The tips here are for advanced usages of composer and its assumed you have read about using composer and have a knowledge of your vendor packages to be updated. Let's consider, you want to update only one specific yii2 vendor library, without updating all the other extension packages?
STEP 1: Update single vendor package only
Let's say the package name is vend/pkg. Run the following command.
php composer.phar update vend/pkg
This will only install or update the vend/pkg extension (plus its dependencies) and overwrite the composer.lock.
STEP 2: Update composer.lock
When you do step 1, you should most likely receive a warning message like below
Note: The lock file is not up to date with the latest changes in
composer.json, you may be getting outdated dependencies, run update to update them.
Do not worry. This is a message you should expect similar to when you edit the composer.json file. Composer detects a change to the md5sum of the file and warns you if this hash differs from the one stored in the composer.lock.
To proceed further, just update the lock file with the following command:
php composer.phar update --lock
Thus, composer will bring your composer.lock file up to date but NOT UPDATE all your other Yii2 vendor packages.