For info, a recent OMV upgrade (April 14th ?) has created a doublon in apt source. http://security.debian.org/debian-security is both in
/etc/apt/sources.list and /etc/apt/sources.list.d/openmediavault-os-security.list.
(I know I can remove one by hand but I prefer to let it fully maintained by OMV itself)