Updating Packages on Ubuntu 26.04 LTS Server (apt update / upgrade)

Managing Package Updates with APT

Ubuntu manages packages with APT. This article covers keeping a server up to date, checking what would change, removing packages that are no longer needed, and looking up package information.

There are two commands, apt and apt-get. Use apt interactively; use apt-get in scripts, where the output format is stable.

Example: checking the APT version
kazulog@sv2:~$ apt --version
apt 3.2.0 (amd64)
kazulog@sv2:~$

Refreshing the Package Lists (apt update)

apt update fetches the list of packages and their latest versions from the repositories. No package is changed at this point.

Command to refresh the package lists
sudo apt update

Example: refreshing the package lists
kazulog@sv2:~$ sudo apt update
Get:1 http://security.ubuntu.com/ubuntu resolute-security InRelease [137 kB]
Hit:2 http://archive.ubuntu.com/ubuntu resolute InRelease
Get:3 http://archive.ubuntu.com/ubuntu resolute-updates InRelease [137 kB]
Get:4 http://security.ubuntu.com/ubuntu resolute-security/main amd64 Packages [471 kB]
Hit:5 http://archive.ubuntu.com/ubuntu resolute-backports InRelease
Get:6 http://archive.ubuntu.com/ubuntu resolute-updates/main amd64 Packages [602 kB]
Get:7 http://security.ubuntu.com/ubuntu resolute-security/universe amd64 Packages [171 kB]
Get:8 http://security.ubuntu.com/ubuntu resolute-security/restricted amd64 Packages [399 kB]
Get:9 http://security.ubuntu.com/ubuntu resolute-security/restricted Translation-en [77.7 kB]
Get:10 http://security.ubuntu.com/ubuntu resolute-security/multiverse amd64 Packages [10.8 kB]
Get:11 http://security.ubuntu.com/ubuntu resolute-security/multiverse Translation-en [2844 B]
Get:12 http://archive.ubuntu.com/ubuntu resolute-updates/main Translation-en [143 kB]
Get:13 http://archive.ubuntu.com/ubuntu resolute-updates/universe amd64 Packages [268 kB]
Get:14 http://archive.ubuntu.com/ubuntu resolute-updates/universe Translation-en [88.4 kB]
Fetched 2508 kB in 3s (727 kB/s)
93 packages can be upgraded. Run 'apt list --upgradable' to see them.
kazulog@sv2:~$

Output	Meaning
`Hit`	Unchanged since last time, nothing fetched
`Get`	New information was downloaded
`Fetched`	Volume downloaded and how long it took
Last line	How many packages can be upgraded

Checking Which Packages Can Be Upgraded

apt list --upgradable lists them.

Command to list upgradable packages
apt list --upgradable

Example: listing upgradable packages
kazulog@sv2:~$ apt list --upgradable 2>/dev/null | head -8
Listing...
base-files/resolute-updates 14ubuntu6.2 amd64 [upgradable from: 14ubuntu6.1]
bind9-dnsutils/resolute-updates,resolute-security 1:9.20.24-1ubuntu0.3 amd64 [upgradable from: 1:9.20.24-1ubuntu0.2]
bind9-host/resolute-updates,resolute-security 1:9.20.24-1ubuntu0.3 amd64 [upgradable from: 1:9.20.24-1ubuntu0.2]
bind9-libs/resolute-updates,resolute-security 1:9.20.24-1ubuntu0.3 amd64 [upgradable from: 1:9.20.24-1ubuntu0.2]
bpftool/resolute-updates,resolute-security 7.7.0+7.0.0-31.31 amd64 [upgradable from: 7.7.0+7.0.0-30.30]
bsdextrautils/resolute-updates,resolute-security 2.41.3-3ubuntu2.2 amd64 [upgradable from: 2.41.3-3ubuntu2]
bsdutils/resolute-updates,resolute-security 1:2.41.3-3ubuntu2.2 amd64 [upgradable from: 1:2.41.3-3ubuntu2]

Each line reads “package / repository new-version architecture [installed version]”. A repository containing -security means a security update.

To see what would happen without changing anything, add -s (simulate) to apt-get. Inst marks a package that would be upgraded and Conf one that would be configured.

Command to simulate the upgrade
sudo apt-get -s upgrade

Example: simulating the upgrade
kazulog@sv2:~$ sudo apt-get -s upgrade | tail -12
Conf libssh2-1t64 (1.11.1-1ubuntu0.26.04.4 Ubuntu:26.04/resolute-updates, Ubuntu:26.04/resolute-security [amd64])
Conf curl (8.18.0-1ubuntu2.5 Ubuntu:26.04/resolute-updates, Ubuntu:26.04/resolute-security [amd64])
Conf libcurl4t64 (8.18.0-1ubuntu2.5 Ubuntu:26.04/resolute-updates, Ubuntu:26.04/resolute-security [amd64])
Conf gnupg-l10n (2.4.8-4ubuntu3.1 Ubuntu:26.04/resolute-updates, Ubuntu:26.04/resolute-security [all])
Conf libcurl3t64-gnutls (8.18.0-1ubuntu2.5 Ubuntu:26.04/resolute-updates, Ubuntu:26.04/resolute-security [amd64])
Conf libevent-core-2.1-7t64 (2.1.12-stable-10ubuntu0.1 Ubuntu:26.04/resolute-updates, Ubuntu:26.04/resolute-security [amd64])
Conf libflashrom1 (1.6.0-2ubuntu1.1 Ubuntu:26.04/resolute-updates [amd64])
Conf udisks2 (2.10.91-1ubuntu2.1 Ubuntu:26.04/resolute-updates, Ubuntu:26.04/resolute-security [amd64])
Conf libudisks2-0 (2.10.91-1ubuntu2.1 Ubuntu:26.04/resolute-updates, Ubuntu:26.04/resolute-security [amd64])
Conf linux-perf (7.0.0-31.31 Ubuntu:26.04/resolute-updates, Ubuntu:26.04/resolute-security [amd64])
Conf linux-tools-common (7.0.0-31.31 Ubuntu:26.04/resolute-updates, Ubuntu:26.04/resolute-security [all])
Conf python3-pyasn1 (0.6.3-1ubuntu0.1 Ubuntu:26.04/resolute-updates, Ubuntu:26.04/resolute-security [all])
kazulog@sv2:~$

Applying the Updates (apt upgrade)

Command to apply the updates
sudo apt upgrade -y

-y answers every confirmation prompt automatically.

The packages to be upgraded are listed first, then applied.

Example: applying the updates (first part)
kazulog@sv2:~$ sudo apt upgrade -y
Upgrading:
  base-files      eject           gpgv                      libcurl3t64-gnutls      libpam0g               linux-headers-virtual  openssh-server           python3.14                    vim-runtime
  bind9-dnsutils  fdisk           libattr1                  libcurl4t64             libperl5.40            linux-image-virtual    openssh-sftp-server      python3.14-gdbm               vim-tiny
  bind9-host      gnu-coreutils   libaudit-common           libevent-core-2.1-7t64  libpython3.14          linux-libc-dev         openssl                  python3.14-minimal            xxd
  bind9-libs      gnupg           libaudit1                 libfdisk1               libpython3.14-minimal  linux-perf             openssl-provider-legacy  sudo-rs                       zlib1g
  bpftool         gnupg-l10n      libblkid1                 libflashrom1            libpython3.14-stdlib   linux-tools-common     perl                     ubuntu-release-upgrader-core
  bsdextrautils   gnupg-utils     libbz2-1.0                libgcrypt20             libsmartcols1          linux-virtual          perl-base                udisks2
  bsdutils        gpg             libc-bin                  liblastlog2-2           libssh2-1t64           locales                perl-modules-5.40        util-linux
  cpio            gpg-agent       libc-dev-bin              libmount1               libssl3t64             login                  python-apt-common        util-linux-extra
  curl            gpg-wks-client  libc-gconv-modules-extra  libpam-modules          libudisks2-0           motd-news-config       python3-apt              uuid-runtime
  diffutils       gpgconf         libc6                     libpam-modules-bin      libuuid1               mount                  python3-distupgrade      vim
  dirmngr         gpgsm           libc6-dev                 libpam-runtime          linux-headers-generic  openssh-client         python3-pyasn1           vim-common

Installing dependencies:
  linux-headers-7.0.0-31          linux-image-7.0.0-31-generic             linux-modules-7.0.0-31-generic  linux-tools-7.0.0-31-generic
  linux-headers-7.0.0-31-generic  linux-main-modules-zfs-7.0.0-31-generic  linux-tools-7.0.0-31

Suggested packages:
  linux-tools

Not upgrading yet due to phasing:
  sos

/snip/

The Summary: line at the end reports how many packages were upgraded, installed and removed.

The summary of the run
Summary:
  Upgrading: 92, Installing: 7, Removing: 0, Not Upgrading: 1
  Space needed: 319 MB / 63.1 GB available

Some packages are reported under Not upgrading yet due to phasing:. Ubuntu does not hand an update to every machine at once; it rolls it out gradually (phased updates). A server that is not yet in scope keeps the older version until its turn comes. This is not a fault, and there is nothing to fix.

apt upgrade versus apt full-upgrade

Command	Behaviour
`apt upgrade`	Upgrades installed packages, but leaves a package alone if upgrading it would require removing another package
`apt full-upgrade`	Upgrades as well, and removes packages when that is required

Use apt upgrade day to day, and consider full-upgrade when packages are left behind.

Packages held back by phased updates are not upgraded by full-upgrade either. Below, full-upgrade runs after upgrade and the package stays where it is.

Example: running full-upgrade
kazulog@sv2:~$ apt list --upgradable 2>/dev/null
sos/resolute-updates 4.11.2-0ubuntu0.1 all [upgradable from: 4.10.2-1]
kazulog@sv2:~$ sudo apt full-upgrade -y
Not upgrading yet due to phasing:
  sos

Summary:
  Upgrading: 0, Installing: 0, Removing: 0, Not Upgrading: 1
kazulog@sv2:~$ apt-cache policy sos | head -4
sos:
  Installed: 4.10.2-1
  Candidate: 4.11.2-0ubuntu0.1
  Version table:

Checking Whether a Reboot Is Needed

When the kernel or libc is updated, a file is created to signal that a reboot is required. Updating alone never reboots the machine.

Commands to check whether a reboot is needed
ls -l /var/run/reboot-required
cat /var/run/reboot-required.pkgs

Example: checking whether a reboot is needed
kazulog@sv2:~$ ls -l /var/run/reboot-required /var/run/reboot-required.pkgs
-rw-r--r-- 1 root root 32 Sep 11 00:01 /var/run/reboot-required
-rw-r--r-- 1 root root 46 Sep 11 00:01 /var/run/reboot-required.pkgs
kazulog@sv2:~$ cat /var/run/reboot-required
*** System restart required ***
kazulog@sv2:~$ cat /var/run/reboot-required.pkgs
libc6
linux-image-7.0.0-31-generic
linux-base

The .pkgs file lists the packages that require it. The files disappear after the reboot.

Removing Packages That Are No Longer Needed

Removing a package leaves behind the packages that were installed automatically to satisfy its dependencies. apt autoremove deletes them together.

Command to remove unneeded packages
sudo apt autoremove

Below, tcpdump is installed and then removed, and the four packages that came with it are deleted by autoremove. The removal step points out that they are no longer required.

Example: removing unneeded packages
kazulog@sv2:~$ sudo apt remove -y tcpdump | cat
WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

Reading package lists...
Building dependency tree...
Reading state information...
Solving dependencies...
The following packages were automatically installed and are no longer required:
  ibverbs-providers  libibverbs1  libnl-route-3-200  libpcap0.8t64
Use 'sudo apt autoremove' to remove them.

REMOVING:
  tcpdump

Summary:
  Upgrading: 0, Installing: 0, Removing: 1, Not Upgrading: 1
  Freed space: 1357 kB

(Reading database ... 132310 files and directories currently installed.)
Removing tcpdump (4.99.6-1) ...
Processing triggers for man-db (2.13.1-1build1) ...
kazulog@sv2:~$ sudo apt autoremove -y | cat
WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

Reading package lists...
Building dependency tree...
Reading state information...
Solving dependencies...
REMOVING:
  ibverbs-providers  libibverbs1  libnl-route-3-200  libpcap0.8t64

Summary:
  Upgrading: 0, Installing: 0, Removing: 4, Not Upgrading: 1
  Freed space: 2739 kB

(Reading database ... 132295 files and directories currently installed.)
Removing ibverbs-providers:amd64 (61.0-2ubuntu3) ...
Removing libpcap0.8t64:amd64 (1.10.6-1ubuntu1) ...
Removing libibverbs1:amd64 (61.0-2ubuntu3) ...
Removing libnl-route-3-200:amd64 (3.12.0-2) ...
Processing triggers for man-db (2.13.1-1build1) ...
Processing triggers for libc-bin (2.43-2ubuntu2.4) ...
kazulog@sv2:~$

Downloaded package files are deleted with apt clean.

Command to clear the cache
sudo apt clean

Ubuntu 26.04 does not keep package files after installing them (APT::Keep-Downloaded-Packages "0"), so the cache barely grows and apt clean frees very little.

Checking the setting
kazulog@sv2:~$ apt-config dump | grep -i 'keep-downloaded'
Version::1.2::APT::Keep-Downloaded-Packages "0";
kazulog@sv2:~$ ls /var/cache/apt/archives/*.deb 2>&1 | head -3
ls: cannot access '/var/cache/apt/archives/*.deb': No such file or directory

Looking Up Package Information

Command	Shows
`apt show [PACKAGE]`	Description, version and dependencies
`apt-cache policy [PACKAGE]`	The installed version and every version available
`apt search [KEYWORD]`	Package search
`dpkg -l`	Installed packages

Example: package information
kazulog@sv2:~$ apt show nginx 2>/dev/null | head -12
Package: nginx
Version: 1.28.3-2ubuntu1.10
Priority: optional
Section: web
Origin: Ubuntu
Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
Original-Maintainer: Debian Nginx Maintainers <pkg-nginx-maintainers@alioth-lists.debian.net>
Bugs: https://bugs.launchpad.net/ubuntu/+filebug
Installed-Size: 1627 kB
Provides: httpd, httpd-cgi, nginx-abi-1.28.3-1
Depends: libc6 (>= 2.34), libcrypt1 (>= 1:4.1.0), libpcre2-8-0 (>= 10.22), libssl3t64 (>= 3.0.0), zlib1g (>= 1:1.1.4), nginx-common (= 1.28.3-2ubuntu1.10)
Breaks: nginx-core (<< 1.22.1-6~), nginx-extras (<< 1.22.1-6~), nginx-light (<< 1.22.1-6~)
kazulog@sv2:~$ apt-cache policy nginx
nginx:
  Installed: 1.28.3-2ubuntu1.10
  Candidate: 1.28.3-2ubuntu1.10
  Version table:
 *** 1.28.3-2ubuntu1.10 500
        500 http://archive.ubuntu.com/ubuntu resolute-updates/main amd64 Packages
        500 http://security.ubuntu.com/ubuntu resolute-security/main amd64 Packages
        100 /var/lib/dpkg/status
     1.28.3-2ubuntu1 500
        500 http://archive.ubuntu.com/ubuntu resolute/main amd64 Packages
kazulog@sv2:~$

apt-cache policy tells you which repository offers which version. Above, -updates and -security both offer the same version.

Example: searching and listing packages
kazulog@sv2:~$ apt search '^tcpdump$' 2>/dev/null
tcpdump/resolute,now 4.99.6-1 amd64 [residual-config]
  command-line network traffic analyzer

kazulog@sv2:~$ dpkg -l | grep -c '^ii'
682

The Repository Configuration

The repositories are defined in /etc/apt/sources.list.d/ubuntu.sources. Since Ubuntu 24.04 this uses the deb822 format, which differs from the one-line-per-entry /etc/apt/sources.list of old.

Command to read the repository configuration
cat /etc/apt/sources.list.d/ubuntu.sources

Example: the repository configuration (comments omitted)
Types: deb
URIs: http://archive.ubuntu.com/ubuntu
Suites: resolute resolute-updates resolute-backports
Components: main universe restricted multiverse
Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg

Types: deb
URIs: http://security.ubuntu.com/ubuntu
Suites: resolute-security
Components: main universe restricted multiverse
Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg

Key	Meaning
`Types`	`deb` for binaries. Add `deb-src` to fetch sources
`URIs`	Repository URL
`Suites`	What to fetch. `resolute` is the code name of 26.04; `-updates` carries bug fixes, `-security` security updates and `-backports` newer versions
`Components`	`main` (officially supported), `universe` (community), `restricted`, `multiverse`
`Signed-By`	The key used to verify signatures

Reading the Update History

APT records what it did in /var/log/apt/history.log, so you can tell later when a change was made, by which command, and to what.

Command to read the history
sudo tail /var/log/apt/history.log

Example: reading the history
kazulog@sv2:~$ sudo tail -12 /var/log/apt/history.log
Start-Date: 2026-09-11  00:04:43
Commandline: apt remove -y tcpdump
Requested-By: kazulog (1000)
Remove: tcpdump:amd64 (4.99.6-1)
End-Date: 2026-09-11  00:04:43

Start-Date: 2026-09-11  00:04:47
Commandline: apt autoremove -y
Requested-By: kazulog (1000)
Remove: libpcap0.8t64:amd64 (1.10.6-1ubuntu1), libnl-route-3-200:amd64 (3.12.0-2), libibverbs1:amd64 (61.0-2ubuntu3), ibverbs-providers:amd64 (61.0-2ubuntu3)
End-Date: 2026-09-11  00:04:48
kazulog@sv2:~$ ls /var/log/apt/
eipp.log.xz  history.log  term.log

term.log holds the detailed output produced while packages were unpacked.

Automatic Security Updates

Ubuntu applies security updates automatically every day by default. Alongside running apt upgrade by hand, review Configuring Automatic Updates (unattended-upgrades).

Test Environment and Session Logs

The examples were captured on Ubuntu 26.04 LTS Server (apt 3.2.0) running on CML. The session log of each step can be downloaded below.

Step	Session log
Initial state (APT version and repositories)	log
Refreshing the lists and listing upgradable packages	log
Simulating the upgrade	log
Applying the updates (92 packages)	log
full-upgrade and the phased update	log
Checking whether a reboot is needed	log
After the reboot, and removing unneeded packages	log
The cache setting	log
Package information	log
The update history	log

Reference

Ubuntu Server documentation: Package management