danielbachhuber/composer-lock-updater. Run composer-lock-updater in your CI system for bot-powered composer.lock pull requests.
Composer in WordPress
Composer in WordPress. Nice — answers both of the questions I had. Can’t wait to convert my first project away from submodules.