0

Is it safe (or best practice) to run "composer update" on Magento 2?

On one hand, Magento has released a specific Magento version with specific dependencies. If those dependencies are upgraded (even to minor versions) it might break Magento or introduce a bug.

On the other hand, the point of composer is to keep dependencies updated with bug fixes etc. So it's preferable to be up-to-date based on Magento's composer.json.

For example, here's a list of updates on the latest version of Magento when running: composer update

 - Updating phpseclib/phpseclib (2.0.5 => 2.0.6)
 - Updating symfony/event-dispatcher (v2.8.21 => v2.8.25)
 - Updating symfony/process (v2.8.21 => v2.8.25)
 - Updating zendframework/zend-stdlib (2.4.11 => 2.4.12)
 - Updating zendframework/zend-eventmanager (2.4.11 => 2.4.12)
 - Updating zendframework/zend-code (2.4.11 => 2.4.12)
 - Updating zendframework/zend-di (2.4.11 => 2.4.12)
 - Updating zendframework/zend-modulemanager (2.4.11 => 2.4.12)
 - Updating zendframework/zend-loader (2.4.11 => 2.4.12)
 - Updating zendframework/zend-view (2.4.11 => 2.4.12)
 - Updating zendframework/zend-validator (2.4.11 => 2.4.13)
 - Updating zendframework/zend-escaper (2.4.11 => 2.4.13)
 - Updating zendframework/zend-uri (2.4.11 => 2.4.12)
 - Updating zendframework/zend-server (2.4.11 => 2.4.12)
 - Updating zendframework/zend-soap (2.4.11 => 2.4.12)
 - Updating zendframework/zend-console (2.4.11 => 2.4.12)
 - Updating zendframework/zend-servicemanager (2.4.11 => 2.4.12)
 - Updating zendframework/zend-text (2.4.11 => 2.4.12)
 - Updating zendframework/zend-i18n (2.4.11 => 2.4.12)
 - Updating zendframework/zend-config (2.4.11 => 2.4.12)
 - Updating zendframework/zend-math (2.4.11 => 2.4.12)
 - Updating zendframework/zend-json (2.4.11 => 2.4.12)
 - Updating zendframework/zend-serializer (2.4.11 => 2.4.12)
 - Updating zendframework/zend-log (2.4.11 => 2.4.12)
 - Updating zendframework/zend-crypt (2.4.11 => 2.4.13)
 - Updating zendframework/zend-http (2.4.11 => 2.4.13)
 - Updating zendframework/zend-filter (2.4.11 => 2.4.12)
 - Updating zendframework/zend-inputfilter (2.4.11 => 2.4.13)
 - Updating zendframework/zend-form (2.4.11 => 2.4.13)
 - Updating zendframework/zend-mvc (2.4.11 => 2.4.13)
 - Updating seld/jsonlint (1.6.0 => 1.6.1)
 - Updating symfony/finder (v3.3.0 => v3.3.5)
 - Updating symfony/yaml (v2.8.21 => v2.8.25)
 - Updating symfony/stopwatch (v3.3.0 => v3.3.5)
 - Updating theseer/fdomdocument (1.6.5 => 1.6.6)
 - Updating symfony/filesystem (v3.3.0 => v3.3.5)
 - Updating symfony/config (v3.2.9 => v3.2.12)
0

Magento has released a specific Magento version with specific dependencies

That's right, so composer update will never accidently update Magento itself.

The dependencies you are listing are not required in a specific version, but still with carefully selected version constraints, e.g.

    "symfony/console": "~2.3, !=2.7.0",
    "phpseclib/phpseclib": "2.0.*",
    "zendframework/zend-json": "^2.6.1",

For these, Magento trusts that semantic versioning is followed, so that you can safely run composer update to receive bugfixes without breaking anything. However, I would not do any update on a Magento site without at least some testing.

It helps if you have automatic smoke tests to ensure that you do not deploy anything that breaks critical functionality.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.