So as TurnKey Linux is based on Debian (v16.x is based on Debian 10/Buster) in a perfect world you should be able to safely install all upgrades (i.e. run 'apt upgrade'). And as a general rule, doing that will be fine and everything will continue to work as it was.

When you do that, you will upgrade to the latest release of the relevant Debian packages. Note that for most Debian packages (with a few exceptions - which you are unlikely to hit on a server). So generally that will NOT update the versions of MySQL or PHP, etc. It will simply install a tweaked copy of the same version. Both security updates and bugfix releases are generally backported to the same version. So updating to a non-security release of a package may well resolve some edge case bugs (which you may or may not have hit). Having said that, updated packages always have a risk of unintended regressions. This applies to security updates too, but generally they have to undergo a more intensive testing regime before they are released.

So in summary, the choice is yours. If everything is working as it should be, then just installing security updates should be enough and there is no need to install all updates. Alternatively, if you hit an issue with something, there is a chance, that it has been fixed in an (non-security) update. Generally running all updates should be fine, but in a production environment, I would recommend always ensuring that you have a full "snapshot" prior, just in case you need to roll back.

Also, in case you weren't aware, security updates should auto install nightly regardless.

As a final note, it's also important to realise that some appliances use third party apt repositories to install software. E.g. Jenkins in our Jenkins appliance, GitLab in our GitLab appliance and Yarn in any of the appliances that include it (e.g. Canvas and most NodeJS based apps). As they don't differentiate between security updates and other updates, software from these repos will never be auto installed. Running a system upgrade (e.g. 'apt upgrade') will update software from these third party repositories which may or may not be what you want!