What order should configuration import and module updates be run?
Updates must be run before configuration is imported

A pending issue against core will ensure that the code and schema versions match before allowing configuration to be imported.



Problems with config import before updates


An update hook relying on a configuration value could end in a different result than if it were run on the pre-import value.
An update could potentially fail if it tried to create configuration entities that already exist.


Concerns for config import after updates


If an update that introduces a new configuration entity is run first, it will create a new configuration item that will have a differing UUID than the one that is in config.  However, once the config is imported the entity should be replaced with the config version.  

There could be a potential problem here if replacing the entity would affect associated content.  For example, if an update migrates content from one field to another, on config import the field would be completely replaced and the content potentially lost.  In this instance the deployment process may need to be adjusted to run the updates on the target environment and export the resulting configuration.