.cspell.json

+{
+  "dictionaries": ["drupal","companies", "fonts", "html", "php", "softwareTerms", "automatic_updates"],
+  "dictionaryDefinitions": [
+    { "name": "automatic_updates", "path": "./dictionary.txt"}
+  ],
+  "ignorePaths": [
+    "README.md"
+  ]
+}

.gitattributes

+/dictionary.txt export-ignore
 /scripts  export-ignore

.gitignore

+/.idea
 /auto-updates-dev

.gitlab-ci.yml

+################
+# DrupalCI GitLabCI template
+#
+# Gitlab-ci.yml to replicate DrupalCI testing for Contrib
+#
+# With thanks to:
+#   * The GitLab Acceleration Initiative participants
+#   * DrupalSpoons
+################
+
+################
+# Guidelines
+#
+# This template is designed to give any Contrib maintainer everything they need to test, without requiring modification. It is also designed to keep up to date with Core Development automatically through the use of include files that can be centrally maintained.
+#
+# However, you can modify this template if you have additional needs for your project.
+################
+
+################
+# Includes
+#
+# Additional configuration can be provided through includes.
+# One advantage of include files is that if they are updated upstream, the changes affect all pipelines using that include.
+#
+# Includes can be overridden by re-declaring anything provided in an include, here in gitlab-ci.yml
+# https://docs.gitlab.com/ee/ci/yaml/includes.html#override-included-configuration-values
+################
+
+include:
+  ################
+  # DrupalCI includes:
+  # As long as you include this, any future includes added by the Drupal Association will be accessible to your pipelines automatically.
+  # View these include files at https://git.drupalcode.org/project/gitlab_templates/
+  ################
+  - project: $_GITLAB_TEMPLATES_REPO
+    # "ref" value can be:
+    # - Recommended (default) - `ref: $_GITLAB_TEMPLATES_REF` - The Drupal Association will update this value to the recommended tag for contrib.
+    # - Latest - `ref: main` - Get the latest additions and bug fixes as they are merged into the templates.
+    # - Minor or Major latests - `ref: 1.x-latest` or `ref: 1.0.x-latest` - Get the latest additions within a minor (mostly bugfixes) or major (bugs and new features).
+    # - Fixed tag - `ref: 1.0.1` - Set the value to a known tag. This will not get any updates.
+    # If you change the default value of ref, you should set the _CURL_TEMPLATES_REF variable in the variables section to be the same as set here.
+    ref: $_GITLAB_TEMPLATES_REF
+    file:
+      - '/includes/include.drupalci.main.yml'
+      # EXPERIMENTAL: For Drupal 7, remove the above line and uncomment the below.
+      # - '/includes/include.drupalci.main-d7.yml'
+      - '/includes/include.drupalci.variables.yml'
+      - '/includes/include.drupalci.workflows.yml'
+
+################
+# Pipeline configuration variables
+#
+# These are the variables provided to the Run Pipeline form that a user may want to override.
+#
+# Docs at https://git.drupalcode.org/project/gitlab_templates/-/blob/1.0.x/includes/include.drupalci.variables.yml
+################
+variables:
+  _PHPUNIT_CONCURRENT: '1'
+  _PHPUNIT_TESTGROUPS: ''
+  # Always test against the previous minor version of core.
+  OPT_IN_TEST_PREVIOUS_MINOR: '1'
+  # @todo Remove this line when https://drupal.org/i/3414093 is fixed.
+  CI_DEBUG_SERVICES: "true"
+  _TARGET_DB_TYPE: "mariadb"
+  _TARGET_DB_VERSION: "10.6"
+  # Always show environment variables, to help in debugging CI problems.
+  _SHOW_ENVIRONMENT_VARIABLES: '1'
+
+
+###################################################################################
+#
+#                                        *
+#                                       /(
+#                                      ((((,
+#                                    /(((((((
+#                                   ((((((((((*
+#                                ,(((((((((((((((
+#                              ,(((((((((((((((((((
+#                            ((((((((((((((((((((((((*
+#                         *(((((((((((((((((((((((((((((
+#                       ((((((((((((((((((((((((((((((((((*
+#                    *((((((((((((((((((  .((((((((((((((((((
+#                  ((((((((((((((((((.       /(((((((((((((((((*
+#                /(((((((((((((((((            .(((((((((((((((((,
+#             ,((((((((((((((((((                 ((((((((((((((((((
+#           .((((((((((((((((((((                   .(((((((((((((((((
+#          (((((((((((((((((((((((                     ((((((((((((((((/
+#        (((((((((((((((((((((((((((/                    ,(((((((((((((((*
+#      .((((((((((((((/  /(((((((((((((.                   ,(((((((((((((((
+#     *((((((((((((((      ,(((((((((((((/                   *((((((((((((((.
+#    ((((((((((((((,          /(((((((((((((.                  ((((((((((((((,
+#   (((((((((((((/              ,(((((((((((((*                 ,(((((((((((((,
+#  *(((((((((((((                .(((((((((((((((                ,(((((((((((((
+#  ((((((((((((/                /((((((((((((((((((.              ,((((((((((((/
+# (((((((((((((              *(((((((((((((((((((((((*             *((((((((((((
+# (((((((((((((            ,(((((((((((((..(((((((((((((           *((((((((((((
+# ((((((((((((,          /((((((((((((*      /((((((((((((/         ((((((((((((
+# (((((((((((((        /((((((((((((/          (((((((((((((*       ((((((((((((
+# (((((((((((((/     /((((((((((((               ,((((((((((((,    *((((((((((((
+#  ((((((((((((((  *(((((((((((/                   *((((((((((((.  ((((((((((((/
+#  *((((((((((((((((((((((((((,                      /(((((((((((((((((((((((((
+#   (((((((((((((((((((((((((                         ((((((((((((((((((((((((,
+#   .(((((((((((((((((((((((/                         ,(((((((((((((((((((((((
+#     ((((((((((((((((((((((/                         ,(((((((((((((((((((((/
+#      *(((((((((((((((((((((                         (((((((((((((((((((((,
+#       ,(((((((((((((((((((((,                      ((((((((((((((((((((/
+#         ,(((((((((((((((((((((*                  /((((((((((((((((((((
+#            ((((((((((((((((((((((,           ,/((((((((((((((((((((,
+#              ,(((((((((((((((((((((((((((((((((((((((((((((((((((
+#                 .(((((((((((((((((((((((((((((((((((((((((((((
+#                     .((((((((((((((((((((((((((((((((((((,.
+#                          .,(((((((((((((((((((((((((.
+#
+###################################################################################
+
+.extra-variables: &extra-variables
+  - MODULE_DIR=$_WEB_ROOT/modules/custom/$CI_PROJECT_NAME
+  # Strip the `-dev` suffix out of $_TARGET_CORE to reveal the name of the Drupal core branch.
+  - CORE_BRANCH=`echo $_TARGET_CORE | sed -e "s/-dev$//"`
+
+composer:
+  extends: .composer-base
+  before_script:
+    # In this case, we want to archive everything.
+    - rm .gitattributes
+    - composer archive --file=module
+  after_script:
+    - *extra-variables
+    - rm -r -f $MODULE_DIR
+    - mkdir -p $MODULE_DIR
+    - tar -x -f module.tar -C $MODULE_DIR
+    - rm module.tar
+    - git clone https://git.drupalcode.org/project/drupal.git --depth 1 --branch $CORE_BRANCH /tmp/drupal-core
+    - cp -R /tmp/drupal-core/composer .
+    # Copy to web as well as \Drupal\Composer\Composer will expect it be there.
+    - cp -R /tmp/drupal-core/composer web
+
+composer (previous minor):
+  before_script:
+    - !reference [composer, before_script]
+  after_script:
+    - !reference [composer, after_script]
+
+composer (previous minor):
+  before_script:
+    - !reference [composer, before_script]
+  after_script:
+    - !reference [composer, after_script]
+
+phpcs:
+  before_script:
+    # Use core's PHPCS configuration.
+    - cp $_WEB_ROOT/core/phpcs.xml.dist .
+
+phpstan:
+  before_script:
+    - *extra-variables
+    # Ensure our PHPStan configuration has the correct include path to core's PHPStan configuration.
+    - sed -i "s#%rootDir%/../../../#%rootDir%/../../../$_WEB_ROOT/#" $MODULE_DIR/phpstan.neon
+
+phpunit:
+  parallel:
+    matrix:
+      - MODULE:
+          - automatic_updates_extensions
+          - automatic_updates
+          - package_manager
+        TEST_TYPE:
+          - Unit
+          - Kernel
+          - Functional
+          - FunctionalJavascript
+          - Build
+  rules:
+    # Automatic Updates Extensions has no unit or functional JavaScript tests.
+    - if: $MODULE == "automatic_updates_extensions" && ($TEST_TYPE == "Unit" || $TEST_TYPE == "FunctionalJavascript")
+      when: never
+    # Package Manager has no functional JavaScript tests.
+    - if: $MODULE == "package_manager" && $TEST_TYPE == "FunctionalJavascript"
+      when: never
+    - when: on_success
+  variables:
+    _PHPUNIT_EXTRA: '--types PHPUnit-$TEST_TYPE --module $MODULE'
+
+phpunit (previous minor):
+  rules:
+    - !reference [phpunit, rules]

DEVELOPING.md

@@ -7,7 +7,7 @@ A simple setup is enough for most users to start contributing to Automatic Updat
 Assuming you meet the [system requirements](#system-requirements), simply run the following command <sup>[[1]](#footnote-1), [[2]](#footnote-2)</sup> from the directory you would like to install your development environment under <sup>[[3]](#footnote-3)</sup>. It will prompt for confirmation before beginning.
 
 ```shell
-/bin/bash -c "$(curl -fsSL https://git.drupalcode.org/project/automatic_updates/-/raw/8.x-2.x/scripts/setup_local_dev.sh)"
+/bin/bash -c "$(curl -fsSL https://git.drupalcode.org/project/automatic_updates/-/raw/3.0.x/scripts/setup_local_dev.sh)"
 ```
 
 That's it. The success message will display next steps.
@@ -26,29 +26,35 @@ That's it. The success message will display next steps.
 
 ### System requirements
 * A *nix-based operating system, such as Linux or macOS.
-* PHP 7.4 or later.
+* Drupal 10 or later.
 * Composer 2 or later. (Automatic Updates is not compatible with Composer 1.)
 * Git must be installed.
 
-### Caveats
-* Symbolic links are not currently supported by Package Manager. If the Drupal core checkout created during setup below contains any, tests will not work. By default, there shouldn't be any, but some may exist in certain situations (for example, if Drush or Drupal core's JavaScript dependencies have been installed).<br>
-  <br>
-  To scan for symbolic links, run `find . -type l` from the Drupal core repository root. If you find any, try to identify their source and eliminate it (for example, by removing a Composer library that places them).
-
 ### Customizing your setup
 Several details of your setup can be customized via environment variables. Set these before running [the installation command above](#local-development-environment-setup).
 
 ```shell
-DRUPAL_CORE_BRANCH="9.5.x" # The branch of Drupal core that will be installed.
-AUTOMATIC_UPDATES_BRANCH="8.x-2.x" # The branch of the Automatic Updates module that will be installed.
-SITE_DIRECTORY="auto-updates-dev" # The path to the directory where the dev environment will be installed.
+DRUPAL_CORE_BRANCH="10.0.x" # The branch of Drupal core that will be installed.
+DRUPAL_CORE_SHALLOW_CLONE="TRUE" # Whether or not to do a "shallow clone" of Drupal core. (Defaults to TRUE.) See note below.
+AUTOMATIC_UPDATES_BRANCH="3.0.x" # The branch of the Automatic Updates module that will be installed.
+SITE_DIRECTORY="auto_updates_dev" # The path to the directory where the dev environment will be installed.
+SITE_HOST=".test" # The path for Drupal's TRUSTED_HOST_PATTERN.
+```
+
+Note: A shallow Git clone is much smaller and therefore faster, but it removes the ability to do debugging operations such as `git bisect` or `git blame`. To recover these abilities, [you can convert your repository to a full clone after the fact](https://stackoverflow.com/questions/6802145/how-to-convert-a-git-shallow-clone-to-a-full-clone):
+
+// cSpell:disable
+```shell
+cd auto-updates-dev
+git fetch --unshallow
 ```
+// cSpell:enable
 
 ### Alternative setup options
 You can download the setup script first to review its contents or modify it before running it:
 
 ```shell
-curl --output setup_local_dev.sh https://git.drupalcode.org/project/automatic_updates/-/raw/8.x-2.x/scripts/setup_local_dev.sh
+curl --output setup_local_dev.sh https://git.drupalcode.org/project/automatic_updates/-/raw/3.0.x/scripts/setup_local_dev.sh
 
 ./scripts/setup_local_dev.sh
 ```
@@ -71,7 +77,7 @@ To set up your environment manually, use the setup script as a reference.
 
 ---
 
-<a name="footnote-1"><sup>1</sup></a> When running a script downloaded from the Web, it is always wise to read its contents first. Ours ([`setup_local_dev.sh`](https://git.drupalcode.org/project/automatic_updates/-/raw/8.x-2.x/scripts/setup_local_dev.sh)) is documented with code comments to help with that. For a more cautious approach, see [Alternative setup options](#alternative-setup-options) above.
+<a name="footnote-1"><sup>1</sup></a> When running a script downloaded from the Web, it is always wise to read its contents first. Ours ([`setup_local_dev.sh`](https://git.drupalcode.org/project/automatic_updates/-/raw/3.0.x/scripts/setup_local_dev.sh)) is documented with code comments to help with that. For a more cautious approach, see [Alternative setup options](#alternative-setup-options) above.
 
 <a name="footnote-2"><sup>2</sup></a> Curl options explained:
 [`-f, --fail`](https://curl.se/docs/manpage.html#-f),

README.md

 Automatic Updates
 ---------------
-### Requirements
-- The Drupal project's codebase must be writable in order to use Automatic Updates. This includes Drupal, modules, themes and the Composer dependencies in the vendor directory. This makes Automatic Updates incompatible with some hosting platforms.
-- The Composer executable must be in the PATH of the web server. If the Composer executable cannot be found the location can be set by adding
-  `$config['package_manager.settings']['executables']['composer'] = '/path/to/composer';` in `settings.php`
 
-### Limitations
-- Drupal multi-site installations are not supported.
-- Automatic Updates does not support version control such as Git. It is the responsibility of site administrators to commit any updates to version control if needed.
-- Automatic Updates does not support symlinks. See [What if Automatic Updates says I have symlinks in my codebase?](#what-if-automatic-updates-says-i-have-symlinks-in-my-codebase) for help if you have any.
-
-### Updating contributed modules and themes
-Automatic Updates includes a sub-module, Automatic Updates Extensions, which supports updating contributed modules and themes.
-
-⚠️ ☢️️ **Automatic Updates Extensions is still experimental and under heavy development.** We encourage you to test it in your local development environment, or another low-stakes testing situation, but it is emphatically NOT ready for use in a production environment. ☢️ ⚠️
+Package Manager is a framework for updating Drupal core and installing contributed modules and themes via Composer. It has no user interface, but it provides an API for creating a temporary copy of the current site, making changes to the copy, and then syncing those changes back into the live site.
 
 ### Automatic Updates Initiative
 
-- Follow and read up on
-  [Ideas queue - Automatic Updates initiative](https://www.drupal.org/project/ideas/issues/2940731)
-
-### FAQ
-
-#### What if Automatic Updates says I have symlinks in my codebase?
-
-A fresh Drupal installation should not have any symlinks, but third party libraries and custom code can add them. If Automatic Updates says you have some, run the following command in your terminal to find them:
-
-```shell
-cd /var/www # Wherever your active directory is located.
-find . -type l
-```
-
-You might see output like the below, indicating symlinks in Drush's `docs` directory, as an example:
+Follow and read more on the [Automatic Updates Initiative overview and roadmap](https://www.drupal.org/project/ideas/issues/2940731).
 
-```
-./vendor/drush/drush/docs/misc/icon_PhpStorm.png
-./vendor/drush/drush/docs/img/favicon.ico
-./vendor/drush/drush/docs/contribute/CONTRIBUTING.md
-./vendor/drush/drush/docs/drush_logo-black.png
-```
+### Updating contrib modules and themes
 
-##### Composer libraries
-
-Symlinks in Composer libraries can be addressed with [Drupal's Vendor Hardening Composer Plugin](https://www.drupal.org/docs/develop/using-composer/using-drupals-vendor-hardening-composer-plugin), which "removes extraneous directories from the project's vendor directory". Use it as follows.
-
-First, add `drupal/core-vendor-hardening` to your Composer project:
-
-```shell
-composer require drupal/core-vendor-hardening
-```
-
-Then, add the following to the `composer.json` in your site root to handle the most common, known culprits. Add your own as necessary.
-
-```json
-"extra": {
-    "drupal-core-vendor-hardening": {
-        "drush/drush": ["docs"],
-        "grasmash/yaml-expander": ["scenarios"]
-    }
-}
-```
-
-The new configuration will take effect on the next Composer install or update event. Do this to apply it immediately:
+Automatic Updates includes a sub-module, Automatic Updates Extensions, which supports updating contributed modules and themes.
 
-```shell
-composer install
-```
+⚠️ ☢️️ Depending on the contributed module or theme, updates to these projects could make the site inoperable. If possible, it is highly recommended that you test these updates in a development environment first.☢️ ⚠️
 
-##### Custom code
+### More info
 
-Symlinks are seldom truly necessary and should be avoided in your own code. No solution currently exists to get around them--they must be removed in order to use Automatic Updates.
+Get more details about the Package Manager module, once installed, at it help page (`admin/help/package_manager`).

auto-update

+#!/usr/bin/env php
+<?php
+
+/**
+ * @file
+ * Provides a terminal command for performing automatic updates.
+ */
+
+use Drupal\automatic_updates\Commands\PostApplyCommand;
+use Drupal\automatic_updates\Commands\RunCommand;
+use Symfony\Component\Console\Application;
+
+if (PHP_SAPI !== 'cli') {
+  throw new \RuntimeException('This command must be run from the command line.');
+}
+
+// Find the autoloader. We know that Automatic Updates is installed somewhere
+// in a Drupal code base, so move up the file system until we find
+// `./vendor/autoload.php`.
+$current_dir = __DIR__;
+$previous_dir = NULL;
+while ($current_dir !== $previous_dir) {
+  $file = $current_dir . '/vendor/autoload.php';
+  if (file_exists($file)) {
+    /** @var \Composer\Autoload\ClassLoader $autoloader */
+    $autoloader = require_once $file;
+    break;
+  }
+  $previous_dir = $current_dir;
+  $current_dir = dirname($current_dir);
+}
+
+if (empty($autoloader)) {
+  throw new \RuntimeException('The autoloader could not be found. Did you run `composer install`?');
+}
+
+// Automatic Updates' namespace is not available for autoloading because it is
+// a Drupal module, which means Drupal must be booted up in order to access it.
+// Since Drupal isn't booted yet, we need to make the autoloader aware of the
+// command namespace.
+$autoloader->addPsr4('Drupal\\automatic_updates\\Commands\\', __DIR__ . '/src/Commands');
+
+$application = new Application('Automatic Updates', '3.0.0');
+$application->add(new RunCommand($autoloader));
+$application->add(new PostApplyCommand($autoloader));
+$application->setDefaultCommand('run')->run();

automatic_updates.info.yml

 name: 'Automatic Updates'
 type: module
 description: 'Automatically updates Drupal core.'
-core_version_requirement: ^9.3
+core_version_requirement: ^10.1
 dependencies:
   - drupal:package_manager
   - drupal:update

automatic_updates.install

@@ -5,13 +5,18 @@
  * Contains install and update functions for Automatic Updates.
  */
 
-use Drupal\automatic_updates\Validation\ReadinessRequirements;
+declare(strict_types = 1);
+
+use Drupal\automatic_updates\CronUpdateRunner;
+use Drupal\automatic_updates\UpdateStage;
+use Drupal\automatic_updates\Validation\StatusCheckRequirements;
+use Drupal\system\SystemManager;
 
 /**
  * Implements hook_uninstall().
  */
 function automatic_updates_uninstall() {
-  \Drupal::service('automatic_updates.updater')->destroy(TRUE);
+  \Drupal::service(UpdateStage::class)->destroy(TRUE);
 }
 
 /**
@@ -20,8 +25,30 @@ function automatic_updates_uninstall() {
 function automatic_updates_requirements($phase) {
   if ($phase === 'runtime') {
     // Check that site is ready to perform automatic updates.
-    /** @var \Drupal\automatic_updates\Validation\ReadinessRequirements $readiness_requirement */
-    $readiness_requirement = \Drupal::classResolver(ReadinessRequirements::class);
-    return $readiness_requirement->getRequirements();
+    /** @var \Drupal\automatic_updates\Validation\StatusCheckRequirements $status_check_requirement */
+    $status_check_requirement = \Drupal::classResolver(StatusCheckRequirements::class);
+    $requirements = $status_check_requirement->getRequirements();
+
+    // Check that site has cron updates enabled or not.
+    // @todo Remove in https://www.drupal.org/project/automatic_updates/issues/3284443
+    if (\Drupal::configFactory()->get('automatic_updates.settings')->get('unattended.level') !== CronUpdateRunner::DISABLED) {
+      $requirements['automatic_updates_cron'] = [
+        'title' => t('Cron installs updates automatically'),
+        'severity' => SystemManager::REQUIREMENT_WARNING,
+        'value' => t('Enabled. This is NOT an officially supported feature of the Automatic Updates module at this time. Use at your own risk.'),
+      ];
+    }
+    return $requirements;
   }
 }
+
+// BEGIN: DELETE FROM CORE MERGE REQUEST
+
+/**
+ * Implements hook_update_last_removed().
+ */
+function automatic_updates_update_last_removed(): int {
+  return 9002;
+}
+
+// END: DELETE FROM CORE MERGE REQUEST

automatic_updates.module

@@ -5,11 +5,19 @@
  * Contains hook implementations for Automatic Updates.
  */
 
+declare(strict_types = 1);
+
 use Drupal\automatic_updates\BatchProcessor;
-use Drupal\Core\Routing\RouteMatchInterface;
-use Drupal\automatic_updates\Validation\AdminReadinessMessages;
+use Drupal\automatic_updates\CronUpdateRunner;
+use Drupal\automatic_updates\ReleaseChooser;
+use Drupal\automatic_updates\UpdateStage;
+use Drupal\automatic_updates\Validation\StatusChecker;
 use Drupal\Core\Form\FormStateInterface;
+use Drupal\Core\Routing\RouteMatchInterface;
+use Drupal\automatic_updates\Validation\AdminStatusCheckMessages;
 use Drupal\Core\Url;
+use Drupal\package_manager\ComposerInspector;
+use Drupal\Core\Utility\Error;
 use Drupal\system\Controller\DbUpdateController;
 
 /**
@@ -17,19 +25,27 @@ use Drupal\system\Controller\DbUpdateController;
  */
 function automatic_updates_help($route_name, RouteMatchInterface $route_match) {
   switch ($route_name) {
-    case 'help.page.auto_updates':
+    case 'help.page.automatic_updates':
       $output = '<h3>' . t('About') . '</h3>';
       $output .= '<p>' . t('Automatic Updates lets you update Drupal core.') . '</p>';
       $output .= '<p>';
       $output .= t('Automatic Updates will keep Drupal secure and up-to-date by automatically installing new patch-level updates, if available, when cron runs. It also provides a user interface to check if any updates are available and install them. You can <a href=":configure-form">configure Automatic Updates</a> to install all patch-level updates, only security updates, or no updates at all, during cron. By default, only security updates are installed during cron; this requires that you <a href=":update-form">install non-security updates through the user interface</a>.', [
         ':configure-form' => Url::fromRoute('update.settings')->toString(),
-        ':update-form' => Url::fromRoute('automatic_updates.report_update')->toString(),
+        ':update-form' => Url::fromRoute('update.report_update')->toString(),
       ]);
       $output .= '</p>';
       $output .= '<p>' . t('Additionally, Automatic Updates periodically runs checks to ensure that updates can be installed, and will warn site administrators if problems are detected.') . '</p>';
       $output .= '<h3>' . t('Requirements') . '</h3>';
-      $output .= '<p>' . t('Automatic Updates requires Composer @version or later available as an executable, and PHP must have permission to run it. The path to the executable may be set in the <code>package_manager.settings:executables.composer</code> config setting, or it will be automatically detected.', ['@version' => ComposerExecutableValidator::MINIMUM_COMPOSER_VERSION]) . '</p>';
+      $output .= '<p>' . t('Automatic Updates requires a Composer executable whose version satisfies <code>@version</code>, and PHP must have permission to run it. The path to the executable may be set in the <code>package_manager.settings:executables.composer</code> config setting, or it will be automatically detected.', ['@version' => ComposerInspector::SUPPORTED_VERSION]) . '</p>';
       $output .= '<p>' . t('For more information, see the <a href=":automatic-updates-documentation">online documentation for the Automatic Updates module</a>.', [':automatic-updates-documentation' => 'https://www.drupal.org/docs/8/update/automatic-updates']) . '</p>';
+      $output .= '<h3 id="minor-update">' . t('Updating to another minor version of Drupal') . '</h3>';
+      $output .= '<p>';
+      $output .= t('Automatic Updates supports updating from one minor version of Drupal core to another; for example, from Drupal 9.4.8 to Drupal 9.5.0. This is only allowed when updating via <a href=":url">the user interface</a>. Unattended background updates can only update <em>within</em> the currently installed minor version (for example, Drupal 9.4.6 to 9.4.8).', [
+        ':url' => Url::fromRoute('update.report_update')->toString(),
+      ]);
+      $output .= '</p>';
+      $output .= '<p>' . t('This is because updating from one minor version of Drupal to another is riskier than staying within the current minor version. New minor versions of Drupal introduce changes that can, in some situations, be incompatible with installed modules and themes.') . '</p>';
+      $output .= '<p>' . t('Therefore, if you want to use Automatic Updates to update to another minor version of Drupal, it is strongly recommended to do a test update first, ideally on an isolated development copy of your site, before updating your production site.') . '</p>';
       return $output;
   }
 }
@@ -42,7 +58,6 @@ function automatic_updates_mail(string $key, array &$message, array $params): vo
   $options = [
     'langcode' => $message['langcode'],
   ];
-
   if ($key === 'cron_successful') {
     $message['subject'] = t("Drupal core was successfully updated", [], $options);
     $message['body'][] = t('Congratulations!', [], $options);
@@ -50,7 +65,54 @@ function automatic_updates_mail(string $key, array &$message, array $params): vo
       '@previous_version' => $params['previous_version'],
       '@updated_version' => $params['updated_version'],
     ], $options);
-    $message['body'][] = t('This e-mail was sent by the Automatic Updates module. Unattended updates are not yet fully supported.', [], $options);
+  }
+  elseif (str_starts_with($key, 'cron_failed')) {
+    $message['subject'] = t("Drupal core update failed", [], $options);
+
+    // If this is considered urgent, prefix the subject line with a call to
+    // action.
+    if ($params['urgent']) {
+      $message['subject'] = t('URGENT: @subject', [
+        '@subject' => $message['subject'],
+      ], $options);
+    }
+
+    $message['body'][] = t('Drupal core failed to update automatically from @previous_version to @target_version. The following error was logged:', [
+      '@previous_version' => $params['previous_version'],
+      '@target_version' => $params['target_version'],
+    ], $options);
+    $message['body'][] = $params['error_message'];
+
+    // If the problem was not due to a failed apply, provide a link for the site
+    // owner to do the update.
+    if ($key !== 'cron_failed_apply') {
+      $url = Url::fromRoute('update.report_update')
+        ->setAbsolute()
+        ->toString();
+
+      if ($key === 'cron_failed_insecure') {
+        $message['body'][] = t('Your site is running an insecure version of Drupal and should be updated as soon as possible. Visit @url to perform the update.', ['@url' => $url], $options);
+      }
+      else {
+        $message['body'][] = t('No immediate action is needed, but it is recommended that you visit @url to perform the update, or at least check that everything still looks good.', ['@url' => $url], $options);
+      }
+    }
+  }
+  elseif ($key === 'status_check_failed') {
+    $message['subject'] = t('Automatic updates readiness checks failed', [], $options);
+
+    $url = Url::fromRoute('system.status')
+      ->setAbsolute()
+      ->toString();
+    $message['body'][] = t('Your site has failed some readiness checks for automatic updates and may not be able to receive automatic updates until further action is taken. Visit @url for more information.', [
+      '@url' => $url,
+    ], $options);
+  }
+
+  // If this email was related to an unattended update, explicitly state that
+  // this isn't supported yet.
+  if (str_starts_with($key, 'cron_')) {
+    $message['body'][] = t('This email was sent by the Automatic Updates module. Unattended updates are not yet fully supported.', [], $options);
     $message['body'][] = t('If you are using this feature in production, it is strongly recommended for you to visit your site and ensure that everything still looks good.', [], $options);
   }
 }
@@ -58,17 +120,30 @@ function automatic_updates_mail(string $key, array &$message, array $params): vo
 /**
  * Implements hook_page_top().
  */
-function automatic_updates_page_top() {
-  /** @var \Drupal\automatic_updates\Validation\AdminReadinessMessages $readiness_messages */
-  $readiness_messages = \Drupal::classResolver(AdminReadinessMessages::class);
-  $readiness_messages->displayAdminPageMessages();
+function automatic_updates_page_top(array &$page_top) {
+  // Ensure error messages will be displayed on the batch page.
+  // @todo Remove this work around when https://drupal.org/i/3406612 is fixed.
+  if (\Drupal::routeMatch()->getRouteName() === 'system.batch_page.html') {
+    // Directly render a status message placeholder without any messages.
+    // Messages are not intended to be show on the batch page, but in the event
+    // an error in a AJAX callback the messages will be displayed.
+    $page_top['messages'] = [
+      '#theme' => 'status_messages',
+      '#message_list' => [],
+      '#status_headings' => [
+        'status' => t('Status message'),
+        'error' => t('Error message'),
+        'warning' => t('Warning message'),
+      ],
+    ];
+  }
+  /** @var \Drupal\automatic_updates\Validation\AdminStatusCheckMessages $status_check_messages */
+  $status_check_messages = \Drupal::classResolver(AdminStatusCheckMessages::class);
+  $status_check_messages->displayAdminPageMessages();
 
   // @todo Rely on the route option after https://www.drupal.org/i/3236497 is
   //   committed.
-  // @todo Remove 'system.batch_page.html' after
-  //   https://www.drupal.org/i/3238311 is committed.
   $skip_routes = [
-    'system.batch_page.html',
     'automatic_updates.confirmation_page',
     'automatic_updates.report_update',
     'automatic_updates.module_update',
@@ -93,110 +168,106 @@ function automatic_updates_module_implements_alter(&$implementations, $hook) {
     // own routes to avoid these messages while an update is in progress.
     unset($implementations['update']);
   }
-  if ($hook === 'cron') {
-    // Whatever mofo.
-    $hook = $implementations['automatic_updates'];
-    unset($implementations['automatic_updates']);
-    $implementations['automatic_updates'] = $hook;
-  }
-}
-
-/**
- * Implements hook_cron().
- */
-function automatic_updates_cron() {
-  \Drupal::service('automatic_updates.cron_updater')->handleCron();
-
-  /** @var \Drupal\automatic_updates\Validation\ReadinessValidationManager $checker_manager */
-  $checker_manager = \Drupal::service('automatic_updates.readiness_validation_manager');
-  $last_results = $checker_manager->getResults();
-  $last_run_time = $checker_manager->getLastRunTime();
-  // Do not run readiness checks more than once an hour unless there are no
-  // results available.
-  if ($last_results === NULL || !$last_run_time || \Drupal::time()->getRequestTime() - $last_run_time > 3600) {
-    $checker_manager->run();
-  }
-
 }
 
 /**
  * Implements hook_modules_installed().
  */
-function automatic_updates_modules_installed() {
-  // Run the readiness checkers if needed when any modules are installed in
-  // case they provide readiness checker services.
-  /** @var \Drupal\automatic_updates\Validation\ReadinessValidationManager $checker_manager */
-  $checker_manager = \Drupal::service('automatic_updates.readiness_validation_manager');
-  $checker_manager->run();
+function automatic_updates_modules_installed($modules) {
+  // Run the status checkers if needed when any modules are installed in
+  // case they provide status checkers.
+  /** @var \Drupal\automatic_updates\Validation\StatusChecker $status_checker */
+  $status_checker = \Drupal::service(StatusChecker::class);
+  $status_checker->run();
+  /** @var \Drupal\automatic_updates\CronUpdateRunner $runner */
+  $runner = \Drupal::service(CronUpdateRunner::class);
+  // If cron updates are disabled status check messages will not be displayed on
+  // admin pages. Therefore, after installing the module the user will not be
+  // alerted to any problems until they access the status report page.
+  if ($runner->getMode() === CronUpdateRunner::DISABLED) {
+    /** @var \Drupal\automatic_updates\Validation\AdminStatusCheckMessages $status_check_messages */
+    $status_check_messages = \Drupal::classResolver(AdminStatusCheckMessages::class);
+    $status_check_messages->displayResultSummary();
+  }
 }
 
 /**
  * Implements hook_modules_uninstalled().
  */
 function automatic_updates_modules_uninstalled() {
-  // Run the readiness checkers if needed when any modules are uninstalled in
-  // case they provided readiness checker services.
-  /** @var \Drupal\automatic_updates\Validation\ReadinessValidationManager $checker_manager */
-  $checker_manager = \Drupal::service('automatic_updates.readiness_validation_manager');
-  $checker_manager->run();
+  // Run the status checkers if needed when any modules are uninstalled in
+  // case they provided status checkers.
+  /** @var \Drupal\automatic_updates\Validation\StatusChecker $status_checker */
+  $status_checker = \Drupal::service(StatusChecker::class);
+  $status_checker->run();
 }
 
 /**
- * Implements hook_form_FORM_ID_alter() for 'update_manager_update_form'.
+ * Implements hook_batch_alter().
+ *
+ * @todo Remove this in https://www.drupal.org/i/3267817.
  */
-function automatic_updates_form_update_manager_update_form_alter(&$form, FormStateInterface $form_state, $form_id) {
-  // Remove current message that core updates are not supported with a link to
-  // use this module's form. The local task to 'update_manager_update_form' is
-  // replaced by our own from but this original form would still accessible via
-  // by its original URL.
-  if (isset($form['manual_updates']['#rows']['drupal']['data']['title'])) {
-    $current_route = \Drupal::routeMatch()->getRouteName();
-    if ($current_route === 'update.module_update') {
-      $redirect_route = 'automatic_updates.module_update';
-    }
-    elseif ($current_route === 'update.report_update') {
-      $redirect_route = 'automatic_updates.report_update';
-    }
-    if (!empty($redirect_route)) {
-      $core_updates_message = t(
-        '<h2>Core updates required</h2>Drupal core updates are supported by the enabled <a href="@url">Automatic Updates module</a>',
-        ['@url' => Url::fromRoute($redirect_route)->toString()]
-      );
-      $form['manual_updates']['#prefix'] = $core_updates_message;
+function automatic_updates_batch_alter(array &$batch): void {
+  foreach ($batch['sets'] as &$batch_set) {
+    if (!empty($batch_set['finished']) && $batch_set['finished'] === [DbUpdateController::class, 'batchFinished']) {
+      $batch_set['finished'] = [BatchProcessor::class, 'dbUpdateBatchFinished'];
     }
   }
 }
 
 /**
- * Implements hook_local_tasks_alter().
+ * Implements hook_form_FORM_ID_alter() for update_settings.
  */
-function automatic_updates_local_tasks_alter(array &$local_tasks) {
-  // The Update module's update form only allows updating modules and themes
-  // via archive files, which could produce unexpected results on a site using
-  // our Composer-based updater.
-  $new_routes = [
-    'update.report_update' => 'automatic_updates.report_update',
-    'update.module_update' => 'automatic_updates.module_update',
-    'update.theme_update' => 'automatic_updates.theme_update',
+function automatic_updates_form_update_settings_alter(array &$form): void {
+  $config = \Drupal::config('automatic_updates.settings');
+
+  $form['unattended_level'] = [
+    '#type' => 'radios',
+    '#title' => t('Unattended background updates'),
+    '#options' => [
+      CronUpdateRunner::DISABLED => t('Disabled'),
+      CronUpdateRunner::SECURITY => t('Security updates only'),
+      CronUpdateRunner::ALL => t('All patch releases'),
+    ],
+    '#default_value' => $config->get('unattended.level'),
+    '#description' => t('When background updates are applied, your site will be briefly put into maintenance mode.'),
   ];
-  foreach ($new_routes as $local_task_id => $new_route) {
-    if (!empty($local_tasks[$local_task_id])) {
-      $local_tasks[$local_task_id]['route_name'] = $new_route;
-    }
-  }
+  $form['unattended_method'] = [
+    '#type' => 'radios',
+    '#title' => t('How unattended updates should be run'),
+    '#options' => [
+      'web' => t('By using the Automated Cron module or a request to /system/cron'),
+      'console' => t('By the <code>auto-update</code> command-line utility'),
+    ],
+    '#default_value' => $config->get('unattended.method'),
+    '#states' => [
+      'invisible' => [
+        'input[name="unattended_level"]' => [
+          'value' => CronUpdateRunner::DISABLED,
+        ],
+      ],
+    ],
+    '#description' => t('To use the <code>/system/cron</code> method <a href="http://drupal.org/docs/user_guide/en/security-cron.html">ensure cron is set up correctly</a>.'),
+  ];
+  $form['#submit'][] = '_automatic_updates_submit_update_settings';
 }
 
 /**
- * Implements hook_batch_alter().
+ * Saves settings for unattended updates.
  *
- * @todo Remove this in https://www.drupal.org/i/3267817.
+ * @param array $form
+ *   The complete form structure.
+ * @param \Drupal\Core\Form\FormStateInterface $form_state
+ *   The form state.
  */
-function automatic_updates_batch_alter(array &$batch): void {
-  foreach ($batch['sets'] as &$batch_set) {
-    if (!empty($batch_set['finished']) && $batch_set['finished'] === [DbUpdateController::class, 'batchFinished']) {
-      $batch_set['finished'] = [BatchProcessor::class, 'dbUpdateBatchFinished'];
-    }
-  }
+function _automatic_updates_submit_update_settings(array &$form, FormStateInterface $form_state): void {
+  \Drupal::configFactory()
+    ->getEditable('automatic_updates.settings')
+    ->set('unattended', [
+      'method' => $form_state->getValue('unattended_method'),
+      'level' => $form_state->getValue('unattended_level'),
+    ])
+    ->save();
 }
 
 /**
@@ -207,22 +278,22 @@ function automatic_updates_preprocess_update_project_status(array &$variables) {
   if ($project['name'] !== 'drupal') {
     return;
   }
-  $updater = \Drupal::service('automatic_updates.updater');
+  $stage = \Drupal::service(UpdateStage::class);
   $supported_target_versions = [];
   /** @var \Drupal\automatic_updates\ReleaseChooser $recommender */
-  $recommender = \Drupal::service('automatic_updates.release_chooser');
+  $recommender = \Drupal::service(ReleaseChooser::class);
   try {
-    if ($installed_minor_release = $recommender->getLatestInInstalledMinor($updater)) {
+    if ($installed_minor_release = $recommender->getLatestInInstalledMinor($stage)) {
       $supported_target_versions[] = $installed_minor_release->getVersion();
     }
-    if ($next_minor_release = $recommender->getLatestInNextMinor($updater)) {
+    if ($next_minor_release = $recommender->getLatestInNextMinor($stage)) {
       $supported_target_versions[] = $next_minor_release->getVersion();
     }
   }
   catch (RuntimeException $exception) {
     // If for some reason we are not able to get the update recommendations
     // do not alter the report.
-    watchdog_exception('automatic_updates', $exception);
+    Error::logException(\Drupal::logger('automatic_updates'), $exception);
     return;
   }
   $variables['#attached']['library'][] = 'automatic_updates/update_status';
@@ -233,7 +304,7 @@ function automatic_updates_preprocess_update_project_status(array &$variables) {
       '#markup' => t(
         '@label <a href=":update-form">Update now</a>', [
           '@label' => $status['label'],
-          ':update-form' => Url::fromRoute('automatic_updates.report_update')->toString(),
+          ':update-form' => Url::fromRoute('update.report_update')->toString(),
         ]),
     ];
   }
@@ -244,7 +315,7 @@ function automatic_updates_preprocess_update_project_status(array &$variables) {
   foreach ($variables['versions'] as &$themed_version) {
     $version_info = &$themed_version['#version'];
     if ($supported_target_versions && in_array($version_info['version'], $supported_target_versions, TRUE)) {
-      $version_info['download_link'] = Url::fromRoute('automatic_updates.report_update')->setAbsolute()->toString();
+      $version_info['download_link'] = Url::fromRoute('update.report_update')->setAbsolute()->toString();
     }
     else {
       // If this version will not be displayed as an option on this module's

automatic_updates.post_update.php

+<?php
+
+/**
+ * @file
+ * Contains post-update hooks for Automatic Updates.
+ *
+ * DELETE THIS FILE FROM CORE MERGE REQUEST.
+ */
+
+declare(strict_types = 1);
+
+/**
+ * Implements hook_removed_post_updates().
+ */
+function automatic_updates_removed_post_updates(): array {
+  return [
+    'automatic_updates_post_update_create_status_check_mail_config' => '3.0.0',
+  ];
+}

automatic_updates.routing.yml

-automatic_updates.update_readiness:
-  path: '/admin/automatic_updates/readiness'
+automatic_updates.status_check:
+  path: '/admin/automatic_updates/status'
   defaults:
-    _controller: '\Drupal\automatic_updates\Controller\ReadinessCheckerController::run'
+    _controller: '\Drupal\automatic_updates\Controller\StatusCheckController::run'
     _title: 'Update readiness checking'
   requirements:
     _permission: 'administer software updates'
   options:
     _maintenance_access: TRUE
-    _automatic_updates_readiness_messages: skip
+    _automatic_updates_status_messages: skip
 automatic_updates.confirmation_page:
   path: '/admin/automatic-update-ready/{stage_id}'
   defaults:
@@ -17,7 +17,7 @@ automatic_updates.confirmation_page:
     _permission: 'administer software updates'
   options:
     _maintenance_access: TRUE
-    _automatic_updates_readiness_messages: skip
+    _automatic_updates_status_messages: skip
 automatic_updates.finish:
   path: '/automatic-update/finish'
   defaults:
@@ -26,45 +26,4 @@ automatic_updates.finish:
     _permission: 'administer software updates'
   options:
     _maintenance_access: TRUE
-    _automatic_updates_readiness_messages: skip
-automatic_updates.cron.post_apply:
-  path: '/automatic-update/cron/post-apply/{stage_id}/{installed_version}/{target_version}/{key}'
-  defaults:
-    _controller: 'automatic_updates.cron_updater:handlePostApply'
-  requirements:
-    _access_system_cron: 'TRUE'
-# Links to our updater form appear in three different sets of local tasks. To ensure the breadcrumbs and paths are
-# consistent with the other local tasks in each set, we need two separate routes to the same form.
-automatic_updates.report_update:
-  path: '/admin/reports/updates/automatic-update'
-  defaults:
-    _form: '\Drupal\automatic_updates\Form\UpdaterForm'
-    _title: 'Update'
-  requirements:
-    _permission: 'administer software updates'
-  options:
-    _admin_route: TRUE
-    _maintenance_access: TRUE
-    _automatic_updates_readiness_messages: skip
-automatic_updates.module_update:
-  path: '/admin/modules/automatic-update'
-  defaults:
-    _form: '\Drupal\automatic_updates\Form\UpdaterForm'
-    _title: 'Update'
-  requirements:
-    _permission: 'administer software updates'
-  options:
-    _admin_route: TRUE
-    _maintenance_access: TRUE
-    _automatic_updates_readiness_messages: skip
-automatic_updates.theme_update:
-  path: '/admin/theme/automatic-update'
-  defaults:
-    _form: '\Drupal\automatic_updates\Form\UpdaterForm'
-    _title: 'Update'
-  requirements:
-    _permission: 'administer software updates'
-  options:
-    _admin_route: TRUE
-    _maintenance_access: TRUE
-    _automatic_updates_readiness_messages: skip
+    _automatic_updates_status_messages: skip

automatic_updates.services.yml

 services:
-  automatic_updates.route_subscriber:
-    class: Drupal\automatic_updates\Routing\RouteSubscriber
+  _defaults:
+    autowire: true
+
+  Drupal\automatic_updates\Routing\RouteSubscriber:
     tags:
       - { name: event_subscriber }
-  automatic_updates.readiness_validation_manager:
-    class: Drupal\automatic_updates\Validation\ReadinessValidationManager
+  Drupal\automatic_updates\Validation\StatusChecker:
     arguments:
-      - '@keyvalue.expirable'
-      - '@datetime.time'
-      - '@event_dispatcher'
-      - '@automatic_updates.updater'
-      - '@automatic_updates.cron_updater'
-      - 24
+      # @todo Remove this when https://drupal.org/i/3325557 lands.
+      $key_value_expirable_factory: '@keyvalue.expirable'
+      $resultsTimeToLive: 24
     tags:
       - { name: event_subscriber }
-  automatic_updates.updater:
-    class: Drupal\automatic_updates\Updater
-    arguments:
-      - '@config.factory'
-      - '@package_manager.path_locator'
-      - '@package_manager.beginner'
-      - '@package_manager.stager'
-      - '@package_manager.committer'
-      - '@file_system'
-      - '@event_dispatcher'
-      - '@tempstore.shared'
-      - '@datetime.time'
-      - '@PhpTuf\ComposerStager\Infrastructure\Factory\Path\PathFactoryInterface'
-  automatic_updates.cron_updater:
-    class: Drupal\automatic_updates\CronUpdater
-    arguments:
-      - '@automatic_updates.release_chooser'
-      - '@logger.factory'
-      - '@plugin.manager.mail'
-      - '@language_manager'
-      - '@state'
-      - '@config.factory'
-      - '@package_manager.path_locator'
-      - '@package_manager.beginner'
-      - '@package_manager.stager'
-      - '@package_manager.committer'
-      - '@file_system'
-      - '@event_dispatcher'
-      - '@tempstore.shared'
-      - '@datetime.time'
-      - '@PhpTuf\ComposerStager\Infrastructure\Factory\Path\PathFactoryInterface'
-  automatic_updates.staged_projects_validator:
-    class: Drupal\automatic_updates\Validator\StagedProjectsValidator
-    arguments:
-      - '@string_translation'
-    tags:
-      - { name: event_subscriber }
-  automatic_updates.release_chooser:
-    class: Drupal\automatic_updates\ReleaseChooser
-    arguments:
-      - '@automatic_updates.validator.version_policy'
-  automatic_updates.composer_executable_validator:
-    class: Drupal\automatic_updates\Validator\PackageManagerReadinessCheck
-    arguments:
-      - '@package_manager.validator.composer_executable'
-    tags:
-      - { name: event_subscriber }
-  automatic_updates.settings_validator:
-    class: Drupal\automatic_updates\Validator\PackageManagerReadinessCheck
-    arguments:
-      - '@package_manager.validator.settings'
-    tags:
-      - { name: event_subscriber }
-  automatic_updates.validator.composer_settings:
-    class: Drupal\automatic_updates\Validator\PackageManagerReadinessCheck
-    arguments:
-      - '@package_manager.validator.composer_settings'
-    tags:
-      - { name: event_subscriber }
-  automatic_updates.disk_space_validator:
-    class: Drupal\automatic_updates\Validator\PackageManagerReadinessCheck
-    arguments:
-      - '@package_manager.validator.disk_space'
-    tags:
-      - { name: event_subscriber }
-  automatic_updates.pending_updates_validator:
-    class: Drupal\automatic_updates\Validator\PackageManagerReadinessCheck
-    arguments:
-      - '@package_manager.validator.pending_updates'
+  Drupal\automatic_updates\StatusCheckMailer: ~
+  Drupal\automatic_updates\UpdateStage:
+    calls:
+      - ['setLogger', ['@logger.channel.automatic_updates']]
+  Drupal\automatic_updates\CronUpdateRunner:
+    calls:
+      - ['setLogger', ['@logger.channel.automatic_updates']]
+    decorates: 'cron'
+  Drupal\automatic_updates\Validator\RequestedUpdateValidator:
     tags:
       - { name: event_subscriber }
-  automatic_updates.validator.file_system_permissions:
-    class: Drupal\automatic_updates\Validator\PackageManagerReadinessCheck
-    arguments:
-      - '@package_manager.validator.file_system'
+  Drupal\automatic_updates\Validator\StagedProjectsValidator:
     tags:
       - { name: event_subscriber }
-  automatic_updates.validator.multisite:
-    class: Drupal\automatic_updates\Validator\PackageManagerReadinessCheck
+  Drupal\automatic_updates\ReleaseChooser: ~
+  Drupal\automatic_updates\Validator\CronFrequencyValidator:
     arguments:
-      - '@package_manager.validator.multisite'
+      $lock: '@lock'
     tags:
       - { name: event_subscriber }
-  automatic_updates.validator.symlink:
-    class: Drupal\automatic_updates\Validator\PackageManagerReadinessCheck
-    arguments:
-      - '@package_manager.validator.symlink'
+  Drupal\automatic_updates\Validator\StagedDatabaseUpdateValidator:
     tags:
       - { name: event_subscriber }
-  automatic_updates.validator.patches:
-    class: Drupal\automatic_updates\Validator\PackageManagerReadinessCheck
-    arguments:
-      - '@package_manager.validator.patches'
+  Drupal\automatic_updates\Validator\VersionPolicyValidator:
     tags:
       - { name: event_subscriber }
-  automatic_updates.cron_frequency_validator:
-    class: Drupal\automatic_updates\Validator\CronFrequencyValidator
-    arguments:
-      - '@config.factory'
-      - '@module_handler'
-      - '@state'
-      - '@datetime.time'
-      - '@string_translation'
-      - '@automatic_updates.cron_updater'
+  Drupal\automatic_updates\Validator\WindowsValidator:
     tags:
       - { name: event_subscriber }
-  automatic_updates.validator.staged_database_updates:
-    class: Drupal\automatic_updates\Validator\StagedDatabaseUpdateValidator
+  logger.channel.automatic_updates:
+    parent: logger.channel_base
+    arguments: ['automatic_updates']
+  Drupal\automatic_updates\ConsoleUpdateStage:
     arguments:
-      - '@package_manager.path_locator'
-      - '@extension.list.module'
-      - '@extension.list.theme'
-      - '@string_translation'
-    tags:
-      - { name: event_subscriber }
-  automatic_updates.validator.xdebug:
-    class: Drupal\automatic_updates\Validator\XdebugValidator
-    tags:
-      - { name: event_subscriber }
-  automatic_updates.validator.version_policy:
-    class: Drupal\automatic_updates\Validator\VersionPolicyValidator
-    arguments:
-      - '@class_resolver'
-    tags:
-      - { name: event_subscriber }
-  automatic_updates.config_subscriber:
-    class: Drupal\automatic_updates\EventSubscriber\ConfigSubscriber
+      $lock: '@lock'
+      $committer: '@Drupal\automatic_updates\MaintenanceModeAwareCommitter'
+    calls:
+      - ['setLogger', ['@logger.channel.automatic_updates']]
+  Drupal\automatic_updates\MaintenanceModeAwareCommitter:
     tags:
       - { name: event_subscriber }
-  automatic_updates.validator.scaffold_file_permissions:
-    class: Drupal\automatic_updates\Validator\ScaffoldFilePermissionsValidator
+  Drupal\automatic_updates\CommandExecutor:
     arguments:
-      - '@package_manager.path_locator'
+      $appRoot: '%app.root%'
+  Drupal\automatic_updates\Validator\ConsoleUserValidator:
     tags:
       - { name: event_subscriber }

automatic_updates_extensions/automatic_updates_extensions.info.yml

 name: 'Automatic Updates Extensions'
 type: module
 description: 'Allows updates to themes and modules'
-core_version_requirement: ^9.3
-lifecycle: experimental
+core_version_requirement: ^10.1
 dependencies:
   - drupal:automatic_updates

automatic_updates_extensions/automatic_updates_extensions.routing.yml

@@ -7,7 +7,7 @@ automatic_updates_extensions.report_update:
     _permission: 'administer software updates'
   options:
     _admin_route: TRUE
-    _automatic_updates_readiness_messages: skip
+    _automatic_updates_status_messages: skip
 
 automatic_updates_extensions.module_update:
   path: '/admin/modules/automatic-update-extensions'
@@ -19,7 +19,7 @@ automatic_updates_extensions.module_update:
   options:
     _admin_route: TRUE
     _maintenance_access: TRUE
-    _automatic_updates_readiness_messages: skip
+    _automatic_updates_status_messages: skip
 
 automatic_updates_extension.theme_update:
   path: '/admin/appearance/automatic-update-extensions'
@@ -31,7 +31,7 @@ automatic_updates_extension.theme_update:
   options:
     _admin_route: TRUE
     _maintenance_access: TRUE
-    _automatic_updates_readiness_messages: skip
+    _automatic_updates_status_messages: skip
 
 automatic_updates_extension.confirmation_page:
   path: '/admin/automatic-update-extensions-ready/{stage_id}'
@@ -43,4 +43,4 @@ automatic_updates_extension.confirmation_page:
   options:
     _admin_route: TRUE
     _maintenance_access: TRUE
-    _automatic_updates_readiness_messages: skip
+    _automatic_updates_status_messages: skip

automatic_updates_extensions/automatic_updates_extensions.services.yml

 services:
-  automatic_updates_extensions.updater:
-    class: Drupal\automatic_updates_extensions\ExtensionUpdater
-    arguments:
-      - '@config.factory'
-      - '@package_manager.path_locator'
-      - '@package_manager.beginner'
-      - '@package_manager.stager'
-      - '@package_manager.committer'
-      - '@file_system'
-      - '@event_dispatcher'
-      - '@tempstore.shared'
-      - '@datetime.time'
-      - '@PhpTuf\ComposerStager\Infrastructure\Factory\Path\PathFactoryInterface'
-  automatic_updates_extensions.validator.packages_installed_with_composer:
-    class: Drupal\automatic_updates_extensions\Validator\PackagesInstalledWithComposerValidator
-    arguments:
-      - '@string_translation'
+  _defaults:
+    autowire: true
+
+  Drupal\automatic_updates_extensions\ExtensionUpdateStage: ~
+  Drupal\automatic_updates_extensions\Validator\UpdateReleaseValidator:
     tags:
       - { name: event_subscriber }
-  automatic_updates_extensions.validator.packages_type:
-    class: Drupal\automatic_updates_extensions\Validator\UpdatePackagesTypeValidator
-    arguments:
-      - '@string_translation'
-      - '@extension.list.module'
-      - '@extension.list.theme'
+  Drupal\automatic_updates_extensions\Validator\ForbidCoreChangesValidator:
     tags:
       - { name: event_subscriber }
-  automatic_updates_extensions.validator.target_release:
-    class: Drupal\automatic_updates_extensions\Validator\UpdateReleaseValidator
+  Drupal\automatic_updates_extensions\Validator\RequestedUpdateValidator:
     tags:
       - { name: event_subscriber }

automatic_updates_extensions/src/BatchProcessor.php

 <?php
 
+declare(strict_types = 1);
+
 namespace Drupal\automatic_updates_extensions;
 
 use Drupal\Core\Url;
-use Drupal\package_manager\Exception\StageValidationException;
 use Symfony\Component\HttpFoundation\RedirectResponse;
 
 /**
@@ -23,13 +24,13 @@ final class BatchProcessor {
   public const STAGE_ID_SESSION_KEY = '_automatic_updates_extensions_stage_id';
 
   /**
-   * Gets the updater service.
+   * Gets the update stage service.
    *
-   * @return \Drupal\automatic_updates_extensions\ExtensionUpdater
-   *   The updater service.
+   * @return \Drupal\automatic_updates_extensions\ExtensionUpdateStage
+   *   The update stage service.
    */
-  protected static function getUpdater(): ExtensionUpdater {
-    return \Drupal::service('automatic_updates_extensions.updater');
+  private static function getStage(): ExtensionUpdateStage {
+    return \Drupal::service(ExtensionUpdateStage::class);
   }
 
   /**
@@ -44,40 +45,24 @@ final class BatchProcessor {
    *   The caught exception, which will always be re-thrown once its messages
    *   have been recorded.
    */
-  protected static function handleException(\Throwable $error, array &$context): void {
-    $error_messages = [
-      $error->getMessage(),
-    ];
-
-    if ($error instanceof StageValidationException) {
-      foreach ($error->getResults() as $result) {
-        $messages = $result->getMessages();
-        if (count($messages) > 1) {
-          array_unshift($messages, $result->getSummary());
-        }
-        $error_messages = array_merge($error_messages, $messages);
-      }
-    }
-
-    foreach ($error_messages as $error_message) {
-      $context['results']['errors'][] = $error_message;
-    }
+  private static function handleException(\Throwable $error, array &$context): void {
+    $context['results']['errors'][] = $error->getMessage();
     throw $error;
   }
 
   /**
-   * Calls the updater's begin() method.
+   * Calls the update stage's begin() method.
    *
    * @param string[] $project_versions
    *   The project versions to be staged in the update, keyed by package name.
    * @param array $context
    *   The current context of the batch job.
    *
-   * @see \Drupal\automatic_updates_extensions\ExtensionUpdater::begin()
+   * @see \Drupal\automatic_updates_extensions\ExtensionUpdateStage::begin()
    */
   public static function begin(array $project_versions, array &$context): void {
     try {
-      $stage_id = static::getUpdater()->begin($project_versions);
+      $stage_id = static::getStage()->begin($project_versions);
       \Drupal::service('session')->set(static::STAGE_ID_SESSION_KEY, $stage_id);
     }
     catch (\Throwable $e) {
@@ -86,37 +71,50 @@ final class BatchProcessor {
   }
 
   /**
-   * Calls the updater's stageVersions() method.
+   * Calls the update stage's stage() method.
    *
    * @param array $context
    *   The current context of the batch job.
    *
-   * @see \Drupal\automatic_updates\Updater::stage()
+   * @see \Drupal\automatic_updates\UpdateStage::stage()
    */
   public static function stage(array &$context): void {
+    $stage_id = \Drupal::service('session')->get(static::STAGE_ID_SESSION_KEY);
     try {
-      $stage_id = \Drupal::service('session')->get(static::STAGE_ID_SESSION_KEY);
-      static::getUpdater()->claim($stage_id)->stage();
+      static::getStage()->claim($stage_id)->stage();
     }
     catch (\Throwable $e) {
-      static::clean($stage_id, $context);
+      // If the stage was not already destroyed because of this exception
+      // destroy it.
+      if (!static::getStage()->isAvailable()) {
+        static::clean($stage_id, $context);
+      }
       static::handleException($e, $context);
     }
   }
 
   /**
-   * Calls the updater's commit() method.
+   * Calls the update stage's apply() method.
    *
    * @param string $stage_id
    *   The stage ID.
    * @param array $context
    *   The current context of the batch job.
    *
-   * @see \Drupal\automatic_updates\Updater::apply()
+   * @see \Drupal\automatic_updates_extensions\ExtensionUpdateStage::apply()
    */
   public static function commit(string $stage_id, array &$context): void {
     try {
-      static::getUpdater()->claim($stage_id)->apply();
+      static::getStage()->claim($stage_id)->apply();
+      // The batch system does not allow any single request to run for longer
+      // than a second, so this will force the next operation to be done in a
+      // new request. This helps keep the running code in as consistent a state
+      // as possible.
+      // @see \Drupal\package_manager\Stage::apply()
+      // @see \Drupal\package_manager\Stage::postApply()
+      // @todo See if there's a better way to ensure the post-apply tasks run
+      //   in a new request in https://www.drupal.org/i/3293150.
+      sleep(1);
     }
     catch (\Throwable $e) {
       static::handleException($e, $context);
@@ -124,18 +122,18 @@ final class BatchProcessor {
   }
 
   /**
-   * Calls the updater's postApply() method.
+   * Calls the update stage's postApply() method.
    *
    * @param string $stage_id
    *   The stage ID.
    * @param array $context
    *   The current context of the batch job.
    *
-   * @see \Drupal\automatic_updates\Updater::postApply()
+   * @see \Drupal\automatic_updates\UpdateStage::postApply()
    */
   public static function postApply(string $stage_id, array &$context): void {
     try {
-      static::getUpdater()->claim($stage_id)->postApply();
+      static::getStage()->claim($stage_id)->postApply();
     }
     catch (\Throwable $e) {
       static::handleException($e, $context);
@@ -143,18 +141,18 @@ final class BatchProcessor {
   }
 
   /**
-   * Calls the updater's clean() method.
+   * Calls the update stage's destroy() method.
    *
    * @param string $stage_id
    *   The stage ID.
    * @param array $context
    *   The current context of the batch job.
    *
-   * @see \Drupal\automatic_updates\Updater::clean()
+   * @see \Drupal\automatic_updates_extensions\ExtensionUpdateStage::destroy()
    */
   public static function clean(string $stage_id, array &$context): void {
     try {
-      static::getUpdater()->claim($stage_id)->destroy();
+      static::getStage()->claim($stage_id)->destroy();
     }
     catch (\Throwable $e) {
       static::handleException($e, $context);
@@ -212,7 +210,7 @@ final class BatchProcessor {
    * @param array $results
    *   The batch results.
    */
-  protected static function handleBatchError(array $results): void {
+  private static function handleBatchError(array $results): void {
     if (isset($results['errors'])) {
       foreach ($results['errors'] as $error) {
         \Drupal::messenger()->addError($error);

automatic_updates_extensions/src/ExtensionUpdater.php → automatic_updates_extensions/src/ExtensionUpdateStage.php

 <?php
 
+declare(strict_types = 1);
+
 namespace Drupal\automatic_updates_extensions;
 
-use Drupal\automatic_updates\Exception\UpdateException;
-use Drupal\automatic_updates\LegacyVersionUtility;
-use Drupal\package_manager\Event\StageEvent;
-use Drupal\package_manager\Exception\StageValidationException;
-use Drupal\package_manager\Stage;
+use Drupal\Component\Datetime\TimeInterface;
+use Drupal\Core\Queue\QueueFactory;
+use Drupal\Core\StringTranslation\TranslatableMarkup;
+use Drupal\Core\TempStore\SharedTempStoreFactory;
+use Drupal\package_manager\ComposerInspector;
+use Drupal\package_manager\FailureMarker;
+use Drupal\package_manager\LegacyVersionUtility;
+use Drupal\package_manager\PathLocator;
+use Drupal\package_manager\StageBase;
+use PhpTuf\ComposerStager\API\Core\BeginnerInterface;
+use PhpTuf\ComposerStager\API\Core\CommitterInterface;
+use PhpTuf\ComposerStager\API\Core\StagerInterface;
+use PhpTuf\ComposerStager\API\Path\Factory\PathFactoryInterface;
+use Symfony\Contracts\EventDispatcher\EventDispatcherInterface;
 
 /**
  * Defines a service to perform updates for modules and themes.
@@ -15,7 +26,54 @@ use Drupal\package_manager\Stage;
  *   This class is an internal part of the module's update handling and
  *   should not be used by external code.
  */
-class ExtensionUpdater extends Stage {
+final class ExtensionUpdateStage extends StageBase {
+
+  /**
+   * {@inheritdoc}
+   */
+  protected string $type = 'automatic_updates_extensions:attended';
+
+  /**
+   * Constructs a new ExtensionUpdateStage object.
+   *
+   * @param \Drupal\package_manager\ComposerInspector $composerInspector
+   *   The Composer inspector service.
+   * @param \Drupal\package_manager\PathLocator $pathLocator
+   *   The path locator service.
+   * @param \PhpTuf\ComposerStager\API\Core\BeginnerInterface $beginner
+   *   The beginner service.
+   * @param \PhpTuf\ComposerStager\API\Core\StagerInterface $stager
+   *   The stager service.
+   * @param \PhpTuf\ComposerStager\API\Core\CommitterInterface $committer
+   *   The committer service.
+   * @param \Drupal\Core\Queue\QueueFactory $queueFactory
+   *   The queue factory.
+   * @param \Symfony\Contracts\EventDispatcher\EventDispatcherInterface $eventDispatcher
+   *   The event dispatcher service.
+   * @param \Drupal\Core\TempStore\SharedTempStoreFactory $tempStoreFactory
+   *   The shared tempstore factory.
+   * @param \Drupal\Component\Datetime\TimeInterface $time
+   *   The time service.
+   * @param \PhpTuf\ComposerStager\API\Path\Factory\PathFactoryInterface $pathFactory
+   *   The path factory service.
+   * @param \Drupal\package_manager\FailureMarker $failureMarker
+   *   The failure marker service.
+   */
+  public function __construct(
+    protected readonly ComposerInspector $composerInspector,
+    PathLocator $pathLocator,
+    BeginnerInterface $beginner,
+    StagerInterface $stager,
+    CommitterInterface $committer,
+    QueueFactory $queueFactory,
+    EventDispatcherInterface $eventDispatcher,
+    SharedTempStoreFactory $tempStoreFactory,
+    TimeInterface $time,
+    PathFactoryInterface $pathFactory,
+    FailureMarker $failureMarker,
+  ) {
+    parent::__construct($pathLocator, $beginner, $stager, $committer, $queueFactory, $eventDispatcher, $tempStoreFactory, $time, $pathFactory, $failureMarker);
+  }
 
   /**
    * Begins the update.
@@ -33,19 +91,27 @@ class ExtensionUpdater extends Stage {
     if (empty($project_versions)) {
       throw new \InvalidArgumentException("No projects to begin the update");
     }
-    $composer = $this->getActiveComposer();
     $package_versions = [
       'production' => [],
       'dev' => [],
     ];
 
-    $require_dev = $composer->getComposer()
-      ->getPackage()
-      ->getDevRequires();
+    $project_root = $this->pathLocator->getProjectRoot();
+    $info = $this->composerInspector->getRootPackageInfo($project_root);
+    $installed_packages = $this->composerInspector->getInstalledPackagesList($project_root);
     foreach ($project_versions as $project_name => $version) {
-      $package = "drupal/$project_name";
-      $group = array_key_exists($package, $require_dev) ? 'dev' : 'production';
-      $package_versions[$group][$package] = LegacyVersionUtility::convertToSemanticVersion($version);
+      $package = $installed_packages->getPackageByDrupalProjectName($project_name);
+      if (empty($package)) {
+        throw new \InvalidArgumentException("The project $project_name is not a Drupal project known to Composer and cannot be updated.");
+      }
+
+      // We don't support updating install profiles.
+      if ($package->type === 'drupal-profile') {
+        throw new \InvalidArgumentException("The project $project_name cannot be updated because updating install profiles is not supported.");
+      }
+
+      $group = isset($info['devRequires'][$package->name]) ? 'dev' : 'production';
+      $package_versions[$group][$package->name] = LegacyVersionUtility::convertToSemanticVersion($version);
     }
 
     // Ensure that package versions are available to pre-create event
@@ -91,13 +157,8 @@ class ExtensionUpdater extends Stage {
   /**
    * {@inheritdoc}
    */
-  protected function dispatch(StageEvent $event, callable $on_error = NULL): void {
-    try {
-      parent::dispatch($event, $on_error);
-    }
-    catch (StageValidationException $e) {
-      throw new UpdateException($e->getResults(), $e->getMessage() ?: "Unable to complete the update because of errors.", $e->getCode(), $e);
-    }
+  protected function getFailureMarkerMessage(): TranslatableMarkup {
+    return $this->t('Automatic updates failed to apply, and the site is in an indeterminate state. Consider restoring the code and database from a backup.');
   }
 
 }

automatic_updates_extensions/src/Form/UpdateReady.php

 <?php
 
+declare(strict_types = 1);
+
 namespace Drupal\automatic_updates_extensions\Form;
 
-use Drupal\automatic_updates\ProjectInfo;
-use Drupal\automatic_updates\Validator\StagedDatabaseUpdateValidator;
+use Drupal\automatic_updates\Form\UpdateFormBase;
+use Drupal\package_manager\ComposerInspector;
+use Drupal\package_manager\Exception\StageFailureMarkerException;
+use Drupal\package_manager\InstalledPackage;
+use Drupal\package_manager\PathLocator;
+use Drupal\package_manager\ProjectInfo;
+use Drupal\package_manager\ValidationResult;
 use Drupal\automatic_updates_extensions\BatchProcessor;
 use Drupal\automatic_updates\BatchProcessor as AutoUpdatesBatchProcessor;
-use Drupal\automatic_updates_extensions\ExtensionUpdater;
+use Drupal\automatic_updates_extensions\ExtensionUpdateStage;
 use Drupal\Core\Batch\BatchBuilder;
 use Drupal\Core\Extension\ModuleExtensionList;
-use Drupal\Core\Form\FormBase;
 use Drupal\Core\Form\FormStateInterface;
 use Drupal\Core\Render\RendererInterface;
 use Drupal\Core\Messenger\MessengerInterface;
@@ -17,74 +23,49 @@ use Drupal\Core\State\StateInterface;
 use Drupal\Core\StringTranslation\TranslatableMarkup;
 use Drupal\package_manager\Exception\StageException;
 use Drupal\package_manager\Exception\StageOwnershipException;
+use Drupal\system\SystemManager;
 use Symfony\Component\DependencyInjection\ContainerInterface;
+use Symfony\Component\EventDispatcher\EventDispatcherInterface;
 
 /**
  * Defines a form to commit staged updates.
  *
  * @internal
- *   Form classes are internal.
+ *   Form classes are internal and should not be used by external code.
  */
-final class UpdateReady extends FormBase {
-
-  /**
-   * The updater service.
-   *
-   * @var \Drupal\automatic_updates_extensions\ExtensionUpdater
-   */
-  protected $updater;
-
-  /**
-   * The state service.
-   *
-   * @var \Drupal\Core\State\StateInterface
-   */
-  protected $state;
-
-  /**
-   * The module list service.
-   *
-   * @var \Drupal\Core\Extension\ModuleExtensionList
-   */
-  protected $moduleList;
-
-  /**
-   * The staged database update validator service.
-   *
-   * @var \Drupal\automatic_updates\Validator\StagedDatabaseUpdateValidator
-   */
-  protected $stagedDatabaseUpdateValidator;
-
-  /**
-   * The renderer service.
-   *
-   * @var \Drupal\Core\Render\RendererInterface
-   */
-  protected $renderer;
+final class UpdateReady extends UpdateFormBase {
 
   /**
    * Constructs a new UpdateReady object.
    *
-   * @param \Drupal\automatic_updates_extensions\ExtensionUpdater $updater
-   *   The updater service.
+   * @param \Drupal\automatic_updates_extensions\ExtensionUpdateStage $stage
+   *   The update stage service.
    * @param \Drupal\Core\Messenger\MessengerInterface $messenger
    *   The messenger service.
    * @param \Drupal\Core\State\StateInterface $state
    *   The state service.
-   * @param \Drupal\Core\Extension\ModuleExtensionList $module_list
+   * @param \Drupal\Core\Extension\ModuleExtensionList $moduleList
    *   The module list service.
-   * @param \Drupal\automatic_updates\Validator\StagedDatabaseUpdateValidator $staged_database_update_validator
-   *   The staged database update validator service.
    * @param \Drupal\Core\Render\RendererInterface $renderer
    *   The renderer service.
+   * @param \Symfony\Component\EventDispatcher\EventDispatcherInterface $eventDispatcher
+   *   Event dispatcher service.
+   * @param \Drupal\package_manager\ComposerInspector $composerInspector
+   *   The Composer inspector service.
+   * @param \Drupal\package_manager\PathLocator $pathLocator
+   *   The path locator service.
    */
-  public function __construct(ExtensionUpdater $updater, MessengerInterface $messenger, StateInterface $state, ModuleExtensionList $module_list, StagedDatabaseUpdateValidator $staged_database_update_validator, RendererInterface $renderer) {
-    $this->updater = $updater;
+  public function __construct(
+    private readonly ExtensionUpdateStage $stage,
+    MessengerInterface $messenger,
+    private readonly StateInterface $state,
+    private readonly ModuleExtensionList $moduleList,
+    private readonly RendererInterface $renderer,
+    private readonly EventDispatcherInterface $eventDispatcher,
+    private readonly ComposerInspector $composerInspector,
+    private readonly PathLocator $pathLocator,
+  ) {
     $this->setMessenger($messenger);
-    $this->state = $state;
-    $this->moduleList = $module_list;
-    $this->stagedDatabaseUpdateValidator = $staged_database_update_validator;
-    $this->renderer = $renderer;
   }
 
   /**
@@ -99,12 +80,14 @@ final class UpdateReady extends FormBase {
    */
   public static function create(ContainerInterface $container) {
     return new static(
-      $container->get('automatic_updates_extensions.updater'),
+      $container->get(ExtensionUpdateStage::class),
       $container->get('messenger'),
       $container->get('state'),
       $container->get('extension.list.module'),
-      $container->get('automatic_updates.validator.staged_database_updates'),
-      $container->get('renderer')
+      $container->get('renderer'),
+      $container->get('event_dispatcher'),
+      $container->get(ComposerInspector::class),
+      $container->get(PathLocator::class),
     );
   }
 
@@ -113,32 +96,19 @@ final class UpdateReady extends FormBase {
    */
   public function buildForm(array $form, FormStateInterface $form_state, string $stage_id = NULL) {
     try {
-      $this->updater->claim($stage_id);
+      $this->stage->claim($stage_id);
     }
-    catch (StageOwnershipException $e) {
+    catch (StageOwnershipException) {
       $this->messenger()->addError($this->t('Cannot continue the update because another Composer operation is currently in progress.'));
       return $form;
     }
+    catch (StageFailureMarkerException $e) {
+      $this->messenger()->addError($e->getMessage());
+      return $form;
+    }
 
     $messages = [];
 
-    // If there are any installed extension with database updates in the staging
-    // area, warn the user that they might be sent to update.php once the staged
-    // changes have been applied.
-    $pending_updates = $this->stagedDatabaseUpdateValidator->getExtensionsWithDatabaseUpdates($this->updater);
-    if ($pending_updates) {
-      natcasesort($pending_updates);
-      $message_item_list = [
-        '#theme' => 'item_list',
-        '#prefix' => '<p>' . $this->t('Possible database updates were detected in the following extensions; you may be redirected to the database update page in order to complete the update process.') . '</p>',
-        '#items' => $pending_updates,
-        '#context' => [
-          'list_style' => 'automatic-updates-extensions__pending-database-updates',
-        ],
-      ];
-      $messages[MessengerInterface::TYPE_WARNING][] = $this->renderer->renderRoot($message_item_list);
-    }
-
     // Don't set any messages if the form has been submitted, because we don't
     // want them to be set during form submit.
     if (!$form_state->getUserInput()) {
@@ -164,7 +134,11 @@ final class UpdateReady extends FormBase {
     $form['package_updates'] = $this->showUpdates();
     $form['backup'] = [
       '#prefix' => '<strong>',
-      '#markup' => $this->t('Back up your database and site before you continue. <a href=":backup_url">Learn how</a>.', [':backup_url' => 'https://www.drupal.org/node/22281']),
+      '#type' => 'checkbox',
+      '#title' => $this->t('Warning: Updating contributed modules or themes may leave your site inoperable or looking wrong.'),
+      '#description' => $this->t('Back up your database and site before you continue. <a href=":backup_url">Learn how</a>. Each contributed module or theme may follow different standards for backwards compatibility, may or may not have tests, and may add or remove features in any release. For these reasons, it is highly recommended that you test this update in a development environment first.', [':backup_url' => 'https://www.drupal.org/node/22281']),
+      '#required' => TRUE,
+      '#default_value' => FALSE,
       '#suffix' => '</strong>',
     ];
     $form['maintenance_mode'] = [
@@ -172,6 +146,18 @@ final class UpdateReady extends FormBase {
       '#type' => 'checkbox',
       '#default_value' => TRUE,
     ];
+
+    // Don't run the status checks once the form has been submitted.
+    if (!$form_state->getUserInput()) {
+      $results = $this->runStatusCheck($this->stage, $this->eventDispatcher);
+      // This will have no effect if $results is empty.
+      $this->displayResults($results, $this->renderer);
+      // If any errors occurred, return the form early so the user cannot
+      // continue.
+      if (ValidationResult::getOverallSeverity($results) === SystemManager::REQUIREMENT_ERROR) {
+        return $form;
+      }
+    }
     $form['actions']['submit'] = [
       '#type' => 'submit',
       '#value' => $this->t('Continue'),
@@ -210,7 +196,7 @@ final class UpdateReady extends FormBase {
    */
   public function cancel(array &$form, FormStateInterface $form_state): void {
     try {
-      $this->updater->destroy();
+      $this->stage->destroy();
       $this->messenger()->addStatus($this->t('The update was successfully cancelled.'));
       $form_state->setRedirect('automatic_updates_extensions.report_update');
     }
@@ -226,18 +212,17 @@ final class UpdateReady extends FormBase {
    *   A render array displaying packages that will be updated.
    */
   private function showUpdates(): array {
-    // Get packages that were updated in the staging area.
-    $active = $this->updater->getActiveComposer();
-    $staged = $this->updater->getStageComposer();
-    $updated_packages = $staged->getPackagesWithDifferentVersionsIn($active);
+    // Get packages that were updated in the stage directory.
+    $installed_packages = $this->composerInspector->getInstalledPackagesList($this->pathLocator->getProjectRoot());
+    $staged_packages = $this->composerInspector->getInstalledPackagesList($this->stage->getStageDirectory());
+    $updated_packages = $staged_packages->getPackagesWithDifferentVersionsIn($installed_packages);
 
     // Build a list of package names that were updated by user request.
     $updated_by_request = [];
-    foreach ($this->updater->getPackageVersions() as $group) {
+    foreach ($this->stage->getPackageVersions() as $group) {
       $updated_by_request = array_merge($updated_by_request, array_keys($group));
     }
 
-    $installed_packages = $active->getInstalledPackages();
     $updated_by_request_info = [];
     $updated_project_info = [];
     $supported_package_types = ['drupal-module', 'drupal-theme'];
@@ -246,17 +231,17 @@ final class UpdateReady extends FormBase {
     // updated.
     foreach ($updated_packages as $name => $updated_package) {
       // Ignore anything that isn't a module or a theme.
-      if (!in_array($updated_package->getType(), $supported_package_types, TRUE)) {
+      if (!in_array($updated_package->type, $supported_package_types, TRUE)) {
         continue;
       }
       $updated_project_info[$name] = [
-        'title' => $this->getProjectTitle($updated_package->getName()),
-        'installed_version' => $installed_packages[$name]->getPrettyVersion(),
-        'updated_version' => $updated_package->getPrettyVersion(),
+        'title' => $this->getProjectTitleFromPackage($updated_package),
+        'installed_version' => $installed_packages[$updated_package->name]->version,
+        'updated_version' => $updated_package->version,
       ];
     }
 
-    foreach (array_keys($updated_packages) as $name) {
+    foreach ($updated_packages as $name => $updated_package) {
       // Sort the updated packages into two groups: the ones that were updated
       // at the request of the user, and the ones that got updated anyway
       // (probably due to Composer's dependency resolution).
@@ -282,21 +267,25 @@ final class UpdateReady extends FormBase {
   /**
    * Gets the human-readable project title for a Composer package.
    *
-   * @param string $package_name
-   *   Package name.
+   * @param \Drupal\package_manager\InstalledPackage $package
+   *   The installed package.
    *
    * @return string
-   *   The human-readable title of the project.
+   *   The human-readable title of the project. If no project information is
+   *   available, the package name is returned.
    */
-  private function getProjectTitle(string $package_name): string {
-    $project_name = str_replace('drupal/', '', $package_name);
+  private function getProjectTitleFromPackage(InstalledPackage $package): string {
+    $project_name = $package->getProjectName();
+    if (!$project_name) {
+      return $package->name;
+    }
     $project_info = new ProjectInfo($project_name);
     $project_data = $project_info->getProjectInfo();
     if ($project_data) {
       return $project_data['title'];
     }
     else {
-      return $project_name;
+      return $package->name;
     }
   }
 

automatic_updates_extensions/src/Form/UpdaterForm.php

 <?php
 
+declare(strict_types = 1);
+
 namespace Drupal\automatic_updates_extensions\Form;
 
-use Drupal\automatic_updates\Event\ReadinessCheckEvent;
-use Drupal\automatic_updates\Validation\ReadinessTrait;
+use Drupal\automatic_updates\Form\UpdateFormBase;
 use Drupal\automatic_updates_extensions\BatchProcessor;
-use Drupal\automatic_updates_extensions\ExtensionUpdater;
+use Drupal\automatic_updates_extensions\ExtensionUpdateStage;
 use Drupal\Core\Batch\BatchBuilder;
-use Drupal\Core\Form\FormBase;
 use Drupal\Core\Form\FormStateInterface;
 use Drupal\Core\State\StateInterface;
 use Drupal\Core\Messenger\MessengerInterface;
 use Drupal\Core\Render\RendererInterface;
 use Drupal\Core\Url;
+use Drupal\package_manager\ComposerInspector;
+use Drupal\package_manager\Exception\StageFailureMarkerException;
+use Drupal\package_manager\FailureMarker;
+use Drupal\package_manager\PathLocator;
+use Drupal\package_manager\ProjectInfo;
+use Drupal\package_manager\ValidationResult;
 use Drupal\system\SystemManager;
+use Drupal\update\ProjectRelease;
 use Drupal\update\UpdateManagerInterface;
 use Symfony\Component\DependencyInjection\ContainerInterface;
 use Symfony\Component\EventDispatcher\EventDispatcherInterface;
@@ -22,70 +29,52 @@ use Symfony\Component\EventDispatcher\EventDispatcherInterface;
  * A form for selecting extension updates.
  *
  * @internal
- *   Form classes are internal.
+ *   Form classes are internal and should not be used by external code.
  */
-final class UpdaterForm extends FormBase {
-
-  use ReadinessTrait;
-
-  /**
-   * The extension updater service.
-   *
-   * @var \Drupal\automatic_updates_extensions\ExtensionUpdater
-   */
-  private $extensionUpdater;
-
-  /**
-   * The event dispatcher service.
-   *
-   * @var \Symfony\Component\EventDispatcher\EventDispatcherInterface
-   */
-  private $eventDispatcher;
-
-  /**
-   * The state service.
-   *
-   * @var \Drupal\Core\State\StateInterface
-   */
-  private $state;
-
-  /**
-   * The renderer service.
-   *
-   * @var \Drupal\Core\Render\RendererInterface
-   */
-  private $renderer;
+final class UpdaterForm extends UpdateFormBase {
 
   /**
    * {@inheritdoc}
    */
   public static function create(ContainerInterface $container) {
     return new static(
-      $container->get('automatic_updates_extensions.updater'),
+      $container->get(ExtensionUpdateStage::class),
       $container->get('event_dispatcher'),
       $container->get('renderer'),
-      $container->get('state')
+      $container->get('state'),
+      $container->get(FailureMarker::class),
+      $container->get(ComposerInspector::class),
+      $container->get(PathLocator::class),
     );
   }
 
   /**
    * Constructs a new UpdaterForm object.
    *
-   * @param \Drupal\automatic_updates_extensions\ExtensionUpdater $extension_updater
-   *   The extension updater service.
-   * @param \Symfony\Component\EventDispatcher\EventDispatcherInterface $event_dispatcher
+   * @param \Drupal\automatic_updates_extensions\ExtensionUpdateStage $stage
+   *   The extension update stage service.
+   * @param \Symfony\Component\EventDispatcher\EventDispatcherInterface $eventDispatcher
    *   The extension event dispatcher service.
    * @param \Drupal\Core\Render\RendererInterface $renderer
    *   The renderer service.
    * @param \Drupal\Core\State\StateInterface $state
    *   The state service.
+   * @param \Drupal\package_manager\FailureMarker $failureMarker
+   *   The failure marker service.
+   * @param \Drupal\package_manager\ComposerInspector $composerInspector
+   *   The Composer inspector service.
+   * @param \Drupal\package_manager\PathLocator $pathLocator
+   *   The path locator service.
    */
-  public function __construct(ExtensionUpdater $extension_updater, EventDispatcherInterface $event_dispatcher, RendererInterface $renderer, StateInterface $state) {
-    $this->extensionUpdater = $extension_updater;
-    $this->eventDispatcher = $event_dispatcher;
-    $this->renderer = $renderer;
-    $this->state = $state;
-  }
+  public function __construct(
+    private readonly ExtensionUpdateStage $stage,
+    private readonly EventDispatcherInterface $eventDispatcher,
+    private readonly RendererInterface $renderer,
+    private readonly StateInterface $state,
+    private readonly FailureMarker $failureMarker,
+    private readonly ComposerInspector $composerInspector,
+    private readonly PathLocator $pathLocator,
+  ) {}
 
   /**
    * {@inheritdoc}
@@ -98,6 +87,13 @@ final class UpdaterForm extends FormBase {
    * {@inheritdoc}
    */
   public function buildForm(array $form, FormStateInterface $form_state) {
+    try {
+      $this->failureMarker->assertNotExists();
+    }
+    catch (StageFailureMarkerException $e) {
+      $this->messenger()->addError($e->getMessage());
+      return $form;
+    }
     $update_projects = $this->getRecommendedModuleUpdates();
     $options = [];
     $recommended_versions = [];
@@ -115,10 +111,16 @@ final class UpdaterForm extends FormBase {
         default:
           $status_message = '';
       }
+      $project_release = ProjectRelease::createFromArray($update_project['releases'][$update_project['recommended']]);
       $options[$project_name] = [
         $update_project['title'] . $status_message,
         $update_project['existing_version'],
-        $update_project['recommended'],
+        $this->t(
+          '@version (<a href=":url">Release notes</a>)',
+          [
+            '@version' => $project_release->getVersion(),
+            ':url' => $project_release->getReleaseUrl(),
+          ]),
       ];
       $recommended_versions[$project_name] = $update_project['recommended'];
     }
@@ -137,19 +139,17 @@ final class UpdaterForm extends FormBase {
       '#empty' => $this->t('There are no available updates.'),
       '#attributes' => ['class' => ['update-recommended']],
       '#required' => TRUE,
-      '#required_error' => t('Please select one or more projects.'),
+      '#required_error' => t('Select one or more projects.'),
     ];
 
     if ($form_state->getUserInput()) {
       $results = [];
     }
     else {
-      $event = new ReadinessCheckEvent($this->extensionUpdater);
-      $this->eventDispatcher->dispatch($event);
-      $results = $event->getResults();
+      $results = $this->runStatusCheck($this->stage, $this->eventDispatcher);
     }
-    $this->displayResults($results, $this->messenger(), $this->renderer);
-    $security_level = $this->getOverallSeverity($results);
+    $this->displayResults($results, $this->renderer);
+    $security_level = ValidationResult::getOverallSeverity($results);
 
     if ($update_projects && $security_level !== SystemManager::REQUIREMENT_ERROR) {
       $form['actions'] = $this->actions($form_state);
@@ -171,9 +171,9 @@ final class UpdaterForm extends FormBase {
    * @return mixed[][]
    *   The form's actions elements.
    */
-  protected function actions(FormStateInterface $form_state): array {
+  private function actions(FormStateInterface $form_state): array {
     $actions = ['#type' => 'actions'];
-    if (!$this->extensionUpdater->isAvailable()) {
+    if (!$this->stage->isAvailable()) {
       // If the form has been submitted do not display this error message
       // because ::deleteExistingUpdate() may run on submit. The message will
       // still be displayed on form build if needed.
@@ -199,7 +199,7 @@ final class UpdaterForm extends FormBase {
    * Submit function to delete an existing in-progress update.
    */
   public function deleteExistingUpdate(): void {
-    $this->extensionUpdater->destroy(TRUE);
+    $this->stage->destroy(TRUE);
     $this->messenger()->addMessage($this->t("Staged update deleted"));
   }
 
@@ -241,22 +241,24 @@ final class UpdaterForm extends FormBase {
       return [];
     }
 
-    $project_data = update_calculate_project_data($available_updates);
+    $all_projects_data = update_calculate_project_data($available_updates);
     $outdated_modules = [];
-    $installed_packages = array_keys($this->extensionUpdater->getActiveComposer()->getInstalledPackages());
+    $installed_packages = $this->composerInspector->getInstalledPackagesList($this->pathLocator->getProjectRoot());
     $non_supported_update_statuses = [];
-    foreach ($project_data as $project_name => $project_info) {
-      if (in_array($project_info['project_type'], $supported_project_types, TRUE)) {
-        if ($project_info['status'] !== UpdateManagerInterface::CURRENT) {
-          if (!in_array("drupal/$project_name", $installed_packages, TRUE)) {
-            $non_supported_update_statuses[] = $project_info['status'];
+    foreach ($all_projects_data as $project_name => $project_data) {
+      if (in_array($project_data['project_type'], $supported_project_types, TRUE)) {
+        if ($project_data['status'] !== UpdateManagerInterface::CURRENT) {
+          if ($installed_packages->getPackageByDrupalProjectName($project_name) === NULL) {
+            $non_supported_update_statuses[] = $project_data['status'];
             continue;
           }
-          if (!empty($project_info['recommended'])) {
-            $outdated_modules[$project_name] = $project_info;
+          $project_information = new ProjectInfo($project_name);
+          $installable_versions = array_keys($project_information->getInstallableReleases());
+          if (!empty($project_data['recommended']) && in_array($project_data['recommended'], $installable_versions, TRUE)) {
+            $outdated_modules[$project_name] = $project_data;
           }
           else {
-            $non_supported_update_statuses[] = $project_info['status'];
+            $non_supported_update_statuses[] = $project_data['status'];
           }
         }
       }
@@ -287,7 +289,6 @@ final class UpdaterForm extends FormBase {
           $message_status
         );
       }
-
     }
     return $outdated_modules;
   }