First, understand the purpose of the composer. Composer is a package dependency management for PHP that complies with the PSR 0/1/2/3/4 specification. So when do we use composer install and when do we use composer update? There is no agreement on the Internet. The first thing we need to know is what they did. The process for Composer Install is that if you have Composer. Lock locally, it will ignore it. If not, it will do the same as for Composer Update. The process of working with Composer Update is that regardless of whether you have Composer. Lock, it will have the latest package updated unless you specify a version number.
If you want your code to pull the same dependencies all the time, you should use Composer Install
If you want to pull the latest dependencies, you should use Composer Update