Release file for http://deb.debian.org/debian-security/dists/bullseye-security/InRelease is expired (invalid since 8h 51min 41s)

Deployment
,
1

Getting below error when deploying my application. Error persists despite rebooting the application.

[06:04:58] 🚀 Starting up repository: 'premium', branch: 'main', main module: 'app.py'

[06:04:58] 🐙 Cloning repository...

[06:05:01] 🐙 Cloning into '/mount/src/premium'...

[06:05:01] 🐙 Cloned repository!

[06:05:01] 🐙 Pulling code changes from Github...

[06:05:03] 📦 Processing dependencies...

[06:05:03] 📦 Apt dependencies were installed from /mount/src/premium/packages.txt using apt-get.

Hit:1 http://deb.debian.org/debian-security bullseye-security InRelease

Hit:2 http://deb.debian.org/debian trixie InRelease

Get:3 http://deb.debian.org/debian trixie-updates InRelease [47.3 kB]

Get:4 https://packages.microsoft.com/debian/11/prod bullseye InRelease [3650 B]

Get:5 http://deb.debian.org/debian-security trixie-security InRelease [43.4 kB]

Get:6 http://deb.debian.org/debian-security trixie-security/main amd64 Packages [252 kB]

Reading package lists...[2026-09-08 06:05:04.158672]

E: Release file for http://deb.debian.org/debian-security/dists/bullseye-security/InRelease is expired (invalid since 8h 51min 59s). Updates for this repository will not be applied.

[06:05:04] ❗️ installer returned a non-zero exit code

[06:05:04] ❗️ Error during processing dependencies! Please fix the error and push an update, or try restarting the app.

2

Welcome to the Streamlit community, and thanks for sharing your deployment error! :rocket: The error message E: Release file for http://deb.debian.org/debian-security/dists/bullseye-security/InRelease is expired (invalid since 8h 51min 59s) means the Debian security repository your app relies on has an expired release file, so apt-get can’t install dependencies from it. This is a server-side issue with the Debian repo, not your code or configuration.

This type of error has occurred before and is usually resolved automatically once the repository maintainers update the release file. You can try redeploying after some time. If the issue persists for more than a day, check the Streamlit Community Cloud status page or the forum for updates. No changes to your requirements.txt or packages.txt are needed unless you see other errors in the logs. If you want to share your repo or a minimal reproducible example, the community can help further! :blush:

Sources:

3

Getting the same error and I am assuming it is the packages.txt. Sharing that file here to see if anyone can assist.

[ UTC ] Logs for carbon-accounting-platform.streamlit.app/

────────────────────────────────────────────────────────────────────────────────────────

[07:24:24] 🚀 Starting up repository: 'carbon-accounting-system', branch: 'main', main module: 'app/main.py'

[07:24:24] 🐙 Cloning repository...

[07:24:24] 🐙 Cloning into '/mount/src/carbon-accounting-system'...

[07:24:25] 🐙 Cloned repository!

[07:24:25] 🐙 Pulling code changes from Github...

[07:24:25] 📦 Processing dependencies...

[07:24:25] 📦 Apt dependencies were installed from /mount/src/carbon-accounting-system/packages.txt using apt-get.

Hit:1 http://deb.debian.org/debian-security bullseye-security InRelease

Hit:2 http://deb.debian.org/debian trixie InRelease

Get:3 http://deb.debian.org/debian trixie-updates InRelease [47.3 kB]

Get:4 http://deb.debian.org/debian-security trixie-security InRelease [43.4 kB]

Get:5 https://packages.microsoft.com/debian/11/prod bullseye InRelease [3650 B]

Get:6 http://deb.debian.org/debian-security trixie-security/main amd64 Packages [252 kB]

Reading package lists...[2026-09-08 07:24:26.687024]

E: Release file for http://deb.debian.org/debian-security/dists/bullseye-security/InRelease is expired (invalid since 10h 11min 21s). Updates for this repository will not be applied.

[07:24:26] ❗️ installer returned a non-zero exit code

[07:24:26] ❗️ Error during processing dependencies! Please fix the error and push an update, or try restarting the app.

chromium
fonts-liberation
fonts-dejavu-core

4

Same problem with my app.
As far as I understand, there is nothing that we (we as in streamlit users) can do to deploy our apps.
Any ETA for the resolution of the problem?
Thank you :folded_hands:

5

I’m guessing there are 1000s of apps being affected by this. I also have this issue, it’s annoying knowing it is completely out of any of our hands. I’d expect a resolution fairly swiftly though I hope!

Some update or acknowledgement would be appreciated though

6

I have temporarily disabled the features in my app that require installs via packages.txt (removing packages.txt allows the app to build/run). It would be good to have a timeline on a fix from the Streamlit team and an update when this issue is fixed.

7

Same problem for all my apps.

8

Same here, confirming this is not app-specific.

App: tymm-soru-fabrikasi (private repo, packages.txt with 4 apt packages)
Three consecutive deploys/reboots today, all failed at the SAME step:

08:48 UTC → “invalid since 11h 35min 39s”
09:05 UTC → “invalid since 11h 52min 30s”
09:51 UTC → “invalid since 12h 38min 27s”

E: Release file for Index of /debian-security/dists
bullseye-security/InRelease is expired
[..] installer returned a non-zero exit code

The elapsed time between deploys matches the increase in the “invalid since”
counter exactly (17 min / 46 min), so the container clock is fine – the
Release file itself is simply no longer being refreshed.

Root cause looks structural, not transient: Debian 11 “bullseye” reached
end-of-life on 2026-08-31 ( Debian -- News -- Debian 11 Long Term Support reaches end-of-life ).
The last Release file’s Valid-Until window (7 days) expired on 2026-09-07
~21:13 UTC, which is exactly when the counter starts. So this will NOT
resolve on its own – the bullseye-security entry needs to be removed from
the build image, or apt needs to tolerate the expired-but-unused repo.

Note the image lists BOTH bullseye-security and trixie sources; only the
bullseye one is expired. Apps WITHOUT a packages.txt are unaffected, since
the apt step never runs.

Waiting on a fix – removing packages.txt is not an option for us
(libcairo2 + fonts-dejavu-core are required for Turkish text rendering).

9

Confirming the same failure on a third app — atlanticinvoicecodification.streamlit.app (repo Roc1986/invoice_codification). Identical bullseye-security InRelease is expired failure, reproduced identically across at least 3 separate reboots between 13:32 and 13:46 UTC today (2026-09-08):

Hit:1 http://deb.debian.org/debian-security bullseye-security InRelease
Hit:2 http://deb.debian.org/debian trixie InRelease
Get:3 http://deb.debian.org/debian trixie-updates InRelease [47.3 kB]
Get:4 http://deb.debian.org/debian-security trixie-security InRelease [43.4 kB]
Get:5 https://packages.microsoft.com/debian/11/prod bullseye InRelease [3650 B]
Get:6 http://deb.debian.org/debian-security trixie-security/main amd64 Packages [252 kB]
Reading package lists...[2026-09-08 13:32:55]
E: Release file for http://deb.debian.org/debian-security/dists/bullseye-security/InRelease is expired. Updates for this repository will not be applied.
[13:32:56] ❗️ installer returned a non-zero exit code
[13:32:56] ❗️ Error during processing dependencies!

I also ruled out my own packages.txt as a factor — emptied it completely and the same apt-get update still ran and failed identically, confirming this is a platform-level step unrelated to app-specific dependencies. Adding this as a fourth confirmed case in case it helps prioritize a fix on Streamlit’s side.

10

Rebooting doesn’t help on my end either. Seems platform-wide rather than app-specific, hoping the team can push a fix on their base image soon.

11

same isues

12

Hey @chete-py and all,
Thank you for flagging! Just wanted to update that the team is aware of this issue and there’s currently a fix in flight! :rocket: Will update when it’s live.

13

Hey everyone, thanks for reporting the issue to us! We have rolled out a new version to prod which should fix the issue! Please let us know if something is still not working and sorry for the inconvenience :slight_smile:

14

Yay, my app rebooted successfully :partying_face:

Thank you!

15

Hi all,

Thank you for the nice work and feedback. https://security.debian.org/debian-security/dists/bullseye-security/InRelease is still showing validUnitl: Mon, 07 Sep 2026 21:13:04 UTC. Any idea how much time would that take to update?

Thanking you very much in advance!

Anis

16

thank u so much. system is running

17

Same isues! ASAP?, Please