Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: hexlaadmin@ispx2cproxy001.x2c.nl
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: aptitude: Security update not considered if a newer version is available
Bcc: hexlaadmin@ispx2cproxy001.x2c.nl

Package: aptitude
Version: 0.8.11-7
Severity: normal

Dear Maintainer,

I started aptitude in UI mode to see the available security updates.
Unfortunately, some security updates where missing when a newer version
of the package is available from another repository. For example the apt
package:

$apt-cache policy apt
apt:
  Installed: 1.8.2.1
  Candidate: 1.8.2.3
  Version table:
     1.8.2.3 500
        500 http://ftp.nl.debian.org/debian buster-updates/main amd64 Packages
     1.8.2.2 500
        500 http://ftp.nl.debian.org/debian buster/main amd64 Packages
        500 http://security.debian.org buster/updates/main amd64 Packages
        500 http://security.debian.org/debian-security buster/updates/main amd64 Packages
 *** 1.8.2.1 100
        100 /var/lib/dpkg/status


Aptitude did not show version 1.8.2.2 under the "Security Updates" heading, but only version 1.8.2.3 under de regular "Upgradable Packages" heading.

I do not regularly install all the updates from buster-updates, only certain packages after impact review.

Due to the miscategorisation of the security updates, they were not installed.


Suggested fix: Always show all security updates under the "Security Updates"
heading. If packages meet the above conditions, show them in both/multiple
sections, each with the corresponding package version.