Why not letting it include the whole ``vendor`` folder ? It would avoid generating a broken phar archive if some new dependency gets added (which may be done because of a change in one of the dependencies, not only because of root package changes)