composer-lock-diff package allows you to see what packages have changed after you run composer update by comparing composer.lock to the the git HEAD.
composer global require davidrjonas/composer-lock-diff:^1.0 # With zsh, run `rehash` to make it known to the shell. # try it composer-lock-diff --help
composer update # don't commit yet! composer-lock-diff