How can I update all the packages under
craft/app/vendor for Craft CMS 3 (Yii 2)?
composer.json file (and the
composer.lock file so you can't even reverse engineer
composer.json) isn't shipped with the official release on purpose.
Craft 3 is still in development preview status (not even alpha release), but the next release will include updated Composer dependencies.