Return to Answer

Update

You stated that updating an individual component resulted in 2 being in vendor.

This isn't right.

As a test I decided to update colinmollenhour/cache-backend-file to version 1.4.5. Not in initial composer.json file but brought in elsewhere. As you can see composer correctly performed the upgrade.

user@cli:/var/www/magento# composer require colinmollenhour/cache-backend-file:1.4.5
./composer.json has been updated
Loading composer repositories with package information
Updating dependencies (including require-dev)
Package operations: 0 installs, 1 update, 0 removals
  - Updating colinmollenhour/cache-backend-file (v1.4.4 => v1.4.5): As there is no 'unzip' command installed zip files are being unpacked using the PHP zip extension.
This may cause invalid reports of corrupted archives. Installing 'unzip' may remediate them.
Downloading (100%)
Package phpunit/phpunit-mock-objects is abandoned, you should avoid using it. No replacement was suggested.
Writing lock file
Generating autoload files
user@cli:/var/www/magento#

Site is operational.

composer.json (before)

{
    "name": "magento/project-community-edition",
    "description": "eCommerce Platform for Growth (Community Edition)",
    "type": "project",
    "license": [
        "OSL-3.0",
        "AFL-3.0"
    ],
    "config": {
        "preferred-install": "dist",
        "sort-packages": true
    },
    "require": {
        "magento/module-bundle-sample-data": "100.3.*",
        "magento/module-catalog-rule-sample-data": "100.3.*",
        "magento/module-catalog-sample-data": "100.3.*",
        "magento/module-cms-sample-data": "100.3.*",
        "magento/module-configurable-sample-data": "100.3.*",
        "magento/module-customer-sample-data": "100.3.*",
        "magento/module-downloadable-sample-data": "100.3.*",
        "magento/module-grouped-product-sample-data": "100.3.*",
        "magento/module-msrp-sample-data": "100.3.*",
        "magento/module-offline-shipping-sample-data": "100.3.*",
        "magento/module-product-links-sample-data": "100.3.*",
        "magento/module-review-sample-data": "100.3.*",
        "magento/module-sales-rule-sample-data": "100.3.*",
        "magento/module-sales-sample-data": "100.3.*",
        "magento/module-swatches-sample-data": "100.3.*",
        "magento/module-tax-sample-data": "100.3.*",
        "magento/module-theme-sample-data": "100.3.*",
        "magento/module-widget-sample-data": "100.3.*",
        "magento/module-wishlist-sample-data": "100.3.*",
        "magento/product-community-edition": "2.3.0",
        "magento/sample-data-media": "100.3.*"
    },
    "require-dev": {
        "friendsofphp/php-cs-fixer": "~2.13.0",
        "lusitanian/oauth": "~0.8.10",
        "magento/magento2-functional-testing-framework": "2.3.9",
        "pdepend/pdepend": "2.5.2",
        "phpmd/phpmd": "@stable",
        "phpunit/phpunit": "~6.5.0",
        "sebastian/phpcpd": "~3.0.0",
        "squizlabs/php_codesniffer": "3.3.1"
    },
    "conflict": {
        "gene/bluefoot": "*"
    },
    "autoload": {
        "psr-4": {
            "Magento\\Framework\\": "lib/internal/Magento/Framework/",
            "Magento\\Setup\\": "setup/src/Magento/Setup/",
            "Magento\\": "app/code/Magento/",
            "Zend\\Mvc\\Controller\\": "setup/src/Zend/Mvc/Controller/"
        },
        "psr-0": {
            "": [
                "app/code/",
                "generated/code/"
            ]
        },
        "files": [
            "app/etc/NonComposerComponentRegistration.php"
        ],
        "exclude-from-classmap": [
            "**/dev/**",
            "**/update/**",
            "**/Test/**"
        ]
    },
    "autoload-dev": {
        "psr-4": {
            "Magento\\Sniffs\\": "dev/tests/static/framework/Magento/Sniffs/",
            "Magento\\Tools\\": "dev/tools/Magento/Tools/",
            "Magento\\Tools\\Sanity\\": "dev/build/publication/sanity/Magento/Tools/Sanity/",
            "Magento\\TestFramework\\Inspection\\": "dev/tests/static/framework/Magento/TestFramework/Inspection/",
            "Magento\\TestFramework\\Utility\\": "dev/tests/static/framework/Magento/TestFramework/Utility/"
        }
    },
    "version": "2.3.0",
    "minimum-stability": "stable",
    "repositories": [
        {
            "type": "composer",
            "url": "https://repo.magento.com/"
        }
    ],
    "extra": {
        "magento-force": "override"
    }
}

composer.json (after)

{
    "name": "magento/project-community-edition",
    "description": "eCommerce Platform for Growth (Community Edition)",
    "type": "project",
    "license": [
        "OSL-3.0",
        "AFL-3.0"
    ],
    "config": {
        "preferred-install": "dist",
        "sort-packages": true
    },
    "require": {
        "colinmollenhour/cache-backend-file": "1.4.5",
        "magento/module-bundle-sample-data": "100.3.*",
        "magento/module-catalog-rule-sample-data": "100.3.*",
        "magento/module-catalog-sample-data": "100.3.*",
        "magento/module-cms-sample-data": "100.3.*",
        "magento/module-configurable-sample-data": "100.3.*",
        "magento/module-customer-sample-data": "100.3.*",
        "magento/module-downloadable-sample-data": "100.3.*",
        "magento/module-grouped-product-sample-data": "100.3.*",
        "magento/module-msrp-sample-data": "100.3.*",
        "magento/module-offline-shipping-sample-data": "100.3.*",
        "magento/module-product-links-sample-data": "100.3.*",
        "magento/module-review-sample-data": "100.3.*",
        "magento/module-sales-rule-sample-data": "100.3.*",
        "magento/module-sales-sample-data": "100.3.*",
        "magento/module-swatches-sample-data": "100.3.*",
        "magento/module-tax-sample-data": "100.3.*",
        "magento/module-theme-sample-data": "100.3.*",
        "magento/module-widget-sample-data": "100.3.*",
        "magento/module-wishlist-sample-data": "100.3.*",
        "magento/product-community-edition": "2.3.0",
        "magento/sample-data-media": "100.3.*"
    },
    "require-dev": {
        "friendsofphp/php-cs-fixer": "~2.13.0",
        "lusitanian/oauth": "~0.8.10",
        "magento/magento2-functional-testing-framework": "2.3.9",
        "pdepend/pdepend": "2.5.2",
        "phpmd/phpmd": "@stable",
        "phpunit/phpunit": "~6.5.0",
        "sebastian/phpcpd": "~3.0.0",
        "squizlabs/php_codesniffer": "3.3.1"
    },
    "conflict": {
        "gene/bluefoot": "*"
    },
    "autoload": {
        "psr-4": {
            "Magento\\Framework\\": "lib/internal/Magento/Framework/",
            "Magento\\Setup\\": "setup/src/Magento/Setup/",
            "Magento\\": "app/code/Magento/",
            "Zend\\Mvc\\Controller\\": "setup/src/Zend/Mvc/Controller/"
        },
        "psr-0": {
            "": [
                "app/code/",
                "generated/code/"
            ]
        },
        "files": [
            "app/etc/NonComposerComponentRegistration.php"
        ],
        "exclude-from-classmap": [
            "**/dev/**",
            "**/update/**",
            "**/Test/**"
        ]
    },
    "autoload-dev": {
        "psr-4": {
            "Magento\\Sniffs\\": "dev/tests/static/framework/Magento/Sniffs/",
            "Magento\\Tools\\": "dev/tools/Magento/Tools/",
            "Magento\\Tools\\Sanity\\": "dev/build/publication/sanity/Magento/Tools/Sanity/",
            "Magento\\TestFramework\\Inspection\\": "dev/tests/static/framework/Magento/TestFramework/Inspection/",
            "Magento\\TestFramework\\Utility\\": "dev/tests/static/framework/Magento/TestFramework/Utility/"
        }
    },
    "version": "2.3.0",
    "minimum-stability": "stable",
    "repositories": [
        {
            "type": "composer",
            "url": "https://repo.magento.com/"
        }
    ],
    "extra": {
        "magento-force": "override"
    }
}

composer update from web root will mass update extensions and components based on version parameters in composer.json.

Or you can require a particular version of something if you want more control over what updates

composer require magento-modules/m2-banner-manager:1.0.5

If you update something that is dependent on something else being newer or whatever composer will sort for you.

Likewise if there is a restriction such as php version supported by component or library composer will throw error.

Although there is a lesser known trick for removing bloatware that comes with vanilla M2 install.

https://www.integer-net.com/removing-unused-core-modules-from-magento-2-the-right-way/

require": {
    [...]
},
"replace": {
    "temando/module-shipping-m2": "*",
    "dotmailer/dotmailer-magento2-extension": "*",
    "shopialfb/facebook-module": "*",
    "klarna/module-kp": "*",
    "klarna/module-ordermanagement": "*",
    "klarna/module-core": "*",
    "amzn/amazon-pay-sdk-php": "*",
    "amzn/amazon-pay-and-login-with-amazon-core-module": "*",
    "amzn/login-with-amazon-module": "*",
    "amzn/amazon-pay-module": "*",
    "vertex/module-tax": "*"
},
"config": {
    [...]

composer update from web root will mass update extensions and components based on version parameters in composer.json.

Or you can require a particular version of something if you want more control over what updates

composer require magento-modules/m2-banner-manager:1.0.5

If you update something that is dependent on something else being newer or whatever composer will sort for you.

Likewise if there is a restriction such as php version supported by component or library composer will throw error.

Although there is a lesser known trick for removing bloatware that comes with vanilla M2 install.

https://www.integer-net.com/removing-unused-core-modules-from-magento-2-the-right-way/ https://www.integer-net.com/make-magento-2-small-again/

require": {
    [...]
},
"replace": {
    "temando/module-shipping-m2": "*",
    "dotmailer/dotmailer-magento2-extension": "*",
    "shopialfb/facebook-module": "*",
    "klarna/module-kp": "*",
    "klarna/module-ordermanagement": "*",
    "klarna/module-core": "*",
    "amzn/amazon-pay-sdk-php": "*",
    "amzn/amazon-pay-and-login-with-amazon-core-module": "*",
    "amzn/login-with-amazon-module": "*",
    "amzn/amazon-pay-module": "*",
    "vertex/module-tax": "*"
},
"config": {
    [...]

Then run composer install or composer update depending on whether you want other stuff to update.

composer update from web root will mass update extensions and components based on version parameters in composer.json.

Or you can require a particular version of something if you want more control over what updates

composer require magento-modules/m2-banner-manager:1.0.5

If you update something that is dependent on something else being newer or whatever composer will sort for you.

Likewise if there is a restriction such as php version supported by component or library composer will throw error.

composer update from web root will mass update extensions and components based on version parameters in composer.json.

Or you can require a particular version of something if you want more control over what updates

composer require magento-modules/m2-banner-manager:1.0.5

If you update something that is dependent on something else being newer or whatever composer will sort for you.

Likewise if there is a restriction such as php version supported by component or library composer will throw error.

Although there is a lesser known trick for removing bloatware that comes with vanilla M2 install.

https://www.integer-net.com/removing-unused-core-modules-from-magento-2-the-right-way/

require": {
    [...]
},
"replace": {
    "temando/module-shipping-m2": "*",
    "dotmailer/dotmailer-magento2-extension": "*",
    "shopialfb/facebook-module": "*",
    "klarna/module-kp": "*",
    "klarna/module-ordermanagement": "*",
    "klarna/module-core": "*",
    "amzn/amazon-pay-sdk-php": "*",
    "amzn/amazon-pay-and-login-with-amazon-core-module": "*",
    "amzn/login-with-amazon-module": "*",
    "amzn/amazon-pay-module": "*",
    "vertex/module-tax": "*"
},
"config": {
    [...]