Finally discovered what the problem was, and two solutions. The problem is that the STM32Cube MX automatic updater specifies the patch version, but the latest available one online is labeled (file-named) for the base version, which has a lower value than the patch. I believe this is a program bug that needs to be addressed.
One solution was given by Pavel, and I used that first. It was to download the two files (base and patch) separately, then rename them to fit the updater. That worked.
The second solution (which I like better) is that one person online said there's a flag set to "automatically update before building" and I found that and un-checked it.