Thanks for your issue report and pull request.

However, this is not so straightforward...

1. Composer documentation recommends that you put composer.lock into version control. But I realize there are other opinions about this.
2. You're right that composer.phar has its own repo, it's just convenient to have it available as a file in the repo instead of having to download it using wget or curl each time.

I have to think about is. Before composer.lock can be removed from the repo, some library versions may have to be better specified so they won't suddenly get upgraded into incompatible versions.

No prob. I wasn't aware that the Composer documentation recommends to include the .lock file. I'm so used to repos not including the .lock file, and it makes some sense if semantic versioning is used properly, but seems like it's not as straightforward as I thought.

Appreciate if you give it a thought, but I don't mind if you choose to reject the pull request. Seems like there are legitimate reasons to do so, and this is a minor-importance request anyways :)

It's too late to do this for the upcoming 0.5 release, but for 0.6 we could use a smarter Composer configuration.

Finally removed composer.phar in commit 8e8d1e1 and updated the documentation in the wiki (install/upgrade) to reflect this. Closing.