On my Ubuntu 16.04 Desktop, I regularly (usually multiple times per week) check for updates via the update manager GUI and install all updates that are shown as available.
Today, and this was definitely not the case yesterday, an update was offered for “iproute2” (“networking and traffic control tools”).
Sometimes when an update is available, as today, I go to packages.ubuntu.com to check the detailed changelog and its history (which is not accessible in the GUI).
When I checked the package entry from xenial, the changelog said that the last update was released in 2016. So I checked the entry from xenial-updates instead, and indeed, there was an item at the top describing version “4.3.0-1ubuntu3.16.04.4” which I just received today via the update manager GUI.
Yet the date for that update was given as September 18, 2018. That’s already two full months back! How can this happen? Updates may be delivered to the GUI as part of staged roll-outs, but two full months is quite a long time for a “medium” urgency update to arrive in the update manager GUI after release, isn’t it?
The date in the changelog is not the date on which the updated package was released. That's merely the date on which whoever made the change modified the changelog for their commit. By the time that commit gets merged into Ubuntu's repos, it might have spent quite a bit of time in testing (for example, in a PPA somewhere, or in Debian
sid/testing). Then it spends time in-proposed, making sure it broke nothing when in Ubuntu's repos. Then it finally moves on to-updates(or-security, as the case may be).You can check the Ubuntu packaging code and publishing history for details.
In this specific case:
The commit in question (same as the top changelog entry):
From the publishing history:
So the changes only made it into Ubuntu's repos on November 6. The day after, it was uploaded to
-proposed, and 12 days later, to-updates. Between timezones and mirror updation frequencies, it took a couple of days more to reach you. Not that long.