patches.lock.json

Filenames may vary in some projects

If the COMPOSER environment variable is set when running various Composer Patches commands, the file normally named patches.lock.json will be named differently.

patches.lock.json is the mechanism that Composer Patches now uses to maintain a known-good list of patches to apply to the project. For external projects, the structure of patches.lock.json may also be treated as an API. If you’re considering patches.lock.json as a data source for your project, there are a few things that you should keep in mind:

patches.lock.json should be considered read-only for external uses.
The general structure of patches.lock.json will not change. You can rely on a JSON file structured like so:

1{
2    "_hash": "[the hash]",
3    "patches": [{patch definition}, {patch definition}, ...]
4}

Each patch definition will look like the expanded format that users can put into their composer.json or external patches file.
No removals or changes will be made to the patch definition object. Additional keys may be created, so any JSON parsing you’re doing should be tolerant of new keys.
The extra object in each patch definition may contain a number of attributes set by other projects or by the user and should be treated as free-form input. Currently, Composer Patches uses this attribute to store information about where a patch was defined (in the provenance key).