apt says packages have been kept back, what to do?

Question

The output of apt-get upgrade is:

The following packages have been kept back:
certbot python-acme python-certbot python-certbot-apache python-cryptography python-openssl

What does this mean? Should I take action? If so, what?

Answer 1

Quick & EASY Solution:

I have had the same issue, several times. Do NOT do sudo apt-get dist-upgrade first.Very important. It can make your system very unstable, programs can crash and you can lose a lot of functionality in your OS. NOTE: This solution is for Debian based machines but will not work on KDE Neon. To update KDE Neon, you must use sudo pkcon update.

You MUST install each package individually, HOWEVER, during that process, other dependencies will also be installed automatically and your issue will be solved in just a few minutes. Please see this blog post to understand why this happens.

I have had no issues with the following solution. It's fairly quick and easy.

---

First, do this:

apt list --upgradable

• This will show a list of packages that can be upgraded.

---

Next, do this:

• Start at the beginning of the list with the first package and type:

sudo apt-get install package-name-here

• This will run through the installation process and pull/install dependencies.

---

After that process completes, do this:

apt list --upgradable

• This will again show which packages can be upgraded. Your list of packages should now be decreasing. Follow the list of packages and type apt list --upgradable after each package install. This should only take a couple of minutes to complete.

Finally:

sudo apt-get autoclean

sudo apt-get update && sudo apt-get dist-upgrade

If this solution worked for you, please don't forget to upvote it so that the correct solution is available for others and is at the top of the list of answers.

If for some reason this solution does not work for you, please see user GAD3R's answer below. It is also a good solution.

Thanks.

Answer 2

What does this mean?

The following packages have been kept back:

The answer is here

This means that there are new versions of these packages which will not be installed for some reason. Possible reasons are broken dependencies (a package on which it depends doesn't have a version available for download) or new dependencies (the package has come to depend on new packages since the last version).

Should I take action?

You need to use dist-upgrade in order to install the new dependencies and upgrade the packages:

sudo apt-get dist-upgrade

The problem can be solved by runing dist-upgrade if not you need to:

Fix broken dependencies

sudo apt-get -f install 

Remove some packages that are no longer installed on your system:

sudo apt-get autoclean

Put the desired package on hold:

echo "<package_name> hold" | dpkg --set-selections

Reconfigure the named package:

dpkg-reconfigure <package_name>

Answer 3

This article nicely summarizes why this happens:

If the dependencies have changed on one of the packages you have installed so that a new package must be installed to perform the upgrade then that will be listed as "kept-back".

The solution to this is to install them explicitly with

sudo apt install [packages]

You probably want to mark these packages as automatically installed, unless you care about them yourself and not just to satisfy dependencies.

sudo apt-mark auto [packages]

To prevent this from happening in the first place, I recommend to use

sudo apt --with-new-pkgs upgrade

to upgrade packages in the future, which allows installation of new packages to satisfy changes in dependencies.

Answer 4

From this Unix SE answer:

Firstly as mentioned above please DO NOT dist-upgrade any production system! While dist-upgrading will "solve" kept back packages it is definitely not the solution to this issue and will quite likely cause you more grief than good if you run it without knowing the implications on your system.

If upgrading a package requires installing additional packages it will be "kept back" when running sudo apt-get upgrade.

As mentioned above you can install these "kept back" packages manually by explicitly running sudo apt-get install [paste kept back packages here] but this will mark these packages as "manually installed" which is often not what we want.

To automatically install any additional packages needed to upgrade the "kept back" packages while not marking the "kept back" packages as manually installed just run sudo apt-get --with-new-pkgs upgrade.

Answer 5

I included this answer in my blog. If you want to see that you can go there from this link.

The above error is very common in Ubuntu terminal when you try to upgrade (apt-get upgrade). This usually happens because dependencies of one package you install has changed. In order to upgrade you need to upgrade those as well first. So it is very straightforward to solve that. You will be able to see those packages that kept back below this error message. as an example I can see following packages in the list:

gnome-software gnome-software-common linux-generic linux-headers-generic linux-image-generic snapd ubuntu-core-launcher ubuntu-software

Don't just type sudo apt-get dist-upgrade It is very dangerous since it installs all pending updates. This could take your working environment to a highly unstable state.

Therefore my opinion is to use famous

sudo apt-get install [package]

You can replace [package] with whatever package is in the error message. Also you can put them as it is as a list (just copy and paste it). As an example in my case I can enter

sudo apt-get install gnome-software gnome-software-common linux-generic linux-headers-generic linux-image-generic snapd ubuntu-core-launcher ubuntu-software

If you want to do

sudo apt-get dist-upgrade

for some reason, just make sure to inspect the list of packages by using the simulate option -s (sudo apt-get -s dist-upgrade), or without the -s option you can terminate execution before accepting. (you can always choose the option no )

Answer 6

I agree with the advice that dist-upgrade is dangerous on a production system, or any other system where you don't want unexpected surprises. For a lighter touch I suggest the following for each of the 'kept back' packages:

apt-get install --only-upgrade kept-back-package-name-here

this will upgrade the 'kept back' package and install any necessary dependencies (the need for which are probably the reason the package has been kept back). Using --only-upgrade means that the package won't be marked as 'manually installed', a issue raised in Brian Heese's answer.

Answer 7

I find an easy way to resolve this is to install aptitude.

sudo apt install aptitude

and then

sudo aptitude update
sudo aptitude upgrade

aptitude will try hard to resolve dependencies automatically and if necessary to provide solutions, including downgrading some packages. Usually it requires no interaction. It is an old Debian tool and as far as I know rock-solid.

Answer 8

Recently a Debian security update introduced a few new dependencies. In this case the linux-image package started to require linux-firmware, among a few others. So they were held back and not installed by unattended-upgrade. After some testing and confirming I was able to selectively install only those packages, while not touching other pending updates:

apt-get -yy install $(apt-get -s upgrade | sed '1,/kept back/d;/will be upgraded/,$d')