Why, there's already $otherToolsDoingIt

1. it's a valuable feature, there's a standalone implementation and Private Packagist also adds it as comments to PRs (which is a nice touch, but not a system seller IMO, so it wouldn't be lost revenue there), there's obviously interest
2. composer.lock is owned by Composer, it's already being read and written by it, a similar feature (outdated) is already built in, makes sense this type of introspection is done by Composer itself
3. if Composer did it, we could rely on it being available on the target system and use it like so

# .gitattributes
composer.lock -merge diff=composer

which would make Git diff show the semantic change, and not just the textual. The same can then be used in CI, wherever Composer is available, which is everywhere because you need it to install your deps anyway.