The output of apt-get upgrade is:

The following packages have been kept back:
certbot python-acme python-certbot python-certbot-apache python-cryptography python-openssl

What does this mean? Should I take action? If so, what?


Quick & EASY Solution:

I have had the same issue, countless times. Do NOT do sudo apt-get dist-upgrade first. Very important.


It can make your system very unstable, programs can crash and you can lose a lot of functionality in your OS.

You MUST install each package individually, HOWEVER, during that process, other dependencies will also be installed automatically and your issue will be solved in just a few minutes.

I have had no issues with the following solution. It's fairly quick and easy.

First, do this:

apt list --upgradable

  • This will show a list of packages that can be upgraded.

Next, do this:

  • Start at the beginning of the list with the first package and type:

sudo apt-get install package-name-here

  • This will run through the installation process and pull/install dependencies.

After that process completes, do this:

apt list --upgradable

  • This will again show which packages can be upgraded. Your list of packages should now be decreasing. Follow the list of packages and type apt list --upgradable after each package install. This should only take a couple of minutes to complete.


sudo apt-get autoclean

sudo apt-get update && sudo apt-get dist-upgrade

If this solution worked for you, please don't forget to upvote it so that the correct solution is available for others and is at the top of the list of answers.

If for some reason this solution does not work for you, please see user GAD3R's answer below. It is also a good solution.


  • 1
    For me the package was ubuntu-minimal. Your instructions worked perfectly. – DeanM Feb 17 at 16:04

What does this mean?

The following packages have been kept back:

The answer is here

This means that there are new versions of these packages which will not be installed for some reason. Possible reasons are broken dependencies (a package on which it depends doesn't have a version available for download) or new dependencies (the package has come to depend on new packages since the last version).

Should I take action?

You need to use dist-upgrade in order to install the new dependencies and upgrade the packages:

sudo apt-get dist-upgrade

The problem can be solved by runing dist-upgrade if not you need to:

Fix broken dependencies

sudo apt-get -f install 

Remove some packages that are no longer installed on your system:

sudo apt-get autoclean

Put the desired package on hold:

echo "<package_name> hold" | dpkg --set-selections

Reconfigure the named package:

dpkg-reconfigure <package_name>

I included this answer in my blog. If you want to see that you can go there from this link.

The above error is very common in Ubuntu terminal when you try to upgrade (apt-get upgrade). This usually happens because dependencies of one package you install has changed. In order to upgrade you need to upgrade those as well first. So it is very straightforward to solve that. You will be able to see those packages that kept back below this error message. as an example I can see following packages in the list:

gnome-software gnome-software-common linux-generic linux-headers-generic linux-image-generic snapd ubuntu-core-launcher ubuntu-software

Don't just type sudo apt-get dist-upgrade It is very dangerous since it installs all pending updates. This could take your working environment to a highly unstable state.

Therefore my opinion is to use famous

sudo apt-get install [package]

You can replace [package] with whatever package is in the error message. Also you can put them as it is as a list (just copy and paste it). As an example in my case I can enter

sudo apt-get install gnome-software gnome-software-common linux-generic linux-headers-generic linux-image-generic snapd ubuntu-core-launcher ubuntu-software

If you want to do

sudo apt-get dist-upgrade

for some reason, just make sure to inspect the list of packages by using the simulate option -s (sudo apt-get -s dist-upgrade), or without the -s option you can terminate execution before accepting. (you can always choose the option no )


From this Unix SE answer:

Firstly as mentioned above please DO NOT dist-upgrade any production system! While dist-upgrading will "solve" kept back packages it is definitely not the solution to this issue and will quite likely cause you more grief than good if you run it without knowing the implications on your system.

If upgrading a package requires installing additional packages it will be "kept back" when running sudo apt-get upgrade.

As mentioned above you can install these "kept back" packages manually by explicitly running sudo apt-get install [paste kept back packages here] but this will mark these packages as "manually installed" which is often not what we want.

To automatically install any additional packages needed to upgrade the "kept back" packages while not marking the "kept back" packages as manually installed just run sudo apt-get --with-new-pkgs upgrade.

  • More about --with-new-pkgs and the side effects of other alternatives here. – Pablo Bianchi Mar 24 at 22:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.