Did you install Elgg with composer? If so just run composer update from the root directory.
If not, install Elgg using starter project and then copy custom plugins into mod.

No I didn't install Elgg with composer. I'm just tired of using SFTP, it's too long and time consuming.

@manacim SFTP is dead to me :)

@ihayredinov is it really dead technology? Lol. Anyways how do I do this?

Back up. Install Elgg with composer using starter project, copy engine/settings, .htaccess and custom plugins (or require them with composer as well). You are good to go.

And what's the command to update?

You can update single package (plugin, library, elgg core) with:

composer update foo/bar

Or you can update all packages with:

composer update

The version constraints in composer.json define how much newer version the command is allowed to install.

Exact version definition doesn't trigger update at all, unless you first manually update the number:

"foo/bar": "2.3.0"

With more advanced operators, you can define version ranges. For example this allows composer to update to any version that is greater than 2.1.0 but smaller than 3.0.0. For example from 2.1.0 to 2.9.5:

"foo/bar": "~2.1"

After running "composer update" in a development environment:

1. Commit both composer.json and composer.lock to git
2. Go to your production environment, pull the changes from git
3. Run "composer install" to install the updated versions to the production environment
4. Now both environments have exactly the same versions of all packages! Cool!

Further reading:

https://ilikekillnerds.com/2014/09/should-you-commit-composer-lock-into-your-git-repository/
https://blog.engineyard.com/2014/composer-its-all-about-the-lock-file

See also the starter project of the elgg.org site itself: https://github.com/elgg/www.elgg.org

[Moderator: this comment was off-topic. It was moved to its own topic. Read it here.]