DNF5 Knowledge Patch
Claude knows DNF4 commands and basic yum/dnf heritage. This skill covers DNF5 changes that affect command syntax, configuration files, and automation workflows.
Index
| Topic | Reference | Key changes |
|---|---|---|
| Advisory command | references/advisory-command.md | Replaces updateinfo, mandatory subcommands, JSON output, --advisory-severities |
| Security upgrades | references/security-upgrades.md | --security/--minimal flags, CVE targeting, automatic updates timer+config, offline upgrades |
| Configuration | references/configuration-changes.md | Versionlock TOML format, config-manager subcommands, needs-restarting default change |
| Automation | references/automation-and-replay.md | Ansible dnf5 module, replay command (split from history) |
Breaking Changes
| DNF4 | DNF5 | Notes |
|---|---|---|
| dnf updateinfo | dnf5 advisory <subcommand> | Bare advisory fails — subcommand required |
| --sec-severity | --advisory-severities=SEVERITY,... | Accepts: critical, important, moderate, low, none |
| --strict | --skip-broken / --skip-unavailable | Split into two flags; best defaults to true |
| dnf-automatic-download.timer | dnf5-automatic.timer | One timer replaces three |
| /etc/dnf/automatic.conf (flat) | /etc/dnf/automatic.conf (new keys) | reboot = when-needed option added |
| versionlock.list (flat) | /etc/dnf/versionlock.toml | TOML with conditions |
| config-manager --add-repo | config-manager addrepo | All flags replaced by subcommands |
| config-manager --enable | config-manager enable | Original repo files never modified |
| needs-restarting (process scan) | needs-restarting (reboothint) | Process scan requires explicit -p |
| history redo/undo | replay <dir> | Standalone command; takes directory, not file |
Quick Reference
Advisory queries
dnf5 advisory subcommands: list, summary, info. Bare dnf5 advisory fails.
dnf5 advisory list --security
dnf5 advisory summary --advisory-severities=critical,important
dnf5 advisory info FEDORA-2024-abc123
dnf5 advisory list --json # basic JSON
dnf5 advisory list --json --with-cve # adds references array
Severity values for --advisory-severities: critical, important, moderate, low, none (comma-separated).
Security upgrades
# Apply only security updates
dnf5 upgrade --security
# Minimal upgrade — lowest version that fixes the advisory
dnf5 upgrade --minimal --security
dnf5 upgrade --minimal --advisory-severities=critical
# Target specific CVE or advisory
dnf5 upgrade --cves=CVE-2024-1234
dnf5 upgrade --advisories=FEDORA-2024-abc123
# Check without applying
dnf5 check-upgrade --security --json
Exit codes: 100 = updates available, 0 = none. --strict is gone — use --skip-broken (dependency issues) and --skip-unavailable (missing packages). best defaults to true.
Automatic security updates
Config defaults: /usr/share/dnf5/dnf5-plugins/automatic.conf. Overrides: /etc/dnf/automatic.conf.
One timer replaces three (dnf-automatic-download.timer, dnf-automatic-install.timer, dnf-automatic-notifyonly.timer are all gone).
# /etc/dnf/automatic.conf
[commands]
upgrade_type = security # "default" or "security"
apply_updates = true
reboot = when-needed # never | when-changed | when-needed (new)
reboot_command = shutdown -r +5 'Rebooting after applying package updates'
[emitters]
emit_via = stdio # stdio, email, motd, command, command_email
systemctl enable --now dnf5-automatic.timer
Offline upgrades
Any transactional command accepts --offline to defer execution to a minimal boot environment:
dnf5 upgrade --security --offline
dnf5 offline status # check pending transaction
dnf5 offline reboot # reboot and apply
dnf5 offline log --number=-1 # view last offline transaction log
Versionlock (TOML)
File moved from flat format to /etc/dnf/versionlock.toml:
version = "1.0"
[[packages]]
name = "openssl"
[[packages.conditions]]
key = "evr"
comparator = ">="
value = "0:3.1.0"
[[packages.conditions]]
key = "evr"
comparator = "<"
value = "0:3.2.0"
dnf5 versionlock add openssl # lock to installed version
dnf5 versionlock exclude openssl-3.1.5-1.fc41 # skip specific version
dnf5 versionlock list
Config-manager
Old flags (--add-repo, --save --setopt, --enable/--disable) are gone. Uses subcommands. Original repo files are never modified — overrides go to /etc/dnf/repos.override.d/99-config_manager.repo.
dnf5 config-manager enable updates-testing
dnf5 config-manager disable fedora
dnf5 config-manager setopt fedora.enabled=0
dnf5 config-manager addrepo --set=baseurl=https://example.com/repo --id=myrepo
Needs-restarting
Default is now reboothint (was process scanning in DNF4). Process scan requires explicit -p.
dnf5 needs-restarting # exit 1 = reboot needed (reboothint only)
dnf5 needs-restarting -s # list services needing restart
dnf5 needs-restarting -p # list processes needing restart
dnf5 needs-restarting -p -e # exclude systemd-managed processes
dnf5 needs-restarting --json # structured JSON output
Ansible dnf5 module
ansible.builtin.dnf5 (since ansible-core 2.15) requires python3-libdnf5 on managed hosts. As of ansible-core 2.19, auto_install_module_deps: true (default) installs it automatically.
- name: Apply security updates only
ansible.builtin.dnf5:
name: "*"
state: latest
security: true
- name: Apply bugfix updates only
ansible.builtin.dnf5:
name: "*"
state: latest
bugfix: true
Replay
history replay moved to standalone dnf5 replay. Takes a directory (not file). Create with --store:
dnf5 upgrade --security --store=./my-transaction
dnf5 replay ./my-transaction --skip-unavailable
Reference Files
| File | Contents | |---|---| | advisory-command.md | Full advisory subcommand reference, JSON output formats, severity filtering | | security-upgrades.md | All security upgrade flags, automatic.conf configuration, timer setup, offline upgrade workflow | | configuration-changes.md | Versionlock TOML schema, config-manager subcommands and override paths, needs-restarting behavior change | | automation-and-replay.md | Ansible dnf5 module usage and dependencies, replay command syntax |