Symfony Flex: What does symfony.lock file do?

Question

After installing symfony/serializer I recognized that my symfony.lock file got changed:

diff --git a/symfony.lock b/symfony.lock
index ba6e23f..bfc391e 100644
--- a/symfony.lock
+++ b/symfony.lock
@@ -301,5 +301,8 @@
     },
     "symfony/asset": {
         "version": "v3.3.10"
+    },
+    "symfony/serializer": {
+        "version": "v3.3.13"
     }
 }

From what I understand, it was introduced with Symfony Flex, but how does it differ from composer.lock and why is it needed on top of that?

Solution

It is the proper lock file for Symfony recipes instead of trying to guess via the state of composer.lock

Flex keeps tracks of the recipes it installed in the symfony.lock file, which must be committed to your code repository (CVS). https://symfony.com/doc/3.4/setup/flex#how-does-flex-work

It was introduced since Flex 1.0.34 version, originally to solve bugs like this: "Configuring recipes executed twice".

Comments

[waghanza]

thanks for this clear answer. does it mean that symfony.lock could be removed from vcs ?

[yceruto]

@waghanza I just updated the answer to be more explicit about this, the symfony.lock file must be committed into your CVS repository. Thanks!

[gview]

No, the composer.lock is used for keeping track of the resolution of dependencies in the composer.json. The Symfony recipes are something separate and not mutually exclusive.

[yceruto]

@gview the question/answer is not about composer.lock, but symfony.lock file when Symfony Flex is used.

[gview]

@yceruto: my comment was an answer to the question from waghanza.