Fedora DNF

Note

DNF 4 is superseded by dnf5 (Fedora’s default since Fedora 41) but stays maintained for the RHEL 8/9 family; mpm wraps dnf5 as a separate manager.

ID

dnf

Home page

https://github.com/rpm-software-management/dnf

Version requirement

>= 4

Platforms

🅱️ BSD · 🐧 Linux · ⨂ Unix

Operations

installed · outdated · orphans · search · install · upgrade · upgrade_all · remove · sync · cleanup · doctor

purl types

pkg:dnf · pkg:rpm

CLI names (lookup order)

dnf · dnf4

Every call

dnf --color=never --quiet <command>

Issues and PRs

📦 manager: rpm-based

Source

meta_package_manager/managers/dnf.py

Fedora’s RPM package manager.

mpm reads the inventory through repoquery rather than the human-facing listing: --userinstalled for packages installed on request (dependencies pulled in automatically are skipped) and --upgrades for pending updates, both with a --queryformat that joins the fields on a private ___MPM___ delimiter so summaries containing spaces stay splittable. Every call is forced --color=never and --quiet for parseable output.

Note

remove runs autoremove, so removing a package also drops the dependencies it leaves orphaned. search matches names only, with no exact or extended mode.

The DNF5 and YUM subclasses reuse everything here, differing only in the binary and forced arguments.

Documentation:

What mpm adds to dnf

Through mpm, dnf gains --exact and --extended search, to narrow to exact names or match descriptions.

Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover dnf alongside dnf5, yum, zypper and any other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your dnf commands, in mpm

You already know dnf: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…

With dnf

With mpm

List what’s installed

dnf repoquery --userinstalled --qf FORMAT

mpm --dnf installed

List outdated packages

dnf repoquery --upgrades --qf FORMAT

mpm --dnf outdated

Search for a package

dnf search usd

mpm --dnf search usd

Install a package

sudo dnf --assumeyes install pip

mpm install pkg:dnf/pip

Upgrade one package

sudo dnf --assumeyes upgrade pip

mpm --dnf upgrade pip

Upgrade everything

sudo dnf --assumeyes upgrade

mpm --dnf upgrade --all

Remove a package

sudo dnf --assumeyes remove pip

mpm remove pkg:dnf/pip

List orphaned dependencies

dnf repoquery --unneeded

mpm --dnf orphans

Clear caches

sudo dnf clean all

mpm --dnf cleanup --cache

Run health checks

dnf check

mpm --dnf doctor

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations

Operation

Supported

Notes

installed

✓

outdated

✓

orphans

✓

search

✓

exact and extended search backfilled by mpm

install

✓

upgrade

✓

upgrade_all

✓

remove

✓

--orphans also drops the package’s orphaned dependencies

sync

✓

cleanup

✓

--orphans runs the system-wide orphan sweep

doctor

✓

Selecting and configuring dnf

Deselect dnf for a single run with --no-dnf, or persist the choice in your configuration:

[mpm]
dnf = false

The arguments and environment variables listed in the box atop this page are forced on every dnf call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.dnf]
timeout = 900

mpm config-template dnf prints every overridable attribute as a ready-to-paste block.

Recipes

A few jobs you would otherwise script around dnf, one mpm command each:

  • Snapshot and clone a machine: mpm --dnf dump dnf.toml, then mpm restore dnf.toml on the next one.

  • Export a compliance SBOM: mpm --dnf sbom (CycloneDX by default, --spdx for SPDX).

  • Gate CI on health: mpm --dnf doctor relays Fedora DNF’s own diagnosis and exits non-zero on trouble.

Privilege escalation

System-wide manager: mpm wraps its privileged operations in sudo out of the box. Instead of letting the tool prompt mid-run, mpm primes the credential cache up-front, with a single branded password prompt at most. Turn escalation off for rootless setups with --no-sudo or the per-manager sudo override.

See privilege escalation for the full policy.

Cooldown

State of Fedora DNF’s release-age gating, from the cooldown support table:

Status: ❌ None (effort focused on dnf5)

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

  • Registry: Distro binary archives (pkg:deb, pkg:rpm, pkg:alpm, pkg:apk)

  • Retraction: Index revert: removal is an archive operation and the mirror is rebuilt without the package. Debian, for one, requires filing an RM: bug against ftp.debian.org (developers-reference)

  • Publish date: ❌ the version string is the distro maintainer’s build, carrying no upstream publication date

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --allow-unsupported-managers opts back in.

Version probe

The version is extracted from the output of dnf --version with:

r"(?P<version>\S+)"

Reference traces

Raw native outputs captured in the manager source: the reference mpm’s parsers were written against. If you know Fedora DNF well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ dnf repoquery --userinstalled --qf FORMAT
acl___MPM___2.2.53-1.el8___MPM___Access control list utilities___MPM___x86_64
audit___MPM___3.0.7-4.el9___MPM___User space auditing tools___MPM___x86_64
audit-libs___MPM___3.0.7-4.el9___MPM___Dynamic auditing library___MPM___x86_64

$ dnf repoquery --upgrades --qf FORMAT
acl___MPM___2.2.53-1.el8___MPM___2.6.53-1.el8___MPM___Access control list utilities___MPM___x86_64
audit___MPM___2.2.53-1.el8___MPM___2.5.53-1.el8___MPM___User space auditing tools___MPM___x86_64
audit-libs___MPM___2.2.53-1.el8___MPM___2.6.53-1.el8___MPM___Dynamic auditing library___MPM___x86_64

$ dnf --color=never --quiet repoquery --unneeded
libfoo-1.0.2-3.el9.x86_64
python3-extra-0:3.9.18-3.el9.noarch

Feed any of these through mpm and the raw output becomes one uniform table, the same shape for every manager: filter it, project columns, or export it (mpm --dnf installed --output json, or csv, toml, yaml), each package carrying a purl and a version comparable across managers.

Changelog

  • 7.4.0 (2026-07-25)

    • Plain cleanup no longer removes orphaned packages: their native sweeps moved behind cleanup --orphans. This also stops emerge’s cleanup from triggering its pre-depclean world upgrade unless --orphans is given.

    • remove no longer cascades to orphaned dependencies by default: a plain removal keeps them. Use the new remove --orphans to restore the previous behavior.

    • cleanup --cache now escalates through sudo: dnf clean all clears the root-owned package cache.

  • 7.1.0 (2026-07-07)

    • upgrade and upgrade --all now pass --assumeyes, as the other dnf operations already did, so upgrades no longer hang on an interactive confirmation prompt.

  • 6.2.0 (2026-03-25)

    • Add --quiet option to all invocations to reduce log verbosity.

  • 5.19.0 (2024-11-14)

    • Implement remove operation.

    • Use query template instead of regex parsing to retrieve package data.

  • 4.12.0 (2022-04-04)

    • Add support for dnf. Closes #516, refs #415.