Block the update of a Debian package, then lift the hold

Sometimes you may need to keep a precise version of a Debian package, after an application incident or while checking an update on a pilot machine. apt-mark hold blocks automatic changes to this package. It also prevents its removal.

Use it for an identified exception, with a reason and a review date. Leaving a security package blocked for months ultimately creates a blind spot in updates.

Identify the package and the installed version

Start by checking the exact name of the package. A search in the repositories doesn’t always tell you what is actually installed on the server.

dpkg-query -W -f='${Package} ${Version}n' package-name
apt-cache policy package-name

The first command displays the local version. The second compares this version with the candidates known by APT. If the package is related to a service, also note the symptom and the version that works before blocking it.

A hold does not replace the understanding of a dependency. If you block openssl, linux-image, or a library used by several applications, look at what the next update wanted to change before freezing the package.

Block the update with apt-mark hold

The command requires administrator rights. Replace package-name with the name noted in the previous step.

sudo apt-mark hold package-name
sudo apt-mark showhold

showhold should display the package. APT then respects this marking during the regular update operations. You can still check what it would do before accepting an upgrade:

sudo apt update
apt list --upgradable
sudo apt-get -s upgrade

The -s option simulates the operation. It neither downloads nor installs any package. Check that the blocked package remains at its expected version and that dependencies do not push APT into an inconsistent situation.

Do not confuse hold and manually installed package

apt-mark manual mainly prevents the auto-removal of a dependency. It does not block its update. In contrast, apt-mark hold changes the dpkg selection of the package to prevent its installation, upgrade, or automatic removal.

You can check this selection with dpkg:

dpkg --get-selections package-name
dpkg --get-selections | grep ' hold$'

This distinction avoids a false sense of security. A manually marked package can very well be upgraded to a new version during apt upgrade.

Lift the hold after testing

When the fix is validated on a test machine, remove the block and then check the list again. Do not launch a global upgrade just to unblock a single package.

sudo apt-mark unhold package-name
sudo apt-mark showhold
sudo apt install package-name

The last command targets only the concerned package. Recheck the additional packages suggested by APT before confirming. For a sensitive package, then restart the concerned service and check its logs. The man page apt-mark for Debian also details the hold, install, remove, and purge selections.

If the hold was placed after a broken update, keep in your ticket or documentation: the package, the frozen version, the reason, the testing date, and the condition that allows unblocking. This trace prevents another administrator from removing the hold without knowing why it existed.

When should a package be removed from the list?

Review the holds at each maintenance cycle. A temporary block can become dangerous when an update fixes a vulnerability or a dependency incompatibility. Check Debian announcements or the software vendor, test the new version out of production, then use apt-mark unhold as soon as the initial issue is resolved.

To install a local .deb package and cleanly repair dependencies, also consult our guide on dpkg and APT. If you automate security fixes, the article on unattended-upgrades on Debian explains the checks to maintain before letting the task run unattended.