dnf update must be wrong...

[Dariusz J. Garbowski]

Hi,

There is something clearly broken with updates (dnf?) but I can't tell what:

1. In KDE I get a notification that there are 6 packages to update. So, as root, I run:


[root at localhost ~]# dnf repolist
Last metadata expiration check performed 2:22:09 ago on Mon Nov 16 19:27:21 2015.
repo id repo name status
*fedora Fedora 23 - x86_64 46,074
rpmfusion-free RPM Fusion for Fedora 23 - Free 692
rpmfusion-free-updates-testing RPM Fusion for Fedora 23 - Free - Test Updates 182
rpmfusion-nonfree RPM Fusion for Fedora 23 - Nonfree 206
rpmfusion-nonfree-updates-testing RPM Fusion for Fedora 23 - Nonfree - Test Updates 26
*updates Fedora 23 - x86_64 - Updates 4,139

[root at localhost ~]# dnf update
Last metadata expiration check performed 2:14:00 ago on Mon Nov 16 19:27:21 2015.
Dependencies resolved.
==============================================================================================================================================================================================
  Package                               Arch                                  Version 
                        Repository                                                     Size
==============================================================================================================================================================================================
Skipping packages with broken dependencies:
  akmods                                noarch                                0.5.4-1.fc23 
                        rpmfusion-free-updates-testing                                 25 k

Transaction Summary
==============================================================================================================================================================================================

Nothing to do.
Complete!



Hmmm... no packages to update. But notification lists 6 packages, including ffmpeg and VirtualBox. 
So I run:

[root at localhost ~]# rpm -qi VirtualBox
Name        : VirtualBox
Version     : 5.0.8
Release     : 1.fc23
...


2. Let's then click install in "Software Updates" notification pop-up. Guess what! Packages are 
downloading and installing.

Let's check:

[root at localhost ~]# rpm -qi VirtualBox
Name        : VirtualBox
Version     : 5.0.10
Release     : 1.fc23
...

What??? Why hasn't dnf picked on this and updated VirtualBox?

Bonus question: what makes it possible for regular user to install packages via some widget in KDE? 
How to disable this?

Regards,
Dariusz