Issue with ansible.builtin.dnf list updates

Get Help
,
1

When using the below task:

- name: Get list of available updates
  ansible.builtin.dnf:
    list: updates
  register: dnf_available_patches

- name: Display available updates
  ansible.builtin.debug:
    var: dnf_available_patches

The output shows more updates than what the normal dnf list updates command shows.
Example: Actual updates = 14, but Ansible shows 56.

It looks like the module lists packages from all architectures and repos, not just the unique ones like the normal dnf command does.
This is causing confusion in our post-patching reports (available vs installed counts don’t match).

Questions:

  1. Is this normal behavior of the ansible.builtin.dnf module, or a known bug?
  2. Is there a way to list only security or bugfix updates using this module (without using shell commands)?

This is part of our end-to-end automated patching setup triggered by ITSM, so reporting accuracy is important.

2

The module documentation says that list is for use with ansible directly, and not in playbooks.

It seems like ansible.builtin.package_facts might be a better approach to what you’re looking for.

3

ansible.builtin.package_facts will be fetching only installed packages not updates, am i rigth?

4

Yes, that does appear to be true.

When doing some testing, I’m able to reproduce this with the following

---
- name: Local DNF test
  hosts: localhost
  connection: local
  gather_facts: true

  tasks:
    - name: list updates with dnf module
      tags: [list, mod]
      ansible.builtin.dnf:
        list: updates
      register: module_updates

    - name: debug module
      tags: [debug, mod]
      ansible.builtin.debug:
        msg: "{{ module_updates.results | length }}"

    - name: list updates with shell
      tags: [list, shell]
      ansible.builtin.shell:
        cmd: dnf check-update | grep -c ' updates$'
      register: shell_updates
      changed_when: False

    - name: debug shell
      tags: [debug, shell]
      ansible.builtin.debug:
        msg: "{{ shell_updates.stdout }}"

    - name: list updates pkg facts
      tags: [list, pkg]
      ansible.builtin.package_facts:
        manager: auto

    - name: debug pkg facts
      tags: [debug, pkg]
      ansible.builtin.debug:
        msg: "{{ ansible_facts.packages }}"

using ansible.builtin.dnf (or .dnf5) with list: updates gives me a different number than using the shell command, and ansible.builtin.package_facts does indeed show all installed packages, and I can’t find anything in the output indicating which of them are updateable.

I will also note that on my test system, the difference was one package, and it was one NOT in the updates repo.