Update Debian on a VPS

Regular updates fix known flaws and prevent a critical patch from piling up with dozens of others. On Debian the operation takes a few commands, but it has two traps: rebooting too fast without checking, and confusing a package update with a release upgrade. This guide covers the routine and prepares the next step without starting it.

Why and when to update

Update after installation, then at least once a month, and as soon as a security advisory concerns exposed software (SSH, Nginx, OpenSSL, PHP, databases). Before any major operation, update first: an outdated system complicates diagnosis. Avoid a large update right before a demo or a traffic peak.

Update packages

sudo apt update
apt list --upgradable
sudo apt upgrade

apt update refreshes the package list without installing anything. apt list --upgradable shows what will change. apt upgrade installs new versions without removing packages; if a dependency requires a removal, it stops and tells you.

When that happens, review the list before using:

sudo apt full-upgrade

full-upgrade may remove or replace packages to resolve dependencies. Read the REMOVING and The following packages will be REMOVED lines before confirming. On a VPS, an unexpected removal can break a service.

Reboot when needed

A reboot is required when the kernel or system libraries change. On a system container the kernel is shared, but libraries and systemd remain local. Check:

test -f /var/run/reboot-required && cat /var/run/reboot-required
sudo needrestart -r l

The file exists only when update-notifier-common is installed. needrestart lists services still using a replaced library. Reboot with sudo systemctl reboot, then verify that SSH and your services answer.

Security updates

Debian enables the security repository by default. To see only those fixes:

sudo apt update
sudo apt list --upgradable | grep -i security

Do not delay a security fix because another package is pending. Automation with unattended-upgrades is covered in a dedicated guide; if you enable it, keep an eye on reboots.

Prepare a release upgrade

Moving from Debian 12 to 13 is not a simple update. Back up data and configuration, list active services, read the release notes, then edit /etc/apt/sources.list and the files in /etc/apt/sources.list.d/ to target the new release. Then run apt update, apt full-upgrade and reboot. Keep the console open: a release upgrade may ask interactive questions and leave the system half-configured if your session drops.