Debian repo 'bullseye-security' Release file expired — apt-get fails on Community Cloud (Sept 2026)

Community Cloud
1

Hi all,

My app has been failing to deploy since ~21:00 UTC yesterday, with this error during dependency installation:

E: Release file for http://deb.debian.org/debian-security/dists/bullseye-security/InRelease is expired (invalid since 33min 29s). Updates for this repository will not be applied.
[21:46:36] :red_exclamation_mark: installer returned a non-zero exit code
[21:46:36] :red_exclamation_mark: Error during processing dependencies!

packages.txt just contains: gdal-bin, qgis, python3-qgis

What I’ve tried:

  • Rebooting the app — no change, and the “invalid since” duration keeps growing on each retry
  • Deleting the app entirely and deploying a fresh one under a new URL — same exact error

Since a brand new app hits the identical error, this doesn’t seem specific to my repo/account — looks like the shared base build image’s apt sources for bullseye-security are stale/broken again, similar to what happened here in 2023:

In that thread, Streamlit staff confirmed it required a fix on their end, and that delete+recreate only helped once that was done.

Is anyone else seeing this today? Also filed a support ticket, just flagging here in case it helps get visibility faster.

Thanks!

2

Hey there, thanks for raising this and providing such a clear summary (and for linking to the previous forum threads)! :police_car_light: You’re absolutely right—this error:

E: Release file for http://deb.debian.org/debian-security/dists/bullseye-security/InRelease is expired (invalid since XXmin XXs). Updates for this repository will not be applied.

…is a recurring issue with the Debian security repository used by Streamlit Community Cloud’s build environment. When the “InRelease” file expires, apt-get fails for all apps needing system packages (like gdal-bin, qgis, python3-qgis), and rebooting or redeploying won’t help until the base image or apt sources are updated on Streamlit’s end. This is confirmed in multiple forum threads, including this one and this one, where the only resolution was a platform-side fix.

You’re not alone—others are likely affected, and the best course is to wait for Streamlit Cloud maintainers to refresh the build environment or apt sources. Deleting/redeploying or editing packages.txt won’t resolve it until then. Keep an eye on the Streamlit Community Cloud status page and the forums for updates.

Sources:

3

Appreciate the flag @adrien.piro!

This is a wider issue that the team is aware of and a fix is on the way! :rocket:

4

Hey @adrien.piro , thanks for reporting the issue to us! We have rolled out a new version to prod which should fix the issue! Please let us know if something is still not working and sorry for the inconvenience :slight_smile:

5 

#12 [build 3/7] RUN apt-get update && apt-get install -y   curl   git   openssh-client   bash   && apt-get clean   && rm -rf /var/lib/apt/lists/*
#12 0.178 Get:1 http://deb.debian.org/debian bullseye InRelease [75.1 kB]
#12 0.189 Get:2 http://deb.debian.org/debian-security bullseye-security InRelease [27.2 kB]
#12 0.189 Get:3 http://deb.debian.org/debian bullseye-updates InRelease [44.0 kB]
#12 0.286 Get:4 http://deb.debian.org/debian bullseye/main amd64 Packages [8066 kB]
#12 0.550 Get:5 http://deb.debian.org/debian bullseye-updates/main amd64 Packages [18.8 kB]
#12 1.226 Reading package lists...
#12 1.580 E: Release file for http://deb.debian.org/debian-security/dists/bullseye-security/InRelease is expired (invalid since 2d 10h 6min 42s). Updates for this repository will not be applied.
#12 ERROR: process "/bin/sh -c apt-get update && apt-get install -y   curl   git   openssh-client   bash   && apt-get clean   && rm -rf /var/lib/apt/lists/*" did not complete successfully: exit code: 100

I am still facing this issue. Can anyone help me out ?

6

@Chandrudu Could you please tell me the URL of your app and I can see whether I find more details. Does this persist even after rebooting the app?

7

Hi @raethlein Can you please let us know what was the exact fix that was applied. We are getting the below error in our pipeline.

Index of /debian bullseye-updates InRelease [44.0 kB]
Reading package lists…
E: Release file for http://deb.debian.org/debian-security/dists/bullseye-security/InRelease is expired (invalid since 2d 13h 45min 8s). Updates for this repository will not be applied.

8

Hey @Sravan1 , we rebuilt our Docker images which included some updates to the bullseye-security list. Could you perhaps provide me a package.txt file you are using in your app which still fails? I’ll try to reproduce it then on my end.

9

Hello @raethlein Please find the below package.json file that we are using on our end

{

"name": "xxxxxxxxxxxxxxxxxx",

"version": "0.0.0",

"engines": {

    "node": ">=18.12.0"

},

"scripts": {

    "ci:install": "npm i",

    "ng": "ng",

    "start": "ng serve",

    "build": "ng build",

    "test": "ng test",

    "test:coverage": "ng test --no-watch --code-coverage",

    "lint": "ng lint",

    "test-watch": "ng test --watch",

    "lint:fix": "ng lint --fix",

    "format:check": "prettier src/ --check",

    "format:write": "prettier src/ --write",

    "e2e": "ng e2e",

    "prepare": "husky"

},

"lint-staged": {

    "src/\*\*/\*.ts": \[

        "eslint --fix",

        "prettier --write",

        "bash test-staged.sh"

    \],

    "src/\*\*/\*.{js,scss,html,json}": \[

        "prettier --write"

    \]

},

"private": true,

"dependencies": {

    "@angular-eslint/schematics": "^18.4.3",

    "@angular/animations": "^18.2.13",

    "@angular/cdk": "^18.2.14",

    "@angular/common": "^18.2.13",

    "@angular/compiler": "^18.2.13",

    "@angular/core": "^18.2.13",

    "@angular/forms": "^18.2.13",

    "@angular/material": "^18.2.14",

    "@angular/platform-browser": "^18.2.13",

    "@angular/platform-browser-dynamic": "^18.2.13",

    "@angular/router": "^18.2.13",

    "@dxc-lm/keycloak-authorisation": "file:offline-packages/ng18pckgs/keycloak-authorisation-0.2.34.tgz",

    "@dxc.lm.sdk.angular/lors-master-data-api": "0.0.15",

    "@dxc.lm.sdk.angular/outwards-reinsurance-api-new": "0.0.19",

    "@ng-idle/core": "^16.0.0",

    "@ng-idle/keepalive": "^16.0.0",

    "@ngrx/effects": "^18.1.1",

    "@ngrx/entity": "^18.1.1",

    "@ngrx/operators": "^18.0.0",

    "@ngrx/router-store": "^18.1.1",

    "@ngrx/store": "^18.1.1",

    "@ngrx/store-devtools": "^18.1.1",

    "aws-amplify": "^5.3.27",

    "browserslist": "4.21.5",

    "file-saver": "^2.0.5",

    "flag-icons": "^7.1.0",

    "ngx-permissions": "^19.0.0",

    "rxjs": "^7.8.2",

    "tslib": "^2.8.1",

    "xlsx": "^0.18.5",

    "zone.js": "\~0.14.10"

},

"devDependencies": {

    "@angular-devkit/build-angular": "^18.2.14",

    "@angular/cli": "^18.2.14",

    "@angular/compiler-cli": "^18.2.13",

    "@types/jasmine": "\~5.1.0",

    "@types/jasminewd2": "\~2.0.3",

    "@types/node": "^12.11.1",

    "@typescript-eslint/eslint-plugin": "8.44.1",

    "@typescript-eslint/parser": "8.44.1",

    "angular-eslint": "18.4.3",

    "codelyzer": "^6.0.0",

    "eslint": "^9.35.0",

    "husky": "^9.0.0",

    "jasmine-core": "\~5.2.0",

    "jasmine-spec-reporter": "\~5.0.0",

    "karma": "\~6.4.0",

    "karma-chrome-launcher": "\~3.2.0",

    "karma-coverage-istanbul-reporter": "\~3.0.2",

    "karma-jasmine": "\~5.1.0",

    "karma-jasmine-html-reporter": "\~2.1.0",

    "lint-staged": "^15.5.2",

    "prettier": "^3.6.2",

    "pretty-quick": "^4.2.2",

    "protractor": "\~7.0.0",

    "ts-node": "\~8.3.0",

    "tslint": "\~6.1.0",

    "tslint-config-prettier": "^1.18.0",

    "typescript": "\~5.5.2",

    "typescript-eslint": "8.40.0"

}

}

10

Hey @Sravan1 , thanks for sharing. I believe this is the wrong file for us to look at. It looks like a component’s frontend dependency file which should have nothing to do with the app start process. Could you perhaps share with me the URL of your app, then I can have a closer look (sorry, I should have asked for that in the first place).