Commit the composer.json changes to the repo. The files downloaded by Composer do not need to be added to the repo. You’ll see a .gitignore file that keeps them out (this was added as a part of the composer packaging). Only composer.json, .gitignore, code in /web/modules/custom and the content of the /web/sites subdirectory (other than the files directory) will be stored in the git repository.