Difference Between Composer.json and Composer.lock or composer.json v/s composer.lock

 In a Simple ways

composer.json is the list of required libraries and versions for your project.

composer.lock is what is currently installed.

Composer Update ( Refers composer.json file )

When you do composer update it will check for the composer.json file and updates all the packages/libraries that are listed in it & once the packages are updated it will rewrite new updates in composer.json & composer.lock file by deleting old package updates.

Basically, the following process takes place

A - Read composer.json

B - Remove installed packages that are not required in composer.json

C- Check latest versions of required packages in composer.json from https://packagist.org

D - Install the latest versions of your packages

E - Update composer.lock with installed packages version & even update composer.json file with it

F - composer install

Composer Install ( Uses composer.lock file)

When you do composer install it will check for composer.lock file and install all the packages/libraries that are listed in composer.lock file.

This command won't update anything like composer update.

Basically, the following process takes place

1) composer.lock file 

If it does not exists then run composer-update and create it

If exists then read composer.lock file for installation of packages

2) Install the packages specified in the composer.lock file