# Issue with ansible.builtin.dnf list updates

**URL:** <https://forum.ansible.com/t/issue-with-ansible-builtin-dnf-list-updates/44763>\
**Category:** Get Help\
**Tags:** ansible, dnf\
**Created:** [October 30, 2025, 9:51am UTC](https://forum.ansible.com/t/issue-with-ansible-builtin-dnf-list-updates/44763 "2025-10-30T09:51:13Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ume90009](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/ume90009/32/7189_2.png) [@ume90009](https://forum.ansible.com/u/ume90009)\
**Post date:** [October 30, 2025, 9:51am UTC](https://forum.ansible.com/t/issue-with-ansible-builtin-dnf-list-updates/44763/1 "2025-10-30T09:51:13Z")

</div>

When using the below task:

```auto
- name: Get list of available updates
  ansible.builtin.dnf:
    list: updates
  register: dnf_available_patches

- name: Display available updates
  ansible.builtin.debug:
    var: dnf_available_patches

```

The output shows more updates than what the normal `dnf list updates` command shows.  
Example: Actual updates = 14, but Ansible shows 56.

It looks like the module lists **packages from all architectures and repos** , not just the unique ones like the normal `dnf` command does.  
This is causing confusion in our post-patching reports (available vs installed counts don’t match).

**Questions:**

1. Is this normal behavior of the `ansible.builtin.dnf` module, or a known bug?
2. Is there a way to list only **security** or **bugfix** updates using this module (without using shell commands)?

This is part of our **end-to-end automated patching** setup triggered by ITSM, so reporting accuracy is important.

---

<div class="post-metadata">

**Author:** ![Lyle\_McKarns](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/lyle_mckarns/32/8142_2.png) [@Lyle\_McKarns](https://forum.ansible.com/u/Lyle_McKarns)\
**Post date:** [October 30, 2025, 11:38am UTC](https://forum.ansible.com/t/issue-with-ansible-builtin-dnf-list-updates/44763/2 "2025-10-30T11:38:32Z")

</div>

[The module documentation](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/dnf_module.html#parameter-list) says that `list` is for use with `ansible` directly, and not in playbooks.

It seems like [ansible.builtin.package\_facts](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/package_facts_module.html#ansible-collections-ansible-builtin-package-facts-module) might be a better approach to what you’re looking for.

---

<div class="post-metadata">

**Author:** ![ume90009](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/ume90009/32/7189_2.png) [@ume90009](https://forum.ansible.com/u/ume90009)\
**Post date:** [October 31, 2025, 6:22am UTC](https://forum.ansible.com/t/issue-with-ansible-builtin-dnf-list-updates/44763/3 "2025-10-31T06:22:16Z")

</div>

[ansible.builtin.package\_facts](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/package_facts_module.html#ansible-collections-ansible-builtin-package-facts-module) will be fetching only installed packages not updates, am i rigth?

---

<div class="post-metadata">

**Author:** ![Lyle\_McKarns](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/lyle_mckarns/32/8142_2.png) [@Lyle\_McKarns](https://forum.ansible.com/u/Lyle_McKarns)\
**Post date:** [October 31, 2025, 1:37pm UTC](https://forum.ansible.com/t/issue-with-ansible-builtin-dnf-list-updates/44763/4 "2025-10-31T13:37:38Z")

</div>

Yes, that does appear to be true.

When doing some testing, I’m able to reproduce this with the following

```yaml
---
- name: Local DNF test
  hosts: localhost
  connection: local
  gather_facts: true

  tasks:
    - name: list updates with dnf module
      tags: [list, mod]
      ansible.builtin.dnf:
        list: updates
      register: module_updates

    - name: debug module
      tags: [debug, mod]
      ansible.builtin.debug:
        msg: "{{ module_updates.results | length }}"

    - name: list updates with shell
      tags: [list, shell]
      ansible.builtin.shell:
        cmd: dnf check-update | grep -c ' updates$'
      register: shell_updates
      changed_when: False

    - name: debug shell
      tags: [debug, shell]
      ansible.builtin.debug:
        msg: "{{ shell_updates.stdout }}"

    - name: list updates pkg facts
      tags: [list, pkg]
      ansible.builtin.package_facts:
        manager: auto

    - name: debug pkg facts
      tags: [debug, pkg]
      ansible.builtin.debug:
        msg: "{{ ansible_facts.packages }}"

```

using `ansible.builtin.dnf` (or `.dnf5`) with `list: updates` gives me a different number than using the shell command, and `ansible.builtin.package_facts` does indeed show all installed packages, and I can’t find anything in the output indicating which of them are updateable.

I will also note that on my test system, the difference was one package, and it was one NOT in the `updates` repo.