Why do we need both composer.lock and symfony.lock?

[nbro]

I'm relearning Symfony. Back when I first used Symfony several years ago, I think there was already composer, but no Symfony CLI. It's still unclear to me why we need both.

Here are my questions

1. Why do we need both composer.lock and symfony.lock? Which dependencies are in composer.lock and symfony.lock?
   I'd assume that symfony.lock contains only Symfony dependencies and composer.lock contains all other dependencies, but what is a Symfony dependency, if that assumption is true?

2. Which command really produces symfony.lock? I know composer install creates composer.lock

3. What was the real name for Symfony CLI? Wasn't composer enough?

[MatTheCat]

symfony.lock has actually nothing to do with Symfony CLI: it is managed by a Composer plugin named Symfony Flex to handle recipes. You can read about it on https://symfony.com/doc/current/quick_tour/flex_recipes.html

[nbro]

The answer seems to be that Flex, the composer plugin that manages symfony.lock, maintains other info, like recipes, in the file symfony.lock, which not all composer packages require.