Run a security only upgrade when you need to close known holes with the smallest change, and a full upgrade during planned maintenance. Preview either one with dnf updateinfo so you know which advisories you are about to install before anything changes on the host.
Two different questions
A full upgrade answers "what is the newest version of everything?" A security upgrade answers "which installed packages have a fix for a published security issue?" The DNF command reference describes the security flag as including packages that provide a fix for a security issue. It applies to upgrade, install, updateinfo and a few related commands.
The practical difference is blast radius. A smaller change set means less to test and a simpler rollback.
Preview before you apply
The updateinfo command reads advisory metadata. According to the DNF command reference it has three views:
| View | What you get |
|---|---|
| summary | Counts of advisories grouped by type. This is the default. |
| list | One line per advisory with ID, type, severity and package version. |
| info | A detailed block per advisory: date, bugs, CVEs, description, severity. |
A simple routine looks like this:
dnf updateinfo summary
dnf updateinfo list --security
dnf upgrade --security
The first line tells you whether anything is pending. The second lists what. The third applies it.
When security only is the right call
- A production host where change windows are tight.
- A fleet where you patch weekly and do a full upgrade monthly.
- An audit setting where you must show that every advisory with a security fix was applied within your own deadline.
When a full upgrade is the better call
- A new host being built, where there is no state to protect.
- A dev or staging machine used to catch breakage early.
- After a long gap, because skipping bugfix updates for months can make later security updates harder to apply cleanly.
Many teams run both: security fixes on a fast cadence, everything else on a calendar.
Limits to keep in mind
Advisory metadata only exists when the repository publishes it. If your repository does not ship updateinfo data, the security flag has little to select from, so check that updateinfo list returns something before you rely on it.
Also note the flag selects updates by advisory, not by whether the flaw is exploitable in your environment. A security update for a package you do not expose is still worth applying, but you can sequence it behind fixes for network facing services. See use EPSS and KEV to set patch priority tiers for ordering.
Try it yourself
Click into a finding and see how severity, fix availability and priority sit together.
Click through it at your own pace, or open it full screen.
Quick check
What does updateinfo summary show?
Counts of advisories grouped by type. The DNF documentation says it is the default view.
Is a security upgrade the same as upgrade minimal?
No. The DNF command reference describes upgrade-minimal as updating to the nearest version that includes a fix, while the security flag selects packages that fix a security issue.
Safeguard shows which of your dependencies and base image packages have advisories, with reachability analysis to help you order the work. A free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
