680acee249fa960440d4892b00a41ecd5 Mon Sep 17 00:00:00 2001
+From: Matei Stanca <i@ambientimpact.com>
+Date: Sun, 18 Jul 2021 21:48:44 -0400
+Subject: [PATCH] Added hook_bulk_user_registration_user_postsave().
+
+---
+ bulk_user_registration.api.php | 19 +++++++++++++++++++
+ src/BulkUserRegistration.php   |  4 ++++
+ 2 files changed, 23 insertions(+)
+
+diff --git a/bulk_user_registration.api.php b/bulk_user_registration.api.php
+index a8146b4..792b61b 100644
+--- a/bulk_user_registration.api.php
++++ b/bulk_user_registration.api.php
+@@ -46,3 +46,22 @@ function hook_bulk_user_registration_user_presave(UserInterface $user, array $da
+     $user->set('identifier', trim($data['identifier']));
+   }
+ }
++
++/**
++ * Alter the user object after it has been saved following import of CSV data.
++ *
++ * Typically used to perform tasks that require the imported user to exist in
++ * the database.
++ *
++ * @param \Drupal\user\UserInterface $user
++ *   The user object.
++ * @param array $data
++ *   The raw CSV data.
++ *
++ * @see hook_bulk_user_registration_extra_fields()
++ */
++function hook_bulk_user_registration_user_postsave(UserInterface $user, array $data) {
++
++  // Do stuff.
++
++}
+diff --git a/src/BulkUserRegistration.php b/src/BulkUserRegistration.php
+index 87961f1..ef87f4b 100644
+--- a/src/BulkUserRegistration.php
++++ b/src/BulkUserRegistration.php
+@@ -96,6 +96,10 @@ class BulkUserRegistration implements BulkUserRegistrationInterface {
+
+     $user->save();
+
++    $this->moduleHandler->invokeAll(
++      'bulk_user_registration_user_postsave', [$user, $userData]
++    );
++
+     return $user;
+   }
+
+-- 
+GitLab
+