Differences between PSU / BP and RU / RUR

Since Oracle Database we change our patching model as well, switching from Patch Set Updates (PSU) and Proactive Bundle Patches (BP) to Release Updates (RU) and Release Update Revisions (RUR). But what are actually the differences between PSU / BP and RU / RUR patch bundles? Is there any or is it just a renaming of well known patch bundles?

No change on MS Windows

First of all, let me say that there won’t be any changes on the Windows platform. If your preferred operating system is MS Windows then stop reading here. On Windows you’ll see exactly the same patching format with Bundle Patches as you saw before.

How about the other platforms?

Everybody else will see changes with Oracle Database – and I blogged about it a while ago:

As I presented now about the first release model already at a User Group Conference I have had some discussions already about RU and RUR – and I believe there’s a bit more clarification needed.

Differences between PSU/BP and RU/RUR

In July 2017 the first Oracle Database RU became available, since October the second RU and the first RUR are available.

But there’s a significant difference between PSUs and RURs. Even though we say “RURs replace PSUs” RURs are not the same as PSUs.

When you look at the PSU and BP trains before you usually choose at the entry to a release which path you’d like to follow, either PSUs every quarter, or BPs. Engineered system customers had no choice: it was Bundle Patches. In Oracle 11.2. the BPs were meant only for Engineered-systems environments. In Oracle 12.1 we switched and recommended BPs over PSUs for all systems.

Patch Set Updates And Bundle Patches

A Patch Set Update (PSU) contains usually security fixes and regression fixes, i.e. bug fixes.

Differences between PSU / BP and RU / RUR

Typical Patch Set Update (PSU) – quarterly

Whereas a Proactive Bundle Patch (BP) was a superset of a PSU containing the PSU but optimizer fixes and functional fixes which may be sometimes feature extensions as well.

Differences between PSU / BP and RU / RUR

Typical Bundle Patch (BP) – quarterly released

And you choose either one train usually. But you could also change from PSUs to BPs or vice versa. Your flow would actually look like this:

Differences between PSU / BP and RU / RUR

Quarterly Patching with either PSUs or BPs – every quarter gets new fixes, PSUs and BPs, each are cumulative to themselves

As PSUs and BPs, each are cumulative you’ll get the fixes from all previous PSUs or BPs for the same release included as well. The PSU a quarter later has new security fixes and new regression fixes added, the Bundle Patch in addition gets new optimizer and functional fixes and of course the same new security and regression fixes the PSU has gotten.

Please see MOS Note: 1962125.1 – Overview of Database Patch Delivery Methods for further details. Optimizer fixes are off since we introduced the FCP (Fix Control Persistence framework) with DBMS_OPTIM_BUNDLE.

Release Updates

Release Updates (RU) look pretty similar to Bundle Patches (BP):

Differences between PSU / BP and RU / RUR

The first Release Update (RU-1)

The following second Release Update contains everything from Release Update 1 plus new fixes in all four areas (marked in dark red/purple below). RUs are cumulative as well as the BPs were.

Differences between PSU / BP and RU / RUR

The second Release Update (RU-2)

RUs get released quarterly at the usual dates.

Release Update Revisions

A Release Update Revision (RUR) is different from an PSU. At the time of the release of RU1 there won’t be an RUR yet. The first RUR will be released containing the entire first RU – plus additional fixes on top. Regression fixes are fixes for misbehavior. They usually hit a lot of customers.

Differences between PSU / BP and RU / RUR

First Release Update Revision (RUR-1)

Actually the first RUR will be released usually a quarter after the first Release Update (RU). It will include all fixes from  Release Update 1 (RU-1) – and add only new security and regression fixes on top. But no new optimizer or functional fixes. When you compare it with the picture above (“The second Release Update”) you’ll spot the same security and regression fixes.

At this date you will have the choice now:

  • Use the Release Update Revision (RUR-1)


  • Install the new Release Update (will be RU-2 by then). It contains the same security and regression fixes as the RUR-1 but also new optimizer and potentially functional fixes in addition (see the picture of “Second Release Update (RU-2)”.

3 months later the next RUR will be released – and it will contain now again only the new security and regression fixes (marked in turquoise) on top. There won’t be any new optimizer or functional fixes added at this point. When you compare both pictures, the one above and the one below (RUR-1 and RUR-2) you’ll see the exact same optimizer and functional fixes from the initial RU-1.

Differences between PSU / BP and RU / RUR

Second Release Update Revision (RUR-2)

And at the same time the third Release Update (RU-3) will become available as well.

It’s important to mention that there is no third Release Update Revision (RUR-3) planned. The model allows only 2 RURs per RU. Afterwards you have the option to either get the most recent RU – or an RUR based on an older RU.

Overview – The Big Picture

The full picture summarizes the schema:

Differences between PSU / BP and RU / RUR

Overview on Release Updates (RU) and Release Update Revisions (RUR) over time

Now you see why there is a significant change. There’s no such thing as PSUs anymore. And you are not nailed on a track. You have the choice to either progressively step forward by applying Release Updates – or pause with new optimizer and functional fixes for up to 6 months patch period.


Share this:

13 thoughts on “Differences between PSU / BP and RU / RUR

  1. Many thanks you for clarify. It’s not so easy to understand.
    May I ask anything else: what are “Mitigate” patches? I’ve read in conclusion with OJVM patches
    Best regards

  2. Mike,

    I’m trying to understand what is the best way to receive the optimizer fixes with the latest RU/RURs. Even after I apply the latest RU or RUR, the optimizer fixes are disabled by default. How do I know what fixes were included and how do I decide which ones to turn on or leave off. I think there needs to be some clarity around this.

    From a customer point of view, if I’m applying a latest RU, I’m hoping to get all the fixes (including optimizer fixes) with the patch. In my experience, most of the issues around the upgrades, are around the optimizer !


    • Naveen,

      I know that this is a strange topic. But in fact I tried to clarify this more here:

      Please check the RU’s readme. If it DOES NOT contain this paragraph:

      “This patch introduces fix control for one or more fixes contained herein. These fixes are disabled by default and will have to be explicitly enabled via alter session/system commands to persist in pfile/spfile as appropriate”

      then no BEHAVIOR CHANGING OPTIMIZER fixes are included and thus nothing to switch on. As soon as this paragraph is present in the RU’s readme there will be guidance which _fix_control setting needs to be used in order to enable the fixes.

      In the July and October RU for there are no such fixes as far as I can see.


  3. Hi Mike,

    some of the images are missing in this article, could you pls re-publish the page with the images loaded properly

    • Ammar,

      are you sure? I tried different browsers and for me all the pictures get displayed correctly.
      Can you please check again and maybe hold the SHIFT key when you push RELOAD in your browser (than it should fetch images again).


  4. Hi Mike

    as everytime thank you
    Maybe I’m confused but the last your pitcure (in the box B-2 🙂 ) seems you are writing that is possible to apply RUR-1 on RU-2 , but before you write “Install the new Release Update (will be RU-2 by then).It contains the same security and regression fixes as the RUR-1 ..” And I undestand that RU-2 include RUR-1 …

    Thank you

    • Hi LUca,

      I know this is a bit confusing – and another reason why I disrecommend to touch RURs unless you get a clear advice from Support or the MAA/Exadata team.

      Let me explain this with months – I think then it is less confusing.

      – in January we release 18.1.0 – no RU or RUR available
      – in April we release 18.2.0 – and for the initial release (18.1.0) there won’t be any RUs or RURs
      – in July we release 18.3.0 (RU and on-prem base release) and 18.2.1 (RUR-1 on top of 18.2.0)
      Both, 18.3.0 and 18.2.1 have the same security and regression fixes. But 18.3.0 has more additional fixes and behavior changing optimizer fixes turned off by default.
      – in October we release 18.4.0 (RU), 18.2.2 (final RUR for 18.2.0) and 18.3.1 (first RUR for 18.3.0)
      All contain the same security and regression fixes. But they settle on different RUs meaning the amount of fixes is very different

      In theory you could switch technically between all 3 of them. But let’s say you give 18.4.0 a try and decide later to roll back to an older patch, you could go backwards to 18.3.1 and 18.2.2 having the same security and regression fixes but missing a lot of additional fixes your release had already consumed. This is technically possible but not recommended.

      When I write RU-2 contains the RUR-1 that means that RU-2 has the same fixes as RUR-1 delivers – but more.
      This is credited to the fact that RU-2 contains:
      – RU-1 (<== e.g. July) - The security and regression fixes from October - Extra fixes such as optimizer behavior changing fixes off by default And when you compare this to RUR-1 which gets released at the same time, it contains: - RU-1 (<== e.g. July) - The security and regression fixes from October That's why I wrote: RU-2 includes RUR-1. Hope this helps - cheers, Mike -

  5. Hi Mike,
    Thanks for your article.
    I would like to know the differences between regression and functional fixes.
    I could guess but I’d rather be sure.
    My client traditionally applies a patch policy consisting of applying interim patches because he fears bugs caused by Patches (PSUs and BPs before, RUs and RURs now). He would be comfortable applying patches with only security bugs … I think the most similar approach would be applying RU and all the RURs of this RU until the next RU.

    Thank you,

    • Jorge,

      I was trying to find the relevant MOS note explaining the differences between regression and functional fixes but was unable to find it.
      You client must change the policy. First of all, there are no bundles containing security fixes only. And second, there are no PSUs anymore.

      Release Updates are the same as Bundle Patches. And stay away from Revisions unless Oracle Support ask you specifically to apply a Revision – see here, why you (or your client should stay away from it):


      • Hi Mike,
        Thanks for your answer.
        In fact, we’re going to propose to our client to apply only RU’s, every six months.
        But, it would be useful if I knew clearly the difference between functional and regression fixes.
        I think regression fixes fix functionality which used to work in a previous RU or RUR but is broken in a later release RU or RUR
        Functional fixes fix code is not working as expected. This code is mostly introduced in the previous release


Leave a Reply

Your email address will not be published. Required fields are marked *

* Checkbox to comply with GDPR is required


I agree

This site uses Akismet to reduce spam. Learn how your comment data is processed.