apt update vs apt upgrade vs apt full-upgrade

When updating Ubuntu or Debian, you will often see instructions to run apt update followed by apt upgrade. Despite their similar names, these commands do different jobs. The third command, full-upgrade, goes one step further: it can remove installed packages when resolving dependencies.

This guide explains the differences between apt update, apt upgrade, and apt full-upgrade, and how to choose the right command for your system.

Differences Between update, upgrade, and full-upgrade #

The main difference is what each command is allowed to change:

For routine updates, start with apt update, then run apt upgrade. Use full-upgrade when completing an upgrade requires package removals, and review those removals before proceeding. The APT manual documents these rules.

These commands work on Ubuntu, Debian, and their derivatives. Run them as root or as a user with sudo privileges .

What apt update Does #

Your system keeps a local package index containing information about the packages available from its configured repositories. The index includes package names, versions, and dependencies.

To refresh that information, run:

sudo apt update

APT contacts the enabled repositories and downloads their latest package information. It does not install newer versions of your applications or system packages.

Afterward, you may see a message such as:

12 packages can be upgraded. Run 'apt list --upgradable' to see them.

The message means that APT has found newer versions, but those versions have not been installed. To see the packages, run:

apt list --upgradable

This lists the available upgrades using the index you just refreshed. It only reads package information, so it does not need sudo.

What apt upgrade Does #

Once the package index is current, install the available updates with:

sudo apt upgrade

APT calculates the changes and shows the packages it plans to upgrade or install. Review the list, then type Y and press Enter to continue.

A package may need an additional library to work with its new version. In that case, apt upgrade can install the library too. However, if completing an upgrade requires removing an installed package, APT leaves that upgrade pending.

For example, imagine an application depends on an older library that conflicts with its replacement. If the old library must be removed, apt upgrade will not make that change. That is where full-upgrade can help.

When to Use apt full-upgrade #

The full-upgrade command can resolve dependency changes that require removing installed packages. It is useful during package transitions, such as when one package replaces another.

Before allowing removals, preview the proposed transaction:

sudo apt --simulate full-upgrade

The --simulate option performs a dry run. It shows the planned changes without installing, upgrading, or removing packages. Check the removal list carefully, especially on a server where other services may depend on those packages.

If the changes are appropriate, run the command without --simulate:

sudo apt full-upgrade

APT shows the plan again before asking for confirmation. If you see an application or service you still need in the removal list, answer n and investigate the dependency conflict first.

You do not need to run both upgrade and full-upgrade every time. The latter already performs package upgrades; its extra permission is the ability to remove packages when needed.

Package Upgrades vs Release Upgrades #

Despite its name, full-upgrade does not select a new Ubuntu or Debian release. APT uses the repositories you have configured.

On Ubuntu, moving to another release is a separate process handled by do-release-upgrade, as described in the Ubuntu release upgrade guide . For a walkthrough of the current LTS release, see How to Upgrade to Ubuntu 26.04 .

On Debian, a release upgrade includes changing the repository sources and following the target release’s upgrade instructions . Running full-upgrade with repositories still pointing to the same codename does not switch you to the next release. For the full process, see our guide on upgrading Debian 12 to Debian 13 .

Running update and upgrade Together #

You can refresh the package index and then install available updates in one line:

sudo apt update && sudo apt upgrade

The && operator runs the second command only if the first exits successfully. We run update first so that upgrade works from current package information. Neither upgrade nor full-upgrade refreshes the index for you.

Read the output from update before proceeding. Some repository download failures produce warnings while APT keeps older index files, so a successful exit does not guarantee that every repository was refreshed.

To make the chain stop on any repository failure, add --error-on=any:

sudo apt update --error-on=any && sudo apt upgrade

With this option, a failed download is reported as an error, and apt update exits with a non-zero status.

You may also see this variation in tutorials:

sudo apt update && sudo apt upgrade -y

The -y option automatically answers yes to the upgrade confirmation. When updating your own machine interactively, leave it out so you can review the changes. It does not make the upgrade more complete.

Why Packages Can Still Be Kept Back #

Newer APT versions list the packages that apt upgrade skipped under Not upgrading:, while older versions print The following packages have been kept back:. These packages do not always need full-upgrade. Before changing commands, check why the update was deferred.

On Ubuntu, phased updates roll out some updates gradually. If your machine is not yet included, apt upgrade lists those packages under their own heading:

Not upgrading yet due to phasing:
  libnss-systemd     libsystemd0  systemd-cryptsetup  systemd-sysv
  libpam-systemd     libudev1     systemd-oomd        udev
  libsystemd-shared  systemd      systemd-resolved    xserver-common

Older APT versions report the same packages as kept back. Usually, you can wait and install them during a later update. Security updates are never phased.

To check a particular package, pass its name to apt policy:

apt policy systemd

systemd:
  Installed: 259.5-0ubuntu3.4
  Candidate: 259.9-0ubuntu0.1
  Version table:
     259.9-0ubuntu0.1 500 (phased 20%)

The (phased 20%) marker means the new version is currently offered to 20 percent of machines. Using full-upgrade does not bypass phasing, and you should not force the update just to clear the message.

A package can also have an explicit hold. To list held packages, run:

apt-mark showhold

If the package appears, check why it was held before changing anything. A hold may protect a version needed by an application or deployment. The apt-mark manual explains how holds prevent automatic package changes.

If there is no phasing or hold, compare the proposed changes from the two upgrade modes. To preview the regular upgrade, run:

sudo apt --simulate upgrade

Compare this with the full-upgrade simulation above. If the second plan proposes removals that allow the pending upgrade to proceed, inspect those packages before deciding whether to accept it. Mixed repositories or incompatible dependencies may require fixing the sources instead.

How apt-get Differs #

One source of confusion is that apt upgrade and apt-get upgrade have different defaults. Plain apt-get upgrade does not install new dependency packages, while apt upgrade can.

Kernel updates are the usual example. A new kernel version arrives as a new package, so plain apt-get upgrade keeps the kernel metapackages back:

The following packages have been kept back:
  linux-headers-generic linux-headers-virtual linux-image-virtual
  linux-virtual

Running apt upgrade installs the new kernel packages and upgrades the metapackages in the same run.

For similar dependency handling with apt-get, use:

sudo apt-get upgrade --with-new-pkgs

This permits new dependencies while still preventing removals. The apt-get manual also documents dist-upgrade, the equivalent of apt full-upgrade.

Prefer apt-get in scripts and automation. Our apt vs apt-get comparison explains when to use each interface.

Conclusion #

Before accepting a full-upgrade, check what APT plans to remove rather than treating it as a stronger version of your daily update command. For installing, removing, and searching packages, see our apt command guide .

About the authors

Dejan Panovski

Dejan Panovski is the founder of Linuxize, an RHCSA-certified Linux system administrator and DevOps engineer based in Skopje, Macedonia. Author of 1000+ Linux tutorials with 20+ years of experience turning complex Linux tasks into clear, reliable guides.

View author page