When you encounter the message “The following packages have been kept back” while updating your Ubuntu system using apt-get update && apt-get upgrade, it indicates that certain packages require manual intervention to update. This typically happens due to dependency issues or significant updates that need careful handling. Here’s how you can address this issue effectively:
Solution 1: Using --with-new-pkgs
A gentle approach to resolve this issue is to use the --with-new-pkgs option with the upgrade command. This method lets upgrade install new dependencies, but it still never removes anything. (The newer apt upgrade front end already allows new packages, so this flag matters mostly for apt-get.) Here’s how you can do it:
sudo apt-get update # Update the package listssudo apt-get upgrade --with-new-pkgs # Upgrade and handle new packagesThis command tries to intelligently handle the upgrade by installing any new dependencies required by the kept-back packages.
Solution 2: Explicit Installation
If the first solution doesn’t fully resolve the issue, you can explicitly install the kept-back packages:
sudo apt-get install <list of packages kept back>Replace <list of packages kept back> with the actual names of the packages. This command forces the installation or upgrade of these specific packages, typically resolving any dependency issues.
Using dist-upgrade
For a heavier-handed fix, especially when the cautious approaches don’t work, you can use:
sudo apt-get dist-upgradeThis command is more aggressive as it not only upgrades the existing packages but also intelligently handles changes in dependencies, including installing new ones and removing outdated ones. However, be cautious with this approach as it might remove packages to resolve complex dependency conflicts, which can disrupt your system setup.
Considerations and Best Practices
While dist-upgrade can resolve complex situations, it’s akin to using a heavy tool for a delicate job. It’s advisable to understand the changes it proposes (especially which packages it intends to remove) before proceeding. Think of it like car maintenance: if you have the time and knowledge, manually resolving dependencies (installing and removing packages as needed) can provide more control and peace of mind.
Final Recommendations
Here’s a consolidated approach to handling kept-back packages in Ubuntu:
- Update your package lists:
sudo apt-get update- Try upgrading using the cautious method with new packages:
sudo apt-get upgrade --with-new-pkgs- If some packages are still held back, install them explicitly:
sudo apt-get install <list of packages kept back>- As a last resort, consider using
dist-upgrade:
sudo apt-get dist-upgradeAlways ensure to replace <list of packages kept back> with the actual names of the packages. By following these steps, you should be able to safely manage and resolve issues with packages that have been kept back during an upgrade on Ubuntu.
When Packages Keep Getting Kept Back (aka the “Why Won’t This Just Work” Section)
Sometimes you run through all of the above and a package still refuses to budge. Before you nuke the server and call it a day, here are the actual common culprits.
Phased updates (Ubuntu). Since Ubuntu 21.04, apt rolls some updates out gradually. Your machine gets a stable random slot per package version, and until that slot opens, apt upgrade lists the package as kept back even though nothing is wrong. Check with apt-cache policy <package-name>: a phased version shows a marker like (phased 20%) next to its priority. Waiting is the safe fix. To take the update now, run sudo apt install <package-name>. To opt out of phasing for good, set APT::Get::Always-Include-Phased-Updates "true"; in a file under /etc/apt/apt.conf.d/. Source: Ubuntu Server docs on apt upgrade and phased updates.
Pinned packages. APT has a preferences system that lets you pin packages to specific versions or repositories. If someone (you, a sysadmin from three jobs ago, or a package maintainer’s postinst script) pinned a package, it will get held back every single time until you deal with the pin. Check your pins:
apt-cache policy <package-name>Look at the Candidate: line and the priority numbers in the version table. If the candidate is lower than the newest version listed, a pin is pushing it down. Check /etc/apt/preferences and /etc/apt/preferences.d/ for the culprit.
Manually held packages. Separate from pinning, APT has a hold mechanism. A package on hold will never be upgraded by any of the commands above, not even dist-upgrade. Check what’s being held:
apt-mark showholdIf you see your troublesome package there, that’s why. To release the hold:
sudo apt-mark unhold <package-name>And if you want to intentionally hold something (say, a kernel version that actually boots), that’s how you do it too. Useful for those “I finally got this working and I refuse to let apt touch it” moments.
Third-party repos with stale GPG keys or mismatched release files. If you’ve got a PPA or a vendor repo (Docker, Grafana, anything with its own /etc/apt/sources.list.d/ entry), and that repo is lagging behind or has a broken Release file, APT refuses to use that repo’s package lists, so candidates go stale or dependencies can’t be resolved, and upgrades get kept back. Spot this with:
sudo apt-get update 2>&1 | grep -iE "err|warn|expired|invalid"A bunch of W: Skipping or E: Failed to fetch lines pointing at a specific repo is your answer. Fix the repo before expecting the packages to flow.
The nuclear diagnostic. If you can’t figure out why a specific package is being kept back, this tells you exactly what’s blocking it:
sudo apt-get install --simulate <package-name>The --simulate flag (same as -s) does a dry run and shows you every dependency decision APT would make, including what it would remove and why. It’s the “explain yourself” flag, and it actually works.
Common Questions
What does “the following packages have been kept back” actually mean?
It means the new version of those packages pulls in a dependency that is not installed
yet, and plain apt upgrade refuses to add or remove packages. Nothing is broken and
nothing is held. APT is being conservative by design. On Debian 12 and Ubuntu the usual
cause is a kernel or library that gained a new dependency.
Is it safe to force install packages that are kept back?
Usually yes, if the only change is new dependencies being added. Run
sudo apt-get install --simulate <package> first and read what APT proposes. Approve it
when the plan only installs new packages. Stop and investigate when it wants to remove
something, because that is where a dist-upgrade breaks a working system.
Why is a package still kept back after apt upgrade --with-new-pkgs?
Because it is pinned or held rather than blocked by dependencies. Check
apt-mark showhold for a manual hold and apt-cache policy <package> for a pin, then
look in /etc/apt/preferences.d/. A held package is skipped by every upgrade command
including dist-upgrade, so no amount of retrying will move it.
How do I find out what is blocking a specific package?
sudo apt-get install --simulate <package> prints every dependency decision APT would
make, including what it would install and remove and why. It changes nothing on disk. A
(phased N%) marker in apt-cache policy output means Ubuntu is rolling the update out
gradually and your machine has not been picked yet.
