On Tue, 2 Dec 2025, Alexander V. Makartsev wrote:
Hi all.
Today apt is acting strange.
It lists packages from "stable-backports" as upgrade candidates for packages
from "stable".
I don't use apt pinning for "stable-backports" or any custom apt preference
that would force backports installation.
I do use external repositories, but all of them are reputable sources
(Steam\Valve, WineHQ, Mozilla, Microsoft, etc.)
and "apt policy" output shows those candidates are not from these external
repos.
This can't be right.
A wild guess, is this some new behavior that stems from new apt sources
format?
<snip>
I suspect this is a race condition.
When you last ran `apt-get update` you got the trixie-proposed-updates
release file that has curl removed from the packages (because it's now
in trixie-updates) but still have the trixie-updates file that doesn't
have the version from proposed updates.
So your version is now considered "local" and gets a priority of 100
At this point apt-get update has the BPO version available, higher
version number, same priority and so it will upgrade.
If I'm right, then `apt-get update` should be enough to fix this.
$ apt list --upgradable
$ apt policy curl
curl:
Installed: 8.14.1-2+deb13u1
Candidate: 8.16.0-4~bpo13+1
Version table:
8.16.0-4~bpo13+1 100
100 https://deb.debian.org/debian trixie-backports/main amd64
Packages
*** 8.14.1-2+deb13u1 100
100 /var/lib/dpkg/status
8.14.1-2 500
500 https://deb.debian.org/debian trixie/main amd64 Packages
apt-cache policy curl
curl:
Installed: (none)
Candidate: 8.14.1-2+deb13u2
Version table:
8.14.1-2+deb13u2 500
500 http://deb.debian.org/debian trixie/main amd64 Packages
Another possibility is that the deb13u1 got pulled very quickly and
replaced due to some bug. In which case installing that version
explicitly will fix things.
I don't see curl.8.14.1-2+deb13u1 on
deb.debian.org/debian/pool/main/c/curl/
so I think that's more likely the problem....
apt-get install curl=8.14.1-2+deb13u2
Tim.
