It's still important to update dependencies of dependencies as well.
composer update <extension package>
is usually the best option if you want to update select packages.
Adding the --with-all-dependencies
flag will also update all dependencies required by the given packages
composer update
is useful if you want to update everything that can be updated, but it's best to run that command on a local environment, test everything went well, then deploying Flarum via the lock file to reduce memory consumption and runtime.
composer show --direct --outdated
can be used to show all extensions with an update available.