microsoft/MSRC-Microsoft-Security-Updates-API

Incorrect supercedence chain in several cases

tetious opened this issue · 0 comments

Windows 11

I'm running into a problem where the Supercedence property is not populated for some Windows 11 cumulative updates.

For example, KB5006674, which is the 2021-10 rollup, should be superseded by the 2021-11 (KB5007215), however it does not have a Supercedence property in the json for Nov.

{
  "Description": {
    "Value": "5007215"
  },
  "URL": "https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5007215",
  "ProductID": [
    "11926",
    "11927"
  ],
  "Type": 2,
  "DateSpecified": false,
  "AffectedFiles": [],
  "RestartRequired": {
    "Value": "Yes"
  },
  "SubType": "Security Update",
  "FixedBuild": "10.0.22000.318"
},

The December rollup (5008215) is also missing a Supercedence property. It seems like it is back in the Jan json, and that rollup (5009566) correctly shows as superseding 5008215.

Windows 10

Additionally, the chain is incorrect for some Windows 10 rollups. KB5006670 (2021-10) should be replaced by KB5007186 (2021-11) which should be replaced by KB5008212 (2021-12).

In the json, both KB5008212 and KB5007186 have a single Supercedence of 5006670, and 5007186 never shows as being superseded.

It feels like a join problem, where it isn't correctly selecting the next previously released rollup, but instead a random earlier rollup from the list. In all cases, the Update Catalog shows multiple "replaces" links...

Is this something that can be corrected? If not, will it be correct going forward?