We've got a customized distribution of Ubuntu, a repository with some custom packages and we run unattended-upgrades on a number of systems. What we want to be able to do is supply an update of one of our packages which might have a new dependency which is not yet installed.

I understand apt normally prevents that from happening automatically, and using dist-upgrade would permit it.

How can I get that behavior so our unattended upgrades work the same way?

Ideally we'd only want new packages installed if one of our packages causes it to be needed (either as a direct dependency or a child, etc.)

Should I be aware of any potential problems or increased risk of breakage. The systems are generally not easily accessed via the console so anything causing a problem requiring manual intervention would be very bad!