This is about UPDATING and not about UPGRADING! (Drupal docs.)

Notes:

  • Updating is a minor version change such as 9.3.4 -> 9.3.5. Upgrading is a major version change such as 9.3 -> 9.4.)
  • Drupal docs on updating core with composer are here.
  • If, like me, you are doing this on a local development or staging site and using ddev, then all the composer and drush commands should start with ddev.
  • Unless you are working on a local site and are SURE no one will attempt interacting with it, put it in maintenance mode before updating.
 
First, how will you know that a core update needed:
  • You see a notice on the List of modules on your site
  • You can create a list of available updates:  composer outdated "drupal/*"
    • This will list all the available updates (core and modules) and indicate version numbers and whether they are minor or a patch, or major.
    • If nothing begins with drupal/core, no core update is needed
 
ALWAYS backup your codebase and database before updating.
 
You need to know whether your are using the older "drupal/core" or the current  "drupal/core-recommended" scaffold.
  • You can find this by running: composer show drupal/core-recommended
  • If you get a list of information about the package:
    • You have "drupal/core-recommended":
    • Update by running: composer update drupal/core "drupal/core-*" --with-all-dependencies
  • If the response you get is "package drupal/core-recommended not installed"
    • Instead update by running: composer update drupal/core --with-dependencies
  • Clean up:
    • Run: drush updatedb (or drush updb)
    • Run: drush cache:rebuild (or drush cr)
  • Visit the site and review the Status Report page. If you have errors or warnings, investigate and address them. (Do this after any significant modification of your site.)