In most cases, the directory vendorshould not be stored in the original control. This has nothing to do with Laravel; this is how you usually work with Composer.
Way to ensure that everyone in your group (and your production servers) have worked with the same dependencies, must support composer.lockand composer.jsonin the source control, so your team can test and run repo composer installNOT composer update.
, , composer update composer.lock composer.json.