What is the difference between CU-GDR and GDR?

Question

There are 2 paths to patching SQL server. Either the SQL CU (cumulative) upgrade or GDR (critical) upgrade.

CU includes functionality fixes and security fixes (https://support.microsoft.com/en-us/topic/kb4047329-sql-server-2017-build-versions-346e8fcd-c07c-5eeb-e10b-e3411ba8d8dd#cu)

GDR only includes security/critical fixes (https://support.microsoft.com/en-us/topic/kb4047329-sql-server-2017-build-versions-346e8fcd-c07c-5eeb-e10b-e3411ba8d8dd#gdr)

Example: Assuming I am on RTM, then it is clear that if I apply CU29 (KB5010786) then I get the cumulative updates from start upto CU29 including the functionality fixes and security fixes.

Question:

Within the GDR table, I can see CU-GDR and GDR

Assuming I have RTM, then, does installing GDR (KB5014354) only apply that 1 fix?, and applying CU29 GDR (KB5014553) apply this & all previous fixes?

The table header (1st column) on both the tables (CU and CU-GDR/GDR) says Cumulative and this is adding to my confusion because -> if both CU-GDR and GDR are cumulative, then what is the difference between CU-GDR and GDR? Example: When would I choose CU-GDR29 vs GDR (the record under the CU-GDR29 in the table)?

I glanced through the documentation in the links given at the bottom of the above link, but couldn't find an answer to my question.

Answer 1

Assuming I have RTM, then, does installing GDR (KB5014354) only apply that 1 fix?

GDRs are cumulative as well, so applying the latest GDR also applies all previous GDR included fixes. All CUs and all GDRs (since service packs are gone, no point talking about them) are cumulative.

Think of it this way, when the version changes then all previous fixes are in that version. If you're running a CU, that includes various other non-security changes as well. If you're on a GDR, the version number still increases but it's lower than any CU number. Thus, a GDR with a higher version number than another GDR is cumulative of all previous versions, of which there will only be GDR releases below that version number. Thus, all GDRs are built off the previous GDR code branch and only include GDR related items. CUs run the same way except they include all changes.

The above was not true for service packs, which they are luckily no longer around.

When would I choose CU-GDR29 vs GDR (the record under the CU-GDR29 in the table)?

You can only choose GDR if you're on RTM or on the GDR train. You can choose CU-GDR29 if you're on RTM, CU train, or GDR train. If you're already running on the CU train, then you must apply the CU GDR as you'll be unable to apply the GDR only as I explained above.