opnsense-update can still be used to selectively upgrade, but
here we shouldn't take any chances.  Worst case the system will
reboot prompting "nothing to do", which isn't true because we
only know about the base and kernel, not the packages state.