root@tpvkavzllc:/var/lib/roundcube# COMPOSER_ALLOW_SUPERUSER=1 /home/admin/.composer/composer -n update
Composer could not detect the root package (roundcube/roundcubemail) version, defaulting to '1.0.0'. See https://getcomposer.org/root-version
Loading composer repositories with package information
Updating dependencies
Lock file operations: 1 install, 4 updates, 0 removals
- Upgrading guzzlehttp/guzzle (7.10.0 => 7.10.5)
- Upgrading guzzlehttp/promises (2.3.0 => 2.4.1)
- Upgrading guzzlehttp/psr7 (2.8.0 => 2.10.3)
- Locking mlocati/ip-lib (1.22.0)
- Upgrading symfony/deprecation-contracts (v3.6.0 => v3.7.0)
Writing lock file
Installing dependencies from lock file (including require-dev)
Package operations: 1 install, 4 updates, 0 removals
proc_open is disabled so 'unzip' and '7z' commands cannot be used, zip files are being unpacked using the PHP zip extension.
This may cause invalid reports of corrupted archives. Besides, any UNIX permissions (e.g. executable) defined in the archives will be lost.
Enabling proc_open and installing 'unzip' or '7z' (21.01+) may remediate them.
- Downloading symfony/deprecation-contracts (v3.7.0)
- Downloading guzzlehttp/psr7 (2.10.3)
- Downloading guzzlehttp/promises (2.4.1)
- Downloading guzzlehttp/guzzle (7.10.5)
- Downloading mlocati/ip-lib (1.22.0)
- Upgrading symfony/deprecation-contracts (v3.6.0 => v3.7.0): Extracting archive
- Upgrading guzzlehttp/psr7 (2.8.0 => 2.10.3): Extracting archive
- Upgrading guzzlehttp/promises (2.3.0 => 2.4.1): Extracting archive
- Upgrading guzzlehttp/guzzle (7.10.0 => 7.10.5): Extracting archive
- Installing mlocati/ip-lib (1.22.0): Extracting archive
Package pear/console_commandline is abandoned, you should avoid using it. No replacement was suggested.
Package pear/net_socket is abandoned, you should avoid using it. No replacement was suggested.
Generating autoload files
5 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
No security vulnerability advisories found.
root@tpvkavzllc:/var/lib/roundcube#
Ok, now try again to login roundcube.
Great, everything worked out! I don’t seem to have updated correctly by putting a space, right?
I don’t see an update to version 16 on the forum, or just change the version in the update steps?
I’m glad it worked 
Seems so
No, I was too lazy to create a new post. As you said, the steps are the same, just change the version to 1.6.16 and the old version to 1.6.15.
Sorry to semi-hijack this thread (and really sorry if this is obvious] but noticed Hestia 1.9.5 has just dropped - one of the changes says “Bump Roundcube to version 1.6.11” - so wanted to check if already updated to 1.6.16 [well, anything above .11] is there anything need to do? [re-update after the 1.9.5 upgrade - or is the fact that is was upgraded outside of HCP enough?] - many thanks 
Looks like a typo, it really adds Roundcube 1.6.15. I suppose nobody created a PR to bump Roundcube version to 1.6.16 before they merged the changes to release the new Hestia version.
No. Maybe you could edit upgrade.conf file and fix the roundcube version to 1.6.16 instead of 1.6.15 but you don’t really need to do that if you installed 1.6.16 manually.