How to properly set up composer.lock?

Question

Composer

Hello
Suppose we have a working application that uses packages installed via composer, do I understand correctly that if we run composer update and composer.json indicates that we are working with a version 2 package, then the package will be updated to version 3 and the application will be in jeopardy?

Answer 1

always use composer install!
When there is time to update or something is notably buggy, then we do it composer updateor composer update name, depending on how much time we have, sort it out. But for production and beginners only composer install
it all depends on how it is specified in composer.json, usually indicated through "^" - not higher than current. major version, "~" is not higher than the minor version. But I can be wrong