Plenty of people have been advocating the following approach to third party code:
The actual package/library files (vendor folder) should not be part of version control, since their revisions are already handled by the declaration, which is thereby under version control and it would be redundant to do both.
This particular quote came from Ulrich Kautz in 10 pillars of modern PHP development.
I disagree with this method. My general rule is:
If it is part of your site then it should be in your version control system.
Sure, that might mean higher disk usage. But it also means fewer potential failure points. That is a trade off I can live with.