Symfony Flex: What does symfony.lock file do?

Question

After installing symfony/serializer I recognized that my symfony.lock file got changed:

diff --git a/symfony.lock b/symfony.lock
index ba6e23f..bfc391e 100644
--- a/symfony.lock
+++ b/symfony.lock
@@ -301,5 +301,8 @@
     },
     "symfony/asset": {
         "version": "v3.3.10"
+    },
+    "symfony/serializer": {
+        "version": "v3.3.13"
     }
 }

From what I understand, it was introduced with Symfony Flex, but how does it differ from composer.lock and why is it needed on top of that?

Answer 1

It is the proper lock file for Symfony recipes instead of trying to guess via the state of composer.lock

Flex keeps tracks of the recipes it installed in the symfony.lock file, which must be committed to your code repository (CVS). https://symfony.com/doc/3.4/setup/flex#how-does-flex-work

It was introduced since Flex 1.0.34 version, originally to solve bugs like this: "Configuring recipes executed twice".