You should always track and apply Drupal 8 patches through Composer (within your composer.json file). Check out the video for the why and the how. Tags Drupal 8