Using apt

apt update refreshes repository indexes and changes nothing else. apt upgrade installs newer versions of what you have but never removes a package to do it, keeping such upgrades back; apt full-upgrade may remove packages, so read its plan before answering yes. Inspect first with apt search, apt show and apt list --upgradable; add -s to any install or removal to print the plan and change nothing.

Removal has three verbs. remove leaves configuration in /etc; purge deletes it too; autoremove drops dependencies nobody needs any more. Leftover configuration traps you when you start clean: a reinstalled php8.5-fpm silently picks up the pool file you thought you had deleted.

sudo apt install -y cowsay
sudo apt-mark hold cowsay       # upgrades now skip it
apt-mark showhold
sudo apt-mark unhold cowsay
sudo apt purge -y cowsay        # remove it and its configuration

Installing:
  cowsay
...
Setting up cowsay (3.03+dfsg2-8build1) ...
cowsay set on hold.
cowsay
Canceled hold on cowsay.
...
REMOVING:
  cowsay*

APT 3.2, the version in Ubuntu 26.04 225 , groups its plan under headings such as Installing: and REMOVING: above a Summary: block; the asterisk marks a purge. Hold a package only while you test: holds are invisible until a server "refuses" to upgrade. /var/log/apt/history.log records every transaction and its command line.