dnf tries to update Java package despite being versionlocked

On several of my RHEL 9 machines managed by Ansible, the java-1.8.0-openjdk package is versionlocked: - name: java-1.8.0-openjdk-1:1.8.0.402.b06-2.el9 state: present However, Ansible tries to update it anyway, and this causes the Ansible Tower job to fail. Below are the corresponding commands when run via Bash shell. [myhost root ~]# dnf versionlock Updating Subscription Management repositories. rhel9flexnet 105 kB/s | 2.0 kB 00:00 rhel9checkmkagent 113 kB/s | 2.0 kB 00:00 rhel9elk8 97 kB/s | 1.7 kB 00:00 rhel9epel 127 kB/s | 2.3 kB 00:00 java-1.8.0-openjdk-1:1.8.0.402.b06-2.el9.* [myhost root ~]# dnf update Updating Subscription Management repositories. rhel9flexnet 112 kB/s | 2.0 kB 00:00 rhel9checkmkagent 122 kB/s | 2.0 kB 00:00 rhel9elk8 108 kB/s | 1.7 kB 00:00 rhel9epel 133 kB/s | 2.3 kB 00:00 Error: Problem: package java-1.8.0-openjdk-1:1.8.0.402.b06-2.el9.x86_64 from @System requires java-1.8.0-openjdk-headless(x86-64) = 1:1.8.0.402.b06-2.el9, but none of the providers can be installed - cannot install both java-1.8.0-openjdk-headless-1:1.8.0.442.b06-2.el9.x86_64 from rhel-9-for-x86_64-appstream-rpms and java-1.8.0-openjdk-headless-1:1.8.0.402.b06-2.el9.x86_64 from @System - cannot install both java-1.8.0-openjdk-headless-1:1.8.0.442.b06-2.el9.x86_64 from rhel-9-for-x86_64-appstream-rpms and java-1.8.0-openjdk-headless-1:1.8.0.402.b06-2.el9.x86_64 from rhel-9-for-x86_64-appstream-rpms - cannot install the best update candidate for package java-1.8.0-openjdk-headless-1:1.8.0.402.b06-2.el9.x86_64 - cannot install the best update candidate for package java-1.8.0-openjdk-1:1.8.0.402.b06-2.el9.x86_64 (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages or '--nobest' to use not only best candidate packages) [myhost root ~]# dnf list installed java-1.8.0-* Updating Subscription Management repositories. Installed Packages java-1.8.0-openjdk.x86_64 1:1.8.0.402.b06-2.el9 @rhel-9-for-x86_64-appstream-rpms java-1.8.0-openjdk-headless.x86_64 1:1.8.0.402.b06-2.el9 @rhel-9-for-x86_64-appstream-rpms [myhost root ~]# dnf list available java-1.8.0-* Updating Subscription Management repositories. rhel9flexnet 111 kB/s | 2.0 kB 00:00 rhel9checkmkagent 122 kB/s | 2.0 kB 00:00 rhel9elk8 99 kB/s | 1.7 kB 00:00 rhel9epel 130 kB/s | 2.3 kB 00:00 Available Packages java-1.8.0-openjdk.x86_64 1:1.8.0.442.b06-2.el9 rhel-9-for-x86_64-appstream-rpms java-1.8.0-openjdk-demo.x86_64 1:1.8.0.442.b06-2.el9 rhel-9-for-x86_64-appstream-rpms java-1.8.0-openjdk-devel.x86_64 1:1.8.0.442.b06-2.el9 rhel-9-for-x86_64-appstream-rpms java-1.8.0-openjdk-headless.x86_64 1:1.8.0.442.b06-2.el9 rhel-9-for-x86_64-appstream-rpms java-1.8.0-openjdk-javadoc.noarch 1:1.8.0.442.b06-2.el9 rhel-9-for-x86_64-appstream-rpms java-1.8.0-openjdk-javadoc-zip.noarch 1:1.8.0.442.b06-2.el9 rhel-9-for-x86_64-appstream-rpms java-1.8.0-openjdk-src.x86_64 1:1.8.0.442.b06-2.el9 rhel-9-for-x86_64-appstream-rpms On a shell I would just run dnf update --exclude=java-1.8.0-* to bypass the problem and get a successful update. However, this needs to be done via Ansible playbooks. I am interested to know how would one do that via Ansible (workaround), and especially **why dnf tries to update versionlocked packages** (main issue). ---- EDIT 1 I've modified our update playbook: - name: Update packages yum: name: "{{ packages_name }}" state: latest exclude: "{{ (packages_donotupdate | default([])) | join(',') }}" so to exclude from the update the packages listed in the variable "packages_donotupdate" (if defined), but it does not work -- it does not update any package on the server. (Note: we use the "yum" Ansible module for backward compatibility reasons.)