Ubuntu: upgrade specific packages or security updates

To refresh only specific packages installed on Ubuntu, use apt install --only-upgrade PACKAGE. To select security updates, check the allowed sources in unattended-upgrades, simulate the upgrade, and then apply it. Depending on the dependencies or settings of the selected packages, other packages may also be changed together.

Things to check before updating

apt update fetches the package list from the repository but does not upgrade installed packages. Installation and upgrading are separate tasks. Before applying the update, check backup and recovery methods, disk space, and potential service interruptions, and schedule the operation time on production servers.

sudo apt update
apt list --upgradable

If the first command fails, resolve repository and network errors, then refresh the list again. The second command shows currently upgradable packages, but this does not mean that all items in the list are security updates.

Upgrading a Specific Package

The commands below use curl as an example, assuming it is already installed. Replace it with the actual name of the installed package you want to update. First, check the candidate version, source, and the expected changes by APT.

apt-cache policy curl
sudo apt-get -s install --only-upgrade curl

-s is a dry run that does not perform the installation. --only-upgrade will not newly install the specified package if it is not already installed. However, it may suggest installing, upgrading, or removing other packages required for the upgrade of the target package, so review the entire result. The desired version may not be selected depending on held packages, dependencies, and repository priority.

If the expected changes are appropriate, apply them with the following command. Reconfirm the list of installations, upgrades, removals, and space requirements suggested by APT, and if it differs from what you expect, stop at the confirmation step.

sudo apt install --only-upgrade curl

After completion, check the installed version with apt-cache policy curl and verify that the corresponding service or application operates correctly. Depending on the package, a service restart or system reboot may be required.

Check the allowed sources for security updates

Unlike the name, unattended-upgrade does not always select only security updates as fixed. Depending on the configured allowed sources, other updates can also be installed. First, check whether the package is installed and the current APT settings.

dpkg-query -W unattended-upgrades
apt-config dump | grep -E 'Unattended-Upgrade::(Allowed-Origins|Origins-Pattern|Automatic-Reboot|Remove-)'
apt-cache policy

If it is not installed, it can be installed with sudo apt install unattended-upgrades. After installation, the automatic update schedule may become active, so check the server policy and existing /etc/apt/apt.conf.d/20auto-upgrades settings. Compare the repository information of apt-cache policy with the allowed list, and also verify settings for automatic reboot or unnecessary package removal. The list may combine values from multiple configuration files.

If sources outside the security scope, such as -updates or external repositories, are allowed, you must adjust the settings according to organizational policy before executing the command below. Ubuntu Pro's ESM security repository and external repositories may be separate sources, so check the support scope and sources to ensure required security patches are not missed. You can check the default sources and reboot settings in Ubuntu automatic update document.

Example allowing only general Ubuntu security repositories

The following is an example configuration that only allows the standard Ubuntu security repositories. It does not include ESM or external repositories, so do not apply it as-is in environments that require those updates. Since this is a persistent setting that also affects automatic updates, record your existing policies and ensure it does not conflict with other configuration management tools before proceeding.

In /etc/apt/apt.conf.d/, create a new file named 99local-security-only without overwriting an existing file, and save the following content. The APT list retains existing entries when new ones are simply added, so first clear both lists. #clear is an APT configuration directive, not a shell prompt.

#clear Unattended-Upgrade::Allowed-Origins;
#clear Unattended-Upgrade::Origins-Pattern;
Unattended-Upgrade::Allowed-Origins {
    "${distro_id}:${distro_codename}-security";
};

Other files may re-add sources later, so after saving, check the actual allowed sources using the above apt-config dump and the dry run results. The security repository must be active, and if necessary dependencies cannot be obtained from allowed sources, some packages may remain pending. To revert this configuration, only remove the file created by this operation and check the configuration and dry run results again.

Dry run and post-application verification

The following command is used to check the allowed sources and packages to be processed without actually installing updates. Review the output and logs for unexpected sources, pending items, and errors.

sudo unattended-upgrade --dry-run --debug

Simulation execution does not guarantee the results of actual work. Review the source and target, the automatic reboot/removal policies, and run the following command only during a suitable maintenance window.

sudo unattended-upgrade --verbose

After completion, check the logs in /var/log/unattended-upgrades/ and the status of affected services, and if necessary, reboot at the planned time. Commenting out repositories in sources.list can overlook other source files and dependencies, so this method is not used here. For options and log paths, refer to Ubuntu unattended-upgrade manual.