Before wrapping up our discussion on Composer, we have one important thing left to discuss: The vendor directory (and by extension, the Composer lock file).
Specifically, we need to talk about why we don’t need to commit the vendor directory to the repository but how our contributors can be sure they have the latest version of the software needed to work with our code base.
Using code quality tools to write better WordPress code is important, yes, but understanding how to properly manage dependencies and our repository is important, too. So before looking at said utilities, let’s review the lock file, the role it plays, and why we don’t need to commit the vendor directory to our repository.