Does Composer patch core automatically? I am using Composer on a Lightning drupal distro. In my composer.json file I set enable-patching true. And I added one core patch for /patches/core-file_upload_ajax_message-1489692-68.patch. WHen I run composer update it applys 3 other patches. See output. Is Composer doing this by itself? 

Applying patches for drupal/core
./patches/core-file_upload_ajax_message-1489692-68.patch (Incorrect handling of file upload limit exceeded - file widget disappears)
https://www.drupal.org/files/issues/no_hook_to_edit-2822460-2.patch (multi-value field widget hook)
https://www.drupal.org/files/issues/2652138-41.patch (2652138 - ImageFormatter does not support SVGs)
https://www.drupal.org/files/issues/1356276-303.patch (1356276 - Allow profiles to provide a base/parent profile and load them in the correct order)
Composer doesn't patch core automatically, but the cweagans/composer-patches plugin allows dependencies to patch other dependencies if:


You have enable-patching set to true in the "extra" section of your root composer.json file, or
You have at least one patch defined in your root composer.json file


In your case, it looks like Lightning is pulling in those other core patches.