This is a high level update procs for update a Drupal 8 site from Drupal v. 8.4.x to 8.5.x to pick up the critical security updates.
This does not include debugging tips if things go sideways resultant of the updates.
Create new clone or update dev site to current and backup. Be ready to restore is things go sideways. Put site in maintenace mode.
Run:
$ composer update drupal/core webflo/drupal-core-require-dev symfony/* --with-dependencies
$ drush updatedb