Your store keeps the version of an app it installed until you accept an update. A new version never changes what the app can do in your store on its own.
Accept an update
When a new version is available, Apps shows Update available next to the app; filter the list by Updates available to see them all. You also get a notification.
Choose Update app. If the version asks for the same access, confirm and your store moves to it; your data with the app stays as it is.
If it asks for more access, such as new store data or new storefront additions, choose Review update: the screen shows the access the new version asks for. Accept to update, or leave it and keep the version you have.
If the developer marked the update as breaking, read their release notes before you continue.
Staff need permission to manage apps to update one.
Private updates
A private app isn't in the App Store: its developer installs it on chosen stores with an install link and sends each update to the stores they choose. A private update reaches your store as a notification and appears under Apps like any other update. Review and accept it the same way; until you do, the app keeps running the version you have. If the developer sends a newer version before you accept, the newer one replaces the offer.
Updates you won't see
Changes to an app's App Store listing, such as its logo or description, don't need an update in your store. Changes the developer makes on their own servers reach every store at once, but they can never give the app more access than you approved.