LFCA 29 🐧 Removing and Updating Packages
Installing software is only half of package management. The other half is taking it away and keeping it current. Removing a package is not the reverse of installing it — configuration files are preserved by default, dependencies that were installed automatically are left behind, and packages that other packages depend on cannot be removed without removing the dependents. Updating is not a single operation either — refreshing the index, upgrading installed packages, and moving to a new distribution release are three different things with different commands and different risks. This chapter covers both operations in full: the commands, the flags, what happens under the hood, the recovery patterns when a removal breaks something, and the difference between a routine upgrade and a distribution upgrade. It continues the package management sequence from the previous two chapters and completes the essential lifecycle.
Key point: apt remove uninstalls a package but leaves its configuration files; apt purge removes the configuration too. apt autoremove cleans up dependencies that were installed automatically and are no longer needed. apt upgrade applies updates without removing packages; apt full-upgrade may remove or install packages to complete the upgrade. On Fedora, dnf remove and dnf upgrade are the equivalents, and dnf autoremove cleans up orphans. Updating the index (apt update) is separate from upgrading the packages (apt upgrade) — the first refreshes the list of what is available, the second installs the newer versions. A distribution upgrade is a third operation, done with do-release-upgrade on Ubuntu or by changing the release in the repository configuration on Debian.
Removing packages on Debian and Ubuntu
The remove command uninstalls the package’s files but preserves its configuration. This is deliberate: reinstalling the package restores it with the previous configuration intact, which is the right behavior for a package that is being temporarily removed.
sudo apt remove nginxThe command removes the package’s files, updates the package database, and leaves the configuration files under /etc in place. It also shows a plan: which packages will be removed, which will be upgraded, and whether removing the package requires removing dependents.
Why removing a package can remove others. If another installed package depends on the one being removed, the dependent package cannot function without it. The resolver handles this in one of two ways: it refuses the removal, or it removes the dependent package as well. The plan shows which dependents will be removed, and the user can abort if the collateral removal is not acceptable.
Why the plan must be read. A removal plan that includes packages not mentioned in the command is the most common cause of accidental breakage. Removing a library that many packages depend on can remove the desktop environment or the network manager. The plan shows the full set, and reading it before confirming is the safety check.
Purging configuration. The purge command removes the package and its configuration files.
sudo apt purge nginxAfter a purge, the package’s configuration is gone. Reinstalling produces a fresh default configuration. The distinction matters when a configuration has become corrupt or when the package is being permanently removed.
Why both commands exist. A package that is being removed because it is no longer wanted should be purged. A package that is being removed temporarily — to reinstall a different version, to reset a broken state — should be removed, so the configuration survives. The two commands serve two intents, and the default (remove) is the conservative one.
Removing without removing dependencies. The --no-autoremove flag prevents the automatic removal of packages that were installed as dependencies and are no longer needed. By default, apt remove does not autoremove; the cleanup is a separate command. The flag is relevant when the automatic behavior has been configured.
Why removal is safer than installation in one respect. An install can pull in new packages and upgrade existing ones. A removal only removes. The plan is smaller, and the change is easier to reason about. The risk is in the dependents — the packages that are removed because they depended on the one being removed.
Why
apt removedoes not remove dependencies. When a package is installed, its dependencies are installed too. When the package is removed, the dependencies remain, because they might be needed by other packages or by the user directly. This is why a system accumulates orphaned dependencies over time, and whyautoremoveexists. The separation of “remove the package” and “remove the dependencies it brought in” is deliberate, because the dependency might have been installed for another reason.
Cleaning up orphans with autoremove
An orphaned dependency is a package that was installed automatically as a dependency of another package and is no longer needed by any installed package. These accumulate as packages are installed and removed, and they consume disk space.
sudo apt autoremoveThe command identifies orphaned dependencies and removes them. It shows a plan, and the plan should be read — an autoremove that removes more than expected is a signal that something depends on a package that was thought to be unused.
Why orphans accumulate. Every install that brings in dependencies leaves those dependencies behind when the parent package is removed. Over a system’s life, this can be hundreds of packages. The autoremove command is the cleanup, and running it periodically keeps the system lean.
Why autoremove should be run after a purge. Purging a package removes its configuration but not its dependencies. The autoremove is the second step that cleans up what the package brought in. Running apt purge package && apt autoremove is the complete removal.
Why autoremove can be dangerous. The heuristic for “no longer needed” is based on the automatic/manual flag in the package database. A package that was installed automatically but is actually used directly — because a script depends on it, or because the user installed it and the flag was lost — can be removed by autoremove. The plan shows what will be removed, and the user should confirm that nothing important is in the list.
Why the automatic/manual distinction exists. When a package is installed explicitly, it is marked “manual.” When it is installed as a dependency, it is marked “automatic.” autoremove removes automatic packages that no manual package depends on. The distinction is what prevents autoremove from removing the packages the user actually wants.
Marking a package as manual. If a package was installed automatically but is needed directly, it can be marked manual.
sudo apt-mark manual packageThis removes it from the autoremove candidate list. The reverse is apt-mark auto, which marks a package as automatic so it becomes eligible for autoremove.
Updating: index refresh vs package upgrade
The word “update” is ambiguous in package management, and the ambiguity causes confusion. There are two distinct operations, and they are often run together.
Refresh the index. apt update downloads the current list of available packages and versions from the repositories. It changes nothing about what is installed. It is the prerequisite for every install and upgrade.
sudo apt updateUpgrade installed packages. apt upgrade installs the newer versions of packages that are already installed, based on the current index.
sudo apt upgradeWhy they are separate. The index refresh is a read-only operation that can be done at any time. The upgrade changes the system and requires the index to be current. Separating them allows the index to be refreshed without committing to an upgrade, and it makes the upgrade’s plan based on fresh information.
Why apt upgrade and apt full-upgrade differ. apt upgrade never removes a package and never installs a new one to satisfy a dependency. If an upgrade requires removing a package, apt upgrade refuses and reports the situation. apt full-upgrade (or apt-get dist-upgrade) will remove and install packages as needed to complete the upgrade. For a routine security update, upgrade is the conservative choice; full-upgrade is for cases where the package set must change.
sudo apt full-upgradeWhy full-upgrade is sometimes necessary. A new version of a package may split into two packages, or a dependency may change to a different library. apt upgrade cannot handle these because it will not install or remove. full-upgrade handles them by making the necessary changes, at the cost of more extensive changes to the system.
Why the upgrade should be done regularly. Security updates are released continuously. A system that is not updated accumulates known vulnerabilities. The upgrade applies the fixes, and running it regularly keeps the exposure window small. On a server, the upgrade is often scheduled and the plan is logged rather than reviewed interactively.
Why a kernel upgrade requires a reboot. The kernel is loaded at boot and cannot be replaced while running. When a kernel package is upgraded, the new kernel is installed alongside the old one, and the running kernel continues until the system is rebooted. The reboot switches to the new kernel, and the old one remains as a fallback.
Why
apt upgrademay hold back packages. When a package’s upgrade requires a change thatapt upgradecannot make — a new dependency, a removal — it is “kept back” and reported at the end. The message says which packages were held back and why.full-upgraderesolves these by making the changes. The kept-back message is a signal that the conservative upgrade could not apply everything.
Automatic updates
Manually running the upgrade is the baseline. On a production system, automatic updates are often configured so security fixes are applied without waiting for an administrator.
Ubuntu’s unattended-upgrades. The unattended-upgrades package applies security updates automatically. It is configured in /etc/apt/apt.conf.d/50unattended-upgrades and enabled or disabled in /etc/apt/apt.conf.d/20auto-upgrades.
sudo apt install unattended-upgrades
sudo dpkg-reconfigure --priority=low unattended-upgradesThe configuration determines which repositories are included (security only, or all), whether a reboot is allowed, and what happens when a package requires a restart.
Why automatic updates are controversial. They apply changes without review, which is good for security and bad for stability. A security update that fixes a vulnerability may also introduce a regression. The tradeoff is between exposure to known vulnerabilities and exposure to unexpected changes. For most systems, the security updates are worth applying automatically and the rest are applied manually.
Why the reboot decision matters. A kernel or library update requires a reboot to take effect. The automatic updater can be configured to reboot without asking, to ask, or to never reboot. On a server, an unexpected reboot is disruptive; on a desktop, it is expected. The configuration reflects the system’s role.
Why Fedora’s approach differs. Fedora uses dnf-automatic for the same purpose, configured through /etc/dnf/automatic.conf. The mechanism is the same — apply updates on a schedule, with a policy for reboots.
Upgrading to a new distribution release
A distribution upgrade is a different operation from a package upgrade. It moves the entire system from one release to the next — Ubuntu 24.04 to 24.10, for example — and it changes the repositories to point at the new release.
Ubuntu’s do-release-upgrade.
sudo do-release-upgradeThe command checks for a new release, downloads the upgrade tool, and runs it. The tool changes the repository configuration, upgrades every package, and handles the transition. It is a significant operation that takes time and may require reboots, and it should be done with a backup.
Debian’s approach. Debian’s distribution upgrade is manual. The repository configuration in /etc/apt/sources.list is changed from one release name to the next, then apt update and apt full-upgrade are run in sequence.
# Edit /etc/apt/sources.list, replace the release name
sudo apt update
sudo apt full-upgrade
sudo apt autoremoveThe sequence is deliberate: refresh the index with the new repositories, then upgrade to the new versions, then clean up the packages that are no longer needed.
Why the distribution upgrade is risky. It changes hundreds or thousands of packages at once, and any of them can introduce a regression. Configuration files may be replaced or preserved with prompts, and the user must decide for each. Services may need to be restarted, and the system may need to be rebooted. The upgrade should be done with a backup and with the ability to roll back.
Why the release upgrade is sometimes skipped. Many administrators prefer a clean install of the new release over an in-place upgrade, because the clean install produces a known state and the upgrade produces a state that has been modified by every previous upgrade. The choice depends on the system’s role and the administrator’s preference.
Why do-release-upgrade checks the version. By default, it upgrades to the next LTS release, not to an interim release. The behavior is controlled by the Prompt setting in /etc/update-manager/release-upgrades. Upgrading to an interim release requires changing the setting or using -d.
The equivalents on other distributions
The concepts are the same, and the syntax differs.
Fedora and RHEL use dnf.
sudo dnf remove nginx
sudo dnf autoremove
sudo dnf upgrade
sudo dnf distro-syncThe remove command is the equivalent of apt remove. The autoremove command cleans up orphans. The upgrade command applies updates. The distro-sync command synchronizes the installed packages with the repository versions, which is the equivalent of a distribution upgrade in effect.
openSUSE uses zypper.
sudo zypper remove nginx
sudo zypper packages --unneeded
sudo zypper update
sudo zypper dupThe dup subcommand is the distribution upgrade. The update command applies updates within the current release. The --unneeded query lists packages that are no longer required, which is the equivalent of the autoremove candidate list.
Arch uses pacman.
sudo pacman -R nginx
sudo pacman -Rns nginx
sudo pacman -Qdtq | sudo pacman -Rns -
sudo pacman -SyuThe -R flag removes a package. The -Rns combination removes the package, its dependencies that are no longer needed, and its configuration files, which is the equivalent of apt purge plus autoremove. The -Qdtq query lists orphaned packages, and piping it to -Rns - removes them. Arch’s rolling release means there is no separate distribution upgrade; the -Syu is both the routine upgrade and the release upgrade.
Why the Arch removal is more complete by default. The -Rns combination removes the package, its unneeded dependencies, and its configuration in one command. This is the opposite of the Debian default, where removal preserves configuration and dependency cleanup is separate. The Arch model assumes a package being removed is being removed permanently.
| Operation | apt | dnf | zypper | pacman |
|---|---|---|---|---|
| Remove | apt remove | dnf remove | zypper remove | pacman -R |
| Purge config | apt purge | — | — | pacman -Rns |
| Autoremove | apt autoremove | dnf autoremove | zypper packages --unneeded | pacman -Qdtq | pacman -Rns - |
| Upgrade | apt upgrade | dnf upgrade | zypper update | pacman -Syu |
| Full upgrade | apt full-upgrade | dnf distro-sync | zypper dup | pacman -Syu |
Complete Example Session
# ============================================
# PART 1: REMOVE A PACKAGE
# ============================================
sudo apt remove nginx
# Reading package lists... Done
# Building dependency tree... Done
# The following packages will be REMOVED:
# nginx nginx-common nginx-core
# 0 upgraded, 0 newly installed, 3 to remove.
# After this operation, 5,678 kB disk space will be freed.
# Do you want to continue? [Y/n] y
# ...
# Removing nginx (1.24.0-1ubuntu1) ...
# Configuration files in /etc/nginx are preserved.
# ============================================
# PART 2: PURGE CONFIGURATION
# ============================================
sudo apt purge nginx
# Removes the package and its configuration files
# ============================================
# PART 3: AUTOREMOVE
# ============================================
sudo apt autoremove
# Reading package lists... Done
# The following packages will be REMOVED:
# libnginx-mod-http-geoip
# libnginx-mod-http-image-filter
# 0 upgraded, 0 newly installed, 2 to remove.
# ...
# ============================================
# PART 4: MARK A PACKAGE MANUAL
# ============================================
sudo apt-mark manual libssl3
# libssl3 set to manually installed.
# It will not be autoremoved.
# ============================================
# PART 5: UPDATE THE INDEX
# ============================================
sudo apt update
# Hit:1 http://archive.ubuntu.com/ubuntu noble InRelease
# Get:2 http://security.ubuntu.com/ubuntu noble-security InRelease
# Reading package lists... Done
# ============================================
# PART 6: UPGRADE PACKAGES
# ============================================
sudo apt upgrade
# Reading package lists... Done
# Building dependency tree... Done
# Calculating upgrade... Done
# The following packages will be upgraded:
# libc6 libssl3
# 2 upgraded, 0 newly installed, 0 to remove.
# ...
# Setting up libc6 (2.39-0ubuntu8.4) ...
# ============================================
# PART 7: FULL UPGRADE
# ============================================
sudo apt full-upgrade
# The following packages will be REMOVED:
# old-package
# The following NEW packages will be installed:
# new-dependency
# The following packages will be upgraded:
# ...
# 1 upgraded, 1 newly installed, 1 to remove.
# ...
# ============================================
# PART 8: KEPT-BACK PACKAGES
# ============================================
sudo apt upgrade
# The following packages have been kept back:
# linux-image-generic
# 0 upgraded, 0 newly installed, 0 to remove.
# The kernel was held back because the upgrade requires
# a new dependency. full-upgrade will apply it.
# ============================================
# PART 9: FEDORA EQUIVALENTS
# ============================================
sudo dnf remove nginx
sudo dnf autoremove
sudo dnf upgrade
sudo dnf distro-sync
# ============================================
# PART 10: ARCH EQUIVALENTS
# ============================================
sudo pacman -R nginx
sudo pacman -Rns nginx
sudo pacman -Qdtq | sudo pacman -Rns -
sudo pacman -Syu
# ============================================
# PART 11: DISTRIBUTION UPGRADE
# ============================================
# Ubuntu
sudo do-release-upgrade
# Debian (manual)
# Edit /etc/apt/sources.list, change the release name
sudo apt update
sudo apt full-upgrade
sudo apt autoremove
# ============================================
# PART 12: WHAT NOT TO DO
# ============================================
# Don't remove a package without reading the plan
# The plan may include critical dependents
# Don't autoremove on a system where packages were
# installed manually but marked automatic
# Don't run a distribution upgrade without a backup
# Don't reboot during a kernel upgrade before it completes
# Don't ignore kept-back packages
# They contain security fixes that were not applied
# Don't use apt remove on a package you want to purge
# The configuration will remainThe twelve parts cover removal, purging, autoremove, marking, update, upgrade, full upgrade, kept-back packages, the equivalents on Fedora and Arch, the distribution upgrade, and the anti-patterns.
Quick Reference
Removal
| Command | Effect |
|---|---|
apt remove pkg | Uninstall, keep config |
apt purge pkg | Uninstall, remove config |
apt autoremove | Remove orphaned deps |
apt-mark manual pkg | Mark as manually installed |
apt-mark auto pkg | Mark as automatic |
Update and Upgrade
| Command | Effect |
|---|---|
apt update | Refresh the index |
apt upgrade | Upgrade, no removals |
apt full-upgrade | Upgrade, may remove/install |
apt list --upgradable | Show upgradable packages |
apt --fix-broken install | Repair the database |
Distribution Upgrade
| Distribution | Command |
|---|---|
| Ubuntu | sudo do-release-upgrade |
| Debian | Edit sources, then apt update && apt full-upgrade |
| Fedora | sudo dnf system-upgrade |
| openSUSE | sudo zypper dup |
| Arch | Rolling — pacman -Syu |
Cross-Distribution Mapping
| Operation | apt | dnf | zypper | pacman |
|---|---|---|---|---|
| Remove | apt remove | dnf remove | zypper remove | pacman -R |
| Purge | apt purge | — | — | pacman -Rns |
| Autoremove | apt autoremove | dnf autoremove | --unneeded | -Qdtq |
| Upgrade | apt upgrade | dnf upgrade | zypper update | -Syu |
| Full | apt full-upgrade | dnf distro-sync | zypper dup | -Syu |
Kernel Upgrade
| Step | Command |
|---|---|
| Upgrade | apt upgrade or apt full-upgrade |
| Check running | uname -r |
| Check installed | dpkg -l 'linux-image-*' |
| Reboot | sudo reboot |
| Remove old | apt autoremove |
Best Practices
✅ Do This:
# Read the removal plan before confirming
sudo apt remove nginx # ✅
# Use purge for permanent removal
sudo apt purge nginx && sudo apt autoremove # ✅
# Run autoremove periodically
sudo apt autoremove # ✅
# Mark packages that are needed directly
sudo apt-mark manual libssl3 # ✅
# Refresh the index before upgrading
sudo apt update && sudo apt upgrade # ✅
# Use full-upgrade when the upgrade requires changes
sudo apt full-upgrade # ✅
# Check for kept-back packages
apt list --upgradable # ✅
# Back up before a distribution upgrade
# The operation changes hundreds of packages # ✅
# Reboot after a kernel upgrade
sudo reboot # ✅❌ Don’t Do This:
# Don't autoremove without reading the plan
sudo apt autoremove # may remove packages you use # ⚠️
# Don't remove a package without checking dependents
sudo apt remove libssl3 # breaks everything that uses it # ⚠️
# Don't ignore kept-back packages
# They contain unapplied security fixes # ⚠️
# Don't run a distribution upgrade without a backup
sudo do-release-upgrade # irreversible without one # ⚠️
# Don't reboot during an upgrade
# The upgrade will be interrupted and the database left broken # ⚠️
# Don't use `apt upgrade` for a distribution upgrade
# Use `do-release-upgrade` or `apt full-upgrade` # ⚠️
# Don't assume remove is the reverse of install
# Configuration and dependencies remain # ⚠️Common Pitfalls
| Pitfall | Problem | Solution |
|---|---|---|
| Remove leaves config | Config files remain | Use purge |
| Orphans accumulate | Wasted disk space | Run autoremove |
| Autoremove removes needed | Marked automatic | apt-mark manual |
| Kept-back packages ignored | Security fixes missing | full-upgrade |
| Interrupted upgrade | Broken database | --fix-broken install |
| Distribution upgrade without backup | Cannot roll back | Back up first |
| Kernel upgrade without reboot | Old kernel running | Reboot |
| Removing a shared library | Dependents break | Read the plan |
Real-World Examples
1. Remove a package
sudo apt remove nginx2. Purge with config
sudo apt purge nginx3. Clean up orphans
sudo apt autoremove4. Mark a package manual
sudo apt-mark manual libssl35. Update and upgrade
sudo apt update && sudo apt upgrade6. Full upgrade
sudo apt full-upgrade7. Check upgradable
apt list --upgradable8. Repair broken state
sudo apt --fix-broken install9. Fedora upgrade
sudo dnf upgrade --refresh10. Arch full system upgrade
sudo pacman -SyuVisual: Remove vs Purge
┌──────────────────────────────────────────────────────────┐
│ apt remove nginx │
│ │
│ /usr/sbin/nginx removed │
│ /usr/lib/nginx/ removed │
│ /etc/nginx/nginx.conf PRESERVED │
│ /etc/nginx/sites/ PRESERVED │
│ │
│ Reinstall → old configuration is restored. │
│ │
├──────────────────────────────────────────────────────────┤
│ apt purge nginx │
│ │
│ /usr/sbin/nginx removed │
│ /usr/lib/nginx/ removed │
│ /etc/nginx/nginx.conf removed │
│ /etc/nginx/sites/ removed │
│ │
│ Reinstall → fresh default configuration. │
│ │
└──────────────────────────────────────────────────────────┘Visual: The Upgrade Types
┌──────────────────────────────────────────────────────────┐
│ apt update │
│ Refresh the index. │
│ Nothing installed changes. │
│ │
├──────────────────────────────────────────────────────────┤
│ apt upgrade │
│ Install newer versions of installed packages. │
│ Does NOT remove packages. │
│ Does NOT install new dependencies for upgrades. │
│ Packages that need those are "kept back." │
│ │
├──────────────────────────────────────────────────────────┤
│ apt full-upgrade │
│ Install newer versions. │
│ MAY remove packages that conflict. │
│ MAY install new dependencies. │
│ Resolves kept-back packages. │
│ │
├──────────────────────────────────────────────────────────┤
│ do-release-upgrade │
│ Move to a new distribution release. │
│ Changes repositories, upgrades everything. │
│ Riskier, slower, should be backed up. │
│ │
└──────────────────────────────────────────────────────────┘Visual: Kept-Back Packages
┌──────────────────────────────────────────────────────────┐
│ sudo apt upgrade │
│ │
│ The following packages have been kept back: │
│ linux-image-generic │
│ linux-headers-generic │
│ 0 upgraded, 0 newly installed, 0 to remove. │
│ │
│ Why? The upgrade requires a new dependency, │
│ and apt upgrade will not install new packages. │
│ │
│ The packages hold security fixes that are not applied. │
│ │
├──────────────────────────────────────────────────────────┤
│ sudo apt full-upgrade │
│ │
│ The following NEW packages will be installed: │
│ linux-modules-extra-6.8.0-45-generic │
│ The following packages will be upgraded: │
│ linux-image-generic linux-headers-generic │
│ 2 upgraded, 1 newly installed, 0 to remove. │
│ │
│ The kept-back packages are applied. │
│ │
└──────────────────────────────────────────────────────────┘Visual: Distribution Upgrade
┌──────────────────────────────────────────────────────────┐
│ Ubuntu 24.04 LTS │
│ │ │
│ │ do-release-upgrade │
│ │ │
│ ▼ │
│ 1. Check for a new release │
│ 2. Download the upgrade tool │
│ 3. Change /etc/apt/sources.list to the new release │
│ 4. apt update │
│ 5. apt full-upgrade │
│ 6. Handle configuration file prompts │
│ 7. Remove obsolete packages │
│ 8. Reboot │
│ │ │
│ ▼ │
│ Ubuntu 24.10 │
│ │
│ Hundreds of packages change. │
│ Backup is essential. │
│ │
└──────────────────────────────────────────────────────────┘Visual: Cross-Distribution Removal
┌──────────────────────────────────────────────────────────┐
│ DEBIAN/UBUNTU │
│ apt remove pkg keep config │
│ apt purge pkg remove config │
│ apt autoremove clean orphans │
│ │
├──────────────────────────────────────────────────────────┤
│ FEDORA/RHEL │
│ dnf remove pkg remove package │
│ dnf autoremove clean orphans │
│ │
├──────────────────────────────────────────────────────────┤
│ OPENSUSE │
│ zypper remove pkg remove package │
│ zypper packages --unneeded list orphans │
│ │
├──────────────────────────────────────────────────────────┤
│ ARCH │
│ pacman -R pkg remove package │
│ pacman -Rns pkg remove + deps + config │
│ pacman -Qdtq list orphans │
│ │
│ Arch is more aggressive by default: │
│ -Rns removes everything in one command. │
│ │
└──────────────────────────────────────────────────────────┘Summary
| Operation | Command (Debian) | Effect |
|---|---|---|
| Remove | apt remove pkg | Uninstall, keep config |
| Purge | apt purge pkg | Uninstall, remove config |
| Autoremove | apt autoremove | Clean orphans |
| Mark manual | apt-mark manual pkg | Exclude from autoremove |
| Refresh index | apt update | Download package lists |
| Upgrade | apt upgrade | Upgrade, no removals |
| Full upgrade | apt full-upgrade | Upgrade, may change set |
| List upgradable | apt list --upgradable | Show available updates |
| Distribution upgrade | do-release-upgrade | Move to new release |
| Repair | apt --fix-broken install | Fix database |
Key takeaways:
apt removepreserves configuration;apt purgeremoves it — the distinction matters when a package is being temporarily removed versus permanently removedapt autoremovecleans up orphaned dependencies — packages installed automatically that no longer have a parent, and the plan should be read before confirming- Packages can be marked manual or automatic —
apt-mark manualprevents a needed package from being autoremoved, andapt-mark automakes one eligible apt updateandapt upgradeare separate operations — the first refreshes the index, the second installs newer versionsapt upgradenever removes or installs new packages — when an upgrade requires a change to the package set, the package is “kept back” and reportedapt full-upgraderesolves kept-back packages by making the necessary removals and installs, at the cost of more extensive changes- Kept-back packages contain unapplied security fixes — they should not be ignored, and the reason for the hold should be understood
- A kernel upgrade requires a reboot — the running kernel cannot be replaced, so the new one takes effect on the next boot
- A distribution upgrade is a different operation —
do-release-upgradeon Ubuntu or a manual repository change on Debian, and it should always be preceded by a backup - The concepts are universal —
dnf remove,zypper remove, andpacman -Rnsdo the same thing with different syntax, and Arch is more aggressive by default
Remember: Removing a package is not the reverse of installing it. Configuration is preserved by default, dependencies are left behind, and dependents may be removed with it. Updating is two operations — refreshing the index and upgrading the packages — and a third, the distribution upgrade, is a separate and riskier thing. Read the plan before confirming, run autoremove periodically, apply full-upgrade when packages are held back, and never start a distribution upgrade without a backup.
Stop using slow, ad-bloated tool sites! 🤮
🔎 Search “KandZ Tools” on Google to use many professional utilities for free.
KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)
⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free
🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!