Magento 2 Safe to Run Composer Update

Question

Is it safe (or best practice) to run "composer update" on Magento 2?

On one hand, Magento has released a specific Magento version with specific dependencies. If those dependencies are upgraded (even to minor versions) it might break Magento or introduce a bug.

On the other hand, the point of composer is to keep dependencies updated with bug fixes etc. So it's preferable to be up-to-date based on Magento's composer.json.

For example, here's a list of updates on the latest version of Magento when running: composer update

 - Updating phpseclib/phpseclib (2.0.5 => 2.0.6)
 - Updating symfony/event-dispatcher (v2.8.21 => v2.8.25)
 - Updating symfony/process (v2.8.21 => v2.8.25)
 - Updating zendframework/zend-stdlib (2.4.11 => 2.4.12)
 - Updating zendframework/zend-eventmanager (2.4.11 => 2.4.12)
 - Updating zendframework/zend-code (2.4.11 => 2.4.12)
 - Updating zendframework/zend-di (2.4.11 => 2.4.12)
 - Updating zendframework/zend-modulemanager (2.4.11 => 2.4.12)
 - Updating zendframework/zend-loader (2.4.11 => 2.4.12)
 - Updating zendframework/zend-view (2.4.11 => 2.4.12)
 - Updating zendframework/zend-validator (2.4.11 => 2.4.13)
 - Updating zendframework/zend-escaper (2.4.11 => 2.4.13)
 - Updating zendframework/zend-uri (2.4.11 => 2.4.12)
 - Updating zendframework/zend-server (2.4.11 => 2.4.12)
 - Updating zendframework/zend-soap (2.4.11 => 2.4.12)
 - Updating zendframework/zend-console (2.4.11 => 2.4.12)
 - Updating zendframework/zend-servicemanager (2.4.11 => 2.4.12)
 - Updating zendframework/zend-text (2.4.11 => 2.4.12)
 - Updating zendframework/zend-i18n (2.4.11 => 2.4.12)
 - Updating zendframework/zend-config (2.4.11 => 2.4.12)
 - Updating zendframework/zend-math (2.4.11 => 2.4.12)
 - Updating zendframework/zend-json (2.4.11 => 2.4.12)
 - Updating zendframework/zend-serializer (2.4.11 => 2.4.12)
 - Updating zendframework/zend-log (2.4.11 => 2.4.12)
 - Updating zendframework/zend-crypt (2.4.11 => 2.4.13)
 - Updating zendframework/zend-http (2.4.11 => 2.4.13)
 - Updating zendframework/zend-filter (2.4.11 => 2.4.12)
 - Updating zendframework/zend-inputfilter (2.4.11 => 2.4.13)
 - Updating zendframework/zend-form (2.4.11 => 2.4.13)
 - Updating zendframework/zend-mvc (2.4.11 => 2.4.13)
 - Updating seld/jsonlint (1.6.0 => 1.6.1)
 - Updating symfony/finder (v3.3.0 => v3.3.5)
 - Updating symfony/yaml (v2.8.21 => v2.8.25)
 - Updating symfony/stopwatch (v3.3.0 => v3.3.5)
 - Updating theseer/fdomdocument (1.6.5 => 1.6.6)
 - Updating symfony/filesystem (v3.3.0 => v3.3.5)
 - Updating symfony/config (v3.2.9 => v3.2.12)

Answer 1

Magento has released a specific Magento version with specific dependencies

That's right, so composer update will never accidently update Magento itself.

The dependencies you are listing are not required in a specific version, but still with carefully selected version constraints, e.g.

    "symfony/console": "~2.3, !=2.7.0",
    "phpseclib/phpseclib": "2.0.*",
    "zendframework/zend-json": "^2.6.1",

For these, Magento trusts that semantic versioning is followed, so that you can safely run composer update to receive bugfixes without breaking anything. However, I would not do any update on a Magento site without at least some testing.

It helps if you have automatic smoke tests to ensure that you do not deploy anything that breaks critical functionality.