Is it safe to delete vendor (Composer)?
A PHP project's dependencies, installed by Composer in the project's vendor folder.
Usually safe
It can be recreated, but it takes a download, a reinstall or the tool's own command.
~/
- Only next to composer.json
- Never inside ~/
Library
What it is
Composer installs the packages a PHP project depends on into a vendor folder next to its composer.json file, along with the autoloader the project uses to load them. Composer can install them again from composer.json and composer.lock. The folder stays behind in projects you no longer work on.
If it's removed
The project won't run until Composer installs its dependencies again. Some projects keep changed or extra files in vendor on purpose, and those changes are lost.
How it's removed
Moved to the Trash, where you can restore it.
The free analyzer finds it and explains it. Removing it is Pro, after a review sheet that lists every move and command. It's never checked for you: it waits for your choice.
Sources
Last checked on 26 Sep 2026. Every entry is written and checked by hand; the app and the command-line tool use the same words.