Laravel itself and practically every package around it are installed through Composer. In doing so, Composer also resolves how the packages depend on each other and finds a combination of versions that fits together.
That is why hardly anyone on a Laravel project writes basic functionality themselves. For image processing, generating PDFs, exporting to Excel or full-text search there are maintained packages that are tested and documented.
The other side of it
Every package is somebody else’s code that ships with yours. It can carry vulnerabilities, and it can stop being maintained. So looking after an application involves two habits. Checking regularly whether advisories exist for the packages installed. And, when taking on a new package, looking at whether anyone still tends it.
Arrears of several years can no longer be caught up in one step, because the packages' requirements start contradicting each other. Why small steps come cheaper is in the article Laravel versions: when an upgrade really becomes urgent.