I don't know if this is a bug or not. I created a brand new PHP project and it created two composer.json files. One outside the root and one inside the root.
I have done absolutely nothing with this project other than set it up. Is this normal?