Debian 13 Trixie: Conservative Defaults and apt Best Practices

Debian 13, released as stable in August 2025 and codenamed trixie, is what conservative server work looks like when it is done well: a huge library of tested packages, a release cycle that prioritizes verified behavior over novelty, and a security team that treats CVE backporting as its full-time job. The release ships a long-term kernel, OpenSSL 3.5, and Python 3.13, but the headline for administrators is not the version numbers; it is that trixie behaves like the Debian you already know. This post covers the apt habits that keep a trixie server boring, which is exactly the point.

What Trixie Changed Under the Hood

Debian 13 ships kernel 6.12 LTS, OpenSSL 3.5, GCC 14, and Python 3.13, with ext4 still the default filesystem for compatibility. For a server admin the more interesting shift is in the plumbing: the classic single-file /etc/apt/sources.list is joined by the deb822 format in /etc/apt/sources.list.d/debian.sources, which describes each suite in named blocks instead of one long line.

cat /etc/apt/sources.list.d/debian.sources

Over time every component moves to deb822. The format is more verbose and considerably more readable, including from scripts that need to know which suites a machine is configured to receive.

Security Updates Come From Their Own Suite

Debian publishes patches per suite. trixie carries the day-to-day package updates, trixie-updates holds fixes that missed the release cut, and trixie-security is the one that matters most on an internet-facing box, because it receives the coordinated CVE fixes as they are published. Never pin or exclude that suite: it is the stream that keeps a multi-year-old install current against newly announced vulnerabilities.

# /etc/apt/sources.list.d/debian.sources (excerpt)
Types: deb
URIs: http://deb.debian.org/debian
Suites: trixie trixie-updates
Components: main

Types: deb
URIs: http://security.debian.org/debian-security
Suites: trixie-security
Components: main

Upgrade and Cleanup Discipline

apt keeps three verb families, and confusing them is how Debian boxes drift. apt-get update refreshes the package indexes; apt-get upgrade applies pending changes that do not require removals; apt-get dist-upgrade performs the full upgrade, which can install or drop packages to satisfy new dependency relationships. On a long-lived server the discipline is to upgrade on a schedule rather than reactively, and to run autoremove after you remove things, or orphaned dependencies accumulate quietly.

apt-get update
apt-get dist-upgrade
apt-get autoremove
apt list --upgradable

The dist-upgrade habit is the honest one: a point release's point updates occasionally need to install a previously absent dependency, and the plain apt-get upgrade will skip exactly those changes, leaving part of the system unpatched without telling you.

Backports and Pinning, Deliberately

Debian's stability is a promise about the archive, not a prohibition on selection. Backports rebuild packages from the next Debian stable and publish them into the trixie-backports suite, which is the sanctioned way to run a newer tool without leaving trixie. Combined with apt pinning, you get precision: the whole machine stays pinned to trixie, and a single package is pulled from backports with the -t flag.

# /etc/apt/apt.conf.d/99default-release
APT::Default-Release "trixie";

echo 'deb http://deb.debian.org/debian trixie-backports main' | sudo tee /etc/apt/sources.list.d/trixie-backports.list
apt-get update
apt-get install -t trixie-backports restic

Pin the default to trixie and opt in per package. That keeps the archive from silently mixing versions while letting the one tool you genuinely need stay current. Search for backports with apt-cache policy before assuming one exists — not every package has been rebuilt.

Takeaway

Trixie asks nothing exotic of its administrators: security suite enabled, dist-upgrade on a schedule, autoremove after cleanup, and backports only per package. Do those four things and the distribution's conservatism becomes your stability, release cycle after release cycle.

You can boot a Netbay Debian 13 VPS in under 60 seconds and establish the same apt baseline on a box that arrives already current — netbayhosts.in.