Why Debian security updates are not installed when using "apt upgrade"? (it needs to be forced with "-t stable-security")

Question

Debian security updates are not installed when using commands like apt upgrade or apt dist-upgrade. I also tried with apt-get instead of apt.

However a command like apt upgrade -t stable-security or apt install nodejs -t stable-security will install security updates (for example https://www.debian.org/security/2022/dsa-5170).

Do you know why? This issue happens on my Debian stable laptop but I also have a Debian stable server (VPS) that does not have this issue. I checked that /etc/apt/sources.list file is the same on both installations and there is no /etc/apt/preferences file.

Here are the uncommented lines of /etc/apt/sources.list (based on https://wiki.debian.org/SourcesList#Example_sources.list):

deb http://deb.debian.org/debian stable main
deb-src http://deb.debian.org/debian stable main

deb http://deb.debian.org/debian-security/ stable-security main
deb-src http://deb.debian.org/debian-security/ stable-security main

deb http://deb.debian.org/debian stable-updates main
deb-src http://deb.debian.org/debian stable-updates main

deb http://deb.debian.org/debian bullseye-backports main
deb-src http://deb.debian.org/debian bullseye-backports main

To answer the question from the comments, here is the output of apt policy:

Package files:
 100 /var/lib/dpkg/status
     release a=now
 100 http://deb.debian.org/debian bullseye-backports/main i386 Packages
     release o=Debian Backports,a=bullseye-backports,n=bullseye-backports,l=Debian Backports,c=main,b=i386
     origin deb.debian.org
 100 http://deb.debian.org/debian bullseye-backports/main amd64 Packages
     release o=Debian Backports,a=bullseye-backports,n=bullseye-backports,l=Debian Backports,c=main,b=amd64
     origin deb.debian.org
 500 http://deb.debian.org/debian stable-updates/main i386 Packages
     release v=11-updates,o=Debian,a=stable-updates,n=bullseye-updates,l=Debian,c=main,b=i386
     origin deb.debian.org
 500 http://deb.debian.org/debian stable-updates/main amd64 Packages
     release v=11-updates,o=Debian,a=stable-updates,n=bullseye-updates,l=Debian,c=main,b=amd64
     origin deb.debian.org
 500 http://deb.debian.org/debian-security stable-security/main i386 Packages
     release v=11,o=Debian,a=stable-security,n=bullseye-security,l=Debian-Security,c=main,b=i386
     origin deb.debian.org
 500 http://deb.debian.org/debian-security stable-security/main amd64 Packages
     release v=11,o=Debian,a=stable-security,n=bullseye-security,l=Debian-Security,c=main,b=amd64
     origin deb.debian.org
 990 http://deb.debian.org/debian stable/main i386 Packages
     release v=11.5,o=Debian,a=stable,n=bullseye,l=Debian,c=main,b=i386
     origin deb.debian.org
 990 http://deb.debian.org/debian stable/main amd64 Packages
     release v=11.5,o=Debian,a=stable,n=bullseye,l=Debian,c=main,b=amd64
     origin deb.debian.org
Pinned packages:

Note that previously I also had https://download.virtualbox.org/virtualbox/debian displayed there but I commented it in /etc/apt/sources.list when searching the issue (it did not solve the problem when trying again apt update and apt upgrade).

We can see that the pinning priority of stable is higher than stable-security, which seems to be the issue, do you have an idea why?

Answer 1

A priority of 990 corresponds to the default release; in all likelihood, there’s a configuration entry saying

APT::Default-Release "stable";

or equivalent.

If you remove that, everything should sort itself out.

Alternatively, as mentioned in the Debian 11 release notes, you can keep an `APT::Default-Release" setting, as long as you change it to

APT::Default-Release "/^bullseye(|-security|-updates)$/";

For most scenarios where Default-Release is useful, I find pinning to be more appropriate.