Ansible apt upgraded accidently PHP 8.2 to 8.3

Get Help
, , ,
1

Hi

I had a strange issue before on a Debian 12 server.
I update our Debian server with Ansible:

apt: update_cache=yes force_apt_get=yes cache_valid_time=3600
apt: upgrade=dist force_apt_get=yes

This resulted then to this on the affected server:

Commandline: /usr/bin/apt-get -y -o Dpkg::Options::=--force-confdef -o Dpkg::Options::=--force-confold dist-upgrade
Install: php8.3-xml:amd64 (8.3.1-1+0~20231221.15+debian11~1.gbp28f2f4, automatic), php8.3-zip:amd64 (8.3.1-1+0~20231221.15+debian11~1.gbp28f2f4, automatic), php8.3-mbstring:amd64 (8.3.1-1+0~20231221.15+debian11~1.gbp28f2f4, automatic), php8.3-common:amd64 (8.3.1-1+0~20231221.15+debian11~1.gbp28f2f4, automatic), php8.3-readline:amd64 (8.3.1-1+0~20231221.15+debian11~1.gbp28f2f4, automatic), php8.3-opcache:amd64 (8.3.1-1+0~20231221.15+debian11~1.gbp28f2f4, automatic), php8.3-curl:amd64 (8.3.1-1+0~20231221.15+debian11~1.gbp28f2f4, automatic), php8.3-mysql:amd64 (8.3.1-1+0~20231221.15+debian11~1.gbp28f2f4, automatic), linux-image-5.10.0-27-amd64:amd64 (5.10.205-2, automatic), php8.3-bz2:amd64 (8.3.1-1+0~20231221.15+debian11~1.gbp28f2f4, automatic), php8.3-cli:amd64 (8.3.1-1+0~20231221.15+debian11~1.gbp28f2f4, automatic), php8.3-fpm:amd64 (8.3.1-1+0~20231221.15+debian11~1.gbp28f2f4, automatic), php8.3-gd:amd64 (8.3.1-1+0~20231221.15+debian11~1.gbp28f2f4, automatic)
Upgrade: php-gd:amd64 (2:8.2+93+0~20231125.47+debian11~1.gbpc7171d, 2:8.3+94+0~20240109.49+debian11~1.gbpe06825), php-common:amd64 (2:93+0~20231125.47+debian11~1.gbpc7171d, 2:94+0~20240109.49+debian11~1.gbpe06825), php-curl:amd64 (2:8.2+93+0~20231125.47+debian11~1.gbpc7171d, 2:8.3+94+0~20240109.49+debian11~1.gbpe06825), linux-image-amd64:amd64 (5.10.197-1, 5.10.205-2), php-mbstring:amd64 (2:8.2+93+0~20231125.47+debian11~1.gbpc7171d, 2:8.3+94+0~20240109.49+debian11~1.gbpe06825), php-bz2:amd64 (2:8.2+93+0~20231125.47+debian11~1.gbpc7171d, 2:8.3+94+0~20240109.49+debian11~1.gbpe06825), php-fpm:amd64 (2:8.2+93+0~20231125.47+debian11~1.gbpc7171d, 2:8.3+94+0~20240109.49+debian11~1.gbpe06825), php-mysql:amd64 (2:8.2+93+0~20231125.47+debian11~1.gbpc7171d, 2:8.3+94+0~20240109.49+debian11~1.gbpe06825), php-xml:amd64 (2:8.2+93+0~20231125.47+debian11~1.gbpc7171d, 2:8.3+94+0~20240109.49+debian11~1.gbpe06825), php-zip:amd64 (2:8.2+93+0~20231125.47+debian11~1.gbpc7171d, 2:8.3+94+0~20240109.49+debian11~1.gbpe06825), postfix:amd64 (3.5.18-0+deb11u1, 3.5.23-0+deb11u1)
End-Date: 2024-01-09  14:13:28

That destroyed then a php-cli script which runs only on PHP 8.2.
8.3 was never installed before on that server. I checked APT history.

Any idea why this had happende? We never had something before with manually apt upgrade…

Thanks

2

Hi,

My bet is on upgrade=dist parameter, which would result in ansible running apt-get dist-upgrade, as shown in your output.

From the man page:

dist-upgrade
           dist-upgrade in addition to performing the function of upgrade, also intelligently handles changing dependencies with new versions of packages; apt-get has a "smart" conflict resolution system, and it will attempt to upgrade the most important packages at the expense of less important ones if
           necessary. The dist-upgrade command may therefore remove some packages. The /etc/apt/sources.list file contains a list of locations from which to retrieve desired package files. See also apt_preferences(5) for a mechanism for overriding the general settings for individual packages.

I suggest you switch this parameter value to ‘yes’ or ‘safe’:

If yes or safe, performs an aptitude safe-upgrade.

1 Like
3

To add to @ptn 's comment, I expect you have the DEB.SURY.ORG repo configured, PHP 8.3 was added fairly recently to it, one result is that previously apt install php-xml would install the latest which was php8.2-xml but now it’ll install php8.3-xml.

FWIW I maintain a role that is designed to install and configure deb.sury.org packages or Debian PHP packages.

1 Like
4

Hi ok that makes sense with the dist. Yes I have The special repo from sury.
So I’ll try with the safe option.

Thanks!!