I had the same problem and never found the reason. You could run
composer update --profile or even
composer update --profile -vvv to have a detailed list of what's going on under the hood. The first one will show you how much memory is used.
It shouldn't be over 600Mb. But still you will run out of memory. As the laravel app goes into maintenance mode, it shouldn't add to it. You could run in a second shell the command
top -ac and see what happens there.
The hosting company couldn't help me either as they blamed it on me lol.
But there is a way around. Upload the
composer.lock only and on the production server run
composer install --no-dev. It will give you a warning about outdated packages. Answer 'yes' and your prod server will be updated without a glitch. This command runs the laravel
composer.json scripts commands too and updates the
composer.json package versions..