4 Ways to Lock or Exclude Package Updates with dnf (yum)

Updated: 28 September 2026 · Applies to: dnf 4.14 to 4.20 on AlmaLinux and Rocky Linux 9 and 10 and RHEL 9 and 10 (yum is an alias of dnf); apt on Ubuntu 24.04 and 26.04 and Debian 13

Sometimes a package must stay at its current version: an application needs a specific PHP or database version, or a kernel update must wait for a maintenance window. dnf offers four ways to hold packages back, from a one-time exception to a permanent lock. On current systems the yum command runs dnf, so the older "yum" methods map to these. We tested the version lock on AlmaLinux 9.

1. Skip a package for one update

dnf upgrade --exclude='kernel*'

Only this update leaves the kernel packages alone. Several patterns can be given, separated by commas.

2. Exclude packages permanently

Add an exclude line to the [main] section of /etc/dnf/dnf.conf:

exclude=kernel* php*

dnf then ignores these packages completely: no updates and no new installs. To override it once, add --disableexcludes=main to a command. You can also put exclude= into one repository's section in /etc/yum.repos.d/, to exclude packages only from that repository.

3. Lock a version with versionlock (recommended)

dnf install python3-dnf-plugin-versionlock
dnf versionlock add nginx          # keep the installed version
dnf versionlock list
dnf versionlock delete nginx       # allow updates again

Unlike exclude, which hides a package completely, versionlock pins the exact version that is installed, and dnf versionlock list documents what is pinned on purpose.

4. Hold a whole module stream

For software delivered as modules on AlmaLinux, Rocky Linux and RHEL 9 (for example PHP, Node.js or MariaDB), the enabled stream already fixes the major version: dnf module list php shows it. Minor updates within the stream still arrive; use versionlock to stop those too.

Ubuntu and Debian

apt-mark hold nginx
apt-mark showhold
apt-mark unhold nginx

Remember to unlock

Held packages also miss security fixes. Keep a list of what you locked and why, and review it regularly.

Official documentation: DNF versionlock plugin and DNF configuration reference (exclude).