[BP/MR335][ENH] Allow composer to update vendor_bundled dependencies and if changed,...

[ENH] Allow composer to update vendor_bundled dependencies and if changed, check for external package sources

Backport: !335 (merged)