The short version
apt upgrade updates packages. It does not remove installed packages and it
usually does not make big dependency changes.
apt full-upgrade can install new dependencies. It can also remove old
packages if this is needed to solve the dependencies.
Check first
apt update
apt list --upgradable
apt -s full-upgrade
The -s option only simulates the operation. Look at the packages that will be
removed, not only at the number of upgrades.
When “kept back” is normal
This can happen for normal reasons:
- a dependency changed, for example a major library;
- a new runtime package is needed;
- a metapackage asks for a newer component;
- another package must be installed or removed first.
A kept-back package is not automatically a security problem. Check the version that APT wants to install and where it comes from:
apt-cache policy nume-pachet
apt-mark showhold
A simple rule
For normal updates, use apt upgrade. If there are many dependency changes,
first run apt -s full-upgrade, read the result, and apply it when you have
time to test the services afterwards.