My composer.json file doesn't update to the latest plugin versions when I update my plugins via the Craft CP or command line.
If you have a caret icon infront of your version number, for example
"craftcms/cms": "^3.0.0",
These version numbers in composer.json will not change when you update.
The caret icon tells Composer it has free reign to update this package, but not to the next major version number. ^3.0.0 can update to 3.1.0, 3.2.0, 3.2.1 etc, but won't update to 4.0.0. As such, it does not need to write to composer.json because the caret icon is already giving it the instructions it needs.
You can read more about it in the Composer documentation.
Running composer update will (if there are updates to perform) write to composer.lock instead. If you are using version control, you can run a git diff to see what changes have been made to your lock file immediately after running an update.
