See "Updating Drupal core via Composer" on Drupal's website.
# List available Drupal updates
composer outdated "drupal/*"
# Verify we are using "drupal/core-recommended"`
composer show drupal/core-recommended
# Update the core with its dependencies
composer update "drupal/core-*" --with-all-dependencies
# Run database updates
drush updatedb
# Rebuild the cache
drush cache:rebuild