When (NOT) to run "composer update"

Not so much about Laravel, but... Never run composer update on production live server, it's slow and will "break" repository. Always run composer update locally on your computer, commit new composer.lock to the repository, and run composer install on the live server.