Unless you created your site using composer create-project drupal-composer/drupal-project, Drupal core is not actually a dependency of your project; instead your composer.json file likely contains the line "name": "drupal/drupal". Effectively, your root composer file is the Drupal core package.
In this case you can only upgrade by manually downloading the new release.
See also: Why does "composer update drupal/drupal" not work?
Edit:
If you want to convert an existing D8 site to the composer-based workflow, the following steps should get you most of the way.
- In a different location, use
composer create-project drupal-composer/drupal-project:8.x-dev <my-new-site> to create the new project. (Confirm the removal of the existing git history, and if you are using version control, use git init; git add .; git commit to initialize the new repository.)
- Look at the contrib modules installed in your current site's
modules/ folder, go into the new project, and use composer require drupal/module1 drupal/module2 [...] to install them. (Any custom modules should be copied into the folder ./web/modules/custom/ in the new project.)
- Copy the contents of your
sites/ folder into the ./web/sites/ folder of the new project.
- After backing up your database, go into your new project folder, and use
vendor/bin/drush updatedb or vendor/bin/drupal upex to update your database with Drush or Drupal Console (both are installed by default).
At this point, your new project should be ready to serve the site; change your webserver configuration or symlinks to point at <my-new-site>/web (the web subdirectory, not the project folder itself).
