Debian 12 "bookworm" reached the end of its regular support in July 2026 and is now maintained by the Debian LTS team until 30 June 2028. For most servers nothing breaks and no new repository is needed, but a few things work differently: security fixes arrive as DLAs instead of DSAs, there will be no more point releases, and not every package is covered. Here is what to check.
The timeline
| Date | Event | Source |
|---|---|---|
| 10 Jun 2023 | Debian 12 released | debian.org/releases |
| 12 Jun 2026 | First bookworm DLA in the security tracker data (the last DSA that included bookworm is dated 18 Jun 2026) | security-tracker DSA/DLA lists |
| 11 Jul 2026 | Debian 12.15, announced as the fifteenth and final point release | debian-announce |
| 12 Jul 2026 | Regular support ends; the LTS team takes over security support | Debian press release |
| 30 Jun 2028 | End of bookworm LTS | debian.org/releases, LTS wiki |
Debian's release table also lists a third-party, paid Extended LTS period for bookworm until 30 June 2033; that is not run by Debian. Debian 13 (trixie) is the current stable release, supported until 9 August 2028 and then under LTS until 30 June 2030.
What changes in practice
Security fixes come as DLAs
Fixes for bookworm are now published as Debian LTS Advisories (DLA) on the debian-lts-announce list and at debian.org/lts/security, not on debian-security-announce. By the end of October 2026 the tracker data lists more than 200 DLAs for bookworm. If your team watches DSA e-mails only, subscribe to the LTS list too.
Your sources stay the same
The LTS/Using page explains that LTS is a handover of responsibility that reuses the same mirrors. If your server already uses bookworm-security, it receives LTS updates automatically:
deb http://deb.debian.org/debian/ bookworm main contrib non-free-firmware non-free
deb https://deb.debian.org/debian-security bookworm-security main contrib non-free-firmware non-freeCheck what your machine actually uses. apt policy without a package name lists every configured source:
apt policy | grep -E 'bookworm(-security)?'
ls /etc/apt/sources.list.d/bookworm-security is now the only update channel
With 12.15 being the final point release, fixes no longer reach bookworm through the main archive. A server without a bookworm-security line will not receive any further security fixes. Existing automatic updates (for example unattended-upgrades configured for security updates) should keep working, because the suite and archive are unchanged; confirm it by checking that DLA packages appear in /var/log/unattended-upgrades/ or /var/log/apt/history.log.
Fewer architectures
LTS covers amd64, i386, arm64, armhf and ppc64el. Machines on other architectures should move to Debian 13.
Not every package is covered
The LTS/Bookworm page says all packages are supported except the games section and those marked unsupported in the debian-security-support package, and that the bookworm release notes' "Limitations in security support" still apply. Those limitations include web browsers (Chromium gets only six months of security support once a release is oldstable) and limited support for Go- and Rust-based packages. Check your own machine:
sudo apt install debian-security-support
check-support-statuscheck-support-status lists installed packages whose support is limited, has ended, or will end early. The package also runs this check whenever packages are installed. If something critical shows up, the Debian announcement asks users to contact debian-lts@lists.debian.org.
Kernels
The default bookworm kernel (the linux source package, 6.1 series) keeps receiving DLAs. The LTS team also publishes a 6.12 kernel for bookworm (source package linux-6.12, for example DLA-4850-1 on 22 October 2026). Whichever you run, reboot after kernel updates.
Same software versions
LTS backports fixes into the versions bookworm already ships; it does not move you to newer major releases. Bookworm stays on PHP 8.2 (for example DLA-4848-1 on 21 October 2026 updated php8.2) and PostgreSQL 15, while Debian 13 ships PHP 8.4 and PostgreSQL 17. PHP 8.2 reaches the end of upstream security support on 31 December 2026, so applications that need a newer PHP are another reason to plan the trixie upgrade.
Pitfalls
- Watching the wrong list. No new DSAs mention bookworm; tooling that filters for DSA ids will miss DLAs.
- Security suite missing. Minimal or custom images sometimes ship without
bookworm-security; after the final point release such machines are frozen. - Third-party repositories. Vendors such as PHP, Docker or database repositories have their own support policies for bookworm; check each one.
- Assuming LTS lasts for ever. 30 June 2028 is a hard stop for Debian's own support.
What you should do
- Confirm every bookworm server has a
bookworm-securitysource and installs updates regularly. - Subscribe to debian-lts-announce, or follow the DLA page, in addition to debian-security-announce.
- Run
check-support-statusand decide what to do with any unsupported package. - Plan the move to Debian 13 well before June 2028, starting with test systems; the trixie release notes describe the supported bookworm-to-trixie upgrade.
- For automation, see our guide to automatic security updates on Debian.
Sources
- debian.org/News/2026/20260712
- lists.debian.org/debian-announce/2026/msg00007.html
- debian.org/News/2026/2026071102
- lists.debian.org/debian-announce/2026/msg00005.html
- debian.org/releases
- wiki.debian.org/LTS
- wiki.debian.org/LTS/Using
- wiki.debian.org/LTS/Bookworm
- manpages.debian.org/bookworm/debian-security-support/check-support-status.1.en.html
- debian.org/releases/bookworm/amd64/release-notes/ch-information.en.html
- salsa.debian.org/security-tracker-team/security-tracker/-/raw/master/data/DLA/list
- salsa.debian.org/security-tracker-team/security-tracker/-/raw/master/data/DSA/list
- security-tracker.debian.org/tracker/DLA-4850-1
- security-tracker.debian.org/tracker/DLA-4848-1
- php.net/supported-versions.php
- debian.org/lts/security
Comments
0 total · 0 threads