``origin`` is the wrong remote. Composer never fetches changes from origin so running ``composer update`` to get a newer version of the package would then mark it as unpushed.