You can see the available commands by running 'composer'. It's 'composer outdated'. But I rarely use this command, as we concern only with 2 things, the development environment and production (see the next points).
Yup, 'composer update', that's what we do in the development env, don't do this in production, why? this would update the composer.lock, which the composer will use for reference to determine the exact version of packages when we call 'composer install'.
As mentioned in point 2, so, in the production we only need to run 'composer install' to instruct the composer to install the packages according to what was registered in composer. lock.
The problem with composer update is that all packages are updated.
Your composer.json will usually prevent you from accidentally applying breaking changes, but it could.
Unless you have time to focus on multiple packages being upgraded at once (and not knowing which one broke your app), you may prefer a more conservative approach and update one package at a time by specifying the package name
