- In composer we do commit the lock file so it's important to use install to have consistent deps (since the phar build also uses that)
- In monolog and jsonlint there is no committed lock file so using install or update doesn't matter on travis since it's a fresh build every time. 

In general though for libraries I'd recommend update rather than install I guess, because they shouldn't really depend on a particular version of the deps to work, but if you don't commit the lock file then on travis it won't matter.