Hello,
Historically, there have been discussions regarding sync delays or incomplete dependency mapping within the apollo errata system (for instance, main packages getting flagged as security updates while related sub-packages or dependencies miss the tag). I see a lot of conflicting info so I am asking here..
Automation Status: Is the generation of updateinfo.xml and its injection into the repository compose phase fully automated as part of the package release pipeline now, or is it still a separate or manual process that can introduce synchronization gaps?
Tagging Completeness: If a security advisory requires updates to core system components and their related dependencies (like the recent grub2-tools additions), does Apollo guarantee that all associated packages in that advisory inherit the security metadata tag, or is there still a risk of partial dependency filtering?
Best Practice: For an enterprise environment requiring strict CVE remediation without full-OS feature updates, is dnf upgrade --security considered officially reliable and production-ready by the Rocky project, or is a full dnf upgrade still the recommended approach?
Thanks