In the case of php libraries, the vendor folder and composer.lock file should not be committed to version control.

Sources:

• https://getcomposer.org/doc/02-libraries.md#lock-file
• https://getcomposer.org/doc/faqs/should-i-commit-the-dependencies-in-my-vendor-directory.md
• https://octobercms.com/docs/help/using-composer