Control: severity -1 important Control: tags -1 security I don't know whether this is related or a new bug, but auto-installed packages via dependencies are also sometimes marked as manually installed. This occurred on 2016-12-13 with:
[INSTALL, DEPENDENCIES] libmariadbclient18:amd64 10.0.28-2 [INSTALL, DEPENDENCIES] mariadb-common:amd64 10.0.28-2 and mariadb-common was marked as manually installed (no "A" in aptitude's UI); the dpkg logs show just this install and usual upgrades. The consequence is that mariadb-common was not proposed for removal as it should be after a later upgrade, leaving a security issue: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850216 -- Vincent Lefèvre <vinc...@vinc17.net> - Web: <https://www.vinc17.net/> 100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/> Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)