Over the past week or so, reports have been accumulating from users who have dismissed a macOS notification encouraging an upgrade to macOS 14 Sonoma only to find themselves being upgraded anyway. The first report on TidBITS Talk came from Dave C., a developer and highly technical user who had intentionally been keeping his 2018 Mac mini on macOS 13 Ventura. When the notification appeared, he clicked the ⓧ button to dismiss it, but that was somehow interpreted as a positive consent to install.
Unfortunately, starting with Ventura, Apple has moved from an upgrade process that involved downloading and launching an “Install macOS versionName” app to an update-like process that starts without giving the user an option to quit. Howard Oakley suggests the update approach dramatically reduces the amount of data that needs to be downloaded and shortens the installation time, but it lacks the flexibility of being able to stop the installer easily or point it at another drive.
Several other users on TidBITS Talk chimed in to say that they had also inadvertently triggered the Sonoma upgrade from that notification. Having read the warning post, when user blm dismissed the notification and saw the Sonoma upgrade start, they restarted their Mac immediately and were able to block the upgrade. Jason Kerr had a similar experience and was also able to shut down in time. Will B. triggered the update accidentally but didn’t realize until he was prompted to restart to install it. He eventually prevented the upgrade from installing by turning the Mac off, rebooting into macOS Recovery, turning off System Integrity Protection (which protects certain parts of the system), deleting the downloaded upgrade files, and restarting.
David Brostoff waited a few minutes after dismissing the notification to shut down, but by then, it was too late, and he was upgraded to Sonoma. A few other users, including anch-innk, Ron LaPedis, and Charles Reeves, Jr. were upgraded to Sonoma even though they didn’t remember dismissing the notification. That’s almost more concerning.
In trying to figure out what was going on, TidBITS Talkers have confirmed that the problem affects both Intel-based and M-series Macs. Some were running macOS 13 Ventura and others macOS 12 Monterey. Being logged in as a standard user didn’t protect David C., whereas blm was logged in as an admin user. Nor did automatic update settings appear to be related—several people allowed macOS to “Check for updates” and “Install Security Responses and system files” but not “Download new updates when available” or “Install macOS updates.”
Al Varnell suggested that the notifications were triggered by a background update called macOSInstallerNotification_RC that was pushed to all Ventura users on 10 January 2024, which matches when these reports started. However, the mere presence of a notification shouldn’t trigger updates when the user explicitly dismisses the notification.
Will B. spent 45 minutes talking to a courteous and sympathetic Apple Support Senior Advisor whose responses suggest that this situation is unintended on Apple’s part. He encouraged those experiencing it to call Apple Support and submit reports through the Feedback Assistant app. In particular, he said that Engineering needs a report posted while the Mac is being threatened with the unwanted update so Feedback Assistant can grab all the relevant logs and provide a snapshot of the state of the machine.
There may be a few ways to forestall the upgrade:
- When faced with the Sonoma upgrade notification, choose Details or Info from the Options menu rather than clicking the ⓧ button.
- If you have clicked the ⓧ button, immediately open System Settings > General > Software Update (or System Preferences > Software Update) and look for a Cancel Update button.
- If that doesn’t work, immediately restart the Mac to see if that interrupts the download and thus short-circuits the update process.
- If you are prompted to restart when you haven’t initiated a restart, click Cancel. You’ll probably be prompted again later, and if you restart manually, the upgrade will probably happen. Try following Will B.’s approach of booting to macOS Recovery, disabling SIP, and deleting the upgrade download.
If you’re particularly concerned that you might inadvertently get Sonoma when you don’t want it, it’s possible turning off “Check for updates” in the Automatically options shown above would help, but it’s usually good to be alerted to new updates. P. Boersting also posted a set of steps to install a profile that defers major upgrades. I haven’t tested these, but they might be worth a try.
Stepping back from the nitty-gritty of this situation, I want to end with a few points:
- I don’t believe Apple meant to force Sonoma upgrades on users. That’s actively hostile behavior because there’s no way of knowing why someone might be sticking with an older version of macOS or if it’s a reasonable time to upgrade. It’s unacceptable to trigger a major system update without explicit user permission, and I can’t see Apple doing that deliberately. If nothing else, upgrading users like that doesn’t benefit Apple in any material way.
- This is a nasty bug and is a distinct lapse on Apple’s part. However, I think it’s overstating the case to claim that it’s indicative of a trend or a reason to stick with older versions of macOS. After all, the versions affected are Monterey and Ventura. Plus, because the bug doesn’t affect everyone, it likely relies on specific circumstances that make it difficult to identify in testing.
- Although no one should be forced to upgrade by this bug, there’s no reason to fear Sonoma. It has been out since September and has received several updates to fix bugs, add promised features, and block security vulnerabilities. I’ve been running it on my M1 MacBook Air since the beta with no particular issues and on my 27-inch iMac for about a month with no problems. If you buy a new Mac, it’s what you’ll get.
It’s likely that Apple will quietly fix the bug behind the scenes and say nothing, so keep an eye on online discussions in TidBITS Talk and elsewhere to see when reports of these forced upgrades stop.