Today I tested … upgrading the firmware on the USB-C PD controller. 
(emoji indicates scary concern about bricking the device)
The command to check the firmware version is
sudo cat /sys/kernel/debug/tps6598x/0-003f/customer_use
and that was giving
0x4c35445000000101
which I took to mean version 0.1.1 - and that is not the latest.
The update procedure is a little untidy for me because my distro (Ubuntu) does not include uuu so I had to build uuu from source using the info from Purism. If anyone else needs to do this, I suggest replying here for more info.
I will note something from Purism’s web site: IMPORTANT: The firmware is for the Evergreen and Dogwood batches. Don’t flash it to other devices.
Otherwise the needed info is here: https://source.puri.sm/Librem5/firmware-tps6598x-nonfree/-/tree/master
I don’t have a USB-C port on my computer, so I had to use a USB-C Male to USB-A Male cable that I had lying around (and that I connected directly into a USB 3.0 port on my computer). I would suppose that the update procedure might try to make the most limited demands on the USB port but I didn’t push it (e.g. by trying a USB 2.0 port or by trying to do it through a hub).
While connected for update, the Librem 5 showed up with lsusb as:
Bus 999 Device 999: ID 1fc9:012b NXP Semiconductors i.MX 8M Dual/8M QuadLite/8M Quad Serial Downloader
where obviously the bus number and device number will be different on your computer.
The update failed (harmlessly?) the first time due to not running the script as root (and the Purism doco doesn’t specifically mention this). The reasonable error was:
Fail Failure open usb device,Try sudo uuu
Maybe a udev rule on my computer would avoid that problem but I don’t anticipate doing this very often so couldn’t be bothered, so sudo ... it is.
After the update, and rebooting the phone, the above cat command gives
0x4c35445000000200
which I took to mean 0.2.0 - so that looks like winning!