Updating WP is just a matter of bumping the version in the composer.json file and running `composer update`. We believe it's better to manually do this and be explicit about it rather than letting WP update itself. This way you can quickly just look in the composer.json to see the versions of everything being used (WP, plugins, etc).