It installs packages while handling dependencies between packages.
composer install Install the package while resolving the dependencies based on the contents of composer.json. In addition, if composer.lock exists, install it based on its contents. By the way, composer.lock contains information about the version of the package installed by composer install.
composer update Based on the contents of composer.json, install the latest version of the package while resolving the dependencies. In addition, update the contents of composer.lock.
composer require Execute when adding a new library etc. in the development environment.
vendor Contains packages installed by composer install or composer update. Basically, it is excluded from the management target of git.