How to Use apt update vs apt upgrade on Ubuntu/Debian

In this tutorial, you'll learn about How to Use apt update vs apt upgrade on Ubuntu/Debian. We cover key concepts, practical examples, and best practices.

The Problem

You run sudo apt update and see a list of packages that "can be upgraded," but running the command again still shows the same packages. You are confused about why apt update alone does not install the newer versions.

Quick Fix

Step 1: Run apt update to refresh package lists

apt update downloads the latest package index from repositories. It does not install or upgrade anything:

sudo apt update

Hit:1 http://archive.ubuntu.com/ubuntu jammy InRelease
Get:2 http://security.ubuntu.com/ubuntu jammy-security InRelease [110 kB]
Fetched 110 kB in 2s (55.0 kB/s)
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
32 packages can be upgraded. Run 'apt list --upgradable' to see them.

Step 2: Run apt upgrade to install newer versions

apt upgrade upgrades all upgradable packages to their latest versions:

sudo apt upgrade

Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Calculating upgrade... Done
The following packages will be upgraded:
  curl openssl python3
3 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Need to get 2,340 kB of archives.
After this operation, 512 kB of additional disk space will be used.
Do you want to continue? [Y/n] y

Step 3: Use apt full-upgrade for package removals

apt full-upgrade handles dependency changes that may require removing packages:

sudo apt full-upgrade

Step 4: List upgradable packages

See which packages are eligible for upgrade without installing them:

apt list --upgradable

Listing... Done
curl/jammy-updates 7.81.0-1ubuntu1.16 amd64 [upgradable from: 7.81.0-1ubuntu1.15]
openssl/jammy-updates 3.0.2-0ubuntu1.18 amd64 [upgradable from: 3.0.2-0ubuntu1.17]

Step 5: Upgrade a single package

Upgrade only one package without touching others:

sudo apt install --only-upgrade curl

Step 6: Automate with unattended-upgrades

Enable automatic security updates:

sudo apt install unattended-upgrades
sudo dpkg-reconfigure --priority=low unattended-upgrades

Alternative Solutions

Use apt list --installed to check current versions

See installed package versions before upgrading:

apt list --installed 2>/dev/null | grep python

Hold specific packages to prevent upgrades

Pin a package at its current version:

sudo apt-mark hold postgresql

Common Mistakes to Avoid

Running apt upgrade without running apt update first. apt upgrade uses the last fetched package list. Always run apt update first.

Using apt full-upgrade on production servers without testing. full-upgrade may remove conflicting packages. Use apt upgrade for safer updates.

Not checking what will be upgraded before confirming. apt upgrade shows the list before installing. Review it to avoid unwanted version bumps.

Pro Tips

Use unattended-upgrades for security patches. Configure automatic security updates to keep your system patched without manual intervention.

Pin repository priorities with apt_preferences. Control which repository provides which package using /etc/apt/preferences.d/ with pin priorities.

Use apt-mark hold to prevent specific upgrades. Keep a critical package at a specific version: sudo apt-mark hold <a href="/databases/postgresql/">postgresql</a>-16.

Prevention

• Run sudo apt update before sudo apt upgrade every time.
• Use sudo apt full-upgrade sparingly as it can remove conflicting packages.
• Enable unattended security upgrades on production servers for critical patches.