Downgrade Debian linux from 10.8 to 10.7

Question

I have installed Debian 10.7 OS on Virtual box.

pra@pra:cat /etc/debian_version 
10.7

However, somehow it is upgraded to 10.8

pra@pra:cat /etc/debian_version 
10.8

Can I know how to downgrade back to 10.7 safely.

Answer 1

Short answer: You don't.

10.7 and 10.8 are point releases. They contain nothing but security updates, backported into the current software versions.

From that page:

Point Releases

Even stable is updated once in a while. Those updates are called "Point Releases". They usually incorporate the security fixes released until the time of the update and fixes for important bugs in the current release. They are prepared by the Stable Release Managers (SRM). As of February 2009 they should happen about every two months.

In fact, the version "upgrade" happens automatically when you update the package cache:

Reading package lists... Done 
Building dependency tree
Reading state information... Done 
43 packages can be upgraded. Run 'apt list --upgradable' to see them. 
N: Repository 'http://ftp.nl.debian.org/debian buster InRelease' changed its 'Version' value from '10.7' to '10.8'

In theory if you still had the archived versions of all the software you installed cached somewhere locally and if you were very careful you could manually downgrade everything back to 10.7, but you'd accomplish absolutely nothing useful and would wind up making your system less secure and stable, not more.

Answer 2

In addition to Shadur's correct answer, I'd like to point out the suite workflow.

Unlike a rolling distribution, Debian stable is stable. That doesn't mean it doesn't change, just that the changes are limited. Specifically, the changes are limited to:

1. Security updates
2. Bug fixes of severity "important" or higher.

In both cases, changes to the package are limited to only what's required to solve the problem. If the original software's author says "it's fixed in the latest version", it's not good enough for a Debian Developer to simply upload the latest version of that package. That developer figures out which line(s) of source code to change to fix the problem and changes ONLY those lines. This ensures that the user experiences no change in the behavior of their system other than what's explicitly intended by the update. The changes are reviewed before they are published.

It's convenient upgrade a bunch of bug fixes at once instead of upgrading one package at a time as they come available and that's what the point-releases represent.

In sources.list, you may have lines which look like this:

(1) deb http://deb.debian.org/debian           buster         main
(2) deb http://deb.debian.org/debian-security/ buster/updates main
(3) deb http://deb.debian.org/debian           buster-updates main

If you only have line (1), then you will only update when the point release happens.

If you have (1) and (2), then you will update when the point release happens, and whenever a new security update is published. This is the configuration I suspect most people use.

If you don't want to wait for the next point release to get the latest bug fixes, you can also add line (3) to get the bug fixes as they are approved. buster-updates is where fixes are queued for the next point release. At the release, the packages from buster-updates are migrated to buster.

Note: In Debian 11 (bullseye), the security suite bullseye/updates will be renamed to bullseye-security to improve clarity.

In case you are wondering, there is significant testing done on package updates before they even reach buster-updates. A maintainer will upload a package to the proposed-updates-new queue, where a release manager will review the change. If approved, it goes into the proposed-updates suite where it sits for some time. Users of the proposed-updates suite check packages for errors and if enough time has passed without any problems only then is it moved to the buster-updates.