People generally recommend actually putting this lockfile into the repo.  Take a look at http://stackoverflow.com/questions/12896780/composer-lock-part-of-the-repository for some reasons.