I discovered a strange behaviour when deploying Symfony Flex applications on Windows using Git and Composer. Somehow the line endings in symfony.lock are changing during composer install. Maybe someone can give me a hint what I'm doing wrong or what I can do better.

The Environment:

• Windows based development machine
• Windows based production sever
• Git configured with core.autocrlf=true on both machines

Steps to reproduce:

1. Create a new project on dev
   composer create-project symfony/skeleton demo
symfony.lock is created using LF charater as line endings ✔️

2. Add everything to Git
   cd demo
git init
git add -A

3. A warning is displayed but symfony.lock still has LF line endings in working copy ✔️

warning: LF will be replaced by CRLF in symfony.lock.
The file will have its original line endings in your working directory.

4. Commit & Push
   git commit -m "init"
git remote add origin https://...
git push -u origin master

5. Clone project on prod machine
   git clone https://... demo
symfony.lock now has CRLF line endings (because of core.autocrlf=true) ✔️

6. Check status
   cd demo
git status

On branch master
Your branch is up-to-date with 'origin/master'.
nothing to commit, working tree clean

7. Install project
   composer install
symfony.lock now has LF line endings ❓

8. check status again
   git status

On branch master
Your branch is up-to-date with 'origin/master'.
Changes not staged for commit:
(use "git add ..." to update what will be committed)
(use "git checkout -- ..." to discard changes in working directory)

    modified:   symfony.lock

no changes added to commit (use "git add" and/or "git commit -a")

So my question is why is symfony.lock updated during composer install? Is that an expected behaviour? I thougth it should be read-only during install just like composer.lock?

Everytime I update my project on production I will have to revert the changes to symfony.lock before I can do a git pull. Thats not very intuitive.