Drupal 9 is designed to be updated with Composer where previous versions allowed manual uploading of files or by using Drush. This is an easy process and can be done running the following at the command line in the 'root' level where your sites composer.lock file is located.

composer outdated "drupal/*"

This will return any Drupal core or modules that are out of date and the suggested version. An example is as follows:

drupal/admin_toolbar          2.4.0 	3.0.0
drupal/core                   9.1.0 	9.1.4
drupal/core-composer-scaffold 9.1.0 	9.1.4
drupal/core-project-message   9.1.0 	9.1.4
drupal/core-recommended       9.1.0 	9.1.4
drupal/google_analytics       2.5.0 	3.1.0

You'll notice that the above 6 lines show 2 modules and 4 lines for Drupal "core". The "core" files can be updated running the following:

composer update drupal/core-* --with-all-dependencies 

If you have problems running the above, try:

composer update drupal/core "drupal/core-*" --with-all-dependencies

The final process is to change directory to run Drush and run any database updates and rebuild the cache:

cd vendor/bin
drush updatedb
drush cache:rebuild