renovate/lib/modules/manager/composer/readme.md

Extracts dependencies from composer.json files, and keeps the associated composer.lock file updated too.

If you use VCS repositories then Renovate needs a hint via the name property, which must match the relevant package. For example, the package acme/foo would need an entry in repositories similar to the following:

{
  "name": "acme/foo",
  "type": "vcs",
  "url": "http://vcs-of-acme.org/acme/foo.git"
}

By default, Renovate will invoke composer update with the --with-dependencies flag. Add composerWithAll to your postUpdateOptions array to use the --with-all-dependencies flag instead.