Undoing a dnf transaction and locking package versions on RHEL

Goal

Inspect what a past dnf transaction did, reverse it if needed, and stop a specific package from being upgraded further.

Prerequisites

Root or sudo access; dnf's transaction history is stored locally, so this only covers actions taken on this host through dnf itself.

Steps

1. List past transactions:

dnf history list

Each row is a transaction ID with a date, the action summary and the number of packages touched. 2. Inspect one in detail before acting on it:

dnf history info <id>

3. Reverse exactly that one transaction — dnf works out the inverse action for each package it touched:

dnf -y history undo <id>

Undo can fail (or partially apply) if a later transaction already modified one of the same packages; dnf history info <id> first tells you what would be touched. 4. To go further back — reverting every transaction since <id>, not just one — use rollback instead:

dnf -y history rollback <id>

RHEL 8, 9 and 10 ship DNF 4. Fedora 41 and later ship DNF5, where undo, rollback and redo exist as well, per the DNF5 history reference; the output format and some options differ. 5. Pin a package so routine upgrades skip it: on RHEL 8/9 (dnf4) this needs a plugin package (python3-dnf-plugin-versionlock):

dnf versionlock add httpd
dnf versionlock list
dnf versionlock delete httpd

The same plugin package applies on RHEL 10 (DNF 4). In DNF5 (Fedora 41 and later) versionlock is a built-in command instead of a plugin.

Expected result

dnf history list shows a new transaction recording the undo or rollback; rpm -q <pkg> reflects the reverted version; dnf versionlock list shows the locked package and its excluded version range.

Limits and test basis

Undo and rollback only replay package-manager actions dnf itself recorded; they do not restore a file an admin edited by hand outside dnf's control, and they cannot repair data changed by the package's own runtime (a database schema migration run by a postinstall script, for example). Run dnf history info <id> before undoing anything you did not run yourself. -y suppresses the confirmation prompt for unattended use.