use composer.json and composer.lock
Ignore the vendor directory
Merge remote-tracking branch 'upstream/master'