Why does Symfony Flex adds own "dev-develop" bundles to root level in composer.json?

I've got a big Symfony project and started to outsource code to standalone bundles. This works like charm.

But I've realized that the composer.json contains "weird" infos on root level, after performing a composer update:

This is why what I'm asking for:

    "customer/base-bundle": {
        "version": "dev-develop"
    },
    "customer/a-bundle": {
        "version": "dev-develop"
    },
    "customer/b-bundle": {
        "version": "dev-develop"
    },
    "customer/c-bundle": {
        "version": "dev-develop"
    },
    "symfony/polyfill-intl-idn": {
        "version": "v1.11.0"
    },

This is the regular config in composer.json:

    "repositories": {
        "base-bundle": {
            "type": "vcs",
            "url": "git@git.example.com:customer-shared/base-bundle.git"
        },
        "a-bundle": {
            "type": "vcs",
            "url": "git@git.example.com:customer-shared/a-bundle.git"
        },
        "b-bundle": {
            "type": "vcs",
            "url": "git@git.example.com:customer-shared/b-bundle.git"
        },
        "c-bundle": {
            "type": "vcs",
            "url": "git@git.pixelpark.com:customer-shared/c-bundle.git"
        }
    },
    "require": {
        // ...
        "customer/base-bundle": "dev-develop",
        "customer/a-bundle": "dev-develop",
        "customer/b-bundle": "dev-develop",
        "customer/c-bundle": "dev-develop"
    }

The repositories and require section is fine. I just don't know why it adds the "dev-develop" packages (and the symfony/polyfill-intl-idn package) separately to composer.json's root.

Is this Symfony/Flex behaviour or Composer default? And for what is this extra information used?

Thanks in advance!

It figured out that there is a bug, when you rename composer.json this way: composer-dev.json

Symfony Flex has a str_replace for their symfony.lock file.

However renaming a custom composer.json this way: dev-composer.json works.