Managing DNF/YUM Version Locks on CloudLinux & RHEL-Based Systems: A Complete Guide

A version lock pins a package at a known version so that dnf update cannot replace it. This guide shows how to install the versionlock plugin, list, add and remove locks, and schedule an unlock safely on AlmaLinux, Rocky Linux, RHEL and CloudLinux 8 and 9.

1. Why lock a package version

• To stop an update from breaking a working application, for example a PHP, MySQL or Apache build your site depends on.
• To keep a known good version of a critical package while you test the new one.
• To delay an upgrade until a fix or compatibility statement is published.

A lock is a temporary safety measure. A package that stays locked also stops receiving security fixes, so keep a note of every lock and the reason for it.

2. Install the versionlock plugin

The versionlock command comes from a plugin that is not always installed.

# AlmaLinux, Rocky Linux, RHEL and CloudLinux 8 and 9
dnf install python3-dnf-plugin-versionlock

CentOS 7 and CloudLinux 7 used yum and the yum-plugin-versionlock package. CentOS 7 is end of life and no longer receives security updates, so plan a move to AlmaLinux or Rocky Linux if you still run it.

3. List locked packages

dnf versionlock list

Example output:

mysql-community-server-0:8.0.37-1.el8.*
ea-apache24-1:2.4.63-2.el8.cloudlinux.*

The same entries are kept in /etc/dnf/plugins/versionlock.list, which is useful to back up or review.

4. Add a version lock

The simplest form locks the version that is currently installed:

dnf versionlock add ea-apache24

To lock a specific version, give the full name, version, release and architecture. Find the exact string first:

rpm -q ea-apache24
dnf versionlock add ea-apache24-2.4.63-2.el8.cloudlinux.x86_64

To block one specific bad version but allow everything else, use an exclude entry instead:

dnf versionlock exclude mysql-community-server-8.0.38-1.el8

Check the result with dnf versionlock list, then run dnf check-update to confirm the package no longer appears.

5. Remove a version lock

6. Schedule an unlock

One-off unlock after 30 days, with at

at runs a command once and then forgets it, which suits a temporary lock.

dnf install at
systemctl enable --now atd
echo "/usr/bin/dnf versionlock delete ea-apache24" | at now + 30 days
atq    # list pending jobs

Fixed date, with cron

A cron line such as the one below runs every year on 25 August at 03:00, not just once. Remove it after it has run, or use at instead.

# /etc/cron.d/unlock-apache  (note the user field)
0 3 25 8 * root /usr/bin/dnf versionlock delete ea-apache24

Conditional unlock when a newer version exists

The original version of this script compared versions as plain text and searched for the word "available" in output that does not contain it, so it never worked. The script below fixes both problems. It also asks dnf to ignore the lock while checking, because a locked package hides newer versions from dnf list.

#!/bin/bash
set -euo pipefail

PACKAGE="ea-apache24"
LOCKED_VERSION="2.4.63"

# Newest version in the repositories, ignoring the lock
AVAILABLE=$(dnf -q --disableplugin=versionlock list --available --showduplicates "$PACKAGE" 2>/dev/null \
  | awk -v p="$PACKAGE" '$1 ~ "^"p"\\." {print $2}' \
  | sed 's/^[0-9]*://' | sort -V | tail -n 1)

if [[ -z "$AVAILABLE" ]]; then
  echo "No available version found for $PACKAGE"
  exit 0
fi

NEWEST=$(printf '%s\n%s\n' "$LOCKED_VERSION" "$AVAILABLE" | sort -V | tail -n 1)

if [[ "$NEWEST" != "$LOCKED_VERSION" ]]; then
  echo "Newer $PACKAGE available: $AVAILABLE"
  dnf versionlock delete "$PACKAGE"
  dnf -y update "$PACKAGE"
fi

Run it weekly from cron, for example 0 4 * * 1 root /root/check-unlock.sh in /etc/cron.d/. On a production server it is often safer to have the script send you an email instead of updating automatically, so you can test the new version first.

7. Good practice

• Lock critical packages before a major system update, and remove the lock once you have tested the new version.
• Record every lock with a date and a reason, for example in a comment next to your backup of versionlock.list.
• Review locks monthly. A forgotten lock silently blocks security updates.
• On cPanel servers, packages starting with ea- belong to EasyApache. Lock them only if you understand the dependencies between them, or the next EasyApache update may fail.

If you want a server where you control package versions yourself, see VPS plans compared.

Frequently asked questions

If you need help with package locks on your server, open a support ticket or use our 24/7 live chat.