Keeping your Linux server updated using sudo apt upgrade is a fundamental security practice. However, there are times when updating a specific package will break a fragile application or a custom configuration. If you rely on an older version of PHP, a specific database driver, or a custom kernel, you must ensure the package manager does not overwrite it during routine maintenance.
How to Hold a Package
In Ubuntu and other Debian-based distributions, you can easily “pin” or “hold” a package at its current version using the apt-mark command.
- Open your terminal or SSH into your server.
- To prevent a package from being upgraded, use the
holdcommand followed by the exact package name. For example, to lock your current version of PHP 7.4, run:
sudo apt-mark hold php7.4 - The terminal will respond with a confirmation message:
php7.4 set on hold.
From now on, whenever you run sudo apt upgrade, the package manager will completely ignore the held package, even if a newer version is available in the repositories. All your other system packages will update normally.
How to View and Release Held Packages
If you have multiple server administrators or you simply forget which packages you locked months ago, you can easily view a list of all currently held packages by running:
apt-mark showhold
When you are finally ready to upgrade the software and deal with any breaking changes, you must release the hold. You can do this by running the unhold command:
sudo apt-mark unhold php7.4
Once the hold is removed, the package will automatically update the next time you run a system upgrade.