We’re seeing either discrepancies or a lag between the ERRATA data published to https://errata.rockylinux.org/ and data in the updateinfo.xml files in the repositories, which means that running dnf check-update --security doesn’t return any updates, where as a straight dnf check-update returns this:
azcmagent.x86_64 1.35.02478-1213 packages-microsoft-com-prod
curl.x86_64 7.76.1-23.el9_2.4 baseos
graylog-server.x86_64 5.0.13-1 graylog
java-1.8.0-openjdk-headless.x86_64 1:1.8.0.392.b08-3.el9 appstream
libcurl.x86_64 7.76.1-23.el9_2.4 baseos
libgs.x86_64 9.54.0-11.el9_2 appstream
libnghttp2.x86_64 1.43.0-5.el9_2.1 baseos
The curl update for instance is RLSA-2023:5763, which is Rocky Enterprise Software Foundation Product Errata. Looking at the RL9.2 baseos 30cdb1ea-9f14-41a9-8f71-15744f155975-UPDATEINFO.xml from the public repo I can see that RLSA-2023:5763. What is the expected lag between the ERRATA data being published and the updateinfo on the repos being updated? We rely on this data for patch management reporting, so would be useful to understand the constraints.