Amazon Linux 2023 Updates: Why "dnf upgrade" Says "Nothing to Do," How to Upgrade to the Latest Release, and How to Check Your Version

On Amazon Linux 2023, sudo dnf upgrade often says "Nothing to do." even when dozens of security updates are waiting, because AL2023 locks every server to the release of the image it was launched from. A server launched from a December 2025 image stays on December 2025's packages until you move it forward on purpose. To install everything up to the newest release, run sudo dnf upgrade --releasever=latest; to see which releases exist first, run sudo dnf check-release-update; and to check what you're on, run cat /etc/amazon-linux-release. This page shows the version format, each upgrade option (one release, the latest, security-only, or "always latest"), how to tell whether you need a reboot, how long AL2023 is supported, and why EPEL doesn't work on it.

Ethan, a developer, runs the server behind his friend Jake's phone repair shop booking site on Amazon Linux 2023. He patched it every month with sudo dnf upgrade and got "Nothing to do." every time. He took that as good news. A security scan said otherwise: the server was missing 34 security updates.

New to Amazon Linux? It's AWS's own Linux for EC2 servers, and each server starts from an AMI, a saved image of the system. Which AMI you launched decides which updates you start with, and, on AL2023, which ones you get later.

Check your Amazon Linux 2023 version

Three ways to see the release, all with the same answer:

cat /etc/amazon-linux-release
grep -E "^(VERSION_ID|PRETTY_NAME)=" /etc/os-release
rpm -q system-release

Amazon Linux release 2023.9.20251208 (Amazon Linux)
VERSION_ID="2023"
PRETTY_NAME="Amazon Linux 2023.9.20251208"
system-release-2023.9.20251208-2.amzn2023.noarch

The release number has three parts:

Scripts that check VERSION_ID only learn that it's AL2023; for the actual patch level, read /etc/amazon-linux-release. The system-release package matters most, because it's what dnf uses to decide which updates you get.

Why "dnf upgrade" says "Nothing to do"

Here's Ethan's server, launched from the December 2025 image and "patched" ten months later:

sudo dnf upgrade

Dependencies resolved.
Nothing to do.
Complete!

AL2023 has a feature called deterministic upgrades through versioned repositories, on by default. Every release has its own frozen copy of the package repository, and a server reads only the copy that matches its installed system-release. So dnf upgrade looks for updates inside December 2025's repository, finds none, and says so truthfully. Meanwhile, the newest release had 34 security updates the server didn't have.

This is deliberate. A fleet launched from one image stays identical until you decide to move it, and you can test each new release before rolling it out. The catch is that nothing moves until you ask, and the message you see when you forget sounds like "all clear". Amazon Linux 2 didn't work this way, which is why habits carried over from it leave AL2023 servers behind.

Jake: "So 'Nothing to do' meant 'nothing in the old box', not 'you're up to date'?"

Ethan: "Exactly. I'd been checking an old shelf every month and calling it fully stocked."

See which releases are newer: dnf check-release-update

To list the releases after yours, use check-release-update. It comes from the dnf-plugin-release-notification package; if the command isn't found, as in AL2023's container images, install the plugin first:

sudo dnf install -y dnf-plugin-release-notification
sudo dnf check-release-update

WARNING:
  A newer release of "Amazon Linux" is available.

  Available Versions:

  Version 2023.10.20260105:
    Run the following command to upgrade to 2023.10.20260105:

      dnf upgrade --releasever=2023.10.20260105

    Release notes:
     https://docs.aws.amazon.com/linux/al2023/release-notes/relnotes-2023.10.20260105.html

It lists every newer release with its own upgrade command and release notes, oldest first, so on an older server the list is long. To see just the security fixes waiting in the newest release, ask dnf directly; on Ethan's server it counted 34:

sudo dnf check-update --releasever=latest --security

Upgrade to the latest release

To bring the server fully up to date, tell dnf which release to upgrade to. latest means the newest one:

sudo dnf upgrade -y --releasever=latest
cat /etc/amazon-linux-release

Amazon Linux release 2023.12.20261012 (Amazon Linux)

On Ethan's server, that installed 2 new packages and upgraded 51. Afterwards, the server is locked to the new release: plain dnf upgrade says "Nothing to do." again, until the next time you move it forward. To move to one specific release instead, for example the one you tested last week, use its number: sudo dnf upgrade --releasever=2023.10.20260105.

A safe routine for one server:

1. Note the current release with cat /etc/amazon-linux-release.
2. Take a snapshot or an image of the instance, so you can go back.
3. Run sudo dnf upgrade -y --releasever=latest.
4. Check whether a reboot is needed, below, and reboot if so.
5. Test your application, then write down the new release number for the next round.

Security updates only

If you want only the security fixes from the newest release, without the rest, add --security:

sudo dnf upgrade -y --releasever=latest --security
cat /etc/amazon-linux-release

Amazon Linux release 2023.9.20251208 (Amazon Linux)

On Ethan's server, that installed the 34 security updates and 2 new packages they needed, and the release number stayed at 2023.9. That's the point of this option, and also its limit: the server now runs a mix of releases, and the next plain dnf upgrade still looks only at the old repository. Taking whole releases is the safer habit, so use this for an urgent fix, then catch up with a full upgrade soon after.

Always the latest: the persistent override

If you'd rather have AL2023 behave like Amazon Linux 2, where dnf upgrade always means "the newest packages", set the override file once:

echo latest | sudo tee /etc/dnf/vars/releasever
sudo dnf upgrade -y

From then on, every dnf upgrade uses the newest release, with no flag needed. On Ethan's test copy, right after the security-only upgrade above, it picked up the remaining 18 updates and moved the server to 2023.12.20261012.

The trade-off is the one deterministic upgrades exist to avoid: two servers patched a day apart can end up on different releases. For a single server like Jake's, the override is the simple choice. For a fleet that must match, keep the default lock and move releases on purpose, as below.

Jake: "So we can tell it to always grab the newest?"

Ethan: "For one server, yes. If we had twenty, I'd want them all on the same release, chosen on a day I picked."

Do you need to reboot?

Updates to the kernel or core libraries take effect only after a reboot. The needs-restarting tool, from the dnf-utils package, tells you:

sudo dnf install -y dnf-utils
needs-restarting -r

No core libraries or services have been updated since boot-up.
Reboot should not be necessary.

If the kernel or a core library changed, it says a reboot is needed. Plan it for a quiet hour, and make sure your services start again on their own after it: run systemctl is-enabled on each one before you reboot.

Updating many servers

For more than a handful of servers, two approaches work well with the release lock. Either replace servers with new ones launched from the latest AL2023 image, which AWS publishes through public SSM parameters, or patch in place with Systems Manager Patch Manager. To find the parameter names for the latest images:

aws ssm get-parameters-by-path --path /aws/service/ami-amazon-linux-latest \
  --query "Parameters[?contains(Name, 'al2023')].Name" --output text

If you patch in place, the release lock gives you a clean monthly routine:

1. On one test server, run sudo dnf check-release-update and pick the newest release number.
2. Upgrade the test server to exactly that number with --releasever=, not latest, because latest may move on before you finish.
3. Test your applications on it, including after a reboot.
4. Upgrade the rest of the fleet to the same number, in batches.
5. Record the number, so next month's round starts from a known point.

Launch templates and infrastructure code that refer to one of those parameters always start from the newest release. For in-place patching, our guide to AWS Systems Manager covers Patch Manager, and if a server doesn't show up there, our SSM Agent guide fixes the connection.

How long AL2023 is supported, and why EPEL doesn't work

AL2023 was released in March 2023, with two support phases:

One more habit from Amazon Linux 2 that doesn't carry over: EPEL. There's no EPEL version that is binary-compatible with AL2023, and the EPEL7 repository that AL2 used stopped receiving updates on June 30, 2024. Many popular EPEL packages have direct replacements in AL2023's own repository. For the rest, AWS offers Supplementary Packages for Amazon Linux (SPAL), thousands of EPEL9 packages rebuilt for AL2023, but they aren't covered by AWS Support, and their security fixes arrive only when upstream ships them.

Troubleshooting by symptom

dnf upgrade says Nothing to do, but a scanner reports missing updates

The server is locked to its release. Run sudo dnf upgrade --releasever=latest.

No such command: check-release-update

The plugin isn't installed. Run sudo dnf install -y dnf-plugin-release-notification.

The release number didn't change after a security upgrade

--security installs only security fixes and keeps the release. Do a full --releasever=latest upgrade to move it.

Two servers from the same image have different packages

One was upgraded with --releasever=latest, or has the override file. Upgrade both to the same release number.

Installing EPEL fails or breaks dependencies

EPEL isn't compatible with AL2023. Use AL2023's own packages, or SPAL for EPEL9 builds.

needs-restarting: command not found

It comes from dnf-utils. Run sudo dnf install -y dnf-utils.

Amazon Linux 2023 versions and updates: frequently asked questions

Ethan upgraded the booking server with --releasever=latest, rebooted it on a Sunday evening, and set the override file, since it's one server. The next scan came back clean. Jake asked what "Nothing to do." means now. Ethan's answer: "Now it actually means nothing to do."

Revision note. Written October 13, 2026, with Amazon Linux 2023 releases 2023.9.20251208 and 2023.12.20261012. "Out of sight, out of mind," as the saying goes; updates you can't see in your release are still updates you need.