I use the RSS feed for the security advisories. When package updates were listed in the feed but, urpmi did not listed any new packages to install, I took a deeper look. The cause seemed to be out of date mirrors.

The mirror status page (https://mirrors.mageia.org/status) lists quite a bunch of red entries. I use one hard coded package source plus a mirrorlist based entry. Via the mirror list I got mirror2.tuxinator.org which is outdated, so was my hard-coded entry. Especially, the scenario were the mirror list approach returns an out of date mirror, is pretty unlucky.

At time of writing out of the 48 listed mirrors 21 are red, 7 brown and 20 green. In other words more than half are not up to date.

Might be worth a look :-).