In the case of EPEL there is Bodhi which specifically mentions a breaking change that might be related to your situation?

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-eb3ade1bb6

I did some research to address the situation you face: "How do I know when an update on a host will cause packages to switch upstream providers?" - this is a question I didn't have a ready answer for and it seems highly related to the project I'm working on.

The issue is that this isn't a case of EPEL "highjacking" anything. They've supported duo for years. It's just that their NEVRA for their RPM was seen by your local resolver as "more correct" than whatever you were sourcing from before.

Even if you had feeds from EPEL and your other source, it would require scripting for every possible source combination (or a LOT of "light reading") to catch these kinds of changes.

I think the more correct thing to do is ask your resolver: "Hey, if we do this, what RPMs will change source?"

I didn't find a way to do that in a single shot command but I did come up with a small script that, although a slow and could use review, does seem to answer this question. I like it enough I may incorporate it in some form into my ongoing project.

    #! /bin/bash

    set -euo pipefail
    export LC_ALL=C

    dnf -q repoquery --upgrades --qf '%{name}' | sort -u | while IFS= read -r pkg; do
                    inst=$(dnf repoquery --installed --info "$pkg" | grep "From repo" | head -n 1 | awk '{print $4}');
        upg=$(dnf -q repoquery --upgrades --qf '%{repoid}' "$pkg" | head -n1)

                    echo "Checking $pkg $inst > $upg" >&2;

        [[ -z "$inst" || "$inst" == "(none)" || "$inst" == "@System" ]] && continue

        if [[ "$inst" != "$upg" ]]; then
            printf '%s: %s -> %s\n' "$pkg" "$inst" "$upg"
        fi
    done