What does "The following packages have been kept back" mean?

If the upgrade would require another package to be deleted, or a new package to be installed, the package will be "kept back." As the man page for apt-get upgrade explains:

Packages currently installed with new versions available are retrieved and upgraded; under no circumstances are currently installed packages removed, or packages not already installed retrieved and installed.

To get past this, you can do

sudo apt-get --with-new-pkgs upgrade

This allows new packages to be installed. It will let you know what packages would be installed and prompt you before actually doing the install.

Basic report is that apt-get upgrade will not upgrade packages for which the package manager would like to delete and reinstall the package. This happens in security patches a lot because, often, it was actually libraries precursor to the final distributable compilation which were patched. The "go ahead and delete things" functionality lives in apt-get dist-upgrade but be sure to run apt-get update first just in case the upstream guys figured something out since you last tried. Sometimes they miss things and fix them quickly.

the message indicates a potentially unsafe condition

if you are certain you want this change to happen you can just

sudo apt-get install  xxxxx

where xxxx is the held package(s) ... typically this will happen when the system knows by performing this install it will have to uninstall other packages ... for example

sudo apt-get --with-new-pkgs upgrade
Reading package lists... Done
Building dependency tree       
Reading state information... Done
Calculating upgrade... Done
The following packages have been kept back:
  libc6 libc6-dbg
0 upgraded, 0 newly installed, 0 to remove and 2 not upgraded.

however I am OK with going ahead and doing updates on those held packages so I run

sudo apt-get install   libc6 libc6-dbg

Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following package was automatically installed and is no longer required:
  libx11-xcb1:i386
Use 'sudo apt autoremove' to remove it.
Suggested packages:
  glibc-doc
The following packages will be REMOVED:
  libatomic1:i386 libbsd0:i386 libc6:i386 libdrm-amdgpu1:i386 libdrm-intel1:i386 libdrm-nouveau2:i386 libdrm-radeon1:i386 libdrm2:i386 libedit2:i386 libelf1:i386
  libexpat1:i386 libffi6:i386 libgcc1:i386 libgl1:i386 libgl1-mesa-dri:i386 libglapi-mesa:i386 libglvnd0:i386 libglx-mesa0:i386 libglx0:i386 libidn2-0:i386 libllvm9:i386
  libnvidia-compute-430:i386 libnvidia-decode-430:i386 libnvidia-encode-430:i386 libnvidia-fbc1-430:i386 libnvidia-gl-430:i386 libnvidia-ifr1-430:i386 libpciaccess0:i386
  libsensors5:i386 libstdc++6:i386 libtinfo6:i386 libunistring2:i386 libx11-6:i386 libxau6:i386 libxcb-dri2-0:i386 libxcb-dri3-0:i386 libxcb-glx0:i386 libxcb-present0:i386
  libxcb-sync1:i386 libxcb1:i386 libxdamage1:i386 libxdmcp6:i386 libxext6:i386 libxfixes3:i386 libxshmfence1:i386 libxxf86vm1:i386 zlib1g:i386
The following packages will be upgraded:
  libc6 libc6-dbg
2 upgraded, 0 newly installed, 47 to remove and 0 not upgraded.
Need to get 8,459 kB of archives.
After this operation, 525 MB disk space will be freed.
Do you want to continue? [Y/n] 

since by doing some research I am OK doing this upgrade I say Y to above prompt ... now those held packages have been installed and the cost was the elimination of unneeded ancillary 32 bit packages ... of course you will have a different set of packages causing this The following packages have been kept back or similar message