Drupal 9 modules can be updated with Composer by running the following at the command line in the 'root' level where your sites composer.lock file is located.
composer outdated "drupal/*"
This will return any Drupal modules that are out of date and the suggested version. An example is as follows:
drupal/admin_toolbar 2.4.0 3.0.0 drupal/google_analytics 2.5.0 3.1.0
If you want more details you can also run something more specific, i.e. composer outdated drupal/admin_toolbar will check that specific module and return more details like:
name : drupal/admin_toolbar descrip. : Provides a drop-down menu interface to the core Drupal Toolbar. keywords : Drupal, Toolbar versions : * 2.4.0 latest : 3.0.0 type : drupal-module license : GNU General Public License v2.0 or later (GPL-2.0-or-later) (OSI approved) https://spdx.org/licenses/GPL-2.0-or-later.html#licenseText homepage : http://drupal.org/project/admin_toolbar source : [git] https://git.drupalcode.org/project/admin_toolbar.git 8.x-2.4 dist : [zip] https://ftp.drupal.org/files/projects/admin_toolbar-8.x-2.4.zip 8.x-2.4 path : C:\xampp\htdocs\Drupal9Install7\modules\admin_toolbar names : drupal/admin_toolbar support source : https://git.drupalcode.org/project/admin_toolbar issues : https://www.drupal.org/project/issues/admin_toolbar requires drupal/core ^8.8.0 || ^9.0
Then to update that single module we run: composer update drupal/admin_toolbar
This normally works but in this case I get a message there is "nothing to modify in the lock file" and funnily enough it is green on the /admin/reports/updates page as version 2.4 is different to version 3.0... I guess this is a safety feature in case the jump for V2 to V3 is dramatic...
In the composer.json file the require section has: "drupal/admin_toolbar": "^2.3"
It's the same with composer update drupal/google_analytics. We cannot force this by specifying the version as we did with the modules or core when we set the site up, i.e. composer update drupal/admin_toolbar:^3.0
If you want an explanation why, use the action word "prohibits" with the version, i.e.: composer prohibits drupal/admin_toolbar:^3.0.0
The result: drupal/recommended-project dev-main requires drupal/admin_toolbar (^2.3)
I guess as it's green it's not a big problem. However, if you want the latest version just use: composer require drupal/admin_toolbar and it'll update the composer.json file and install/update the new version.
The final process is to change directory to run Drush and run any database updates and rebuild the cache:
cd vendor/bin drush updatedb drush cache:rebuild