Those are managed with composer.
Nostr-php only contains the composer.json (so no composer.lock file) so you're always downloading the latest version of the dependencies defined in that composer.json file.
To update your existing project, run `composer update -W`
If you're still stuck, remove the vendor map first with `rm -rf vendor` and run `composer install`