Composer caches every package version, and vendor folders repeat them

Composer has the same shape as every other package manager: a global cache of what it downloaded, and a full copy inside each project. The difference is that PHP projects tend to be numerous and long lived, so the copies add up quietly.

The two halves

composer config --global --list | grep cache-dir
du -sh ~/.composer ~/Library/Caches/composer 2>/dev/null
find ~ -maxdepth 5 -type d -name vendor 2>/dev/null \
  -exec du -sh {} + | sort -h | tail -15

The global cache holds downloaded archives and repository metadata. Each vendor folder is a full extraction of everything that project needs, and a framework project's vendor directory is routinely hundreds of megabytes.

Clearing them

Both are safe as long as composer.lock is present, which pins exact versions. With the lock file, reinstalling gives you exactly what you had; without it, you get whatever resolves today, which is a different and less comfortable proposition.

The bulk removal that is worth doing

find ~ -maxdepth 5 -type d -name vendor -mtime +180 2>/dev/null \
  -exec du -sh {} + | sort -h | tail -20

That lists vendor folders untouched for six months. Those belong to projects you are not working on, and composer install brings them back in a minute when you return.

Checking the lock file first

ls composer.lock 2>/dev/null || echo 'no lock file, be careful'

A project without a lock file is the one case to leave alone, because reinstalling may not reproduce the same versions. It is the same rule as CocoaPods and Podfile.lock, and it applies across every ecosystem.