What is `pkg upgrade -v` intended to do?

[Jim L.]

Per pkg-upgrade(8):

-v, --vulnerable
Upgrade packages which are known to be vulnerable. See pkg-audit(8) for more details.

When no packages are vulnerable, I would expect `pkg upgrade -v` to do nothing. But the required syntax to do that is:

pkg audit -Fq | egrep -q . && pkg upgrade -v

Or am I missing something again?

# pkg audit
0 problem(s) in 0 package(s) found.
# pkg upgrade -nv
Updating FreeBSD-ports repository catalogue...
FreeBSD-ports repository is up to date.
Updating FreeBSD-ports-kmods repository catalogue...
FreeBSD-ports-kmods repository is up to date.
Updating MYREPO repository catalogue...
Fetching meta.conf: 100%     168 B   0.2 kB/s    00:01  
Fetching data: 100%    18 KiB  18.3 kB/s    00:01  
Processing entries: 100%
MYREPO repository update completed. 60 packages processed.
All repositories are up to date.
vulnxml file up-to-date
Checking for upgrades (32 candidates): 100%
Processing candidates (32 candidates): 100%
The following 2 package(s) will be affected (of 0 checked):

Installed packages to be UPGRADED:
        parallel: 20260822 -> 20260922 [FreeBSD-ports]
        sudo: 1.9.17p2_2 -> 1.9.17p2_4 [FreeBSD-ports]

Number of packages to be upgraded: 2

4 MiB to be downloaded.

 

[bob2112]

I've never used this, but the source refers to it as adding vulnerable packages, which suggests would it only make a difference to selective upgrades. It seems like a bug if it's adding vulnerable packages to a list of all packages.

 

[Jim L.]

Hmm... I'm looking to do a pkg upgrade for only those packages which are a) vulnerable, and b) have a newer version of the package available. I don't want to fix any packages that aren't broken.

Is there a better way to do that than pkg audit -Fq || pkg upgrade $(pkg audit -Fq) ?

 

[Jim L.]

More generally...

In the case where package foo is installed, vulnerable, and has no update available; while package bar is also installed, not vulnerable, and has an update available, what action is "pkg upgrade -v" defined to perform?

Conversely, when no installed package has a vulnerability, what should "pkg upgrade -v" do?