Composer install and update in Magento2

composer update will update your dependencies as they are specified in composer.json

For example, if you require this package as a dependency:

"mockery/mockery": "0.9.*",

and you have actually installed the 0.9.1 version of the package, running composer update will cause an upgrade of this package (for example to 0.9.2, if it’s already been released)

in detail composer update will:

• Read composer.json
• Remove installed packages that are no more required in composer.json
• Check the availability of the latest versions of your required packages
• Install the latest versions of your packages
• Update composer.lock to store the installed packages version

composer install

composer install will not update anything; it will just install all the dependencies as specified in the composer.lock file

In detail:

• Check if composer.lock file exists (if not, it will run composer update and create it)
• Read composer.lock file
• Install the packages specified in the composer.lock file

When to install and when to update

• composer update is mostly used in the ‘development phase’, to upgrade our project packages according to what we have specified in the composer.json file,
• composer install is primarily used in the ‘deploying phase’ to install our application on a production server or on a testing environment, using the same dependencies stored in the composer.lock file created by composer update.

Thank you.