Magento 2 vendor/ Directory

The vendor/ directory contains all Composer-managed dependencies including core Magento code.

vendor/
├── autoload.php                 # Composer autoloader entry point
├── autoload_classmap.php        # Class-to-file mappings
├── autoload_namespaces.php      # Namespace-to-directory mappings
├── autoload_psr4.php            # PSR-4 autoloading rules
├── autoload_real.php            # Autoloader initialization
├── autoload_static.php          # Static autoload data
├── composer/                    # Composer internals
│   ├── autoload_classmap.php
│   ├── autoload_namespaces.php
│   ├── autoload_psr4.php
│   ├── ClassLoader.php
│   ├── installed.json           # Installed packages metadata
│   └── installed.php            # Installed packages PHP array
├── magento/                     # Core Magento packages
│   ├── framework/               # Magento Framework
│   ├── module-catalog/          # Catalog module
│   ├── module-customer/         # Customer module
│   ├── module-checkout/         # Checkout module
│   ├── module-sales/            # Sales module
│   ├── module-backend/          # Admin module
│   ├── module-store/            # Store management
│   ├── module-config/           # System configuration
│   ├── module-theme/            # Theme framework
│   ├── module-ui/               # UI components
│   ├── module-view/             # View system
│   ├── module-webapi/           # Web API framework
│   └── ...                      # All core modules
├── laminas/                     # Laminas (Zend) components
│   ├── laminas-view/
│   ├── laminas-validator/
│   └── ...
├── symfony/                     # Symfony components
│   ├── console/
│   ├── event-dispatcher/
│   └── ...
├── psr/                         # PSR interfaces
│   ├── psr/
│   │   ├── http-message/
│   │   ├── log/
│   │   └── simple-cache/
├── laminas/                     # Laminas packages
├── composer/                    # Composer PHP library
└── ...                          # Other third-party packages

Key directories:

• vendor/magento/ - Core Magento modules and framework
• vendor/laminas/ - Laminas (formerly Zend) components
• vendor/symfony/ - Symfony console and other components
• vendor/psr/ - PSR interface standards

The vendor/magento/ directory contains all core Magento code as individual Composer packages.

Framework package:

vendor/magento/framework/
├── App/                    # Application lifecycle
│   ├── Bootstrap.php
│   ├── FrontController.php
│   ├── Http.php
│   └── State.php
├── ObjectManager/          # Dependency injection
│   └── ObjectManager.php
├── View/                   # View system
│   ├── Element/
│   │   ├── AbstractBlock.php
│   │   └── Template.php
│   └── Result/
│       ├── Layout.php
│       └── Page.php
├── DB/                     # Database abstraction
│   ├── Adapter/
│   │   └── Pdo\Mysql.php
│   └── Select.php
├── Event/                  # Event system
│   └── Manager.php
├── Cache/                  # Cache system
│   └── Frontend/
├── HTTP/                   # HTTP handling
├── Session/                # Session management
├── Stdlib/                 # Standard library
└── Phrase/                 # Translations

Module packages:

vendor/magento/module-catalog/
├── Api/                    # Service contracts
│   ├── ProductRepositoryInterface.php
│   └── Data/
│       └── ProductInterface.php
├── Block/                  # View blocks
├── Controller/             # Controllers
├── Model/                  # Business logic
│   ├── Product.php
│   └── ResourceModel/
├── etc/                    # Configuration
├── view/                   # Frontend assets
├── composer.json
└── registration.php

Package types in Magento:

• magento2-module - Feature modules
• magento2-theme - Themes
• magento2-language - Translations
• library - Framework and utilities

Magento uses Composer's autoloading to automatically load classes from vendor packages.

Autoload methods:

1. PSR-4 Autoloading:

// vendor/magento/module-catalog/composer.json
{
    "autoload": {
        "psr-4": {
            "Magento\\Catalog\\": ""
        },
        "files": [
            "registration.php"
        ]
    }
}

2. Classmap Autoloading:

// vendor/composer/autoload_classmap.php (excerpt)
return [
    'Magento\\Catalog\\Model\\Product' => $vendorDir . '/magento/module-catalog/Model/Product.php',
    'Magento\\Catalog\\Api\\ProductRepositoryInterface' => $vendorDir . '/magento/module-catalog/Api/ProductRepositoryInterface.php',
];

3. File Autoloading:

// vendor/composer/autoload_files.php (excerpt)
return [
    $vendorDir . '/magento/module-catalog/registration.php',
    $vendorDir . '/magento/module-customer/registration.php',
];

How autoloading works:

// When you use a class:
$product = new \Magento\Catalog\Model\Product();

// 1. PHP checks PSR-4 rules: Magento\\Catalog\\ → module-catalog/
// 2. Maps class to file: Model/Product.php
// 3. Includes the file automatically

Regenerate autoload files:

composer dump-autoload
# or
composer install

Autoload performance:

• Classmap is fastest (pre-generated lookup table)
• PSR-4 requires file system checks
• Both are cached in production mode

Composer manages all vendor packages through composer.json and composer.lock.

composer.json structure:

{
    "name": "magento/project-community-edition",
    "description": "Magento Community Edition",
    "type": "project",
    "license": "proprietary",
    "require": {
        "magento/product-community-edition": "2.4.6",
        "composer/composer": "^2.0"
    },
    "require-dev": {
        "phpunit/phpunit": "^9.5"
    },
    "autoload": {
        "psr-4": {
            "Magento\\": "app/code/Magento/"
        },
        "psr-0": {
            "": "app/code/"
        },
        "files": [
            "app/etc/ non Composer Component List.php"
        ]
    }
}

Common Composer commands:

# Install dependencies from composer.lock
composer install

# Update specific package
composer update vendor/magento/module-catalog

# Add new package
composer require vendor/package:^1.0

# Remove package
composer remove vendor/package

# Show installed packages
composer show

# Show specific package info
composer show vendor/magento/module-catalog

# Search for packages
composer search magento/module

Package version constraints:

• ^1.0 - Compatible with 1.0 (semver)
• ~1.2 - >=1.2.0, <1.3.0
• 1.0.* - Any 1.0.x version
• >=1.0 <2.0 - Range constraint

Checking package status:

# List outdated packages
composer outdated

# Check for security vulnerabilities
composer audit