composer bump raises the constraints in composer.json to match what is installed, which is either exactly what you want or exactly what you do not.
$ composer bump --dev-only
phpunit/phpunit ^10.5 => ^10.5.11
rector/rector ^0.18 => ^0.19.2
# for an APPLICATION this is right: the lock file is the
# truth and the constraints should not be looser than
# what has been tested.
# for a LIBRARY it is wrong: narrowing a constraint
# makes the package harder to install alongside others,
# for no benefit to anybody.The distinction between an application and a library is the whole story with this command, and it has no flag for it — running it in a package is a way of making your consumers’ dependency resolution worse. In the application it is now part of the dependency-update routine, immediately after the lock file is regenerated, so the two never drift.