automatic_updates_extensions/src/BatchProcessor.php

+<?php
+
+declare(strict_types = 1);
+
+namespace Drupal\automatic_updates_extensions;
+
+use Drupal\Core\Url;
+use Symfony\Component\HttpFoundation\RedirectResponse;
+
+/**
+ * A batch processor for updates.
+ *
+ * @internal
+ *   This class is an internal part of the module's update handling and
+ *   should not be used by external code.
+ */
+final class BatchProcessor {
+
+  /**
+   * The session key under which the stage ID is stored.
+   *
+   * @var string
+   */
+  public const STAGE_ID_SESSION_KEY = '_automatic_updates_extensions_stage_id';
+
+  /**
+   * Gets the update stage service.
+   *
+   * @return \Drupal\automatic_updates_extensions\ExtensionUpdateStage
+   *   The update stage service.
+   */
+  private static function getStage(): ExtensionUpdateStage {
+    return \Drupal::service(ExtensionUpdateStage::class);
+  }
+
+  /**
+   * Records messages from a throwable, then re-throws it.
+   *
+   * @param \Throwable $error
+   *   The caught exception.
+   * @param array $context
+   *   The current context of the batch job.
+   *
+   * @throws \Throwable
+   *   The caught exception, which will always be re-thrown once its messages
+   *   have been recorded.
+   */
+  private static function handleException(\Throwable $error, array &$context): void {
+    $context['results']['errors'][] = $error->getMessage();
+    throw $error;
+  }
+
+  /**
+   * Calls the update stage's begin() method.
+   *
+   * @param string[] $project_versions
+   *   The project versions to be staged in the update, keyed by package name.
+   * @param array $context
+   *   The current context of the batch job.
+   *
+   * @see \Drupal\automatic_updates_extensions\ExtensionUpdateStage::begin()
+   */
+  public static function begin(array $project_versions, array &$context): void {
+    try {
+      $stage_id = static::getStage()->begin($project_versions);
+      \Drupal::service('session')->set(static::STAGE_ID_SESSION_KEY, $stage_id);
+    }
+    catch (\Throwable $e) {
+      static::handleException($e, $context);
+    }
+  }
+
+  /**
+   * Calls the update stage's stage() method.
+   *
+   * @param array $context
+   *   The current context of the batch job.
+   *
+   * @see \Drupal\automatic_updates\UpdateStage::stage()
+   */
+  public static function stage(array &$context): void {
+    $stage_id = \Drupal::service('session')->get(static::STAGE_ID_SESSION_KEY);
+    try {
+      static::getStage()->claim($stage_id)->stage();
+    }
+    catch (\Throwable $e) {
+      // If the stage was not already destroyed because of this exception
+      // destroy it.
+      if (!static::getStage()->isAvailable()) {
+        static::clean($stage_id, $context);
+      }
+      static::handleException($e, $context);
+    }
+  }
+
+  /**
+   * Calls the update stage's apply() method.
+   *
+   * @param string $stage_id
+   *   The stage ID.
+   * @param array $context
+   *   The current context of the batch job.
+   *
+   * @see \Drupal\automatic_updates_extensions\ExtensionUpdateStage::apply()
+   */
+  public static function commit(string $stage_id, array &$context): void {
+    try {
+      static::getStage()->claim($stage_id)->apply();
+      // The batch system does not allow any single request to run for longer
+      // than a second, so this will force the next operation to be done in a
+      // new request. This helps keep the running code in as consistent a state
+      // as possible.
+      // @see \Drupal\package_manager\Stage::apply()
+      // @see \Drupal\package_manager\Stage::postApply()
+      // @todo See if there's a better way to ensure the post-apply tasks run
+      //   in a new request in https://www.drupal.org/i/3293150.
+      sleep(1);
+    }
+    catch (\Throwable $e) {
+      static::handleException($e, $context);
+    }
+  }
+
+  /**
+   * Calls the update stage's postApply() method.
+   *
+   * @param string $stage_id
+   *   The stage ID.
+   * @param array $context
+   *   The current context of the batch job.
+   *
+   * @see \Drupal\automatic_updates\UpdateStage::postApply()
+   */
+  public static function postApply(string $stage_id, array &$context): void {
+    try {
+      static::getStage()->claim($stage_id)->postApply();
+    }
+    catch (\Throwable $e) {
+      static::handleException($e, $context);
+    }
+  }
+
+  /**
+   * Calls the update stage's destroy() method.
+   *
+   * @param string $stage_id
+   *   The stage ID.
+   * @param array $context
+   *   The current context of the batch job.
+   *
+   * @see \Drupal\automatic_updates_extensions\ExtensionUpdateStage::destroy()
+   */
+  public static function clean(string $stage_id, array &$context): void {
+    try {
+      static::getStage()->claim($stage_id)->destroy();
+    }
+    catch (\Throwable $e) {
+      static::handleException($e, $context);
+    }
+  }
+
+  /**
+   * Finishes the stage batch job.
+   *
+   * @param bool $success
+   *   Indicate that the batch API tasks were all completed successfully.
+   * @param array $results
+   *   An array of all the results.
+   * @param array $operations
+   *   A list of the operations that had not been completed by the batch API.
+   */
+  public static function finishStage(bool $success, array $results, array $operations): ?RedirectResponse {
+    if ($success) {
+      $stage_id = \Drupal::service('session')->get(static::STAGE_ID_SESSION_KEY);
+      $url = Url::fromRoute('automatic_updates_extension.confirmation_page', [
+        'stage_id' => $stage_id,
+      ]);
+      return new RedirectResponse($url->setAbsolute()->toString());
+    }
+    static::handleBatchError($results);
+    return NULL;
+  }
+
+  /**
+   * Finishes the commit batch job.
+   *
+   * @param bool $success
+   *   Indicate that the batch API tasks were all completed successfully.
+   * @param array $results
+   *   An array of all the results.
+   * @param array $operations
+   *   A list of the operations that had not been completed by the batch API.
+   */
+  public static function finishCommit(bool $success, array $results, array $operations): ?RedirectResponse {
+    \Drupal::service('session')->remove(static::STAGE_ID_SESSION_KEY);
+
+    if ($success) {
+      $url = Url::fromRoute('automatic_updates.finish')
+        ->setAbsolute()
+        ->toString();
+      return new RedirectResponse($url);
+    }
+    static::handleBatchError($results);
+    return NULL;
+  }
+
+  /**
+   * Handles a batch job that finished with errors.
+   *
+   * @param array $results
+   *   The batch results.
+   */
+  private static function handleBatchError(array $results): void {
+    if (isset($results['errors'])) {
+      foreach ($results['errors'] as $error) {
+        \Drupal::messenger()->addError($error);
+      }
+    }
+    else {
+      \Drupal::messenger()->addError("Update error");
+    }
+  }
+
+}

automatic_updates_extensions/src/ExtensionUpdateStage.php

+<?php
+
+declare(strict_types = 1);
+
+namespace Drupal\automatic_updates_extensions;
+
+use Drupal\Component\Datetime\TimeInterface;
+use Drupal\Core\Queue\QueueFactory;
+use Drupal\Core\StringTranslation\TranslatableMarkup;
+use Drupal\Core\TempStore\SharedTempStoreFactory;
+use Drupal\package_manager\ComposerInspector;
+use Drupal\package_manager\FailureMarker;
+use Drupal\package_manager\LegacyVersionUtility;
+use Drupal\package_manager\PathLocator;
+use Drupal\package_manager\StageBase;
+use PhpTuf\ComposerStager\API\Core\BeginnerInterface;
+use PhpTuf\ComposerStager\API\Core\CommitterInterface;
+use PhpTuf\ComposerStager\API\Core\StagerInterface;
+use PhpTuf\ComposerStager\API\Path\Factory\PathFactoryInterface;
+use Symfony\Contracts\EventDispatcher\EventDispatcherInterface;
+
+/**
+ * Defines a service to perform updates for modules and themes.
+ *
+ * @internal
+ *   This class is an internal part of the module's update handling and
+ *   should not be used by external code.
+ */
+final class ExtensionUpdateStage extends StageBase {
+
+  /**
+   * {@inheritdoc}
+   */
+  protected string $type = 'automatic_updates_extensions:attended';
+
+  /**
+   * Constructs a new ExtensionUpdateStage object.
+   *
+   * @param \Drupal\package_manager\ComposerInspector $composerInspector
+   *   The Composer inspector service.
+   * @param \Drupal\package_manager\PathLocator $pathLocator
+   *   The path locator service.
+   * @param \PhpTuf\ComposerStager\API\Core\BeginnerInterface $beginner
+   *   The beginner service.
+   * @param \PhpTuf\ComposerStager\API\Core\StagerInterface $stager
+   *   The stager service.
+   * @param \PhpTuf\ComposerStager\API\Core\CommitterInterface $committer
+   *   The committer service.
+   * @param \Drupal\Core\Queue\QueueFactory $queueFactory
+   *   The queue factory.
+   * @param \Symfony\Contracts\EventDispatcher\EventDispatcherInterface $eventDispatcher
+   *   The event dispatcher service.
+   * @param \Drupal\Core\TempStore\SharedTempStoreFactory $tempStoreFactory
+   *   The shared tempstore factory.
+   * @param \Drupal\Component\Datetime\TimeInterface $time
+   *   The time service.
+   * @param \PhpTuf\ComposerStager\API\Path\Factory\PathFactoryInterface $pathFactory
+   *   The path factory service.
+   * @param \Drupal\package_manager\FailureMarker $failureMarker
+   *   The failure marker service.
+   */
+  public function __construct(
+    protected readonly ComposerInspector $composerInspector,
+    PathLocator $pathLocator,
+    BeginnerInterface $beginner,
+    StagerInterface $stager,
+    CommitterInterface $committer,
+    QueueFactory $queueFactory,
+    EventDispatcherInterface $eventDispatcher,
+    SharedTempStoreFactory $tempStoreFactory,
+    TimeInterface $time,
+    PathFactoryInterface $pathFactory,
+    FailureMarker $failureMarker,
+  ) {
+    parent::__construct($pathLocator, $beginner, $stager, $committer, $queueFactory, $eventDispatcher, $tempStoreFactory, $time, $pathFactory, $failureMarker);
+  }
+
+  /**
+   * Begins the update.
+   *
+   * @param string[] $project_versions
+   *   The versions of the packages to update to, keyed by package name.
+   *
+   * @return string
+   *   The unique ID of the stage.
+   *
+   * @throws \InvalidArgumentException
+   *   Thrown if no project version is provided.
+   */
+  public function begin(array $project_versions): string {
+    if (empty($project_versions)) {
+      throw new \InvalidArgumentException("No projects to begin the update");
+    }
+    $package_versions = [
+      'production' => [],
+      'dev' => [],
+    ];
+
+    $project_root = $this->pathLocator->getProjectRoot();
+    $info = $this->composerInspector->getRootPackageInfo($project_root);
+    $installed_packages = $this->composerInspector->getInstalledPackagesList($project_root);
+    foreach ($project_versions as $project_name => $version) {
+      $package = $installed_packages->getPackageByDrupalProjectName($project_name);
+      if (empty($package)) {
+        throw new \InvalidArgumentException("The project $project_name is not a Drupal project known to Composer and cannot be updated.");
+      }
+
+      // We don't support updating install profiles.
+      if ($package->type === 'drupal-profile') {
+        throw new \InvalidArgumentException("The project $project_name cannot be updated because updating install profiles is not supported.");
+      }
+
+      $group = isset($info['devRequires'][$package->name]) ? 'dev' : 'production';
+      $package_versions[$group][$package->name] = LegacyVersionUtility::convertToSemanticVersion($version);
+    }
+
+    // Ensure that package versions are available to pre-create event
+    // subscribers. We can't use ::setMetadata() here because it requires the
+    // stage to be claimed, but that only happens during ::create().
+    $this->tempStore->set(static::TEMPSTORE_METADATA_KEY, [
+      'packages' => $package_versions,
+    ]);
+    return $this->create();
+  }
+
+  /**
+   * Returns the package versions that will be required during the update.
+   *
+   * @return string[][]
+   *   An array with two sub-arrays: 'production' and 'dev'. Each is a set of
+   *   package versions, where the keys are package names and the values are
+   *   version constraints understood by Composer.
+   */
+  public function getPackageVersions(): array {
+    return $this->getMetadata('packages');
+  }
+
+  /**
+   * Stages the update.
+   */
+  public function stage(): void {
+    $this->checkOwnership();
+
+    // Convert an associative array of package versions, keyed by name, to
+    // command-line arguments in the form `vendor/name:version`.
+    $map = function (array $versions): array {
+      $requirements = [];
+      foreach ($versions as $package => $version) {
+        $requirements[] = "$package:$version";
+      }
+      return $requirements;
+    };
+    $versions = array_map($map, $this->getPackageVersions());
+    $this->require($versions['production'], $versions['dev']);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function getFailureMarkerMessage(): TranslatableMarkup {
+    return $this->t('Automatic updates failed to apply, and the site is in an indeterminate state. Consider restoring the code and database from a backup.');
+  }
+
+}

automatic_updates_extensions/src/Form/UpdateReady.php

+<?php
+
+declare(strict_types = 1);
+
+namespace Drupal\automatic_updates_extensions\Form;
+
+use Drupal\automatic_updates\Form\UpdateFormBase;
+use Drupal\package_manager\ComposerInspector;
+use Drupal\package_manager\Exception\StageFailureMarkerException;
+use Drupal\package_manager\InstalledPackage;
+use Drupal\package_manager\PathLocator;
+use Drupal\package_manager\ProjectInfo;
+use Drupal\package_manager\ValidationResult;
+use Drupal\automatic_updates_extensions\BatchProcessor;
+use Drupal\automatic_updates\BatchProcessor as AutoUpdatesBatchProcessor;
+use Drupal\automatic_updates_extensions\ExtensionUpdateStage;
+use Drupal\Core\Batch\BatchBuilder;
+use Drupal\Core\Extension\ModuleExtensionList;
+use Drupal\Core\Form\FormStateInterface;
+use Drupal\Core\Render\RendererInterface;
+use Drupal\Core\Messenger\MessengerInterface;
+use Drupal\Core\State\StateInterface;
+use Drupal\Core\StringTranslation\TranslatableMarkup;
+use Drupal\package_manager\Exception\StageException;
+use Drupal\package_manager\Exception\StageOwnershipException;
+use Drupal\system\SystemManager;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+use Symfony\Component\EventDispatcher\EventDispatcherInterface;
+
+/**
+ * Defines a form to commit staged updates.
+ *
+ * @internal
+ *   Form classes are internal and should not be used by external code.
+ */
+final class UpdateReady extends UpdateFormBase {
+
+  /**
+   * Constructs a new UpdateReady object.
+   *
+   * @param \Drupal\automatic_updates_extensions\ExtensionUpdateStage $stage
+   *   The update stage service.
+   * @param \Drupal\Core\Messenger\MessengerInterface $messenger
+   *   The messenger service.
+   * @param \Drupal\Core\State\StateInterface $state
+   *   The state service.
+   * @param \Drupal\Core\Extension\ModuleExtensionList $moduleList
+   *   The module list service.
+   * @param \Drupal\Core\Render\RendererInterface $renderer
+   *   The renderer service.
+   * @param \Symfony\Component\EventDispatcher\EventDispatcherInterface $eventDispatcher
+   *   Event dispatcher service.
+   * @param \Drupal\package_manager\ComposerInspector $composerInspector
+   *   The Composer inspector service.
+   * @param \Drupal\package_manager\PathLocator $pathLocator
+   *   The path locator service.
+   */
+  public function __construct(
+    private readonly ExtensionUpdateStage $stage,
+    MessengerInterface $messenger,
+    private readonly StateInterface $state,
+    private readonly ModuleExtensionList $moduleList,
+    private readonly RendererInterface $renderer,
+    private readonly EventDispatcherInterface $eventDispatcher,
+    private readonly ComposerInspector $composerInspector,
+    private readonly PathLocator $pathLocator,
+  ) {
+    $this->setMessenger($messenger);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getFormId() {
+    return 'automatic_updates_update_ready_form';
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function create(ContainerInterface $container) {
+    return new static(
+      $container->get(ExtensionUpdateStage::class),
+      $container->get('messenger'),
+      $container->get('state'),
+      $container->get('extension.list.module'),
+      $container->get('renderer'),
+      $container->get('event_dispatcher'),
+      $container->get(ComposerInspector::class),
+      $container->get(PathLocator::class),
+    );
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function buildForm(array $form, FormStateInterface $form_state, string $stage_id = NULL) {
+    try {
+      $this->stage->claim($stage_id);
+    }
+    catch (StageOwnershipException) {
+      $this->messenger()->addError($this->t('Cannot continue the update because another Composer operation is currently in progress.'));
+      return $form;
+    }
+    catch (StageFailureMarkerException $e) {
+      $this->messenger()->addError($e->getMessage());
+      return $form;
+    }
+
+    $messages = [];
+
+    // Don't set any messages if the form has been submitted, because we don't
+    // want them to be set during form submit.
+    if (!$form_state->getUserInput()) {
+      foreach ($messages as $type => $messages_of_type) {
+        foreach ($messages_of_type as $message) {
+          $this->messenger()->addMessage($message, $type);
+        }
+      }
+    }
+
+    $form['actions'] = [
+      'cancel' => [
+        '#type' => 'submit',
+        '#value' => $this->t('Cancel update'),
+        '#submit' => ['::cancel'],
+      ],
+      '#type' => 'actions',
+    ];
+    $form['stage_id'] = [
+      '#type' => 'value',
+      '#value' => $stage_id,
+    ];
+    $form['package_updates'] = $this->showUpdates();
+    $form['backup'] = [
+      '#prefix' => '<strong>',
+      '#type' => 'checkbox',
+      '#title' => $this->t('Warning: Updating contributed modules or themes may leave your site inoperable or looking wrong.'),
+      '#description' => $this->t('Back up your database and site before you continue. <a href=":backup_url">Learn how</a>. Each contributed module or theme may follow different standards for backwards compatibility, may or may not have tests, and may add or remove features in any release. For these reasons, it is highly recommended that you test this update in a development environment first.', [':backup_url' => 'https://www.drupal.org/node/22281']),
+      '#required' => TRUE,
+      '#default_value' => FALSE,
+      '#suffix' => '</strong>',
+    ];
+    $form['maintenance_mode'] = [
+      '#title' => $this->t('Perform updates with site in maintenance mode (strongly recommended)'),
+      '#type' => 'checkbox',
+      '#default_value' => TRUE,
+    ];
+
+    // Don't run the status checks once the form has been submitted.
+    if (!$form_state->getUserInput()) {
+      $results = $this->runStatusCheck($this->stage, $this->eventDispatcher);
+      // This will have no effect if $results is empty.
+      $this->displayResults($results, $this->renderer);
+      // If any errors occurred, return the form early so the user cannot
+      // continue.
+      if (ValidationResult::getOverallSeverity($results) === SystemManager::REQUIREMENT_ERROR) {
+        return $form;
+      }
+    }
+    $form['actions']['submit'] = [
+      '#type' => 'submit',
+      '#value' => $this->t('Continue'),
+    ];
+
+    return $form;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function submitForm(array &$form, FormStateInterface $form_state) {
+    // Store maintenance_mode setting so we can restore it when done.
+    $this->getRequest()
+      ->getSession()
+      ->set(AutoUpdatesBatchProcessor::MAINTENANCE_MODE_SESSION_KEY, $this->state->get('system.maintenance_mode'));
+
+    if ($form_state->getValue('maintenance_mode')) {
+      $this->state->set('system.maintenance_mode', TRUE);
+    }
+    $stage_id = $form_state->getValue('stage_id');
+    $batch = (new BatchBuilder())
+      ->setTitle($this->t('Apply updates'))
+      ->setInitMessage($this->t('Preparing to apply updates'))
+      ->addOperation([BatchProcessor::class, 'commit'], [$stage_id])
+      ->addOperation([BatchProcessor::class, 'postApply'], [$stage_id])
+      ->addOperation([BatchProcessor::class, 'clean'], [$stage_id])
+      ->setFinishCallback([BatchProcessor::class, 'finishCommit'])
+      ->toArray();
+
+    batch_set($batch);
+  }
+
+  /**
+   * Cancels the in-progress update.
+   */
+  public function cancel(array &$form, FormStateInterface $form_state): void {
+    try {
+      $this->stage->destroy();
+      $this->messenger()->addStatus($this->t('The update was successfully cancelled.'));
+      $form_state->setRedirect('automatic_updates_extensions.report_update');
+    }
+    catch (StageException $e) {
+      $this->messenger()->addError($e->getMessage());
+    }
+  }
+
+  /**
+   * Displays all projects that will be updated.
+   *
+   * @return mixed[][]
+   *   A render array displaying packages that will be updated.
+   */
+  private function showUpdates(): array {
+    // Get packages that were updated in the stage directory.
+    $installed_packages = $this->composerInspector->getInstalledPackagesList($this->pathLocator->getProjectRoot());
+    $staged_packages = $this->composerInspector->getInstalledPackagesList($this->stage->getStageDirectory());
+    $updated_packages = $staged_packages->getPackagesWithDifferentVersionsIn($installed_packages);
+
+    // Build a list of package names that were updated by user request.
+    $updated_by_request = [];
+    foreach ($this->stage->getPackageVersions() as $group) {
+      $updated_by_request = array_merge($updated_by_request, array_keys($group));
+    }
+
+    $updated_by_request_info = [];
+    $updated_project_info = [];
+    $supported_package_types = ['drupal-module', 'drupal-theme'];
+
+    // Compile an array of relevant information about the packages that will be
+    // updated.
+    foreach ($updated_packages as $name => $updated_package) {
+      // Ignore anything that isn't a module or a theme.
+      if (!in_array($updated_package->type, $supported_package_types, TRUE)) {
+        continue;
+      }
+      $updated_project_info[$name] = [
+        'title' => $this->getProjectTitleFromPackage($updated_package),
+        'installed_version' => $installed_packages[$updated_package->name]->version,
+        'updated_version' => $updated_package->version,
+      ];
+    }
+
+    foreach ($updated_packages as $name => $updated_package) {
+      // Sort the updated packages into two groups: the ones that were updated
+      // at the request of the user, and the ones that got updated anyway
+      // (probably due to Composer's dependency resolution).
+      if (in_array($name, $updated_by_request, TRUE)) {
+        $updated_by_request_info[$name] = $updated_project_info[$name];
+        unset($updated_project_info[$name]);
+      }
+    }
+    $output = [];
+    if ($updated_by_request_info) {
+      // Create the list of messages for the packages updated by request.
+      $output['requested'] = $this->getUpdatedPackagesItemList($updated_by_request_info, $this->t('The following projects will be updated:'));
+    }
+
+    if ($updated_project_info) {
+      // Create the list of messages for packages that were updated
+      // incidentally.
+      $output['dependencies'] = $this->getUpdatedPackagesItemList($updated_project_info, $this->t('The following dependencies will also be updated:'));
+    }
+    return $output;
+  }
+
+  /**
+   * Gets the human-readable project title for a Composer package.
+   *
+   * @param \Drupal\package_manager\InstalledPackage $package
+   *   The installed package.
+   *
+   * @return string
+   *   The human-readable title of the project. If no project information is
+   *   available, the package name is returned.
+   */
+  private function getProjectTitleFromPackage(InstalledPackage $package): string {
+    $project_name = $package->getProjectName();
+    if (!$project_name) {
+      return $package->name;
+    }
+    $project_info = new ProjectInfo($project_name);
+    $project_data = $project_info->getProjectInfo();
+    if ($project_data) {
+      return $project_data['title'];
+    }
+    else {
+      return $package->name;
+    }
+  }
+
+  /**
+   * Generates an item list of packages that will be updated.
+   *
+   * @param array[] $updated_packages
+   *   An array of packages that will be updated, each sub-array containing the
+   *   project title, installed version, and target version.
+   * @param \Drupal\Core\StringTranslation\TranslatableMarkup $item_list_title
+   *   The title of the generated item list.
+   *
+   * @return array
+   *   A render array for the generated item list.
+   */
+  private function getUpdatedPackagesItemList(array $updated_packages, TranslatableMarkup $item_list_title): array {
+    $create_message_for_project = function (array $project): TranslatableMarkup {
+      return $this->t('@title from @from_version to @to_version', [
+        '@title' => $project['title'],
+        '@from_version' => $project['installed_version'],
+        '@to_version' => $project['updated_version'],
+      ]);
+    };
+    return [
+      '#theme' => 'item_list',
+      '#prefix' => '<p>' . $item_list_title . '</p>',
+      '#items' => array_map($create_message_for_project, $updated_packages),
+    ];
+  }
+
+}

automatic_updates_extensions/src/Form/UpdaterForm.php

+<?php
+
+declare(strict_types = 1);
+
+namespace Drupal\automatic_updates_extensions\Form;
+
+use Drupal\automatic_updates\Form\UpdateFormBase;
+use Drupal\automatic_updates_extensions\BatchProcessor;
+use Drupal\automatic_updates_extensions\ExtensionUpdateStage;
+use Drupal\Core\Batch\BatchBuilder;
+use Drupal\Core\Form\FormStateInterface;
+use Drupal\Core\State\StateInterface;
+use Drupal\Core\Messenger\MessengerInterface;
+use Drupal\Core\Render\RendererInterface;
+use Drupal\Core\Url;
+use Drupal\package_manager\ComposerInspector;
+use Drupal\package_manager\Exception\StageFailureMarkerException;
+use Drupal\package_manager\FailureMarker;
+use Drupal\package_manager\PathLocator;
+use Drupal\package_manager\ProjectInfo;
+use Drupal\package_manager\ValidationResult;
+use Drupal\system\SystemManager;
+use Drupal\update\ProjectRelease;
+use Drupal\update\UpdateManagerInterface;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+use Symfony\Component\EventDispatcher\EventDispatcherInterface;
+
+/**
+ * A form for selecting extension updates.
+ *
+ * @internal
+ *   Form classes are internal and should not be used by external code.
+ */
+final class UpdaterForm extends UpdateFormBase {
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function create(ContainerInterface $container) {
+    return new static(
+      $container->get(ExtensionUpdateStage::class),
+      $container->get('event_dispatcher'),
+      $container->get('renderer'),
+      $container->get('state'),
+      $container->get(FailureMarker::class),
+      $container->get(ComposerInspector::class),
+      $container->get(PathLocator::class),
+    );
+  }
+
+  /**
+   * Constructs a new UpdaterForm object.
+   *
+   * @param \Drupal\automatic_updates_extensions\ExtensionUpdateStage $stage
+   *   The extension update stage service.
+   * @param \Symfony\Component\EventDispatcher\EventDispatcherInterface $eventDispatcher
+   *   The extension event dispatcher service.
+   * @param \Drupal\Core\Render\RendererInterface $renderer
+   *   The renderer service.
+   * @param \Drupal\Core\State\StateInterface $state
+   *   The state service.
+   * @param \Drupal\package_manager\FailureMarker $failureMarker
+   *   The failure marker service.
+   * @param \Drupal\package_manager\ComposerInspector $composerInspector
+   *   The Composer inspector service.
+   * @param \Drupal\package_manager\PathLocator $pathLocator
+   *   The path locator service.
+   */
+  public function __construct(
+    private readonly ExtensionUpdateStage $stage,
+    private readonly EventDispatcherInterface $eventDispatcher,
+    private readonly RendererInterface $renderer,
+    private readonly StateInterface $state,
+    private readonly FailureMarker $failureMarker,
+    private readonly ComposerInspector $composerInspector,
+    private readonly PathLocator $pathLocator,
+  ) {}
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getFormId() {
+    return 'automatic_updates_extensions_updater_form';
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function buildForm(array $form, FormStateInterface $form_state) {
+    try {
+      $this->failureMarker->assertNotExists();
+    }
+    catch (StageFailureMarkerException $e) {
+      $this->messenger()->addError($e->getMessage());
+      return $form;
+    }
+    $update_projects = $this->getRecommendedModuleUpdates();
+    $options = [];
+    $recommended_versions = [];
+    foreach ($update_projects as $project_name => $update_project) {
+      switch ($update_project['status']) {
+        case UpdateManagerInterface::NOT_SECURE:
+        case UpdateManagerInterface::REVOKED:
+          $status_message = $this->t('(Security update)');
+          break;
+
+        case UpdateManagerInterface::NOT_SUPPORTED:
+          $status_message = $this->t('(Unsupported)');
+          break;
+
+        default:
+          $status_message = '';
+      }
+      $project_release = ProjectRelease::createFromArray($update_project['releases'][$update_project['recommended']]);
+      $options[$project_name] = [
+        $update_project['title'] . $status_message,
+        $update_project['existing_version'],
+        $this->t(
+          '@version (<a href=":url">Release notes</a>)',
+          [
+            '@version' => $project_release->getVersion(),
+            ':url' => $project_release->getReleaseUrl(),
+          ]),
+      ];
+      $recommended_versions[$project_name] = $update_project['recommended'];
+    }
+    $form['recommended_versions'] = [
+      '#type' => 'value',
+      '#value' => $recommended_versions,
+    ];
+    $form['projects'] = [
+      '#type' => 'tableselect',
+      '#header' => [
+        $this->t('Project:'),
+        $this->t('Current Version:'),
+        $this->t('Update Version:'),
+      ],
+      '#options' => $options,
+      '#empty' => $this->t('There are no available updates.'),
+      '#attributes' => ['class' => ['update-recommended']],
+      '#required' => TRUE,
+      '#required_error' => t('Select one or more projects.'),
+    ];
+
+    if ($form_state->getUserInput()) {
+      $results = [];
+    }
+    else {
+      $results = $this->runStatusCheck($this->stage, $this->eventDispatcher);
+    }
+    $this->displayResults($results, $this->renderer);
+    $security_level = ValidationResult::getOverallSeverity($results);
+
+    if ($update_projects && $security_level !== SystemManager::REQUIREMENT_ERROR) {
+      $form['actions'] = $this->actions($form_state);
+    }
+
+    $form['last_check'] = [
+      '#theme' => 'update_last_check',
+      '#last' => $this->state->get('update.last_check', 0),
+    ];
+    return $form;
+  }
+
+  /**
+   * Builds the form actions.
+   *
+   * @param \Drupal\Core\Form\FormStateInterface $form_state
+   *   The form state.
+   *
+   * @return mixed[][]
+   *   The form's actions elements.
+   */
+  private function actions(FormStateInterface $form_state): array {
+    $actions = ['#type' => 'actions'];
+    if (!$this->stage->isAvailable()) {
+      // If the form has been submitted do not display this error message
+      // because ::deleteExistingUpdate() may run on submit. The message will
+      // still be displayed on form build if needed.
+      if (!$form_state->getUserInput()) {
+        $this->messenger()->addError($this->t('Cannot begin an update because another Composer operation is currently in progress.'));
+      }
+      $actions['delete'] = [
+        '#type' => 'submit',
+        '#value' => $this->t('Delete existing update'),
+        '#submit' => ['::deleteExistingUpdate'],
+      ];
+    }
+    else {
+      $actions['submit'] = [
+        '#type' => 'submit',
+        '#value' => $this->t('Update'),
+      ];
+    }
+    return $actions;
+  }
+
+  /**
+   * Submit function to delete an existing in-progress update.
+   */
+  public function deleteExistingUpdate(): void {
+    $this->stage->destroy(TRUE);
+    $this->messenger()->addMessage($this->t("Staged update deleted"));
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function submitForm(array &$form, FormStateInterface $form_state) {
+    $projects = $form_state->getValue('projects');
+    $selected_projects = array_filter($projects);
+    $recommended_versions = $form_state->getValue('recommended_versions');
+    $selected_versions = array_intersect_key($recommended_versions, $selected_projects);
+    $batch = (new BatchBuilder())
+      ->setTitle($this->t('Downloading updates'))
+      ->setInitMessage($this->t('Preparing to download updates'))
+      ->addOperation(
+        [BatchProcessor::class, 'begin'],
+        [$selected_versions]
+      )
+      ->addOperation([BatchProcessor::class, 'stage'])
+      ->setFinishCallback([BatchProcessor::class, 'finishStage'])
+      ->toArray();
+
+    batch_set($batch);
+  }
+
+  /**
+   * Gets the modules that require updates.
+   *
+   * @return mixed[]
+   *   Modules that require updates.
+   */
+  private function getRecommendedModuleUpdates(): array {
+    $supported_project_types = [
+      "module", "module-disabled", "theme", "theme-disabled",
+    ];
+    $available_updates = update_get_available(TRUE);
+    if (empty($available_updates)) {
+      $this->messenger()->addError('There was a problem getting update information. Try again later.');
+      return [];
+    }
+
+    $all_projects_data = update_calculate_project_data($available_updates);
+    $outdated_modules = [];
+    $installed_packages = $this->composerInspector->getInstalledPackagesList($this->pathLocator->getProjectRoot());
+    $non_supported_update_statuses = [];
+    foreach ($all_projects_data as $project_name => $project_data) {
+      if (in_array($project_data['project_type'], $supported_project_types, TRUE)) {
+        if ($project_data['status'] !== UpdateManagerInterface::CURRENT) {
+          if ($installed_packages->getPackageByDrupalProjectName($project_name) === NULL) {
+            $non_supported_update_statuses[] = $project_data['status'];
+            continue;
+          }
+          $project_information = new ProjectInfo($project_name);
+          $installable_versions = array_keys($project_information->getInstallableReleases());
+          if (!empty($project_data['recommended']) && in_array($project_data['recommended'], $installable_versions, TRUE)) {
+            $outdated_modules[$project_name] = $project_data;
+          }
+          else {
+            $non_supported_update_statuses[] = $project_data['status'];
+          }
+        }
+      }
+    }
+    if ($non_supported_update_statuses) {
+      $message_status = array_intersect([UpdateManagerInterface::NOT_SECURE, UpdateManagerInterface::NOT_SUPPORTED, UpdateManagerInterface::REVOKED], $non_supported_update_statuses) ?
+        MessengerInterface::TYPE_ERROR :
+        MessengerInterface::TYPE_STATUS;
+      if ($outdated_modules) {
+        $this->messenger()->addMessage(
+          $this->t(
+            'Other updates were found, but they must be performed manually. See <a href=":url">the list of available updates</a> for more information.',
+            [
+              ':url' => Url::fromRoute('update.status')->toString(),
+            ]
+          ),
+          $message_status
+        );
+      }
+      else {
+        $this->messenger()->addMessage(
+          $this->t(
+            'Updates were found, but they must be performed manually. See <a href=":url">the list of available updates</a> for more information.',
+            [
+              ':url' => Url::fromRoute('update.status')->toString(),
+            ]
+          ),
+          $message_status
+        );
+      }
+    }
+    return $outdated_modules;
+  }
+
+}

automatic_updates_extensions/src/Validator/ForbidCoreChangesValidator.php

+<?php
+
+declare(strict_types=1);
+
+namespace Drupal\automatic_updates_extensions\Validator;
+
+use Drupal\Core\StringTranslation\StringTranslationTrait;
+use Drupal\Core\Url;
+use Drupal\package_manager\ComposerInspector;
+use Drupal\package_manager\Event\PreApplyEvent;
+use Drupal\package_manager\Event\StatusCheckEvent;
+use Drupal\package_manager\InstalledPackagesList;
+use Drupal\package_manager\PathLocator;
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
+
+/**
+ * Validates that no changes were made to Drupal Core packages.
+ *
+ * @internal
+ *   This is an internal part of Automatic Updates and may be changed or removed
+ *   at any time without warning. External code should not interact with this
+ *   class.
+ */
+final class ForbidCoreChangesValidator implements EventSubscriberInterface {
+
+  use StringTranslationTrait;
+
+  public function __construct(
+    private readonly PathLocator $pathLocator,
+    private readonly ComposerInspector $composerInspector,
+  ) {}
+
+  /**
+   * Validates the staged packages.
+   *
+   * @param \Drupal\package_manager\Event\StatusCheckEvent|\Drupal\package_manager\Event\PreApplyEvent $event
+   *   The event object.
+   */
+  public function validateStagedCorePackages(StatusCheckEvent|PreApplyEvent $event): void {
+    $stage = $event->stage;
+    // We only want to do this check if the stage belongs to Automatic Updates
+    // Extensions.
+    if ($stage->getType() !== 'automatic_updates_extensions:attended' || !$stage->stageDirectoryExists()) {
+      return;
+    }
+    $active_core_packages = $this->getInstalledCorePackages($this->pathLocator->getProjectRoot());
+    $stage_core_packages = $this->getInstalledCorePackages($stage->getStageDirectory());
+
+    $new_packages = $stage_core_packages->getPackagesNotIn($active_core_packages);
+    $removed_packages = $active_core_packages->getPackagesNotIn($stage_core_packages);
+    $changed_packages = $active_core_packages->getPackagesWithDifferentVersionsIn($stage_core_packages);
+
+    $error_messages = [];
+    foreach ($new_packages as $new_package) {
+      $error_messages[] = $this->t("'@name' installed.", ['@name' => $new_package->name]);
+    }
+    foreach ($removed_packages as $removed_package) {
+      $error_messages[] = $this->t("'@name' removed.", ['@name' => $removed_package->name]);
+    }
+    foreach ($changed_packages as $name => $updated_package) {
+      $error_messages[] = $this->t(
+        "'@name' version changed from @active_version to @staged_version.",
+        [
+          '@name' => $updated_package->name,
+          '@staged_version' => $stage_core_packages[$name]->version,
+          '@active_version' => $updated_package->version,
+        ]
+      );
+
+    }
+    if ($error_messages) {
+      $event->addError($error_messages, $this->t(
+        'Updating Drupal Core while updating extensions is currently not supported. Use <a href=":url">this form</a> to update Drupal core. The following changes were made to the Drupal core packages:',
+        [':url' => Url::fromRoute('update.report_update')->toString()]
+      ));
+    }
+  }
+
+  /**
+   * Gets all the installed core packages for a given project root.
+   *
+   * This method differs from
+   * \Drupal\package_manager\ComposerInspector::getInstalledPackagesList in that
+   * it ensures that the 'drupal/core' is included in the list if present.
+   *
+   * @param string $composer_root
+   *   The path to the composer root.
+   *
+   * @return \Drupal\package_manager\InstalledPackagesList
+   *   The installed core packages.
+   */
+  private function getInstalledCorePackages(string $composer_root): InstalledPackagesList {
+    $installed_package_list = $this->composerInspector->getInstalledPackagesList($composer_root);
+    $core_packages = $installed_package_list->getCorePackages();
+    if (isset($installed_package_list['drupal/core']) && !isset($core_packages['drupal/core'])) {
+      $core_packages = new InstalledPackagesList(array_merge($core_packages->getArrayCopy(), ['drupal/core' => $installed_package_list['drupal/core']]));
+    }
+    return $core_packages;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function getSubscribedEvents(): array {
+    $events[StatusCheckEvent::class][] = ['validateStagedCorePackages'];
+    $events[PreApplyEvent::class][] = ['validateStagedCorePackages'];
+    return $events;
+  }
+
+}

automatic_updates_extensions/src/Validator/RequestedUpdateValidator.php

+<?php
+
+declare(strict_types=1);
+
+namespace Drupal\automatic_updates_extensions\Validator;
+
+use Composer\Semver\Semver;
+use Drupal\Core\StringTranslation\StringTranslationTrait;
+use Drupal\package_manager\ComposerInspector;
+use Drupal\package_manager\Event\PreApplyEvent;
+use Drupal\package_manager\Event\StatusCheckEvent;
+use Drupal\package_manager\PathLocator;
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
+
+/**
+ * Validates that requested packages have been updated.
+ *
+ * @internal
+ *   This is an internal part of Automatic Updates and may be changed or removed
+ *   at any time without warning. External code should not interact with this
+ *   class.
+ */
+final class RequestedUpdateValidator implements EventSubscriberInterface {
+
+  use StringTranslationTrait;
+
+  /**
+   * Constructs a RequestedUpdateValidator object.
+   *
+   * @param \Drupal\package_manager\ComposerInspector $composerInspector
+   *   The Composer inspector service.
+   * @param \Drupal\package_manager\PathLocator $pathLocator
+   *   The path locator service.
+   */
+  public function __construct(
+    private readonly ComposerInspector $composerInspector,
+    private readonly PathLocator $pathLocator,
+  ) {}
+
+  /**
+   * Validates that requested packages have been updated to the right version.
+   *
+   * @param \Drupal\package_manager\Event\PreApplyEvent|\Drupal\package_manager\Event\StatusCheckEvent $event
+   *   The pre-apply event.
+   */
+  public function checkRequestedStagedVersion(PreApplyEvent|StatusCheckEvent $event): void {
+    $stage = $event->stage;
+    if ($stage->getType() !== 'automatic_updates_extensions:attended' || !$stage->stageDirectoryExists()) {
+      return;
+    }
+    $requested_package_versions = $stage->getPackageVersions();
+    $active = $this->composerInspector->getInstalledPackagesList($this->pathLocator->getProjectRoot());
+    $staged = $this->composerInspector->getInstalledPackagesList($event->stage->getStageDirectory());
+    $changed_stage_packages = $staged->getPackagesWithDifferentVersionsIn($active)->getArrayCopy();
+
+    if (empty($changed_stage_packages)) {
+      $event->addError([$this->t('No updates detected in the staging area.')]);
+      return;
+    }
+
+    // Check for all changed the packages if they are updated to the requested
+    // version.
+    foreach (['production', 'dev'] as $package_type) {
+      foreach ($requested_package_versions[$package_type] as $requested_package_name => $requested_version) {
+        if (array_key_exists($requested_package_name, $changed_stage_packages)) {
+          $staged_version = $changed_stage_packages[$requested_package_name]->version;
+          if (!Semver::satisfies($staged_version, $requested_version)) {
+            $event->addError([
+              $this->t(
+                "The requested update to '@requested_package_name' to version '@requested_version' does not match the actual staged update to '@staged_version'.",
+                [
+                  '@requested_package_name' => $requested_package_name,
+                  '@requested_version' => $requested_version,
+                  '@staged_version' => $staged_version,
+                ]
+              ),
+            ]);
+          }
+        }
+        else {
+          $event->addError([
+            $this->t(
+              "The requested update to '@requested_package_name' to version '@requested_version' was not performed.",
+              [
+                '@requested_package_name' => $requested_package_name,
+                '@requested_version' => $requested_version,
+              ]
+            ),
+          ]);
+        }
+      }
+    }
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function getSubscribedEvents(): array {
+    $events[StatusCheckEvent::class][] = ['checkRequestedStagedVersion'];
+    $events[PreApplyEvent::class][] = ['checkRequestedStagedVersion'];
+    return $events;
+  }
+
+}

automatic_updates_extensions/src/Validator/UpdateReleaseValidator.php

+<?php
+
+declare(strict_types = 1);
+
+namespace Drupal\automatic_updates_extensions\Validator;
+
+use Drupal\package_manager\ComposerInspector;
+use Drupal\package_manager\PathLocator;
+use Drupal\package_manager\ProjectInfo;
+use Drupal\package_manager\LegacyVersionUtility;
+use Drupal\Core\StringTranslation\StringTranslationTrait;
+use Drupal\package_manager\Event\PreCreateEvent;
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
+
+/**
+ * Validates that updated projects are secure and supported.
+ *
+ * @internal
+ *   This class is an internal part of the module's update handling and
+ *   should not be used by external code.
+ *
+ * @todo Decide if this validator can be removed completely in
+ *    https://www.drupal.org/i/3351091.
+ */
+final class UpdateReleaseValidator implements EventSubscriberInterface {
+
+  use StringTranslationTrait;
+
+  /**
+   * Constructs an UpdateReleaseValidator object.
+   *
+   * @param \Drupal\package_manager\ComposerInspector $composerInspector
+   *   The Composer inspector service.
+   * @param \Drupal\package_manager\PathLocator $pathLocator
+   *   The path locator service.
+   */
+  public function __construct(
+    private readonly ComposerInspector $composerInspector,
+    private readonly PathLocator $pathLocator
+  ) {}
+
+  /**
+   * Checks if the given version of a project is supported.
+   *
+   * Checks if the given version of the given project is in the core update
+   * system's list of known, secure, installable releases of that project.
+   * considered a supported release by verifying if the project is found in the
+   * core update system's list of known, secure, and installable releases.
+   *
+   * @param string $name
+   *   The name of the project.
+   * @param string $semantic_version
+   *   A semantic version number for the project.
+   *
+   * @return bool
+   *   TRUE if the given version of the project is supported, otherwise FALSE.
+   *   given version is not supported will return FALSE.
+   */
+  private function isSupportedRelease(string $name, string $semantic_version): bool {
+    $supported_releases = (new ProjectInfo($name))->getInstallableReleases();
+    if (!$supported_releases) {
+      return FALSE;
+    }
+
+    // If this version is found in the list of installable releases, it is
+    // secured and supported.
+    if (array_key_exists($semantic_version, $supported_releases)) {
+      return TRUE;
+    }
+    // If the semantic version number wasn't in the list of
+    // installable releases, convert it to a legacy version number and see
+    // if the version number is in the list.
+    $legacy_version = LegacyVersionUtility::convertToLegacyVersion($semantic_version);
+    if ($legacy_version && array_key_exists($legacy_version, $supported_releases)) {
+      return TRUE;
+    }
+    // Neither the semantic version nor the legacy version are in the list
+    // of installable releases, so the release isn't supported.
+    return FALSE;
+  }
+
+  /**
+   * Checks that the update projects are secure and supported.
+   *
+   * @param \Drupal\package_manager\Event\PreCreateEvent $event
+   *   The event object.
+   */
+  public function checkRelease(PreCreateEvent $event): void {
+    $stage = $event->stage;
+    // This check only works with Automatic Updates Extensions.
+    if ($stage->getType() !== 'automatic_updates_extensions:attended') {
+      return;
+    }
+
+    $active_packages = $this->composerInspector->getInstalledPackagesList($this->pathLocator->getProjectRoot());
+    $all_versions = $stage->getPackageVersions();
+    $messages = [];
+    foreach (['production', 'dev'] as $package_type) {
+      foreach ($all_versions[$package_type] as $package_name => $sematic_version) {
+        $project_name = $active_packages[$package_name]->getProjectName();
+        // If the version isn't in the list of installable releases, then it
+        // isn't secure and supported and the user should receive an error.
+        if (!$this->isSupportedRelease($project_name, $sematic_version)) {
+          $messages[] = $this->t('Project @project_name to version @version', [
+            '@project_name' => $project_name,
+            '@version' => $sematic_version,
+          ]);
+        }
+      }
+    }
+    if ($messages) {
+      $summary = $this->formatPlural(
+        count($messages),
+        'Cannot update because the following project version is not in the list of installable releases.',
+        'Cannot update because the following project versions are not in the list of installable releases.'
+      );
+      $event->addError($messages, $summary);
+    }
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function getSubscribedEvents(): array {
+    return [
+      PreCreateEvent::class => 'checkRelease',
+    ];
+  }
+
+}

automatic_updates_extensions/tests/fixtures/new_module/1.0.0/composer.json

+{
+  "name": "drupal/new_module",
+  "type": "drupal-module",
+  "version": "1.0.0"
+}

automatic_updates_extensions/tests/fixtures/new_module/1.0.0/new_module.info.yml.hide

+name: 'New module'
+type: module
+core_version_requirement: ^9.7 || ^10
+project: new_module

automatic_updates_extensions/tests/fixtures/new_module/1.1.0/composer.json

+{
+  "name": "drupal/new_module",
+  "type": "drupal-module",
+  "version": "1.1.0"
+}

automatic_updates_extensions/tests/fixtures/new_module/1.1.0/new_module.info.yml.hide

+name: 'New module'
+type: module
+core_version_requirement: ^9.7 || ^10
+project: new_module

automatic_updates_extensions/tests/fixtures/release-history/alpha.1.1.0.xml

+<?xml version="1.0" encoding="utf-8"?>
+<!--
+This fixture is used by  \Drupal\Tests\automatic_updates_extensions\Build\ModuleUpdateTest.
+
+Contains metadata about the following (fake) releases of alpha module, all of which are secure, in order:
+- 1.1.0
+- 1.0.0
+-->
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>Alpha</title>
+<short_name>alpha</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>1.1.,1.0.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/alpha</link>
+  <terms>
+   <term><name>Projects</name><value>Alpha project</value></term>
+  </terms>
+<releases>
+  <release>
+    <name>Alpha 1.1.0</name>
+    <version>1.1.0</version>
+    <tag>1.1.0</tag>
+    <status>published</status>
+    <release_link>http://example.com/alpha-1-1-0-release</release_link>
+    <download_link>http://example.com/alpha-1-1-0.tar.gz</download_link>
+    <date>1584195300</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+ <release>
+   <name>Alpha 1.0.0</name>
+   <version>1.0.0</version>
+   <tag>1.0.0</tag>
+   <status>published</status>
+   <release_link>http://example.com/alpha-1-0-0-release</release_link>
+   <download_link>http://example.com/alpha-1-0-0.tar.gz</download_link>
+   <date>1581603300</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+</releases>
+</project>

automatic_updates_extensions/tests/fixtures/release-history/automatic_updates_extensions_test_theme.1.1.xml

+<?xml version="1.0" encoding="utf-8"?>
+<!--
+This fixture is used by \Drupal\Tests\automatic_updates_extensions\Functional\UpdaterFormTest.
+
+Contains metadata about the following (fake) releases of automatic_updates_extensions_test_theme, all of which are secure, in order:
+- 3.0.0
+- 8.x-2.1
+- 8.x-2.0
+-->
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+  <title>Automatic Updates Extensions Test Theme</title>
+  <short_name>automatic_updates_extensions_test_theme</short_name>
+  <dc:creator>drupal</dc:creator>
+  <type>project_theme</type>
+  <supported_branches>8.x-2.,3.0.</supported_branches>
+  <project_status>published</project_status>
+  <link>http://example.com/project/automatic_updates_extensions_test_theme</link>
+  <terms>
+    <term>
+      <name>Projects</name>
+      <value>Themes</value>
+    </term>
+    <term>
+      <name>Maintenance status</name>
+      <value>Minimally maintained</value>
+    </term>
+    <term>
+      <name>Development status</name>
+      <value>Under active development</value>
+    </term>
+  </terms>
+  <releases>
+    <release>
+      <name>automatic_updates_extensions_test_theme 3.0.0</name>
+      <version>3.0.0</version>
+      <tag>3.0.0</tag>
+      <status>published</status>
+      <release_link>http://example.com/automatic_updates_extensions_test_theme-3-0-0-release</release_link>
+      <download_link>http://example.com/automatic_updates_extensions_test_theme-3.0.0.tar.gz</download_link>
+      <date>1597793786</date>
+      <files>
+        <file>
+          <url>http://example.com/automatic_updates_extensions_test_theme-3.0.0.tar.gz</url>
+          <archive_type>tar.gz</archive_type>
+          <md5>43956be126b27d718ecffd0b17244aa1</md5>
+          <size>196080</size>
+          <filedate>1597793786</filedate>
+        </file>
+        <file>
+          <url>http://example.com/automatic_updates_extensions_test_theme-3.0.0.zip</url>
+          <archive_type>zip</archive_type>
+          <md5>5d24ec88ac4755af6ccbe6ef5ff8b3c9</md5>
+          <size>200399</size>
+          <filedate>1597793786</filedate>
+        </file>
+      </files>
+      <security covered="1">Covered by Drupal's security advisory policy</security>
+      <core_compatibility>^8 || ^9</core_compatibility>
+    </release>
+    <release>
+      <name>automatic_updates_extensions_test_theme 8.x-2.1</name>
+      <version>8.x-2.1</version>
+      <tag>8.x-2.1</tag>
+      <status>published</status>
+      <release_link>http://example.com/automatic_updates_extensions_test_theme-8-x-2-1-release</release_link>
+      <download_link>http://example.com/automatic_updates_extensions_test_theme-8.x-2.1.tar.gz</download_link>
+      <date>1597793786</date>
+      <files>
+        <file>
+          <url>http://example.com/automatic_updates_extensions_test_theme-8.x-2.1.tar.gz</url>
+          <archive_type>tar.gz</archive_type>
+          <md5>43956be126b27d718ecffd0b17244aa1</md5>
+          <size>196080</size>
+          <filedate>1597793786</filedate>
+        </file>
+        <file>
+          <url>http://example.com/automatic_updates_extensions_test_theme-8.x-2.1.zip</url>
+          <archive_type>zip</archive_type>
+          <md5>5d24ec88ac4755af6ccbe6ef5ff8b3c9</md5>
+          <size>200399</size>
+          <filedate>1597793786</filedate>
+        </file>
+      </files>
+      <terms>
+        <term>
+          <name>Release type</name>
+          <value>Bug fixes</value>
+        </term>
+      </terms>
+      <security covered="1">Covered by Drupal's security advisory policy</security>
+      <core_compatibility>8.x</core_compatibility>
+    </release>
+    <release>
+      <name>automatic_updates_extensions_test_theme 8.x-2.0</name>
+      <version>8.x-2.0</version>
+      <tag>8.x-2.0</tag>
+      <status>published</status>
+      <release_link>http://example.com/automatic_updates_extensions_test_theme-8-x-2-0-release</release_link>
+      <download_link>http://example.com/automatic_updates_extensions_test_theme-8.x-2.0.tar.gz</download_link>
+      <date>1597793786</date>
+      <files>
+        <file>
+          <url>http://example.com/automatic_updates_extensions_test_theme-8.x-2.0.tar.gz</url>
+          <archive_type>tar.gz</archive_type>
+          <md5>43956be126b27d718ecffd0b17244aa1</md5>
+          <size>196080</size>
+          <filedate>1597793786</filedate>
+        </file>
+        <file>
+          <url>http://example.com/automatic_updates_extensions_test_theme-8.x-2.0.zip</url>
+          <archive_type>zip</archive_type>
+          <md5>5d24ec88ac4755af6ccbe6ef5ff8b3c9</md5>
+          <size>200399</size>
+          <filedate>1597793786</filedate>
+        </file>
+      </files>
+      <terms>
+        <term>
+          <name>Release type</name>
+          <value>Bug fixes</value>
+        </term>
+      </terms>
+      <security covered="1">Covered by Drupal's security advisory policy</security>
+      <core_compatibility>8.x</core_compatibility>
+    </release>
+  </releases>
+</project>

automatic_updates_extensions/tests/fixtures/release-history/new_module.1.1.0.xml

+<?xml version="1.0" encoding="utf-8"?>
+<!--
+This fixture is used by  \Drupal\Tests\automatic_updates_extensions\Build\ModuleUpdateTest.
+
+Contains metadata about the following (fake) releases of new_module, all of which are secure, in order:
+- 1.1.0
+- 1.0.0
+-->
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>New Module</title>
+<short_name>new_module</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>1.1.,1.0.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/new_module</link>
+  <terms>
+   <term><name>Projects</name><value>New Module project</value></term>
+  </terms>
+<releases>
+  <release>
+    <name>New Module 1.1.0</name>
+    <version>1.1.0</version>
+    <tag>1.1.0</tag>
+    <status>published</status>
+    <release_link>http://example.com/new_module-1-1-0-release</release_link>
+    <download_link>http://example.com/new_module-1-1-0.tar.gz</download_link>
+    <date>1584195300</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+ <release>
+   <name>New Module 1.0.0</name>
+   <version>1.0.0</version>
+   <tag>1.0.0</tag>
+   <status>published</status>
+   <release_link>http://example.com/new_module-1-0-0-release</release_link>
+   <download_link>http://example.com/new_module-1-0-0.tar.gz</download_link>
+   <date>1581603300</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+</releases>
+</project>

automatic_updates_extensions/tests/fixtures/release-history/semver_test.1.1.xml

+<?xml version="1.0" encoding="utf-8"?>
+<!--
+This fixture is used by \Drupal\Tests\automatic_updates_extensions\Functional\UpdaterFormTest.
+
+Contains metadata about the following (fake) releases of semver_test module, all of which are secure, in order:
+- 8.2.0, which is in an unsupported branch
+- 8.1.1
+- 8.1.1-beta1
+- 8.1.1-alpha1
+- 8.1.0
+- 8.1.0-beta1
+- 8.1.0-alpha1
+- 8.0.1
+- 8.0.1-beta1
+- 8.0.1-alpha1
+- 8.0.0
+- 8.0.0-beta1
+- 8.0.0-alpha1
+-->
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>Semver Test</title>
+<short_name>semver_test</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.0.,8.1.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/semver_test</link>
+  <terms>
+   <term><name>Projects</name><value>Semver Test project</value></term>
+  </terms>
+<releases>
+  <release>
+    <name>Semver Test 8.2.0</name>
+    <version>8.2.0</version>
+    <tag>8.2.0</tag>
+    <status>published</status>
+    <release_link>http://example.com/semver_test-8-2-0-release</release_link>
+    <download_link>http://example.com/semver_test-8-2-0.tar.gz</download_link>
+    <date>1584195300</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+ <release>
+   <name>Semver Test 8.1.1</name>
+   <version>8.1.1</version>
+   <tag>8.1.1</tag>
+   <status>published</status>
+   <release_link>http://example.com/semver_test-8-1-1-release</release_link>
+   <download_link>http://example.com/semver_test-8-1-1.tar.gz</download_link>
+   <date>1581603300</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Semver Test 8.1.1-beta1</name>
+   <version>8.1.1-beta1</version>
+   <tag>8.1.1-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/semver_test-8-1-1-beta1-release</release_link>
+   <download_link>http://example.com/semver_test-8-1-1-beta1.tar.gz</download_link>
+   <date>1579011300</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Semver Test 8.1.1-alpha1</name>
+   <version>8.1.1-alpha1</version>
+   <tag>8.1.1-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/semver_test-8-1-1-alpha1-release</release_link>
+   <download_link>http://example.com/semver_test-8-1-1-alpha1.tar.gz</download_link>
+   <date>1576419300</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Semver Test 8.1.0</name>
+   <version>8.1.0</version>
+   <tag>8.1.0</tag>
+   <status>published</status>
+   <release_link>http://example.com/semver_test-8-1-0-release</release_link>
+   <download_link>http://example.com/semver_test-8-1-0.tar.gz</download_link>
+   <date>1573827300</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Semver Test 8.1.0-beta1</name>
+   <version>8.1.0-beta1</version>
+   <tag>8.1.0-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/semver_test-8-1-0-beta1-release</release_link>
+   <download_link>http://example.com/semver_test-8-1-0-beta1.tar.gz</download_link>
+   <date>1571235300</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Semver Test 8.1.0-alpha1</name>
+   <version>8.1.0-alpha1</version>
+   <tag>8.1.0-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/semver_test-8-1-0-alpha1-release</release_link>
+   <download_link>http://example.com/semver_test-8-1-0-alpha1.tar.gz</download_link>
+   <date>1568643300</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Semver Test 8.0.1</name>
+   <version>8.0.1</version>
+   <tag>8.0.1</tag>
+   <status>published</status>
+   <release_link>http://example.com/semver_test-8-0-1-release</release_link>
+   <download_link>http://example.com/semver_test-8-0-1.tar.gz</download_link>
+   <date>1566051300</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Semver Test 8.0.1-beta1</name>
+   <version>8.0.1-beta1</version>
+   <tag>8.0.1-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/semver_test-8-0-1-beta1-release</release_link>
+   <download_link>http://example.com/semver_test-8-0-1-beta1.tar.gz</download_link>
+   <date>1563459300</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Semver Test 8.0.1-alpha1</name>
+   <version>8.0.1-alpha1</version>
+   <tag>8.0.1-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/semver_test-8-0-1-alpha1-release</release_link>
+   <download_link>http://example.com/semver_test-8-0-1-alpha1.tar.gz</download_link>
+   <date>1560867300</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Semver Test 8.0.0</name>
+   <version>8.0.0</version>
+   <tag>8.0.0</tag>
+   <status>published</status>
+   <release_link>http://example.com/semver_test-8-0-0-release</release_link>
+   <download_link>http://example.com/semver_test-8-0-0.tar.gz</download_link>
+   <date>1558275300</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Semver Test 8.0.0-beta1</name>
+   <version>8.0.0-beta1</version>
+   <tag>8.0.0-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/semver_test-8-0-0-beta1-release</release_link>
+   <download_link>http://example.com/semver_test-8-0-0-beta1.tar.gz</download_link>
+   <date>1555683300</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Semver Test 8.0.0-alpha1</name>
+   <version>8.0.0-alpha1</version>
+   <tag>8.0.0-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/semver_test-8-0-0-alpha1-release</release_link>
+   <download_link>http://example.com/semver_test-8-0-0-alpha1.tar.gz</download_link>
+   <date>1553091300</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+</releases>
+</project>

automatic_updates_extensions/tests/modules/automatic_updates_extensions_test/automatic_updates_extensions_test.info.yml

+name: 'Automatic Updates Extensions Tests'
+description: 'Provides functional tests for recommended versions'
+type: module
+package: Testing
+dependencies:
+  - automatic_updates:automatic_updates_extensions

automatic_updates_extensions/tests/modules/automatic_updates_extensions_test/automatic_updates_extensions_test.module

+<?php
+
+/**
+ * @file
+ * Contains hook implementation for Automatic Updates Extensions Test.
+ */
+
+/**
+ * Implements hook_update_status_alter().
+ */
+function automatic_updates_extensions_test_update_status_alter(&$projects) {
+  if (\Drupal::state()->get('testUninstallableRelease') && !empty($projects['semver_test'])) {
+    $projects['semver_test']['recommended'] = $projects['semver_test']['existing_version'];
+  }
+}

automatic_updates_extensions/tests/modules/automatic_updates_extensions_test_api/automatic_updates_extensions_test_api.info.yml

+name: 'Automatic Updates Extensions Test API'
+description: 'Provides API endpoints for doing stage operations in functional tests.'
+type: module
+package: Testing
+dependencies:
+  - automatic_updates:automatic_updates_extensions
+  - automatic_updates:package_manager_test_api

automatic_updates_extensions/tests/modules/automatic_updates_extensions_test_api/automatic_updates_extensions_test_api.routing.yml

+automatic_updates_extensions_test_api:
+  path: '/automatic-updates-extensions-test-api'
+  defaults:
+    _controller: 'Drupal\automatic_updates_extensions_test_api\ApiController::run'
+  requirements:
+    _access: 'TRUE'
+automatic_updates_extensions_test_api.finish:
+  path: '/automatic-updates-extensions-test-api/finish/{id}'
+  defaults:
+    _controller: 'Drupal\automatic_updates_extensions_test_api\ApiController::finish'
+  requirements:
+    _access: 'TRUE'

automatic_updates_extensions/tests/modules/automatic_updates_extensions_test_api/src/ApiController.php

+<?php
+
+declare(strict_types = 1);
+
+namespace Drupal\automatic_updates_extensions_test_api;
+
+use Drupal\automatic_updates_extensions\ExtensionUpdateStage;
+use Drupal\package_manager\PathLocator;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+use Symfony\Component\HttpFoundation\Request;
+use Drupal\package_manager_test_api\ApiController as PackageManagerApiController;
+
+/**
+ * Provides API endpoint to interact with stage directory in functional tests.
+ */
+class ApiController extends PackageManagerApiController {
+
+  /**
+   * {@inheritdoc}
+   */
+  protected $finishedRoute = 'automatic_updates_extensions_test_api.finish';
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function create(ContainerInterface $container) {
+    return new static(
+      $container->get(ExtensionUpdateStage::class),
+      $container->get(PathLocator::class),
+    );
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function createAndApplyStage(Request $request): string {
+    $id = $this->stage->begin($request->get('projects', []));
+    $this->stage->stage();
+    $this->stage->apply();
+    return $id;
+  }
+
+}