Updated laravel but the vendor folder is an exception?

On my laravel local website, I did 'composer update' this updated to the latest laravel version fine locally. Now before I deploy it, I don't understand how my site interprets the new version has the only changed file is the 'composer.lock' file, I downloaded a templated .gitignore file that had /vendor to be left out, so before I deploy this composer.lock file, my main question is how is my laravel local updating on the live with just one file thats changed? Without the vendor folder I can't see how it achieves the updated laravel, is there something I need to do on the live server to update laravel? I am using laravel forge btw. I updated it, checked my deployment logs, I still can't work out why and how composer.lock is so significant to vendor updates on the live server, does this file tell composer what to update on the live server??? Just from reading the contents it does not seem like it to me.