- Security updates: apt marks a package from a "-security" suite (Debian
12 now reports oldstable-security). dnf reads `dnf updateinfo list
--security` (dnf5 keeps updateinfo as an alias of advisory). zypper
uses `zypper -x patch --dry-run --category security`, because
`zypper -x list-patches` ignores --category and has no package names.
pacman and apk cannot tell, so they show no security count.
https://dnf5.readthedocs.io/en/latest/commands/advisory.8.htmlhttps://github.com/openSUSE/zypper/blob/master/doc/zypper.8.txt
- Reboot required: /var/run/reboot-required, `needrestart -b` (KSTA 2
or 3), `dnf needs-restarting -r` (matched by text, because a missing
plugin also exits 1), and `zypper needs-rebooting` (exit 102).
https://github.com/liske/needrestart/blob/master/README.batch.mdhttps://dnf-plugins-core.readthedocs.io/en/latest/needs_restarting.html
- An explicit risk list per package manager (Docker engine, kernels,
libc/glibc/musl, systemd, dbus, openssh) replaces the "name contains
docker/kernel" guess on the page and in every notification channel.
- The page shows security and reboot badges, a security count, and the
risk of each package. "Reboot server" (with confirmation, update
policy on the loaded server) schedules the reboot with systemd-run and
checks the server again five minutes later. Archived (transferred)
servers are never touched.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- apt: use apt-get with DEBIAN_FRONTEND=noninteractive and keep changed
configuration files (--force-confdef/--force-confold). A single package
uses install --only-upgrade, so it is never installed when missing.
- pacman: do not run `pacman -Sy` on the live database during the check.
Use checkupdates (with fakeroot) or a temporary sync database, the same
method checkupdates uses. pacman 7 downloads as the alpm user, so the
temporary directory is 755. Arch allows only "Update all" (-Syu), because
partial upgrades are unsupported.
https://man.archlinux.org/man/checkupdates.8https://wiki.archlinux.org/title/System_maintenance#Partial_upgrades_are_unsupported
- dnf: list upgrades with `repoquery --upgrades --latest-limit 1 --qf`
(dnf5 needs the explicit \n, dnf4 prints empty lines) and read the
current versions from `rpm -qa`. The package name has no .arch suffix.
https://dnf5.readthedocs.io/en/latest/changes_from_dnf4.html
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Andras BacsaiandClaude Opus 5.5