Initial question (please see new question below)

EDIT: apparently, filtering on urgency would not be so efficient, so, please go below for amended question.

This question is quite the same than this one asked more than 20 years ago by Dan Christensen on the Debian mailing list.

So, I am just going to quote:

Is there a way to upgrade all currently installed packages which have had an urgency=high version uploaded to the archive since I last upgraded? (And any necessary dependencies, of course.) I'm thinking of this for the unstable distribution. The idea is to frequently do such upgrades to get any security fixes, and less frequently do an entire dist-upgrade.

Note: the urgency=high info is added by the package maintainer on the package changelog (apt changelog <package>).

So how can I "filter" my apt --with-new-pkgs upgrade so that only the most important/urgent stuff is upgraded?

Knowing that using (temporarily) a sources.list having only the "security" line may work relatively well in stable, but not so much with testing/unstable.

New question

Need: because I use either testing or unstable, I want to choose when to upgrade, because there can be many software upgrades with reboot or X restart involved (and things breaking / new bugs sometimes). However, I would like to stay up to date on a daily basis with security or important noninvasive updates/patches only.

In fact, I'm really looking for a way not to upgrade "too much", but still upgrading daily low impact stuff (bug/security fixes) on a Debian testing/unstable. Do you have a suggestion for doing that?

2 Answers 2


So how can I "filter" my apt --with-new-pkgs upgrade so that only the most important/urgent stuff is upgraded?

You can’t, not only because apt doesn’t provide any relevant filter, but more significantly because there isn’t a way to determine whether a package upgrade in testing or unstable is really important and/or urgent. A package version’s “urgency” in unstable is an unreliable indicator. Looking at the last ten advisories, I see six identified as medium urgency (including Thunderbird and Xorg), and four identified as high urgency.

It also happens quite frequently that security issues are noticed after the corresponding upload has gone to unstable; the stable release gets a backport, but the update isn’t flagged as security-related in unstable (or only after-the-fact).

Even filtering out low-urgency upgrades doesn’t help: low-urgency upgrades are few and far between. It’s anecdotal, but on my main Debian system with 6,037 packages installed, only 232 packages have their latest upgrade marked urgency=low.

You could write an apt-listbugs-style filter which looks for CVEs in the changelogs, but even that would miss some since CVEs aren’t always indicated in unstable changelog entries.

Knowing that using a sources.list having only the "security" line works pretty well in stable, but not so much with testing/unstable.

That’s a bad idea for stable; some security updates don’t go through the security repository, including many kernel updates.

  • Thanks for the comment on the sources.list with security only. I amended my question to avoid suggesting doing that. As for the rest, maybe I could amend my question to exclude low priority rather than include only high? I'm looking for a way not to upgrade "too much", but still upgrading low impact stuff (bug/security fixes). Last comment: it's not because the label is unreliable that I technically can't filter on it, so your cause/effect statement here may not be what you really mean. ;)
    – Totor
    Jan 10, 2023 at 11:16
  • The question I quoted in my answer didn’t mention specifically filtering on the label, just filtering important/urgent upgrades; I took it as a general question, not “how can I implement this particular filter”. I’ve expanded my answer to be more general. Jan 10, 2023 at 13:49

So... While it's not possible to do natively, and it might not be advisible to do at all, you can use a combination of apt list --upgradeable and some bash to achieve it.

I've written a script that should do the trick.

There are a few caveats:

  1. You need to suppress the warning given by apt if you try to use it in a script - so this might change in the future.

    WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

    This can be done by adding a file under /etc/apt/apt.conf.d/ with this content:

    Binary::apt::Apt::Cmd::Disable-Script-Warning "true";

    Found the information here, but it wasn't clear on how to add to the file.

  2. This might not work when repositories you added don't add changelogs (F.ex gitlab.)

  3. This only works if the script is run regularly. F.ex if there are multiple updates between your current system's state and the package, and the latest upgrade is not classified as high, the package won't be upgraded.

  4. It will work with kernel upgrades as well, as they show up with apt list --upgradeable.

  • 1
    Thank you because this actually attempts to answer my original question (with some not so standard bashisms admittedly ;)). So I will +1, but sadly, I probably won't use it, because Stephen Kitt pointed to the probable inefficiency of this strategy to achieve what I want, and I tend to believe him. I edited my question to adapt.
    – Totor
    Jan 10, 2023 at 21:37
  • Yes, the caveats are quite big, but it was an interesting Question to pose. With the dependencies on the packages, there will probably not be much use. Maybe this: link is something that's worth looking into for you.
    – Anuril
    Jan 11, 2023 at 7:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .