Running composer require vendor/package
will consult packagist.org for the most current released version and add both the latest release and the version requirement to get this release and compatible updates later.
This will install only stable versions.
After the initial install, you have two options:
composer install
will again install the previously found packages.
composer update
will look for updated packages that match the version requirement.
Never run update
unattended. A developer should run this consciously and then run the test suite to determine if everything still works (or the continuous integration job does it if available). Especially only run install
when deploying to production.