Debian 12 – full-upgrade blocked by held packages – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Full-upgrade aborts with dependency blocks, leaving hosts partially patched.

Environment & Reproduction

Common after manual pinning and previous emergency package holds.

cat /etc/debian_version
sudo apt-mark showhold
sudo apt full-upgrade

Root Cause Analysis

Held packages and pin priorities prevent resolver transitions required for release-consistent updates.

Quick Triage

List holds, pins, and broken package state quickly.

sudo apt-mark showhold
grep -RIn 'Pin:' /etc/apt/preferences /etc/apt/preferences.d 2>/dev/null
sudo apt -f install -y

Step-by-Step Diagnosis

Use resolver debug simulation and audit package metadata.

sudo apt-get -o Debug::pkgProblemResolver=yes dist-upgrade -s
sudo dpkg --audit
grep -RIn "held|broken" /var/log/apt 2>/dev/null | tail -n 20

Solution – Primary Fix

Release unnecessary holds, repair package state, and upgrade.

for p in $(apt-mark showhold); do sudo apt-mark unhold $p; done
sudo dpkg --configure -a
sudo apt -f install -y
sudo apt full-upgrade -y

Solution – Alternative Approaches

Disable conflicting third-party repositories temporarily.

sudo sed -i 's/^deb/#deb/g' /etc/apt/sources.list.d/*.list
sudo apt update
sudo apt full-upgrade -y

Verification & Acceptance Criteria

Resolver completes and no package holds remain unless explicitly required.

sudo apt-mark showhold
sudo apt-get check
sudo apt full-upgrade -s

Rollback Plan

Re-apply approved holds after compatibility checks.

sudo apt-mark hold 
sudo apt update
sudo apt-get check

Prevention & Hardening

Track package holds and pinning in configuration management.

apt-mark showhold > /var/tmp/held-packages.txt
apt-cache policy | head -n 120
grep -RIn 'Pin:' /etc/apt/preferences* 2>/dev/null

Related Errors & Cross-Refs

Related to stale repositories, invalid pins, and interrupted upgrades.

Related tutorial: View the step-by-step tutorial for Debian 12.

View all Debian 12 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Debian documentation for apt policy, pinning, and full-upgrade workflows.