I'm sorta on the fence on this one. I generally add composer.lock to .gitignore for my library projects but I've seen some decent arguments for adding composer.lock to the repository.

The main reason I've seen for including composer.lock for library projects is that it can help in testing by ensuring that anyone else doing development work on the library can have the same dependencies. While this is extremely important for applications I think that this is far less critical for library projects since by nature of Composer the dependencies the library is installed against is a moving target anyway. Pinning a library to a specific set of dependencies doesn't really do a whole lot to help aid development when you look at it from that perspective.

In any event, the point is moot as I don't really see this PR getting merged. :) Feel free to discuss these things further if you want to but please keep that in mind.

If you disagree and think that I should consider more changes to this fork and/or if you think I should reconsider merging this PR, let's discuss that some more on the PR itself and not on this particular code comment thread.

Thanks!