Circling back to add that today I'd add `composer.json` and `composer.lock` to git and gitignore `vendor/` - Composer is a much more stable tool than it used to be!