How to install a plugin without updating?

[jonm]

I'm running 25.1.1 and I want to install a plugin, but when I try I get the message:

***GOT REQUEST TO INSTALL***
Currently running OPNsense 25.1.1 (amd64) at Sun Mar 23 15:11:28 CET 2025
Installation out of date. The update to opnsense-25.1.3 is required.
***DONE***

Is there a way around this? I don't want to update to 25.1.1 on this production system just yet.

[newsense]

Either you switch to OPNsense Business Edition or you keep up with the upgrade cycle on OPNsense CE.

OPNsense BE 25.4 will likely be based off of 25.1.4 which is supposed to arrive in a few days.

Holding off arbitrarily on older versions is not a secure option. If you have an actual issue report it here or on Github so it will be addressed one way or another, but don't expect things to magically start working whenever you feel like doing another upgrade. _Actual_ OPNsense bugs in core are extremely rare and far between if you care to look on Github, more often than not are "upstream" issues or misconfigurations that create the most noise. And those actual bugs are usually dealt with and a fix is provided in under 24h - from my observations, most often than not even if the report came in during a weekend.

[jonm]

OK, thanks. I guess it was a daft question.

[Monviech (Cedrik)]

To give a different explanation why its not easily possible:

Plugins evolve with new code introduced in core. This means, that when a plugin version uses something new in the framework of core, it will fail to run or have errors on older versions that do not include that code path yet.

As example look at the os-frr plugin that introduced things like the base apply button:
https://github.com/opnsense/plugins/pull/4542

Now check where it first got introduced:
https://forum.opnsense.org/index.php?topic=46310.0

Hope this makes more sense now. :)

[franco]

Just use this from the shell

# pkg install os-this-plugin

and do not report problems associated with that approach, because the limitation are known and that's why the safety check is in place.

Another way is to stay on your current stable release using the firmware flavour setting (advanced):

25.1/MINT/25.1.1/latest

It has other downsides, but is a bit more explicit to what you're trying to achieve.


Cheers,
Franco