WSO2 API Manager and MI are a collection of different jars and webapps. In our opensource code base, each product has a product repo (product-apim, micro-integrator, product-is) and multiple component repositories (carbon-apimgt, wso2-synapse). All of these are in the WSO2 or WSO2-extensions organization.
If you want to find the codebase for a specific version of a product or a component, you can check the release tag of the repository. For an example, if you want to find the APIM 4.0.0 related code base, you first need to get the 4.0.0 tag in product-apim repository.
Since we use maven as the build tool, pom.xml in the product repository includes all the component versions. Most of the time, fix is sent to a component repository and you can find the relevant component version by referring to this pom.xml. For example, most of the apim specific components are included in the carbon-apimgt repository. You can find the relevant carbon-apimgt version in the pom.xml as 9.0.174.
If you check out the carbon-apimgt repo's 9.0.174 tag, you can find the relevant code base. Similarly, synapse version is 2.1.7-wso2v227.
Once you find the relevant code base, you can apply your fix and build the component locally. This will build the jar with your fix and you can patch the product by adding this jar to the /repository/component/patches/patch0001/<Jar_name>.jar.
Make sure that use the same name as the jar included in the /repository/component/plugins repository (Sometimes the "-" in the name is converted to "_" in the name).
