I don't commit vendor. I don't commit any code that i'm not going to be maintaining myself. composer install generally installs all dependencies only once in an environment. When composer.json is updated it's only the updated dependencies that are going to be downloaded and applied.
As always with external dependencies it's good idea to protect yourself by creating adapters to be better prepared if you need to replace a dependency.
We're a place where coders share, stay up-to-date and grow their careers.
We strive for transparency and don't collect excess data.