Yum doesn't update httpd past version 2.2.3 on centos

Question

I have a fresh CentOS vps (CentOS release 5.4 (Final)), and yum installs Apache/httpd version 2.2.3 but 2.2.14 is the latest release. Why doesn't yum install more recent updates?

Solution 1

CentOS is based on Red Hat Enterprise Linux, which is built for businesses to use in servers. As such, it values stability far more than the latest bleeding edge features which may or may not work properly. So it rarely has the latest and greatest versions of anything. The preference is instead for the version that's been around the block a few times, and had all the kinks worked out.

Now, that being said, RedHat does back port patches. So any bugs or vulnerability issues that are fixed in later versions of Apache will be applied to RedHat's version. So you have the security of the latest patches, combined with the stability of a well known, and well tested software version. That's exactly what businesses are looking for.

If you really want the latest version of something, you still have options. You can A) compile it yourself. B) Get a distribution more aimed at bleeding edge versions. Or C) use a repository other than the official RedHat ones, that may have newer versions of software.

Solution 2

Because RedHat hasn't released packages for the newer releases. You probably won't see a newer release of apache until 6.0 comes out. It should be noted that RedHat does back port fixes and (possibly) some features of the newer versions to the apache version's in 4.x/5.x.

See Christopher Karel's answer for the reasons behind this.

If you want a newer version, try the CentOS extras or RPMForge repos. Just be aware that you may end up breaking your installs compatibility with the official RedHat/CentOS releases. You can find a list of repos in the CentOS Wiki.

If you absolutely need the bleeding edge, you'll need to compile from source or choose another distro.

Solution 3

Most packages included in RHEL and derivative distributions stay at the same version throughout the life cycle of the major release. All security patches and significant bugfixes are backported, but new features are rarely added. I'm not saying it never happens, on the contrary, every minor release of RHEL brings certain new things, with version bumps of the relevant packages, but Red Hat moves in this direction very conservatively, mostly driven by marketing (case in point: constant improvements in virtualization functionality in RHEL 5). Since new features added to apache between 2.2.3 and 2.2.14 bring no noticeable market advantage to Red Hat as a Linux vendor, it's a pretty good bet apache will not be updated.

Comments

[Scott Coldwell]

I'm not concerned about bleeding edge as much as security. It's somewhat comforting to know that they backport bug fixes, but it would be nice to see some indication that that's happened. There have been many fixes since 2.2.3.