securityonion/salt/versionlock/soc_versionlock.yaml

versionlock:
  hold:
    description: List of packages to prevent from upgrading. To reduce the frequency of required reboots, add 'kernel' to this list.
    global: True
    forcedType: "[]string"
    multiline: True
    helpLink: versionlock.html