> I use this sources.list from the beginning with hoary. > Why do I still run 1.0.2 and not 1.0.4? You have 1.0.2 because you have pinned the priority of hoary/main, but not hoary-security/main. ;-)