unattended upgrades is not upgrading the python packages that are available for upgrade. Other packages do get upgraded, for example raspberrypi-sys-mods got upgraded last night.
pi@raspberrypi:~ $ apt list --upgradable
Listing... Done
libpython3.11-minimal/stable-security 3.11.2-6+deb12u3 arm64 [upgradable from: 3.11.2-6+deb12u2]
libpython3.11-stdlib/stable-security 3.11.2-6+deb12u3 arm64 [upgradable from: 3.11.2-6+deb12u2]
libpython3.11/stable-security 3.11.2-6+deb12u3 arm64 [upgradable from: 3.11.2-6+deb12u2]
python3.11-minimal/stable-security 3.11.2-6+deb12u3 arm64 [upgradable from: 3.11.2-6+deb12u2]
python3.11-venv/stable-security 3.11.2-6+deb12u3 arm64 [upgradable from: 3.11.2-6+deb12u2]
python3.11/stable-security 3.11.2-6+deb12u3 arm64 [upgradable from: 3.11.2-6+deb12u2]
pi@raspberrypi:~ $ sudo apt-mark showhold
pi@raspberrypi:~ $ sudo unattended-upgrade --verbose --dry-run
Checking if system is running on battery is skipped. Please install powermgmt-base package to check power status and skip installing updates when the system is running on battery.
Starting unattended upgrades script
Allowed origins are: origin=cloudflared,codename=bookworm,label=cloudflared, origin=Debian,codename=bookworm,label=Debian, origin=Debian,codename=bookworm,label=Debian-Security, origin=Raspbian,codename=bookworm,label=Raspbian, origin=Raspberry Pi Foundation,codename=bookworm,label=Raspberry Pi Foundation
Initial blacklist:
Initial whitelist (not strict):
No packages found that can be upgraded unattended and no pending auto-removals
The list of kept packages can't be calculated in dry-run mode.
pi@raspberrypi:~ $ apt-get upgrade --dry-run
NOTE: This is only a simulation!
apt-get needs root privileges for real execution.
Keep also in mind that locking is deactivated,
so don't depend on the relevance to the real current situation!
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Calculating upgrade... Done
The following packages will be upgraded:
libpython3.11 libpython3.11-minimal libpython3.11-stdlib python3.11 python3.11-minimal python3.11-venv
6 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Inst python3.11-venv [3.11.2-6+deb12u2] (3.11.2-6+deb12u3 Debian-Security:12/stable-security [arm64]) []
Inst libpython3.11 [3.11.2-6+deb12u2] (3.11.2-6+deb12u3 Debian-Security:12/stable-security [arm64]) []
Inst python3.11 [3.11.2-6+deb12u2] (3.11.2-6+deb12u3 Debian-Security:12/stable-security [arm64]) []
Inst libpython3.11-stdlib [3.11.2-6+deb12u2] (3.11.2-6+deb12u3 Debian-Security:12/stable-security [arm64]) []
Inst python3.11-minimal [3.11.2-6+deb12u2] (3.11.2-6+deb12u3 Debian-Security:12/stable-security [arm64]) []
Inst libpython3.11-minimal [3.11.2-6+deb12u2] (3.11.2-6+deb12u3 Debian-Security:12/stable-security [arm64])
Conf python3.11-venv (3.11.2-6+deb12u3 Debian-Security:12/stable-security [arm64])
Conf libpython3.11 (3.11.2-6+deb12u3 Debian-Security:12/stable-security [arm64])
Conf python3.11 (3.11.2-6+deb12u3 Debian-Security:12/stable-security [arm64])
Conf libpython3.11-stdlib (3.11.2-6+deb12u3 Debian-Security:12/stable-security [arm64])
Conf python3.11-minimal (3.11.2-6+deb12u3 Debian-Security:12/stable-security [arm64])
Conf libpython3.11-minimal (3.11.2-6+deb12u3 Debian-Security:12/stable-security [arm64])
pi@raspberrypi:~ $ cat /etc/apt/apt.conf.d/20auto-upgrades
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
APT::Periodic::Download-Upgradeable-Packages "1";
APT::Periodic::AutocleanInterval "28";
pi@raspberrypi:~ $ cat /etc/apt/apt.conf.d/50unattended-upgrades
Unattended-Upgrade::Origins-Pattern {
"origin=cloudflared,codename=${distro_codename},label=cloudflared";
"origin=Debian,codename=${distro_codename},label=Debian";
"origin=Debian,codename=${distro_codename},label=Debian-Security";
"origin=Raspbian,codename=${distro_codename},label=Raspbian";
"origin=Raspberry Pi Foundation,codename=${distro_codename},label=Raspberry Pi Foundation";
};
Unattended-Upgrade::Package-Blacklist {
};
Is the problem that unattended-upgrade is implemented at least partially in python so it can't upgrade python? Is there something else going on?
