If you are a PHP Developer in 2020, you don’t have any excuses to use composerimproperly. It allows you to declare the libraries your project depends on and it will manage (install/update) them for you Composer is a gift of god, maybe even a religious thing, I know, but you have to understand several commands in order to respect the other team members as well as the whole project.
In a production environments it’s important to use composer install --no-dev to exclude all packages used in developing process.
When you use composer update you should know what might happen.