And sudo apt full-upgrade when a new OS version is available.
full-upgrade is the same as upgrade except it’ll remove old packages if required. (e.g. programs that don’t support the new version and hold back the upgrade due to old dependencies). When upgrading Debian to a new release, I usually first run upgrade, then run full-upgrade and read the output very carefully before continuing.