In the past (Drupal 7), security-only update via drush was simple as:
drush up --security-only
now, Drush 9.3 returns:
Command “up” is ambiguous.
Did you mean one of these?
composer does not help either:
composer outdated drupal/*
In fact, my Drupal is outdated:
How can I update Drupal security updates via command line?
UPDATE (composer prohibits):
$ composer prohibits drupal/core:8.5.5 There is no installed package depending on "drupal/core" in versions not matching 8.5.5