Hi,
Both of the metadata urls contain the same json data. For ease of refereence :
This is the original url that was in the vcsa config.conf file released with v6.7.0. As docuemented in the thread that theBobkin refers to this url contained a broken reference for v6.7.0 U1. Vmware did two things to fix this. First they provided a new json file at a new url, which is URL#2 below. Secondly they removed the broken references in the json file at URL #1.
This is the URL that replaces URL#1 and is referred to in the kb's previously referred to (58891 and 60393).
Now both URLs contain the same json file. That is nice - thus folks that didn't get the memo that the original url was filled with bad data and that there is a new url no longer have to update their config.conf file with the new url.
However that json file was put up on the web over 90 days ago. Thus the alert that is happing now. It is true that new patches have been released in the last three months but the release catalog db is not used for VUM patch downloads. Those are handled via a separate method - my system checks for patches every night and gets them. Thus even though my release catalog db file is now over three months old I have received automatically the patch ESXi670-201901001 with build ID 11675023 released in Jan 2019.
So, bottom line is both url contain the same catalog data, it is over 90 days since it was last updated, and it is [probably] okay if you are getting patches downloaded automatically on a daily basis.
Cheers,
Ron