How can I update the latest image that my docker service/stack uses?

You really shouldn't use latest in production or anything beyond local machine testing/learning. It makes everything ambiguous as to which image you're using, and you can't tell in docker service ls/ps if it's current by default and all sorts of other ambiguities (like SHA's not being visible in Docker Hub's GUI).

If you have no way around it, at least Swarm tries to query your registry and check for an updated SHA. If it sees one with docker service update --image <username>/<repo> <servicename> then it will pull and do a rolling update. You can watch docker events to be sure things are happening, and you can use docker service ps --no-trunc <servicename> to check afterward and see the SHA hashes of old and new images.

If you are using a compose file to deploy a service. I would not recommend using this command:

docker service update --image <username>/<repo> <servicename>    

This causes your file to be out of date and no longer the source of record for your service configuration. Instead, update your compose file with the specific image version, as Bret Fisher suggested, and run this command:

docker stack up -c </path/to/compose.yml> <servicename>

Keeping valid records is important if other people are also managing the swarm.

To add to Bret Fisher's answer, running docker stack deploy -c compose-file.yml with the same compose-file.yml file, and having an image tagged as latest will indeed compare the SHA of the images and redeploy the corresponding service's image if needed.

This is thanks to the --resolve-image flag added in Docker 17.09, which default to always.

And while testing it, I found out that it would even pull the newest image if needed too.

Related GitHub issue: https://github.com/moby/moby/issues/30951#issuecomment-342647614.