There are two things to patch: the base system (kernel and userland) and third-party packages. How you patch the base depends on how it was installed.
1Know how your base system was installed
FreeBSD 15.1 can install the base system from traditional distribution sets or as packages (pkgbase). freebsd-update applies to traditional installs. On a pkgbase install, the base system is updated with pkg instead and freebsd-update must not be used. Check which you have:
pkg info -x '^FreeBSD-' | head
# Output listing FreeBSD-* packages means a pkgbase system.
# No output means a traditional install.pkgbase is new in FreeBSD 15. Follow the FreeBSD Handbook and the 15.1 release notes for pkgbase update procedures rather than guessing.
2Patch a traditional install
freebsd-update fetch
freebsd-update install
freebsd-version -kruIf the kernel was patched, freebsd-version -k differs from -r until you reboot.
3Patch a pkgbase install
pkg update
pkg upgrade # updates FreeBSD-* base packages as well as third-party packages4Upgrade packages
pkg update
pkg upgrade
pkg audit -F
service -R # optional: restart enabled services to load new libraries5Use a boot environment as a safety net
On ZFS, take a boot environment before patching so you can roll back from the boot menu. See the bectl tutorial.
bectl create pre-patch-$(date +%Y%m%d)
freebsd-update fetch install
shutdown -r now6Moving to a new point release
On a traditional install, upgrading to the next release uses freebsd-update upgrade, followed by repeated install runs with a reboot between them. For example, when 15.2-RELEASE is announced, a 15.1 system moves to it like this (substitute whichever X.Y-RELEASE you are targeting). Read the release announcement first, because it lists the exact steps. Minor security patches within 15.1 still use freebsd-update fetch install as shown above.
freebsd-update -r 15.2-RELEASE upgrade
freebsd-update install
shutdown -r now
freebsd-update install
pkg upgrade7Get notified
The daily security run already checks installed packages against the vulnerability database (pkg audit) and mails the result to root. On traditional installs, freebsd-update cron downloads available base updates at a random time and mails you, without installing them:
# add to /etc/crontab (traditional installs only)
0 3 * * * root /usr/sbin/freebsd-update cron