Why are you adding composer.lock to the gitignore file?

It's not required for operation and it's also ignored in another package.

And how are we supposed to update that file in the future?

@Hackwar is correct the composer.lock should not be in the .gitignore

It might be correct in other software packages where the user always has to run composer but thats not the case or joomla where composer is only used by those developing the cms

We don't the lock file for subpackages because they get updated with joomla composer.lock but I can put it back if you like. We keep some and some are ignored seam not 100% clear to me.

Composer does not use the lock files from packages in the vendor directory for calculating the dependency tree, it is not needed to check anything matching libraries/vendor/**/composer.lock into the repository (I'll go so far as to say that package is wrong for checking in a lock file in the first place, libraries shouldn't be checking those in).

reading through this again, I misread the original commit. @HLeithner you were right in adding that to gitignore.

I only removed the composer.lock of polyfill-unserialize and phpmailer.
I would create a new PR for the suggested global composer.lock ignore including some other cleanups.

I would add the following files to the list (feedback is welcome)

• libraries/vendor/**/.appveyor.yml
• libraries/vendor/**/.gitattributes
• libraries/vendor/**/.gitignore
• libraries/vendor/**/.github
• libraries/vendor/**/.gitmodules
• libraries/vendor/**/.travis.yml
• libraries/vendor/**/composer.lock
• libraries/vendor/**/composer.json
• libraries/vendor/**/CONTRIBUTING.md
• libraries/vendor/**/LICENSE
• libraries/vendor/**/phpunit*
• libraries/vendor/**/README*
• libraries/vendor/**/test*
• libraries/vendor/**/UPGRADING.md

All LICENSE files should be checked in AND shipped unless someone is going to create and maintain a singular file listing all licenses of all third party elements.

Don’t most licenses also have text along the lines of “you should have received a copy of the license with this software and if not contact us”? There is a method to the madness used for what files were elected to be kept and what files stripped.

I thought the same about the license files. Doesn't matter if we include the license files or not, so better include them.

Which method do you refrer to? I didn't found more then the comment at top of the ignore file.

I have tested this item ✅ successfully on bef949c

thx for testing.