View a markdown version of this page

Applying security updates in-place - Amazon Linux 2027
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Applying security updates in-place

AL2027 Preview

AL2027 is currently available for preview. It is intended for evaluation and testing only and is not recommended for production workloads.

Note

We recommend applying all updates available in a new AL2027 release. Picking only security updates, or only specific updates, should be the exception rather than the rule. For an overview of applying all updates, see Applying updates using DNF and repository versions.

To restrict an upgrade to packages that have a security advisory, use the --security option:

sudo dnf upgrade --security --releasever=latest

To apply only the updates from specific advisories, name them with the --advisories option. The advisory identifier in this example follows the Amazon Linux Security Advisory (ALAS) format:

sudo dnf upgrade --releasever=latest --advisories=ALAS2027-2026-001

This updates the packages mentioned in the advisory to the latest version available in the selected release, which might be newer than the version the advisory introduced. To update the affected packages only up to the lowest versions that fix the advisory, use dnf upgrade-minimal instead:

sudo dnf upgrade-minimal --releasever=latest --advisories=ALAS2027-2026-001

In the following example, the advisory is fixed by zsh-5.9-21 and the repository also carries the newer zsh-5.9-22. The upgrade-minimal command selects the lowest version that fixes the advisory:

Updating and loading repositories:
Repositories loaded.
Package          Arch   Version           Repository       Size
Upgrading:
 zsh             x86_64 0:5.9-21.amzn2027 example       0.0   B
   replacing zsh x86_64 0:5.9-20.amzn2027 amazonlinux   7.9 MiB

Transaction Summary:
 Upgrading:          1 package
 Replacing:          1 package

If the fixed versions are already installed, both commands make no changes. You can also filter by severity with --advisory-severities=severity, or by CVE with --cves=cve-id.

Note

In DNF5, the DNF (version 4) option --advisory was renamed to --advisories. The old spelling is kept as a compatibility alias in AL2027.

Note

Unless the system-release package is updated, the release version that DNF is locked to does not change.

Warning

When installing updates from a newer release without changing the version that DNF is locked to, take care with subsequent mutating DNF operations. Package dependencies might have changed in the newer release, and the older release that you remain locked to might not be able to satisfy the new dependencies.

Advisory publication for AL2027 begins with the public preview. Until then, advisory-filtered commands find no matching updates. The preceding example was captured with example advisories, so the advisory identifier and package versions are examples. For listing the advisories that apply to a system, see Listing applicable advisories.