That is unfortunate. ![]()
A Qubes Security Bulletin (QSB) is a security announcement issued by the Qubes OS Project, typically providing a summary and impact analysis of one or more recently discovered software vulnerabilities, including details about patching to address them. This is a very common thing in computing and is not at all unique to Qubes. Examples from other projects and companies include Xen Security Advisories (XSAs), Lenovo Product Security Advisories (LENs), and Debian Security Advisories (DSAs). Almost every similar project and company has their own version of this. There is also, of course, the Common Vulnerabilities and Exposures (CVE) system.
Occasionally, QSBs may require or recommend (depending on the user’s circumstances) action that is not already handled by the updater. When that is the case, we state the actions explicitly, with step-by-step instructions, if appropriate. In most cases, however, everything is handled by the updater, and the important update information provided by the QSB is: (1) the fact that an important security update is available (currently in security-testing, soon in stable), and (2) the exact package version numbers containing the fixes. If you already check for and install updates daily or more frequently, then most QSBs will not require any unusual action from you, but many users do not have the best habits in this regard, so QSBs help keep users safe and informed.
In the past, more user action was required, but we’ve improved the updater so that it can now automatically (via Salt) perform more actions for the user. This improves security because it removes user error from the equation in these cases.
We’re also working on making further improvements in this area, such as having all security updates installed automatically by default (#6299) and having a notification system built in to the OS that informs users when action is required on their part (#3430).
If by “dom0 updates by cli” you mean the command qubes-dom0-update (as opposed to qubesctl), then nothing. It’s only the opposite that holds: the Qubes Update tool (which uses qubesctl, which uses Salt), can do more than just qubes-dom0-update, dnf, and apt can by themselves, since it can use Salt for additional automated actions. (This was the topic of conversion in the thread to which you linked above.)
I believe I just answered this in the post above:
I’ll also add this information to the installation guide so that new users will be better informed.