/node_modules /vendor package-lock.json composer.lock