What are the risks of doing apt-get upgrade(s), but never apt-get dist-upgrade(s)?

Question

At work, I received a VM on VirtualBox. I have no clue about its composition except that it is running Debian 10.

Quickly, because tools like Chrome were complaining, I had to do an apt-get update + upgrade to put packages in their recent versions enough.

But because I've still some problems (freezing of Virtualbox or of my VM, I can't decide), I am thinking about doing an apt-get dist-upgrade.

At home, I wouldn't have questioned myself and the command would have been issued immediately. But at work, in front of an unknown VM, I'm wondering if it's wise.

• What are the (general) risks I'm facing if I launch an apt-get dist-upgrade?

• Would you say, even when you don't know what OS and software settings you have below you, that it's, in general, a good idea to do so?

• At the opposite, if I refuse to do any dist-upgrade in this "VM life" what may I face? Am I doomed to encounter some troubles?

Answer 1

While 'apt upgrade' offers a conservative approach to upgrading packages without installing or removing any additional software, 'apt dist-upgrade' provides a more comprehensive solution, handling complex dependency changes and minimizing the impact on other packages.

The decision to perform a dist-upgrade is recommended for keeping your system up to date with the latest security patches and bug fixes but on an unknown VM should be based on a careful assessment of the risks involved!

A dist-upgrade may install new packages or remove existing.

If you decide to dist-upgrade, check to have the availability of a backup or a rollback, to restore the original state.

Risks when Decide:

• dist-upgrade may install new packages or remove them, this can lead to conflicts between packages, if there are custom configurations or thirdparty software installed on the system.

• It can introduce changes that may not be fully tested or compatible with your specific environment, this can result in system instability, crashes, or unpredictable behavior.

• If the vm has been customized or has a specific software, the configurations may overwriten or conflicts with those customizations and could lead to issues with the function.

Risks when not decide:

• By not upgrading the system components, you might miss out important security updates that could leave your system vulnerable to exploits and attacks.

• Newer packages and dependencies may not be compatible with older versions.

• You might miss out on bug fixes, performance improvements, and new features introduced in the updated packages.

Why use apt-get upgrade instead of apt-get dist-upgrade?

Apt Upgrade vs Apt Dist-upgrade: The Key Differences

What's the difference between apt-get upgrade vs dist-upgrade?

Answer 2

What are the (general) risks I'm facing if I launch an apt-get dist-upgrade?

If the system is old (as Debian 10 is) and /etc/apt/sources.list and/or /etc/apt/sources.list.d/*.list files identify the Debian repository using words like stable or testing instead of using the appropriate release codename (buster for Debian 10), the current stable release of Debian may have changed since the system was last updated. This used to be the standard default in older versions of Debian.

For example, if /etc/apt/sources.list had these lines:

deb http://deb.debian.org/debian stable main contrib non-free
deb http://security.debian.org/ stable main contrib non-free

Since the current stable version is now Debian 11 (and Debian 10 hass now become oldstable), running apt-get dist-upgrade would attempt to upgrade the system from Debian 10 to Debian 11. This should never be done without first reading the Release Notes of the new version, as there may be specific procedures that need to be followed to ensure a successful upgrade.

If you wish to stay with Debian 10, you should ensure all references to the Debian repositories in /etc/apt/sources.list and /etc/apt/sources.list.d/*.list use the release codename buster instead of stable or oldstable.

And if you have software installed for Debian 10 from third-party repositories, these packages might or might not work if the system is upgraded to Debian 11. You would have to check each such third-party repository: is the software claimed to also work in Debian 11, or do they have a different repository that should be used with Debian 11? Are there any special procedures needed for major release upgrades?

Answer 3

The difference between apt-get upgrade and apt-get dist-upgrade is that the latter will install and/or remove packages to unblock upgrading of other packages while the former will only upgrade packages if they can be upgraded without changing the list of installed packages (note: apt upgrade will install new packages but not remove packages).

If you only use apt-get upgrade you may miss out on some updates.

Whenever you use apt-get dist-upgrade you should pay attention to what it says it is going to do. And you shouldn't select yes until you understand it.

On a pure Debian stable system being upgraded within a release* dist-upgrade should not be adding or removing much. The whole point of a stable release is that once it has been made changes should be kept to a minimum.

Kernel packages are a bit of an exception to this. The kernel doesn't have a stable module ABI upstream, even within stable release series and sometimes a kernel upgrade brings with it a kernel ABI bump which leads to kernel packages being renamed.

Web browsers can also be a bit of an exception. None of them have support lifecycles as long as Debian stable releases, which means new major versions of browsers, potentially with new dependencies have to be introduced to stable releases.

If the system has backports, or third party repositories in use then those may have more intrusive and riskier upgrades.

* Upgrading to the next release is another matter.