vendor node_modules composer.lock