Composer install versus update and noisy security advisories
A team wants reproducible dependency sets for applications while avoiding repeated security advisory notifications in CI. Composer documents install as reproducing the exact versions recorded in composer.lock and update as re-resolving version constraints against repositories and writing a new lock file. The distinction creates an unresolved decision about w