Yrurtj

I am running Debian 9 (stretch) and have just tried to run apt-get update and apt-get upgrade in order to update my (test) webserver as part of regular maintenance.

apt-get upgrade says:

The following packages have been kept back:
linux-image-amd64 mariadb-client-10.1 mariadb-server mariadb-server-10.1 mariadb-server-core-10.1

I understand that apt-get upgrade is, sensibly, cautious about package updates, and will only update already installed packages, rather than bringing in any new additional dependencies already. (I have already seen this older related question.)

I know that I could instead run apt-get dist-upgrade in order to "force" the dependencies to be installed. I am just wondering if there is any particular reason why these MariaDB updates have been held back, and if there is any way to tell whether it might to risky to install them regardless?

(Yes, this is only a test server, so it would not be the worst thing if I tried the upgrade and it failed somehow (and I would then know that I should ignore those updates for the live server), but I am just wondering if there is any way to find out what the issue with these packages might be (such as finding out what version would be being expected to be installed, and whether there might be anything in the Debian package release notes that I could refer to)?)

Currently, I have the following versions installed:

• mysql Ver 15.1 Distrib 10.1.26-MariaDB, for debian-linux-gnu (x86_64) using readline 5.2


• Server version: 10.1.26-MariaDB-0+deb9u1 Debian 9.1

My main concern is to ensure that my server is up to date with security updates, as far as possible.

You can find a package’s changelog by going to its package page (“https://packages.debian.org/packagename”), and looking for a link to the “Developer Information” on the right-hand side. (There’s also a “Debian Changelog” link, but it doesn’t always work.) On the resulting Package Tracker page, look for the latest stable security version on the left-hand side, and click on the icon with a checkmark. In your case, you’re missing:

• 
  these changes for MariaDB;


• 
  these changes for the kernel.

In both cases, as you suspect, apt-get upgrade isn’t upgrading because the upgrades require installing new packages; in MariaDB’s case, libconfig-inifiles-perl, and in the kernel’s case, the new kernel ABI packages. To install these new packages without going for a full dist-upgrade (which can also remove packages), run

apt-get upgrade --with-new-pkgs

or

apt upgrade

(apt upgrade behaves like apt-get upgrade --with-new-pkgs, favouring user-friendliness over consistency).