> The last thing you want is unattended-upgrades silently restarting services I don't buy this argument: It makes an arbitrary distinction between software in

> The last thing you want is unattended-upgrades silently restarting services I don't buy this argument: It makes an arbitrary distinction between software in which the fix is reflected, and software where it isn't. For example, if said upgrade breaks an on-demand job which isn't a permanently running process but invoked by your customers through nginx, your customers also won't be seeing the results they need to. If you wanted unattended-upgrades to not have its changes reflect in the system, you might as well configure it into the mode where it only notifies you, instead of installing the new version automatically.