The output of apt-get upgrade is:

The following packages have been kept back:
certbot python-acme python-certbot python-certbot-apache python-cryptography python-openssl

What does this mean? Should I take action? If so, what?

8 Answers 8


Quick & EASY Solution:

I have had the same issue, several times. Do NOT do sudo apt-get dist-upgrade first.Very important. It can make your system very unstable, programs can crash and you can lose a lot of functionality in your OS. NOTE: This solution is for Debian based machines but will not work on KDE Neon. To update KDE Neon, you must use sudo pkcon update.

You MUST install each package individually, HOWEVER, during that process, other dependencies will also be installed automatically and your issue will be solved in just a few minutes. Please see this blog post to understand why this happens.

I have had no issues with the following solution. It's fairly quick and easy.

First, do this:

apt list --upgradable

  • This will show a list of packages that can be upgraded.

Next, do this:

  • Start at the beginning of the list with the first package and type:

sudo apt-get install package-name-here

  • This will run through the installation process and pull/install dependencies.

After that process completes, do this:

apt list --upgradable

  • This will again show which packages can be upgraded. Your list of packages should now be decreasing. Follow the list of packages and type apt list --upgradable after each package install. This should only take a couple of minutes to complete.


sudo apt-get autoclean

sudo apt-get update && sudo apt-get dist-upgrade

If this solution worked for you, please don't forget to upvote it so that the correct solution is available for others and is at the top of the list of answers.

If for some reason this solution does not work for you, please see user GAD3R's answer below. It is also a good solution.


  • 2
    For me the package was ubuntu-minimal. Your instructions worked perfectly.
    – DeanM
    Feb 17, 2019 at 16:04
  • Don't use this solution if you're on KDE Neon. Sep 25, 2019 at 17:57
  • Some packages could not be installed. This may mean that you have requested an impossible situation or if you are using the unstable distribution that some required packages have not yet been created or been moved out of Incoming.
    – Michael
    Oct 23, 2020 at 1:34
  • Used for Ubuntu 22.04.1. Can't see: "The following packages have been kept back: gnome-remote-desktop grub-common grub-pc grub-pc-bin grub2-common gstreamer1.0-pipewire libpipewire-0.3-0 libpipewire-0.3-common libspa-0.2-modules open-vm-tools open-vm-tools-desktop openssh-client..." anymore. Before that OS became very slow unexpectedly
    – abc
    Jan 11, 2023 at 7:52
  • In most cases dist-upgrade is better that this solution because it will calculate the correct decisions about which packages to remove and upgrade but this solution gives you more control.
    – mjaggard
    Jan 13, 2023 at 10:41

What does this mean?

The following packages have been kept back:

The answer is here

This means that there are new versions of these packages which will not be installed for some reason. Possible reasons are broken dependencies (a package on which it depends doesn't have a version available for download) or new dependencies (the package has come to depend on new packages since the last version).

Should I take action?

You need to use dist-upgrade in order to install the new dependencies and upgrade the packages:

sudo apt-get dist-upgrade

The problem can be solved by runing dist-upgrade if not you need to:

Fix broken dependencies

sudo apt-get -f install 

Remove some packages that are no longer installed on your system:

sudo apt-get autoclean

Put the desired package on hold:

echo "<package_name> hold" | dpkg --set-selections

Reconfigure the named package:

dpkg-reconfigure <package_name>
  • 5
    It seems to me that "for some reason" is kind of a bug. Apt should tell the user why a package was held back, IMHO. For what it's worth, it seems that one reason this can happen is something called "Phased Updates" -- see wiki.ubuntu.com/PhasedUpdates -- basically, that it's trying to keep everyone from updating all at once, in case there's a regression or whatever. How much time would be saved if the software would tell us this, and to just try again later, or give an option to force it or something? Anyway...
    – lindes
    Sep 17, 2022 at 17:04

This article nicely summarizes why this happens:

If the dependencies have changed on one of the packages you have installed so that a new package must be installed to perform the upgrade then that will be listed as "kept-back".

The solution to this is to install them explicitly with

sudo apt install [packages]

You probably want to mark these packages as automatically installed, unless you care about them yourself and not just to satisfy dependencies.

sudo apt-mark auto [packages]

To prevent this from happening in the first place, I recommend to use

sudo apt --with-new-pkgs upgrade

to upgrade packages in the future, which allows installation of new packages to satisfy changes in dependencies.

  • 1
    Two thumbs up for --with-new-pkgs! And let me stress just again that, "DO NOT dist-upgrade any production system! While dist-upgrading will "solve" kept back packages it is definitely not the solution to this issue and will quite likely cause you more grief than good if you run it without knowing the implications on your system."
    – xpt
    Jun 29, 2019 at 4:19

From this Unix SE answer:

Firstly as mentioned above please DO NOT dist-upgrade any production system! While dist-upgrading will "solve" kept back packages it is definitely not the solution to this issue and will quite likely cause you more grief than good if you run it without knowing the implications on your system.

If upgrading a package requires installing additional packages it will be "kept back" when running sudo apt-get upgrade.

As mentioned above you can install these "kept back" packages manually by explicitly running sudo apt-get install [paste kept back packages here] but this will mark these packages as "manually installed" which is often not what we want.

To automatically install any additional packages needed to upgrade the "kept back" packages while not marking the "kept back" packages as manually installed just run sudo apt-get --with-new-pkgs upgrade.

  • 1
    More about --with-new-pkgs and the side effects of other alternatives here.
    – Pablo A
    Mar 24, 2019 at 22:01

I included this answer in my blog. If you want to see that you can go there from this link.

The above error is very common in Ubuntu terminal when you try to upgrade (apt-get upgrade). This usually happens because dependencies of one package you install has changed. In order to upgrade you need to upgrade those as well first. So it is very straightforward to solve that. You will be able to see those packages that kept back below this error message. as an example I can see following packages in the list:

gnome-software gnome-software-common linux-generic linux-headers-generic linux-image-generic snapd ubuntu-core-launcher ubuntu-software

Don't just type sudo apt-get dist-upgrade It is very dangerous since it installs all pending updates. This could take your working environment to a highly unstable state.

Therefore my opinion is to use famous

sudo apt-get install [package]

You can replace [package] with whatever package is in the error message. Also you can put them as it is as a list (just copy and paste it). As an example in my case I can enter

sudo apt-get install gnome-software gnome-software-common linux-generic linux-headers-generic linux-image-generic snapd ubuntu-core-launcher ubuntu-software

If you want to do

sudo apt-get dist-upgrade

for some reason, just make sure to inspect the list of packages by using the simulate option -s (sudo apt-get -s dist-upgrade), or without the -s option you can terminate execution before accepting. (you can always choose the option no )


I agree with the advice that dist-upgrade is dangerous on a production system, or any other system where you don't want unexpected surprises. For a lighter touch I suggest the following for each of the 'kept back' packages:

apt-get install --only-upgrade kept-back-package-name-here

this will upgrade the 'kept back' package and install any necessary dependencies (the need for which are probably the reason the package has been kept back). Using --only-upgrade means that the package won't be marked as 'manually installed', a issue raised in Brian Heese's answer.

  • Note: That didn't work using Kubuntu 22.04 at least in that case: $ apt list --manual-installed | grep software-properties- (and it was seen:) software-properties-common/jammy-updates,jammy-updates all [actualizable desde:] $ sudo apt install --only-upgrade software-properties-qt $ apt list --manual-installed | grep software-properties- (and it was seen:) software-properties-common/jammy-updates,jammy-updates,now all [instalado]↵ software-properties-qt/jammy-updates,jammy-updates,now all [instalado]
    – Ganton
    Aug 12, 2022 at 13:17

I find an easy way to resolve this is to install aptitude.

sudo apt install aptitude

and then

sudo aptitude update
sudo aptitude upgrade

aptitude will try hard to resolve dependencies automatically and if necessary to provide solutions, including downgrading some packages. Usually it requires no interaction. It is an old Debian tool and as far as I know rock-solid.


Recently a Debian security update introduced a few new dependencies. In this case the linux-image package started to require linux-firmware, among a few others. So they were held back and not installed by unattended-upgrade. After some testing and confirming I was able to selectively install only those packages, while not touching other pending updates:

apt-get -yy install $(apt-get -s upgrade | sed '1,/kept back/d;/will be upgraded/,$d')

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .