Currently, {projectRoot}/vendor/ dir is scanned recursively every run, which may take noticeable time.

What can be done?
Result of vendor scanning may be cached (in \PHPStan\Cache\Cache prodived by DI, for example).
Invalidation could be based on composer.lock (we store SHA of a file, and if changed, rescan vendor).
Also, there should be a way to disable this cache in case vendor has symlinks to local folders (a typical way of developing Composer packages before publishing them to packagist).