Updating FreeBSD: freebsd-update for the base system, pkg upgrade for packages, and pkg audit for known vulnerabilities

Goal

Apply security patches and package updates to a FreeBSD 14.x host, perform a major release upgrade, and check installed packages against known vulnerabilities before or after either.

Prerequisites

Root access; binary updates exist only for RELEASE (and ALPHA/BETA/RC) builds on supported architectures, not for systems built from source; for a release upgrade, a maintenance window with at least one reboot and, per the FreeBSD Handbook, a full backup taken beforehand.

Steps

1. Patch the base system (kernel and userland binaries, not third-party packages): freebsd-update fetch followed by freebsd-update install. The manual page describes freebsd-update as the tool "used to fetch, install, and rollback" binary updates. fetch refuses to run without a terminal; for scheduled checks use freebsd-update cron, which only downloads. If the patches touch the kernel, the Handbook notes the system will need a reboot in order to boot into the patched kernel; otherwise restart the affected daemons.
2. For a release change, apply current patches first, then run freebsd-update -r 14.3-RELEASE upgrade (substitute the target) and review the component list. This step downloads the release and merges configuration files, which may open an editor for manual merges — it does not run unattended. Then freebsd-update install installs the kernel; reboot; run freebsd-update install again for userland; after a major version change, reinstall all packages (pkg-static upgrade -f) and run freebsd-update install once more to remove old shared libraries.
3. Update installed third-party packages independently of the base system: pkg update (refresh the catalogue) then pkg upgrade (or pkg upgrade -y for a non-interactive run). pkg-upgrade(8) describes the command as comparing installed package versions "to what is available" in configured repositories and adding out-of-date ones to a work list; it does not install new packages except to satisfy dependencies.
4. Check for known vulnerabilities before or after upgrading: pkg audit -F. pkg-audit(8) documents the command as auditing "installed packages against known vulnerabilities" and generating reports with security-advisory references; -F fetches the vulnerability database first. Treat any reported package as a priority to update or remove.
5. Note pkgbase's status before relying on it: publishing of the base system as pkg(8) packages began in October 2023, and the Handbook states plainly that "their use with FreeBSD 14 is currently experimental," with freebsd-base(7) becoming a technology preview only from FreeBSD 15.0-RELEASE onward for installation, minor and major upgrades. On FreeBSD 14.x, freebsd-update remains the documented base-system update path.

Expected result

freebsd-update install exits 0 with no pending patches on the next freebsd-update fetch; freebsd-version -kru shows the expected installed kernel, running kernel and userland versions; pkg audit reports no vulnerable packages installed.

Limits and test basis

A release freebsd-update upgrade cannot be scripted end-to-end because of interactive config-merge prompts; pair it with a ZFS boot environment (see the companion bectl article) so a failed upgrade can be rolled back without restoring from backup. pkg audit checks installed packages; base-system vulnerabilities are handled through FreeBSD security advisories and freebsd-update, so a clean pkg audit does not prove the base system is patched.