We usually recommend: apt-get update apt-get upgrade However, this doesn't work for the OpenSSH update because it adds a new dependency. Should we recommend dist-upgrade instead in such cases? Are there other corner cases where upgrade is not sufficient?