Install colorbox library via composer

I'm now trying to leverage composer as much as possible to avoid PITA-manual installations.

The merge plugin seemed great, as Webform uses it (https://drupaldope.com/drupal-9/webform-libraries), but module developers are moving away from it. Colorbox prefers the "path repository" method.
They explain why here https://www.drupal.org/node/3069730 but as always in all things Drupal don't provide the reader with an immediate alternative.

Instead, to load the library, edit your main composer.json file and make your "repositories" section look like this:

    "repositories": [
        {
            "type": "composer",
            "url": "https://packages.drupal.org/8"
        },
        {
            "type": "package",
            "package": {
              "name": "jackmoore/colorbox",
              "version": "1.6.4",
              "type": "drupal-library",
              "dist": {
                "url": "https://github.com/jackmoore/colorbox/archive/1.6.4.zip",
                "type": "zip"
              }
            }
        }
    ],

then run composer require jackmoore/colorbox

I wonder if the library will be automatically upgraded to a newer version if colorbox decides to upgrade. oh well.