I just added a PPA repository for the development version of the GIMP, but I get this error:

$ apt-get update && apt-get upgrade
The following packages have been kept back:
  gimp gimp-data libgegl-0.0-0 libgimp2.0

Why and how can I solve it so that I can use the latest version instead of the one I have now?

  • 23
    Strictly speaking, I would say that is a warning, not an error. – Kazark Nov 16 '11 at 19:59

18 Answers 18


According to an article on debian-administration.org,

If the dependencies have changed on one of the packages you have installed so that a new package must be installed to perform the upgrade then that will be listed as "kept-back".

Cautious solution 1:

Per Pablo's answer, you can run sudo apt-get --with-new-pkgs upgrade, and it will install the kept-back packages.

This has the benefit of not marking the kept-back packages as "manually installed," which could force more user intervention down the line (see comments).

If Pablo's solution works for you, please upvote it. If not, please comment what went wrong.

Cautious solution 2:

The cautious solution is to run sudo apt-get install <list of packages kept back>. In most cases this will give the kept-back packages what they need to successfully upgrade.

Aggressive solution:

A more aggressive solution is to run sudo apt-get dist-upgrade, which will force the installation of those new dependencies.

But dist-upgrade can be quite dangerous. Unlike upgrade it may remove packages to resolve complex dependency situations. Unlike you, APT isn't always smart enough to know whether these additions and removals could wreak havoc.

So if you find yourself in a place where the "cautious solution" doesn't work, dist-upgrade may work... but you're probably better off learning a bit more about APT and resolving the dependency issues "by hand" by installing and removing packages on a case-by-case basis.

Think of it like fixing a car... if you have time and are handy with a wrench, you'll get some peace of mind by reading up and doing the repair yourself. If you're feeling lucky, you can drop your car off with your cousin dist-upgrade and hope she knows her stuff.

| improve this answer | |
  • 191
    As this is an accepted answer needs, it really needs updating to warn about using dist-upgrade on a stable system as many of the other answers below have pointed out. Personally I think there is a simpler/safer answer that needs promoted: apt-get install <list of pkgs> – Cas Oct 3 '12 at 12:41
  • 8
    Cas, should I just add that it could be dangerous to run a dist-upgrade on a stable system? Why exactly is that dangerous? (I honestly don't know apt all that well.) – Michael Crenshaw Oct 3 '12 at 16:27
  • 20
    There is a Server Fault answer that explains dist-upgrade in a bit more detail. I think its just worth clarifying (not dangerous as such) that it may upgrade the entire system which may be beyond what the user expects/wants i.e. in the OP example they are wondering why gimp is being held back. – Cas Oct 5 '12 at 16:38
  • 21
    Please note that sudo apt-get dist-upgrade can also remove packages. Consequently, it's best always to inspect the list of changes that will be made before agreeing to them, when running sudo apt-get dist-upgrade. – Eliah Kagan Mar 22 '13 at 13:56
  • 7
    @EliahKagan May I add that even apt-get upgrade can remove packages? It will always do that when there would be a version conflict otherwise. Think of llvm3.6 vs. llvm3.6v5 (with the "v5" meaning that it was compiled with gcc 5). These two cannot co-exist, only either of both can be kept on the system. So yes dist-upgrade may remove some packages as well, but it's not only dist-upgrade that would do this; under certain circumstances, upgrade would, as well. – syntaxerror Oct 12 '15 at 15:58

Whenever you receive from the command apt-get upgrade the message

The following packages have been kept back:

then to upgrade one or all of the kept-back packages, without doing a distribution upgrade (this is what dist-upgrade does, if I remember correctly) is to issue the command:

apt-get install <list of packages kept back>

this will resolve the kept-back issues and will ask to install additional packages, etc. as was explained by other answers.

| improve this answer | |
  • 3
    When packages are kept back this way and I manually apt-get upgrade <list of packages>, if I redo apt-get upgrade, it will list the packages in question as no longer required and that I can use apt autoremove to remove them, which I do, and then one last apt-get upgrade and they are no longer listed as kept back... Very weird. Any thoughts? – cram2208 May 16 '17 at 14:31
  • Does apt-get install also remove packages when necessary to resolve gnarly dependency situations, or would you have to run a separate apt-get remove command to accomplish that part of the upgrade process? – Michael Crenshaw Sep 5 '17 at 21:23
  • @cram2208 I believe that's the expected behaviour. The packages that were "automatically installed and [...] no longer required" are the previous versions of the upgraded packages, which are now no longer needed. apt autoremove then removes these unused dependencies. – Alex Sep 7 '17 at 0:56
  • 3
    If the upgrade would require a new package to be installed, the package will be "kept back." First consider using: sudo apt-get --with-new-pkgs upgrade which would not have side affect of causing packages to be marked as manually installed – l --marc l Dec 6 '17 at 21:59
  • @mac9416 yes it does. – jarno Jan 26 '18 at 18:04

Try this Unix SE answer:

sudo apt-get --with-new-pkgs upgrade

This allows new packages to be installed. It will let you know what packages would be installed and prompt you before actually doing the install.

apt command (friendly alternative to apt-get) share this option.

Using apt install <pkg> instead will mark pkg as "manually installed"!! To mark it again as "automatically installed" use apt-mark auto <pkg> (see also subcommand showmanual). More info on this answer.

| improve this answer | |
  • 23
    +1 because it does not have side affect of causing packages to be marked as manually installed. – ctrl-alt-delor Oct 7 '17 at 11:05
  • 2
    Note to who ever reads my comment above: not having the side effect of marking as manually installed is a good thing. I like this answer. – ctrl-alt-delor May 2 '18 at 9:22
  • 1
    Yes. apt-mark auto <pkg> should only be necessary to mark a package as being automatically installed (here the man page). – Pablo Bianchi Jul 20 '18 at 4:37
  • 26
    For some reason sudo apt-get --with-new-pkgs upgrade still shows the packages as "kept back". No error message. – Franklin Yu Nov 12 '18 at 19:06
  • 2
    Just want to add that for many up to date debian 9.6 server instances this was the absolute safest solution without breaking things. Thank you for this, Pablo, as I had luckily tested other options on staging environments beforehand, and could admin many servers up to security standards thanks to the --with-new-pkgs inclusion with much cleaner results for general future package management. Really, this UNIX SE answer should be upvoted! – Julius Jan 9 '19 at 8:18

apt-get dist-upgrade is dangerous for stable environment,

  1. wrong source.list setting and you end up with broken ubuntu.
  2. you might get entire application upgraded to version you dont want.

Use case: kernel upgrade kept back, you just want to upgrade the kernel, dont want to upgrade entire distribution.

Better way to handle kept back package:

sudo aptitude

If you have kept back package you should see Upgradable Packages on top of the list.

  • Hit + on that list
  • Hit g twice
  • Answer debconf stuff if asked
  • Press return to continue
  • Press Q
  • Press yes

Your kept back package installed.

| improve this answer | |
  • 36
    apt-get dist-upgrade is only dangerous if you have bad repositories in /etc/apt/sources.list*. It's good to be aware that dist-upgrade upgrades all packages, but with the default repositories, that should be fine. Not using dist-upgrade could be dangerous, as you might miss security updates. – Flimm Dec 27 '12 at 19:35
  • 7
    apt-get dist-upgrade can remove as well as add packages, but it is not really dangerous. Any package installation command can cause serious damage if you have problems in your sources.list file! A regular apt-get upgrade command will install any package from any software source that is enabled; dist-upgrade is not unique in this way. Furthermore, using aptitude to perform any operation at all, at least on amd64, is much more dangerous than running apt-get dist-upgrade, in a release where bug 831768 isn't fixed. – Eliah Kagan Mar 22 '13 at 14:03
  • For me, it was easier (local machine with X running) to just open synaptic and force the package's upgrade. For some reason it didn't seem to show up at all where you described in synaptic. – djvs Jul 27 '15 at 14:39
  • 5
    Also sudo aptitude safe-upgrade – msanford May 19 '16 at 15:31
  • 1
    @msanford Thank you! Your solution fixed it for me where sudo apt-get --with-new-pkgs upgrade did not. – John Mar 26 at 9:36

There are normally two reasons you may see this message.

If upgrading the program (via sudo apt-get upgrade) would cause packages to be added or removed, then the program will be held back. You can use sudo apt-get dist-upgrade in this case, which will then offer to add or remove the additional programs.

This is pretty common and usually not an issue. Occasionally (particularly during an Ubuntu alpha) a dist-upgrade will offer to remove a lot of other programs, in which case you probably want to cancel it.

If the program depends on packages or versions that are not available, then the program will be held back. You really can't do anything but wait in this circumstance, since the package is basically uninstallable. This can happen when packages get added to the repository out of order, when a package is renamed, or when a package stops providing a virtual package.

| improve this answer | |
  • 6
    Is there a way to determine whether the held package needs a dependency that can't be installed or if it is being held because other packages depend on it. I have many held packages and I believe both of these cases may apply on my system. – Jake Dec 8 '16 at 9:29
  • Thanks, the second reason was the issue for me. Even apt-get dist-upgrade refused to install it. Inspecting the package with aptitude showed that it depends on a package that isn't available. I guess I'll have to wait. – jlh May 2 '18 at 14:55

You can also try:

sudo aptitude safe-upgrade

It's safer than full-upgrade (originally named dist-upgrade) because "packages will not be removed unless they are unused".

From man aptitude:


Upgrades installed packages to their most recent version. Installed packages will not be removed unless they are unused /.../ Packages which are not currently installed may be installed to resolve dependencies unless the --no-new-installs command-line option is supplied.

| improve this answer | |

Most likely these packages are held back because their installation would create dependency inconsistencies. This can either happen because you are using archives under active development, ppas, or because the mirror you uses is not fully updated.

In the last case, just wait, when the dependencies are resolved it will be installed the next time.


There is another possibility, packages might be held back if there is put a hold on them, or if they are pinned.

| improve this answer | |
  • What do you base that likelihood on, without knowing whatever he ran an apt-get upgrade or an apt-get dist-upgrade (alt. the aptitude equivalents)? – andol Jul 31 '10 at 22:21
  • 1
    this is the most occurring problem in support questions and bugs – txwikinger Jul 31 '10 at 22:25
  • Agreed. You should probably wait and check you apt_preferences. This is often caused by development archives where the and available packages dependencies are changing very quickly. Wait for them to settle down and you may not need to dist-upgrade at all. If you'd still like to dist-upgrade, then look at the NEW packages to be installed and the packages to be removed before going ahead. – Umang Aug 1 '10 at 2:29
  • This is my case because I get the "kept back" message using dist-upgrade – Postadelmaga Aug 17 '12 at 9:02
  • In cases where this problem is due to a messup with apt preferences (pinning), I found reinstallation of the kept packages helped me: apt-get install --reinstall <packages>. – tanius Apr 13 '14 at 11:11

This is usually because the package has added a dependency, and upgrade doesn't want to add it for you without permission.

If you run:

sudo apt-get install gimp gimp-data libgegl-0.0-0 libgimp2.0

Then the new versions should be installed together with their new dependency.

| improve this answer | |
  • Upgrades specific packages (and their dependencies) without the commitment (risks) of a dist-upgrade. – John Mee Sep 21 '15 at 7:43

This worked for me

sudo aptitude full-upgrade
| improve this answer | |
  • 1
    Even aptitude upgrade worked for me. – Bibhas Dec 14 '13 at 16:15
  • I`am using Ubuntu 14.04 and I does not have aptitude command line – ahmed hamdy Mar 31 '15 at 13:33
  • apt-get dist-upgrade gave me the same message, but this solved it for me. I had a package which was breaking the upgrade of another package. I didn't need the one I installed, so aptitude full-upgrade gave me the option to remove it so it could upgrade everything else. – f.ardelian Apr 30 '15 at 0:53

I have found that aptitude does a better job at upgrading packages if the versions differ just slightly. I had a situation like this:

me@compy:/etc/apt$ apt-cache policy gzip
  Installed: 1.3.5-15
  Candidate: 1.3.5-15+etch1
  Version table:
     1.3.5-15+etch1 0
        500 http://archive.debian.org etch/main Packages
 *** 1.3.5-15 0
        100 /var/lib/dpkg/status

This made apt-get hold back the update, but aptitude updated it just fine. I'm unsure which algorithm is used to determine if a package should be updated or not. I guess these two had the same version, only a different 'qualifier'. But in any case, apt-get wouldn't update it, but aptitude would.

| improve this answer | |

Ubuntu 18.04 provides a newer, streamlined syntax via apt which is functionally like sudo apt-get --with-new-pkgs upgrade.

sudo apt full-upgrade

sudo apt upgrade is used to install available upgrades of all packages currently installed on the system from the sources configured via sources.list(5). New packages will be installed if required to satisfy dependencies, but existing packages will never be removed. If an upgrade for a package requires the remove of an installed package the upgrade for this package isn't performed.

sudo apt full-upgrade performs the function of upgrade but will remove currently installed packages if this is needed to upgrade the system as a whole.

See: apt man page: 18.04, 20.04

| improve this answer | |
  • After this operation, 2,548 MB disk space will be freed. You are about to do something potentially harmful. To continue type in the phrase 'Yes, do as I say!' – Cosmo Arun Apr 1 at 22:59

In my case packages held back were those related to linux-headers and kernel. I came to this by trying to solve an issue with having a red exclamation mark in the notification area and not being able to update packages.

To solve it, I did not have to use neither dist-upgrade nor manual apt-get install xxx.

What I did and has helped has been simple and clean:

sudo apt-get update
sudo apt-get autoremove
sudo apt-get autoclean
sudo apt-get upgrade

I had to manually confirm Grub update and its configuration.

Then I just worked with the computer for a while and then standard update dialogue has appeared again finally including "Ubuntu base" section with kernel and related. The update was performed without any trouble and I do not see any held back packages any more.

Also, it is very important to keep in mind that those *buntu updates including kernel updates are sensitive to hibernation - I've got this problem several times and I always get it resolved by restarting the machine and performing the steps above.

So maybe this would be just enough?!

(situation being described in here is related to my Xubuntu 15.10 in the end of december 2015)

| improve this answer | |

I ran into this problem when a new kernel was released. (Possibly because I have unstable updates enabled.) I found the simplest way to do the install was through Ubuntu's graphical installer (update-manager).

| improve this answer | |

This looks like the correct way to reinstall kept back package:

apt-get install --reinstall libjpeg-progs

At least this worked for me when libjpeg-progs was stuck after upgrading from Ubuntu 14.04 to 16.04. I'm sure you can do the same with any other kept back app, e.g. gimp.


| improve this answer | |
  • 1
    You could do it without --reinstall, too. – jarno Jan 26 '18 at 18:00
  • Funny thing is that it removes the libjpeg-turbo-progs package. – jarno Jan 26 '18 at 20:11

I ran into this problem using synaptic because it appeared to hang, and to try and fix this I re-booted and tried again.

SOLUTION: Then I discovered an informative message as part of the package with some post-installation instructions for me.

I had to hit "details", and then 'q' for quit after reading the message, and then things proceeded normally.

| improve this answer | |

In actual fact, the switch you need is dselect-upgrade which installs / removes dependencies for the particular package set involved.

| improve this answer | |

I have read all the posts and found that there are many interesting explanations. I was trying all of them but have not any results completely. I have a problem with mysql-utilities which I couldn't upgrade. The updating was proposed by the system. So, I want to show some steps to do it. Of course, I will repeat in some moments all of the aforementioned posts. Here is my mistake, yes I found it by already existed posts, but what should I do next? enter image description here

The next step is:

sudo apt-get --purge remove mysql-utilities

The results we can see in the image beneath. I remove the package and check this by command:

sudo apt-get -f install

Results - Fine! Later I installed this new version of package correctly. enter image description here

This way, I think can help for more new people because having other packages we can do the same steps.

Once, I am sorry, when I repeated in some places other posts.

| improve this answer | |
  • 6
    Please don't use screenshots for terminal text, since that makes it unsearchable by Google and unreadable by some people. Instead, paste the terminal text into your answer, select that text, and press the {} button in the editor to properly format it. – Chai T. Rex Jan 25 '18 at 22:14
  • @ChaiT.Rex Thanks for remarks, I will take it in opinion for the future. – Vasyl Lyashkevych Jan 25 '18 at 22:43

For the very specific flavour of this problem where the proprietary nvidia drivers are halfway updated to a new version, I reinstalled them using the driver manager. To give some context: I was stuck halfway between the 440 and 450 version of the driver and a whole package of libnvidia 440 packages were kept back. This resulted in my kubuntu being stuck at the spash screen after grub. To get into the system, I had to add "nomodeset" to the grub command as described here.

In this specific case

sudo apt-get --with-new-pkgs upgrade

did have no effect. However, I was able to reinstall the drivers through the additional driver management. In my case, on Kubuntu I started

sudo kubuntu-driver-manager

On Ubuntu you can reach the same thing via System Settings > System > Software & Updates > Additional Drivers

There I selected the 450 driver and the graphic drivers were reinstalled, resulting in a properly booting machine.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.