Now that T119766: Composer's autoloader should be autoloaded in extension registry (if configured) is resolved, we should definitely be able to do this.

Change 371965 had a related patch set uploaded (by TheDJ; owner: TheDJ):
[mediawiki/core@master] update.php: Check for outdated composer deps of extensions

https://gerrit.wikimedia.org/r/371965

Change 371965 abandoned by TheDJ:
update.php: Check for outdated composer deps of extensions

https://gerrit.wikimedia.org/r/371965

I tested the patch with various extensions: without composer.json (LanguageTool), with composer.json containing a 'require' section, with composer.json without 'require' section. The first type is correctly detected, the second correctly says if the composer.lock inside the extension directory is obsolete, and the third type says there is no composer.lock file (it’s true but it’s normal in production).

I guess the patch was abandonned because the extension directory does not mandatorily contain a composer.lock file, the alternative scenario is the composer.json was registered in MW’s main composer.json in 'merge-plugin' section. At my knowledge these are the two scenarios to autoload Composer librairies in extensions. If correct the patch could be improved to check that composer.json 'require' section from extension directory match either composer.lock in extension directory either the global composer.lock.

Also if this is implemented there could be "false" warnings because of T141225, because extensions could use version ranges (e.g. 2.3.*) in their Composer requirements.

It could be necessary to discuss this before implementing this change, because it will impact all extensions using Composer requirements with a policy not as strict as MediaWiki core’s one: either the users will start asking (legitimately) why they got warnings during updates either the extension mainteners would have to change their policy.

I guess the patch was abandonned because the extension directory does not mandatorily contain a composer.lock file

It was abandoned because no one showed interest in it. I find it better to abandon such patches, rather than having them stay open for months and giving the vibe that someone (/me) will still be working on it.