My mistake -- I was searching on a system which had the OBS security repo enabled, and I only saw the package from OBS and not the one from base, and drew the wrong conclusion. 'zypper search-packages' on SLES shows both packages, but that doesn't exist in Leap. Anyways, sorry for the noise.