Updating modules and themes using Composer

The recommended way to install and update a Drupal 8 site is using Composer.

People who are used to upgrading module with Drush should notice that in Drush 9 and Drush 10 (the current version) all the up commands pm-update, pm-updatecode and pm-updatestatus are deprecated. You have to use the corresponding Composer commands instead.

List updates

Use Composer's built-in command for listing packages that have updates available:

composer outdated "drupal/*"

You can get the same information with the Composer's show command.

List security updates

The security status from Drupal.org isn't available through Composer. Luckily Drush comes to the rescue:

drush pm:security

Install updates

For a minor-version update to a given Drupal module/project, simply use the following:

composer update drupal/modulename --with-dependencies

To preview the update, and show you what would happen, without actually changing anything, add --dry-run.

For a major-version upgrade (such as 1.x to 2.x), update alone isn't enough: you must first require the new major version explicitly. Since major versions often introduce major changes, this would be an excellent time to visit the module/project to inspect its documentation and issue queue. Once you're confident that the upgrade is fully compatible with your site, use the following, substituting the new major version number as needed:

composer require drupal/modulename:^2.0

Then proceed with the update as above.

Finally, run any database updates, rebuild the cache and export the potentially changed configurations, reviewing the changes via --diff:

drush updatedb
drush cache:rebuild
drush config:export --diff

https://www.drupal.org/docs/updating-drupal/updating-modules-and-themes-using-composer