Why are packages not updated in LXC VM?

Question

linux

On two of my VMs (LXC images of Ubuntu 20.10)
, some packages, 15 of them, have stopped updating, although the rest that appear new are successfully updated.
What could be the reason?

here is the output that there are new versions of the packages

spoiler

~# apt list --upgradable
Вывод списка… Готово
libapache2-mod-php7.4/stretch 7.4.25-2+0~20211101.54+debian9~1.gbp484212 amd64 [может быть обновлён с: 7.4.25-1+ubuntu18.04.1+deb.sury.org+1]
php7.4-cli/stretch 7.4.25-2+0~20211101.54+debian9~1.gbp484212 amd64 [может быть обновлён с: 7.4.25-1+ubuntu18.04.1+deb.sury.org+1]
php7.4-common/stretch 7.4.25-2+0~20211101.54+debian9~1.gbp484212 amd64 [может быть обновлён с: 7.4.25-1+ubuntu18.04.1+deb.sury.org+1]
php7.4-curl/stretch 7.4.25-2+0~20211101.54+debian9~1.gbp484212 amd64 [может быть обновлён с: 7.4.25-1+ubuntu18.04.1+deb.sury.org+1]
php7.4-dev/stretch 7.4.25-2+0~20211101.54+debian9~1.gbp484212 amd64 [может быть обновлён с: 7.4.25-1+ubuntu18.04.1+deb.sury.org+1]
php7.4-fpm/stretch 7.4.25-2+0~20211101.54+debian9~1.gbp484212 amd64 [может быть обновлён с: 7.4.25-1+ubuntu18.04.1+deb.sury.org+1]
php7.4-gd/stretch 7.4.25-2+0~20211101.54+debian9~1.gbp484212 amd64 [может быть обновлён с: 7.4.25-1+ubuntu18.04.1+deb.sury.org+1]
php7.4-json/stretch 7.4.25-2+0~20211101.54+debian9~1.gbp484212 amd64 [может быть обновлён с: 7.4.25-1+ubuntu18.04.1+deb.sury.org+1]
php7.4-mbstring/stretch 7.4.25-2+0~20211101.54+debian9~1.gbp484212 amd64 [может быть обновлён с: 7.4.25-1+ubuntu18.04.1+deb.sury.org+1]
php7.4-mysql/stretch 7.4.25-2+0~20211101.54+debian9~1.gbp484212 amd64 [может быть обновлён с: 7.4.25-1+ubuntu18.04.1+deb.sury.org+1]
php7.4-opcache/stretch 7.4.25-2+0~20211101.54+debian9~1.gbp484212 amd64 [может быть обновлён с: 7.4.25-1+ubuntu18.04.1+deb.sury.org+1]
php7.4-readline/stretch 7.4.25-2+0~20211101.54+debian9~1.gbp484212 amd64 [может быть обновлён с: 7.4.25-1+ubuntu18.04.1+deb.sury.org+1]
php7.4-soap/stretch 7.4.25-2+0~20211101.54+debian9~1.gbp484212 amd64 [может быть обновлён с: 7.4.25-1+ubuntu18.04.1+deb.sury.org+1]
php7.4-xml/stretch 7.4.25-2+0~20211101.54+debian9~1.gbp484212 amd64 [может быть обновлён с: 7.4.25-1+ubuntu18.04.1+deb.sury.org+1]
php7.4-zip/stretch 7.4.25-2+0~20211101.54+debian9~1.gbp484212 amd64 [может быть обновлён с: 7.4.25-1+ubuntu18.04.1+deb.sury.org+1]

And here is the output of those packages that stubbornly do not want to be updated

spoiler

~# apt upgrade -y
Чтение списков пакетов… Готово
Построение дерева зависимостей
Чтение информации о состоянии… Готово
Расчёт обновлений… Готово
Следующие пакеты будут оставлены в неизменном виде:
libapache2-mod-php7.4 php7.4-cli php7.4-common php7.4-curl php7.4-dev php7.4-fpm php7.4-gd php7.4-json php7.4-mbstring php7.4-mysql php7.4-opcache php7.4-readline
php7.4-soap php7.4-xml php7.4-zip
Обновлено 0 пакетов, установлено 0 новых пакетов, для удаления отмечено 0 пакетов, и 15 пакетов не обновлено.

Answer 1

So the package manager needs to remove something. upgrade obviously doesn't do this:

New packages will be installed if required to
satisfy dependencies, but existing packages will never be removed.
If an upgrade for a package requires the removal of an installed
package the upgrade for this package isn't performed.

Ask
sudo apt full-upgrade
what exactly he proposes to do

Answer 2

And if you try to install them through sudo apt install ?

Answer 3

I would start from how many domains you still need to protect. The cheapest multi-domain certificate that I saw cost about 4000 rubles / year. Moreover, the price of the certificate includes only 3 domains. For the same money, you can buy 4-8 Comodo PositiveSSL certificates at once (depending on the supplier's prices), and easily install a separate certificate for each domain name. You will have to spend a little more time on installation, but this should not be done so often :-)
If you look at Comodo PositiveSSL, then at the moment the situation is as follows:
masterhost - from 2800 rubles/g
leaderssl - from 1,100 rub/g
P.S.You said that you need to increase the trust of visitors. I would then also think about how important it is for site visitors to receive confirmation that you are who you say you are. If important, and you are a legal entity, then you should buy a Certificate with Organization Verification (OV). In this case, users who click on the lock symbol in the address bar will see not only information about the encrypted connection, but also the name of the organization. From this it will follow that the certification center has checked the constituent documents of the company and confirms its existence. Users will immediately understand that this is not a "clone" or "fake" site created by scammers and will trust you more.

Answer 4

You need a UC (Unified Communications Certificate) also called a SAN certificate.
Who to buy from is your choice. Major CAs: Thawte, Verisign.

Answer 5

I purchased a UCC SSL certificate for only $45 for a client site from https://www.ssl2buy.com/comodo-multi-domain-ssl.php that way one cheap certificate covers multiple domain names and it is SHA-2.