The two most common reasons are:
One or more packages that the "kept back" packages Depend upon are not yet available in the archive. This is most common if you use Debian Sid or Debian Testing, or some other "rolling" type distribution, but sometimes also occurs with regular and security update distros.
It's a matter of timing - when packages get uploaded, accepted into the archive, and then distributed to your local repo mirror. It usually settles with a day or two, but can sometimes take longer if there is a major upgrade of something in progress (e.g. a new version of KDE or Gnome or something that involves lots of packages) and/or one package is holding up lots of other packages.
It's not worth worrying about. Just wait and try to apt update
and apt upgrade
or apt dist-upgrade
again in a few days.
You have manually held some of the packages (e.g. with apt-mark hold
). You can fix this yourself with apt-mark unhold
.
BTW, I recommend holding both linux-headers-amd64
and linux-image-amd64
anyway, especially if you are using DKMS packages such as nvidia-kernel-dkms
or zfs-dkms
which may conflict with or require new patches to work with new kernels (you should not upgrade your kernel until you know that these DKMS packages will compile with the new kernel! and your *dkms*
packages should be held too and only upgraded manually). Then you can upgrade them manually (and hold them again) with something like:
apt-get install linux-image-amd64 linux-headers-amd64 ; apt-mark hold linux-image-amd64 linux-headers-amd64
You can begin investigating the actual cause on your system with apt-cache
(particularly the show
and policy
sub-commands) and aptitude
(which has useful why
and why-not
sub-commands). For example, try running:
apt-cache show linux-image-amd64
apt-cache policy linux-image-amd64
aptitude why-not linux-image-amd64
aptitude why linux-image-amd64
You'll need to read and understand the apt
and dpkg
documentation to interpret the output. Most of it is fairly straight-forward and obvious in meaning, but some is not - particularly the aptitude why
output, which requires understanding of the code letters at the beginning of each output line.
apt-get upgrade
doesn’t install new packages and will hold back any upgrades that need new packages. See the linked dupe although I suspect you know all this already ;-). – Stephen Kitt Nov 08 '22 at 05:34