Drupal 9 modules can be updated with Composer by running the following at the command line in the 'root' level where your sites composer.lock file is located.

composer outdated "drupal/*"

This will return any Drupal modules that are out of date and the suggested version. An example is as follows:

drupal/admin_toolbar          2.4.0 	3.0.0
drupal/google_analytics       2.5.0 	3.1.0

If you want more details you can also run something more specific, i.e. composer outdated drupal/admin_toolbar will check that specific module and return more details like:

name     : drupal/admin_toolbar
descrip. : Provides a drop-down menu interface to the core Drupal Toolbar.
keywords : Drupal, Toolbar
versions : * 2.4.0
latest   : 3.0.0
type     : drupal-module
license  : GNU General Public License v2.0 or later (GPL-2.0-or-later) (OSI approved) https://spdx.org/licenses/GPL-2.0-or-later.html#licenseText
homepage : http://drupal.org/project/admin_toolbar
source   : [git] https://git.drupalcode.org/project/admin_toolbar.git 8.x-2.4
dist     : [zip] https://ftp.drupal.org/files/projects/admin_toolbar-8.x-2.4.zip 8.x-2.4
path     : C:\xampp\htdocs\Drupal9Install7\modules\admin_toolbar
names    : drupal/admin_toolbar

support
source : https://git.drupalcode.org/project/admin_toolbar
issues : https://www.drupal.org/project/issues/admin_toolbar

requires
drupal/core ^8.8.0 || ^9.0

Then to update that single module we run: composer update drupal/admin_toolbar

This normally works but in this case I get a message there is "nothing to modify in the lock file" and funnily enough it is green on the /admin/reports/updates page as version 2.4 is different to version 3.0... I guess this is a safety feature in case the jump for V2 to V3 is dramatic...

In the composer.json file the require section has: "drupal/admin_toolbar": "^2.3"

It's the same with composer update drupal/google_analytics. We cannot force this by specifying the version as we did with the modules or core when we set the site up, i.e. composer update drupal/admin_toolbar:^3.0

If you want an explanation why, use the action word "prohibits" with the version, i.e.: composer prohibits drupal/admin_toolbar:^3.0.0

The result: drupal/recommended-project dev-main requires drupal/admin_toolbar (^2.3)

I guess as it's green it's not a big problem. However, if you want the latest version just use: composer require drupal/admin_toolbar and it'll update the composer.json file and install/update the new version.

The final process is to change directory to run Drush and run any database updates and rebuild the cache:

cd vendor/bin
drush updatedb
drush cache:rebuild