diff --git a/SOURCES/0027-advisory-upgrade-filter-out-advPkgs-with-different-a.patch b/SOURCES/0027-advisory-upgrade-filter-out-advPkgs-with-different-a.patch
new file mode 100644
index 0000000..9376f7d
--- /dev/null
+++ b/SOURCES/0027-advisory-upgrade-filter-out-advPkgs-with-different-a.patch
@@ -0,0 +1,100 @@
+From dd4862b4ff957ad2e535ace32a2f38706da64793 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ale=C5=A1=20Mat=C4=9Bj?= <amatej@redhat.com>
+Date: Mon, 30 May 2022 08:59:41 +0200
+Subject: [PATCH] advisory upgrade: filter out advPkgs with different arch
+
+This prevents a situation in security upgrades where libsolv cannot
+upgrade dependent pkgs because we ask for an upgrade of different arch:
+
+We can get the following testcase if libdnf has filtered out
+json-c-2-2.el8.x86_64@rhel-8-for-x86_64-baseos-rpms
+(because there is an advisory for already installed json-c-1-1.el8.x86_64) but
+json-c-2-2.el8.i686@rhel-8-for-x86_64-baseos-rpms is not filtered out because
+it has different architecture. The resulting transaction doesn't work.
+
+```
+repo @System -99.-1000 testtags <inline>
+#>=Pkg: bind-libs-lite 1 1.el8 x86_64
+#>=Pkg: json-c 1 1.el8 x86_64
+
+repo rhel-8-for-x86_64-baseos-rpms -99.-1000 testtags <inline>
+#>=Pkg: json-c 2 2.el8 x86_64
+#>=Prv: libjson-c.so.4()(64bit)
+#>
+#>=Pkg: json-c 2 2.el8 i686
+#>=Prv: libjson-c.so.4()
+#>
+#>=Pkg: bind-libs-lite 2 2.el8 x86_64
+#>=Req: libjson-c.so.4()(64bit)
+system x86_64 rpm @System
+job update oneof json-c-1-1.el8.x86_64@@System json-c-2-2.el8.i686@rhel-8-for-x86_64-baseos-rpms bind-libs-lite-2-2.el8.x86_64@rhel-8-for-x86_64-baseos-rpms [forcebest,targeted,setevr,setarch]
+result transaction,problems <inline>
+#>problem f06d81a4 info package bind-libs-lite-2-2.el8.x86_64 requires libjson-c.so.4()(64bit), but none of the providers can be installed
+#>problem f06d81a4 solution 96f9031b allow bind-libs-lite-1-1.el8.x86_64@@System
+#>problem f06d81a4 solution c8daf94f allow json-c-2-2.el8.x86_64@rhel-8-for-x86_64-baseos-rpms
+#>upgrade bind-libs-lite-1-1.el8.x86_64@@System bind-libs-lite-2-2.el8.x86_64@rhel-8-for-x86_64-baseos-rpms
+#>upgrade json-c-1-1.el8.x86_64@@System json-c-2-2.el8.x86_64@rhel-8-for-x86_64-baseos-rpms```
+```
+
+= changelog =
+msg: Filter out advisory pkgs with different arch during advisory upgrade, fixes possible problems in dependency resulution.
+type: bugfix
+resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2088149
+---
+ libdnf/sack/query.cpp | 25 +++++++++++++++++++------
+ 1 file changed, 19 insertions(+), 6 deletions(-)
+
+diff --git a/libdnf/sack/query.cpp b/libdnf/sack/query.cpp
+index ac2736b5..03d39659 100644
+--- a/libdnf/sack/query.cpp
++++ b/libdnf/sack/query.cpp
+@@ -1877,12 +1877,6 @@ Query::Impl::filterAdvisory(const Filter & f, Map *m, int keyname)
+ std::vector<Solvable *> candidates;
+ std::vector<Solvable *> installed_solvables;
+
+- Id id = -1;
+- while ((id = resultPset->next(id)) != -1) {
+- candidates.push_back(pool_id2solvable(pool, id));
+- }
+- NameArchEVRComparator cmp_key(pool);
+-
+ if (cmp_type & HY_UPGRADE) {
+ Query installed(sack, ExcludeFlags::IGNORE_EXCLUDES);
+ installed.installed();
+@@ -1893,6 +1887,18 @@ Query::Impl::filterAdvisory(const Filter & f, Map *m, int keyname)
+ installed_solvables.push_back(pool_id2solvable(pool, installed_id));
+ }
+ std::sort(installed_solvables.begin(), installed_solvables.end(), NameArchSolvableComparator);
++ Id id = -1;
++ while ((id = resultPset->next(id)) != -1) {
++ Solvable * s = pool_id2solvable(pool, id);
++ // When doing HY_UPGRADE consider only candidate pkgs that have matching Name and Arch
++ // with some already installed pkg (in other words: some other version of the pkg is already installed).
++ // Otherwise a pkg with different Arch than installed can end up in upgrade set which is wrong.
++ // It can result in dependency issues, reported as: RhBug:2088149.
++ auto low = std::lower_bound(installed_solvables.begin(), installed_solvables.end(), s, NameArchSolvableComparator);
++ if (low != installed_solvables.end() && s->name == (*low)->name && s->arch == (*low)->arch) {
++ candidates.push_back(s);
++ }
++ }
+
+ // Apply security filters only to packages with lower priority - to unify behaviour upgrade
+ // and upgrade-minimal
+@@ -1915,7 +1921,14 @@ Query::Impl::filterAdvisory(const Filter & f, Map *m, int keyname)
+ }
+ }
+ std::swap(candidates, priority_candidates);
++ } else {
++ Id id = -1;
++ while ((id = resultPset->next(id)) != -1) {
++ candidates.push_back(pool_id2solvable(pool, id));
++ }
+ }
++
++ NameArchEVRComparator cmp_key(pool);
+ std::sort(candidates.begin(), candidates.end(), cmp_key);
+ for (auto & advisoryPkg : pkgs) {
+ if (cmp_type & HY_UPGRADE) {
+--
+2.36.1
+
diff --git a/SPECS/libdnf.spec b/SPECS/libdnf.spec
index 40652e9..05d9201 100644
--- a/SPECS/libdnf.spec
+++ b/SPECS/libdnf.spec
@@ -56,7 +56,7 @@
Name: libdnf
Version: %{libdnf_major_version}.%{libdnf_minor_version}.%{libdnf_micro_version}
-Release: 8%{?dist}
+Release: 8.1%{?dist}
Summary: Library providing simplified C and Python API to libsolv
License: LGPLv2+
URL: https://github.com/rpm-software-management/libdnf
@@ -87,6 +87,7 @@ Patch23: 0023-Turn-off-strict-validation-of-modulemd-documents-RhBug20048
Patch24: 0024-Add-unittest-for-setting-up-repo-with-empty-keyfile-RhBug1994614.patch
Patch25: 0025-Add-getLatestModules.patch
Patch26: 0026-Update-translations-RhBug-2017272.patch
+Patch27: 0027-advisory-upgrade-filter-out-advPkgs-with-different-a.patch
BuildRequires: cmake
BuildRequires: gcc
@@ -331,6 +332,9 @@ popd
%endif
%changelog
+* Wed Jun 15 2022 Lukas Hrazky <lhrazky@redhat.com> - 0.63.0-8.1
+- advisory upgrade: filter out advPkgs with different arch
+
* Fri Mar 18 2022 Marek Blaha <mblaha@redhat.com> - 0.63.0-8
- Update translations