bug: Lockfile is not fully deterministic

[DoDoENT]

Did you check docs and existing issues?

• [X] I have read all the lazy.nvim docs
• [X] I have searched the existing issues of lazy.nvim
• [X] I have searched the existing issues of plugins related to this issue

Neovim version (nvim -v)

0.10.0

Operating system/version

Linux and MacOS

Describe the bug

I'm committing my lazy-lock.json file to my dotfiles git to ensure all my computers use the same version of all plugins for which my config is tweaked and tested.

To ensure consistency, I'm using the R option in the Lazy Menu to ensure it restores the same plugin versions after pulling the latest changes from my other computer.

However, after pulling the changes and pressing R in the Lazy Menu to restore the plugins, I can see changes in my lazy-lock.json file that make no sense.

Here is an example of the diff:

Head: master
Merge: origin/master
Help: g?

Unstaged (1)
M dotfiles/nvim/lazy-lock.json
@@ -17,7 +17,7 @@
   "image.nvim": { "branch": "master", "commit": "a2a0849e0b3dbed90f9283603cedb683bda5d4d1" },
   "indent-blankline.nvim": { "branch": "master", "commit": "d98f537c3492e87b6dc6c2e3f66ac517528f406f" },
   "lazy.nvim": { "branch": "main", "commit": "fafe1f7c640aed75e70a10e6649612cd96f39149" },
-  "lsp-zero.nvim": { "branch": "main", "commit": "aa36afcf7a59fbd98008c9a434593c423d3d649a" },
+  "lsp-zero.nvim": { "branch": "v3.x", "commit": "aa36afcf7a59fbd98008c9a434593c423d3d649a" },
   "lualine-web-devicons": { "branch": "master", "commit": "b4b302d6ae229f67df7a87ef69fa79473fe788a9" },
   "lualine.nvim": { "branch": "master", "commit": "0a5a66803c7407767b799067986b4dc3036e1983" },
   "mason-lspconfig.nvim": { "branch": "main", "commit": "a4caa0d083aab56f6cd5acf2d42331b74614a585" },

As you can see, lsp-zero.nvim package is still on the same commit it was on my other computer (which is OK and expected), but the branch name has changed. Apparently, both main and v3.x branches currently point to the same commit in the lsp-zero.nvim repository. This confuses the lazy.nvim to randomly choose the branch pointing to the commit.

This not only causes annoying diffs on my different computers, but also introduces a small risk of having different update behavior on different computers - I'm guessing that lazy.nvim uses the branch name to check for updates in that branch, and if for some plugin those branches diverge, different computer using the same lockfile in the same time can observe different updates for the same plugin, assuming that the diff in question wasn't reverted or committed.

Can this be made consistent?

Steps To Reproduce

1. Install some plugin that has multiple branches pointing to the same comit.
2. Move the lazy-lock.json to a different computer
3. Restore the plugins from migrated lockfile on a different computer

Expected Behavior

Restoring the plugins should never modify the lazy-lock.json

Actual Behavior

Sometimes the file is changed in an unexplained way.

[folke]

It still all works correctly right?

Not worth looking into this. Won't fix, closing...

[DoDoENT]

It works correctly, it's just annoying. Maybe some junior may find this a worthy "first contribution" issue?