Updating such old Drupal can be stressing. (one passed, but its not rule - try on sandbox/on your own risk)
At first - update drush to version 9.5.x - composer update drush/drush --with-dependencies --dry-run
Run drush updb && drush cr && drush cron
composer outdated drupal/*
composer update drupal/core webflo/drupal-core-require-dev --with-dependencies --dry-run
composer update drupal/core webflo/drupal-core-require-dev --with-dependencies
Run drush updb && drush cr && drush cron
Tested on PHP v. 7.0.x which failed. After restarting Apache, tried to switch to PHP 7.2.x and voila - PASSED
Then I ran composer update - for updating rest of modules (bit risky..), but again - PASSED.