diff --git a/automatic_updates.module b/automatic_updates.module
index 5157e76f2e011f53663f5195aed3b47ec2d08c97..34ea03297fc0e2509cca0b8d44b664a4df258af2 100644
--- a/automatic_updates.module
+++ b/automatic_updates.module
@@ -27,7 +27,7 @@ function automatic_updates_page_top(array &$page_top) {
     ];
     // These routes don't need additional nagging.
     if (in_array(\Drupal::routeMatch()->getRouteName(), $disabled_routes, TRUE)) {
-        return;
+      return;
     }
     /** @var \Drupal\automatic_updates\Services\AutomaticUpdatesPsaInterface $psa */
     $psa = \Drupal::service('automatic_updates.psa');
diff --git a/src/Services/AutomaticUpdatesPsa.php b/src/Services/AutomaticUpdatesPsa.php
index 5ca53f29005ec583284a2e4702dbfd3b1f645cb8..b53ec61f7bb6ef2ada1ceeb71ec7eec36de9b7c4 100644
--- a/src/Services/AutomaticUpdatesPsa.php
+++ b/src/Services/AutomaticUpdatesPsa.php
@@ -211,11 +211,8 @@ class AutomaticUpdatesPsa implements AutomaticUpdatesPsaInterface {
    *   The extension version.
    */
   protected function contribMessage(array &$messages, $json, $extension_version) {
-    array_walk($json->secure_versions, function (&$version) {
-      $version = \Drupal::CORE_COMPATIBILITY . '-' . $version;
-    });
     $version_string = implode('||', $json->secure_versions);
-    $constraint = new Constraint($extension_version, \Drupal::CORE_COMPATIBILITY);
+    $constraint = new Constraint("<=$extension_version", \Drupal::CORE_COMPATIBILITY);
     if (!$constraint->isCompatible($version_string)) {
       $messages[] = $this->t('Drupal Contrib Project PSA: <a href=":url">:message</a>', [
         ':message' => $json->title,
diff --git a/tests/modules/test_automatic_updates/src/Controller/JsonTestController.php b/tests/modules/test_automatic_updates/src/Controller/JsonTestController.php
index cb72134a7939da980154ef446d1168bcf2e1dca9..ce3e5859253c64f665b549183f5a39244b6e1f98 100644
--- a/tests/modules/test_automatic_updates/src/Controller/JsonTestController.php
+++ b/tests/modules/test_automatic_updates/src/Controller/JsonTestController.php
@@ -17,6 +17,7 @@ class JsonTestController extends ControllerBase {
    *   Return JSON feed response.
    */
   public function json() {
+    $feed = [];
     $feed[] = [
       'title' => 'Critical Release - PSA-2019-02-19',
       'link' => 'https://www.drupal.org/psa-2019-02-19',
@@ -52,7 +53,7 @@ class JsonTestController extends ControllerBase {
       'project' => 'node',
       'extensions' => ['node'],
       'type' => 'module',
-      'secure_versions' => ['8.10.99'],
+      'secure_versions' => ['8.2.0'],
       'pubDate' => 'Tue, 19 Mar 2019 12:50:00 +0000',
     ];
     $feed[] = [
@@ -82,6 +83,15 @@ class JsonTestController extends ControllerBase {
       'secure_versions' => ['8.10.99'],
       'pubDate' => 'Tue, 19 Mar 2019 12:50:00 +0000',
     ];
+    $feed[] = [
+      'title' => 'Token - Moderately critical - Access bypass - SA-CONTRIB-2019',
+      'link' => 'https://www.drupal.org/sa-contrib-2019',
+      'project' => 'token',
+      'extensions' => ['token'],
+      'type' => 'module',
+      'secure_versions' => ['1.5'],
+      'pubDate' => 'Tue, 19 Mar 2019 12:50:00 +0000',
+    ];
     return new JsonResponse($feed);
   }
 
diff --git a/tests/src/Functional/AutomaticUpdatesTest.php b/tests/src/Functional/AutomaticUpdatesTest.php
index 823784db6663b975fbc6015399d9981c128d9935..5cfca1d9812b54e731594b0a109d29f9dbb52a0f 100644
--- a/tests/src/Functional/AutomaticUpdatesTest.php
+++ b/tests/src/Functional/AutomaticUpdatesTest.php
@@ -52,12 +52,12 @@ class AutomaticUpdatesTest extends BrowserTestBase {
     $this->drupalGet(Url::fromRoute('system.admin'));
     $this->assertSession()->pageTextContains('Drupal Core PSA: Critical Release - PSA-2019-02-19');
     $this->assertSession()->pageTextNotContains('Drupal Core PSA: Critical Release - PSA-Really Old');
-    $this->assertSession()->pageTextContains('Drupal Contrib Project PSA: Node - Moderately critical - Access bypass - SA-CONTRIB-2019');
+    $this->assertSession()->pageTextNotContains('Drupal Contrib Project PSA: Node - Moderately critical - Access bypass - SA-CONTRIB-2019');
     $this->assertSession()->pageTextContains('Drupal Contrib Project PSA: Seven - Moderately critical - Access bypass - SA-CONTRIB-2019');
     $this->assertSession()->pageTextContains('Drupal Contrib Project PSA: Standard - Moderately critical - Access bypass - SA-CONTRIB-2019');
 
     // Test cache.
-    $end_point = $this->buildUrl(Url::fromRoute('test_automatic_updates.json_test_denied_controller'));
+    $end_point = 'http://localhost/automatic_updates/test-json-denied';
     $this->config('automatic_updates.settings')
       ->set('psa_endpoint', $end_point)
       ->save();