Does 'apt update' also update nmap's scripts?

Question

I'm building a Linux OVA on a VM to scan stuff with nmap.
I'm using cron to keep my packages up to date:

sudo apt-get update
sudo apt-get upgrade
sudo apt-get autoremove

It's from my understanding that nmap should be kept up-to-date with this.
However, I've seen this command on different blogs: nmap –script-updatedb.

This is the documentation from Nmap's website.

--script-updatedb
This option updates the script database found in scripts/script.db which is used by Nmap to determine the available default scripts and categories. It is only necessary to update the database if you have added or removed NSE scripts from the default scripts directory or if you have changed the categories of any script. This option is generally used by itself: nmap --script-updatedb.

Do I need both?

Answer 1

The scripts in /usr/share/nmap/scripts are all part of the nmap-common package. Thus, one might think that running nmap –script-updatedb needs to be run when that package is either installed or upgraded. However, the database file itself is also part of that package:

# dpkg -S script.db 
nmap-common: /usr/share/nmap/scripts/script.db

Therefore, the script.db file is already correct by the installation/upgrade itself.

Only if you happen to have your own additional scripts in that directory, you need to run the updatedb command whenever nmap-common is updated in order to add them (again) to the otherwise fresh database. One may wonder why the updatedb command is not simply run as part of the post-installation script of nmap-common, but I suspect that it can be considered somewhat dangerous to simply add "personal" scripts without some extra confirmation ... (I checked: The only thing the posit-installation script does is to "decrypt" a mildly obfuscated Windows(!) executable nmap_service.exe)