pkg audit disagrees with pkg upgrade ???

[Lowell Gilbert]

Don't top-post, please.

"edflecko ." <edflecko at gmail.com> writes:

> On Wed, May 7, 2014 at 12:21 AM, Arthur Chance <freebsd at qeng-ho.org> wrote:
>
>> On 06/05/2014 21:27, edflecko . wrote:
>>
>>> I'm checking to see if I need to upgrade any installed packages. pkg audit
>>> -F says I have three vulnerabilities, but when I run pkg upgrade -y, it
>>> thinks everything is O.K. (see below)
>>>
>>> Why the discrepancy? Which one should I believe?
>>>
>>
>> Apples and oranges. Just because a port has a vulnerability doesn't
>> necessarily mean there's a newer version available yet.

> Great, thank you.
>
> Is there a way to see what package(s) is specifically using these dependent
> packages? I might choose to remove the host package, for security reasons,
> and thereby remove these as well.

Sure. "pkg info -r <package-name>". See "man pkg-info" for details.

Or, sometimes, I just try to "pkg delete" the package, and (if it's
still a dependency) I'll get an error message that tells me what depends
on it.