This article is from the comp.sys.acorn FAQ, by Paul Vigay with numerous contributions by others.
All patch modules, official RISC OS extensions and the like can be sourced from the RISC OS ftp sites. Ideally your dealer will also have copies of them too and you should be able to obtain them from them. (If they don't you may like to pass on the ones from the ftp site, if you request them, so that they are up to-date.) Failing that you should probably contact RISCOS Ltd who now manage all aspects of RISC OS development.
I am also in the process of compiling a complete list of up-to-date module version numbers, together with links to where you can download them from.
This database is online at http://www.vigay.com/riscos/system/