node_modules vendor composer.lock