Kyrne just so you know, please do not suggest running composer update in production. It sounds like a good idea, but it really isn't ?
The update task updates all dependencies of the project, even those that were never tested by the developers to be included. The project provides a composer.lock file which is generated after every (successful) composer update to be used with the composer install command. The composer.lock file holds the versions loaded during the composer update process, the versions that we can assume works with Flarum.
So please use this command to re-install any lost packages from the vendor folder:
composer install --prefer-dist --no-dev
- Using prefer-dist will have composer try to install distribution files (archives) as much as possible, which leaves out directories like tests and readme on every dependency.
- Using --no-dev will have composer install none of the packages needed to do development with. Eg phpunit and other stuff not needed in production environments.
As a side note; you should be able to simply delete the whole vendor folder whenever you feel like it and run the above command to rebuild it without any problems.