On Wed, Aug 26, 2026 at 04:09:24PM +0200, Madalin Ignisca wrote: > https://wiki.debian.org/StableUpdates > > It does not state that it is required either, and the wording suggests it is > an opt-in to enable.
The wiki is not official documentation. All official documentation I've seen indicates stable-updates is active by default (i.e. is not "opt-in"). Debian-installer activates and installs packages from stable-updates by default at installation time. We follow the d-i behavior with our default installation and will continue to do so. > If you do 13.6 exact release, does it means it should contain already > packages that have been updated in stable-updates after the day of > release? Because for cloud image this is what happened. Yes, that is the expected behavior. Similarly, it should contain all packages from stable-security released since the latest point release. > Stable - base, mandatory > Security - critical, required 100% in under certification environments > Updates - proposed updates, not security, that are nice to have, an opt-in if > you accept possible every day updates available. That is an inaccurate understanding. Stable-updates is not "proposed updates" or "nice to have", nor is it any less controlled than the security repository. Stable updates are targeted changes that fix critical issues and need to be adopted in a timely manner without waiting for the next stable update. Updates published via this repository are published by the stable release managers and accompanied by an announcement to [email protected], similar to security updates being accompanied by a DSA to debian-security-announce. It's a fairly common occurrence for us to publish new cloud images specifically to pick up changes published via stable-updates, for example the systemd update from SUA 275 (https://lists.debian.org/debian-stable-announce/2025/09/msg00002.html). And the recent python3.13 updated from stable-updates that you mentioned in your original mail is specifically targeted to address a regression introduced in the most recent point release that can cause python to crash. It is described in SUA 285 at https://lists.debian.org/debian-stable-announce/2026/07/msg00003.html. Many of the packages in the cloud images need to be updated within the image in order to fully take effect. For example, the systemd issue noted above refers to a crash *during provisioning*. The admin couldn't rely on apt to install package updates post-provisioning. Similarly, there are multiple python processes invoked during the cloud image boot. I don't believe it's the case here, but if the above python3.13 regression caused those services to crash, we could not expect users to install the updates during or after the provisioning process. The updates need to be included in the image. noah
