Debian testing - upgrade "Buster" to "Bullseye" version, no server for security.debian.org

Question

I tried to upgrade my Debian System using apt, the repository is set to "testing" so I expected it to change to the next version "Bullseye" from "Buster" automatically but since "Buster" moved on I get:

404  Not Found [IP: 151.101.12.204 80]

when running apt update.

The security.debian.org address does not seem to have Release files, did the address change?

E: The repository 'http://security.debian.org testing/updates Release' no longer has a Release file.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

this are the relevant entries of my /etc/apt/sources.list:

deb http://ftp.ch.debian.org/debian/ testing main contrib non-free
deb-src http://ftp.ch.debian.org/debian/ testing main contrib non-free

deb http://security.debian.org/ testing/updates main contrib non-free
deb-src http://security.debian.org/ testing/updates main contrib non-free

# jessie-updates, previously known as 'volatile'
deb http://ftp.ch.debian.org/debian/ testing-updates main contrib non-free
deb-src http://ftp.ch.debian.org/debian/ testing-updates main contrib non-free

I checked man apt-secure but could not find or understand the relevant information.

---

Update: I got two answers so far, both referring to the ofical debian.org page, but suggest a complete different solution. Can someone please explain, since I decided to not remove the security.debian.org entries, but changed the version-attribute format.

Answer 1

From https://wiki.debian.org/Status/Testing

deb http://security.debian.org testing-security main contrib non-free
deb-src http://security.debian.org testing-security main contrib non-free 

The entries slightly changed after the latest release.

Here is an announcement to debian-devel-announce:

... over the last years we had people getting confused over -updates (recommended updates) and /updates (security updates). Starting with Debian 11 "bullseye" we have therefore renamed the suite including the security updates to -security. An entry in sources.list should look like

deb security.debian.org/debian-security bullseye-security main 

For previous releases the name will not change.

Answer 2

Its a little bit confusing, but

If you are tracking testing or the next-stable code name, you should always have a corresponding deb http://security.debian.org <"testing" or codename>-security main line in your /etc/apt/sources.list . See this FAQ-Item. https://www.debian.org/security/faq#testing:

Q: How is security handled for testing?

A: Security for testing benefits from the security efforts of the entire project for unstable. However, there is a minimum two-day migration delay, and sometimes security fixes can be held up by transitions. The Security Team helps to move along those transitions holding back important security uploads, but this is not always possible and delays may occur. Especially in the months after a new stable release, when many new versions are uploaded to unstable, security fixes for testing may lag behind. If you want to have a secure (and stable) server you are strongly encouraged to stay with stable.

I think you should NOT disable the security updates for testing and keep a line like

deb http://security.debian.org testing-security main

Answer 3

To upgrade to testing you should disable the security updates.

How to upgrade to Debian (next-stable) Testing

To upgrade to testing from current stable, if you have already installed the stable release:

2.Remove or comment out your stable security updates line(s) (anything with security.debian.org in it).