There is the little bit misleading composer command: composer update. It also allow to only update 1 to n packages with composer update package1 package2 (package names as arguments. Howevery, there is a constraint to be considered! composer update is updating the packages within the defined requirements – thus it is not updating the package.json!
If you want to install the newest package version, you must add the package as a new requirement with composer require. This way the newest (or older version if dependencies are blocking the newest) package will be used. composer install overwrites the package.json.