Short story: Can I run `composer update` on a running site without having to worry about which dependencies are updated first?

Longer story: I'm trying to figure out if the actual update process with composer is atomical. 

Are the dependencies updated/activated all at once, when everything is downloaded and checked OK, or is each dependency updated as soon as it's downloaded? What if one update fails in the middle?

Having trouble finding docs on that, so I'm hoping someone can help out! If this is documented, I'd be happy with a link there.