Keep the lock file
For an application, commit composer.json and composer.lock. composer install uses locked versions when a lock file is present. Avoid running composer update as an automatic production deployment step: it resolves versions again and may change the tested dependency set.
Review updates deliberately
Create a branch, update the intended packages and inspect the lock-file diff. Check compatibility constraints, release notes and required migrations. Run tests and composer audit; an audit result is useful evidence, not proof that the whole application is secure.
Deploy predictably
Build from the reviewed lock file. Use project-appropriate production options, confirm required PHP extensions and restart workers as the project documents. Keep the previous application build and database backup available. A code rollback does not automatically reverse a database migration.
composer validate --strict
composer install
composer audit
