Composer required on the Server in case

[Lemon_Juice]

@Mittineague

But if Composer were on the server, the critical security update would happen as soon as it was released, or just be easier to do?

I don’t think this will happen by default but I imagine you can set up a cron job to run composer update periodically. However, I don’t know if I would do it - there’s always a risk of an update breaking things.