`composer update` doesn't update to the latest version
You should run composer update locally. This will update composer.lock with the versions of all the packages you have installed. You should commit your composer.lock file to your version control.
On your server, once you've updated your files you should then run a composer install so Composer can update its dependencies to match those specified in your composer.lock file.
I just spent two hours debugging this. Turns out the problem was that there was a "version" tag in the composer.json file.
When there is a version tag there, that version will be used in priority above any git tag version that you apply.
If you know the package you want to update you can specify it and the package will be upgraded to the latest version. Just require the package globally and it'll work like a charm.
composer global require laravel/installer