Is the vendor data needed?

While reviewing the changes for this lib, I noticed, that the vendor directory is being included.

Is this needed? Usually, it's added by mistake and causes:
a) confusion
b) problems when tracking changes

ref: https://my.diffend.io/gems/passbase/1.1.0/1.2.0

If the presence of vendor data is valid I would love the reasoning. Thanks!