I'm pasting below the output from (successively) zypper lu (showing an incoming
patch but no packages to update), zypper up ("Nothing to do. Reboot
necessary.") and zypper patch (needing interactive conflict resolution).

I think the correct solution is #1 but what if I choose wrong? Will I end up
with an unbootable kernel?



linux-2iyu:~ # (zypper lu -t package -t patch || echo 'exit status' $? ; date )
2>&1 |tee -a ~/zypper.log
Loading repository data...
Reading installed packages...

Patches

Repository                 | Name | Category | Severity  | Interactive | Status
| Summary
---------------------------+------+----------+-----------+-------------+--------+-------------------------------------
SUSE:Leap-42.3-Update-Test | 7969 | security | important | reboot      | needed
| Security update for the Linux Kernel

Found 1 applicable patch:
1 patch needed (1 security patch)


Package updates

No updates found.
Thu 12 Apr 15:05:21 CEST 2018
linux-2iyu:~ # (zypper up -t patch -t package || echo 'exit status' $? ; date )
2>&1 |tee -a ~/zypper.log
Loading repository data...
Reading installed packages...

The following 81 package updates will NOT be installed:
  ffmpeg gstreamer-plugins-bad gstreamer-plugins-bad-32bit
gstreamer-plugins-bad-doc gstreamer-plugins-bad-lang gstreamer-plugins-ugly
gstreamer-plugins-ugly-32bit gstreamer-plugins-ugly-doc
gstreamer-plugins-ugly-lang k3b k3b-lang kernel-debug-4.4.126-48.2
kernel-debug-devel-4.4.126-48.2 kernel-default-4.4.126-48.2
kernel-default-devel-4.4.126-48.2 kernel-vanilla-4.4.126-48.2
kernel-vanilla-devel-4.4.126-48.2 libavcodec56 libavcodec56-32bit libavcodec57
libavcodec57-32bit libavdevice56 libavdevice56-32bit libavdevice57 libavfilter5
libavfilter5-32bit libavfilter6 libavformat56 libavformat56-32bit libavformat57
libavresample2 libavresample2-32bit libavresample3 libavutil54
libavutil54-32bit libavutil55 libavutil55-32bit libgstadaptivedemux-1_0-0
libgstadaptivedemux-1_0-0-32bit libgstbadaudio-1_0-0 libgstbadaudio-1_0-0-32bit
libgstbadbase-1_0-0 libgstbadbase-1_0-0-32bit libgstbadvideo-1_0-0
libgstbadvideo-1_0-0-32bit libgstbasecamerabinsrc-1_0-0
libgstbasecamerabinsrc-1_0-0-32bit libgstcodecparsers-1_0-0
libgstcodecparsers-1_0-0-32bit libgstgl-1_0-0 libgstgl-1_0-0-32bit
libgstmpegts-1_0-0 libgstmpegts-1_0-0-32bit libgstphotography-1_0-0
libgstphotography-1_0-0-32bit libgsturidownloader-1_0-0
libgsturidownloader-1_0-0-32bit libgstwayland-1_0-0 libgstwayland-1_0-0-32bit
libmad0 libmjpegutils-2_0-0 libmjpegutils-2_0-0-32bit libpostproc53
libpostproc53-32bit libpostproc54 libquicktime0 libsox3 libswresample1
libswresample1-32bit libswresample2 libswresample2-32bit libswscale3
libswscale3-32bit libswscale4 libswscale4-32bit libxine2 libxine2-codecs
libxine2-pulse libxml++-2_6-2 mjpegtools sox

The following NEW patch is going to be installed:
  7969

The following patch requires a system reboot:
  7969


    Note: System reboot required.
Nothing to do.
Thu 12 Apr 15:05:39 CEST 2018
linux-2iyu:~ # (zypper patch || echo 'exit status' $? ; date ) 2>&1 |tee -a
~/zypper.log
Loading repository data...
Reading installed packages...
Resolving package dependencies...

Problem: patch:7969-1.noarch conflicts with kernel-debug.x86_64 < 4.4.126-48.2
provided by kernel-debug-4.4.126-48.1.x86_64
 Solution 1: Following actions will be done:
  replacement of kernel-debug-4.4.126-48.1.x86_64 with
kernel-debug-4.4.126-48.2.x86_64
  deinstallation of kernel-debug-4.4.126-48.1.x86_64
  replacement of kernel-debug-devel-4.4.126-48.1.x86_64 with
kernel-debug-devel-4.4.126-48.2.x86_64
  deinstallation of kernel-debug-devel-4.4.126-48.1.x86_64
  replacement of kernel-default-4.4.126-48.1.x86_64 with
kernel-default-4.4.126-48.2.x86_64
  deinstallation of kernel-default-4.4.126-48.1.x86_64
  replacement of kernel-default-devel-4.4.126-48.1.x86_64 with
kernel-default-devel-4.4.126-48.2.x86_64
  deinstallation of kernel-default-devel-4.4.126-48.1.x86_64
  replacement of kernel-vanilla-4.4.126-48.1.x86_64 with
kernel-vanilla-4.4.126-48.2.x86_64
  deinstallation of kernel-vanilla-4.4.126-48.1.x86_64
  replacement of kernel-vanilla-devel-4.4.126-48.1.x86_64 with
kernel-vanilla-devel-4.4.126-48.2.x86_64
  deinstallation of kernel-vanilla-devel-4.4.126-48.1.x86_64
 Solution 2: do not install patch:7969-1.noarch

Choose from above solutions by number or cancel [1/2/c] (c): c
exit status 4
Thu 12 Apr 15:20:45 CEST 2018