automatic_updates.info.yml

@@ -2,6 +2,7 @@ name: 'Automatic Updates'
 type: module
 description: 'Automatically updates Drupal core.'
 core_version_requirement: ^9.2
+lifecycle: experimental
 dependencies:
   - drupal:automatic_updates_9_3_shim
   - drupal:package_manager

automatic_updates.module

@@ -148,7 +148,7 @@ function automatic_updates_form_update_manager_update_form_alter(&$form, FormSta
  * Implements hook_form_FORM_ID_alter() for 'update_settings' form.
  */
 function automatic_updates_form_update_settings_alter(array &$form, FormStateInterface $form_state, string $form_id) {
-  $project_info = new ProjectInfo();
+  $project_info = new ProjectInfo('drupal');
   $version = ExtensionVersion::createFromVersionString($project_info->getInstalledVersion());
   $current_minor = $version->getMajorVersion() . '.' . $version->getMinorVersion();
   // @todo In https://www.drupal.org/node/2998285 use the update XML to

automatic_updates.routing.yml

@@ -7,6 +7,7 @@ automatic_updates.update_readiness:
     _permission: 'administer software updates'
   options:
     _maintenance_access: TRUE
+    _automatic_updates_readiness_messages: skip
 automatic_updates.confirmation_page:
   path: '/admin/automatic-update-ready/{stage_id}'
   defaults:
@@ -16,6 +17,7 @@ automatic_updates.confirmation_page:
     _permission: 'administer software updates'
   options:
     _maintenance_access: TRUE
+    _automatic_updates_readiness_messages: skip
 automatic_updates.finish:
   path: '/automatic-update/finish'
   defaults:
@@ -24,6 +26,7 @@ automatic_updates.finish:
     _permission: 'administer software updates'
   options:
     _maintenance_access: TRUE
+    _automatic_updates_readiness_messages: skip
 # Links to our updater form appear in three different sets of local tasks. To ensure the breadcrumbs and paths are
 # consistent with the other local tasks in each set, we need two separate routes to the same form.
 automatic_updates.report_update:

automatic_updates.services.yml

@@ -129,3 +129,11 @@ services:
       - '@string_translation'
     tags:
       - { name: event_subscriber }
+  automatic_updates.validator.xdebug:
+    class: Drupal\automatic_updates\Validator\XdebugValidator
+    tags:
+      - { name: event_subscriber }
+  automatic_updates.validator.target_release:
+    class: \Drupal\automatic_updates\Validator\UpdateReleaseValidator
+    tags:
+      - { name: event_subscriber }

automatic_updates_extensions/automatic_updates_extensions.info.yml

@@ -2,6 +2,7 @@ name: 'Automatic Updates Extensions'
 type: module
 description: 'Allows updates to themes and modules'
 core_version_requirement: ^9.2
+hidden: true
+lifecycle: experimental
 dependencies:
   - drupal:automatic_updates
-hidden: true

automatic_updates_extensions/automatic_updates_extensions.links.task.yml

+automatic_updates_extensions.report_update:
+  route_name: automatic_updates_extensions.report_update
+  base_route: system.admin_reports
+  title: Update Extensions
+  weight: 20
+
+automatic_updates_extensions.module_update:
+  route_name: automatic_updates_extensions.module_update
+  base_route: system.modules_list
+  title: Update Extensions
+  weight: 20
+
+automatic_updates_extensions.theme_update:
+  route_name: automatic_updates_extension.theme_update
+  base_route: system.themes_page
+  title: Update Extensions
+  weight: 20

automatic_updates_extensions/automatic_updates_extensions.routing.yml

-automatic_updates_extensions.update:
-  path: '/admin/automatic-update-extensions'
+automatic_updates_extensions.report_update:
+  path: 'admin/reports/updates/automatic-update-extensions'
   defaults:
     _form: 'Drupal\automatic_updates_extensions\Form\UpdaterForm'
     _title: 'Automatic Updates Form'
@@ -8,3 +8,39 @@ automatic_updates_extensions.update:
   options:
     _admin_route: TRUE
     _automatic_updates_readiness_messages: skip
+
+automatic_updates_extensions.module_update:
+  path: '/admin/modules/automatic-update-extensions'
+  defaults:
+    _form: 'Drupal\automatic_updates_extensions\Form\UpdaterForm'
+    _title: 'Automatic Updates Form'
+  requirements:
+    _permission: 'administer software updates'
+  options:
+    _admin_route: TRUE
+    _maintenance_access: TRUE
+    _automatic_updates_readiness_messages: skip
+
+automatic_updates_extension.theme_update:
+  path: '/admin/appearance/automatic-update-extensions'
+  defaults:
+    _form: 'Drupal\automatic_updates_extensions\Form\UpdaterForm'
+    _title: 'Automatic Updates Form'
+  requirements:
+    _permission: 'administer software updates'
+  options:
+    _admin_route: TRUE
+    _maintenance_access: TRUE
+    _automatic_updates_readiness_messages: skip
+
+automatic_updates_extension.confirmation_page:
+  path: '/admin/automatic-update-extensions-ready/{stage_id}'
+  defaults:
+    _form: '\Drupal\automatic_updates_extensions\Form\UpdateReady'
+    _title: 'Ready to update'
+  requirements:
+    _permission: 'administer software updates'
+  options:
+    _admin_route: TRUE
+    _maintenance_access: TRUE
+    _automatic_updates_readiness_messages: skip

automatic_updates_extensions/automatic_updates_extensions.services.yml

@@ -11,3 +11,7 @@ services:
       - '@event_dispatcher'
       - '@tempstore.shared'
       - '@datetime.time'
+  automatic_updates_extensions.validator.target_release:
+    class: Drupal\automatic_updates_extensions\Validator\UpdateReleaseValidator
+    tags:
+      - { name: event_subscriber }

automatic_updates_extensions/src/BatchProcessor.php

+<?php
+
+namespace Drupal\automatic_updates_extensions;
+
+use Drupal\Core\Url;
+use Drupal\package_manager\Exception\StageValidationException;
+use Symfony\Component\HttpFoundation\RedirectResponse;
+
+/**
+ * A batch processor for updates.
+ */
+class BatchProcessor {
+
+  /**
+   * The session key under which the stage ID is stored.
+   *
+   * @var string
+   */
+  public const STAGE_ID_SESSION_KEY = '_automatic_updates_extensions_stage_id';
+
+  /**
+   * Gets the updater service.
+   *
+   * @return \Drupal\automatic_updates_extensions\ExtensionUpdater
+   *   The updater service.
+   */
+  protected static function getUpdater(): ExtensionUpdater {
+    return \Drupal::service('automatic_updates_extensions.updater');
+  }
+
+  /**
+   * Records messages from a throwable, then re-throws it.
+   *
+   * @param \Throwable $error
+   *   The caught exception.
+   * @param array $context
+   *   The current context of the batch job.
+   *
+   * @throws \Throwable
+   *   The caught exception, which will always be re-thrown once its messages
+   *   have been recorded.
+   */
+  protected static function handleException(\Throwable $error, array &$context): void {
+    $error_messages = [
+      $error->getMessage(),
+    ];
+
+    if ($error instanceof StageValidationException) {
+      foreach ($error->getResults() as $result) {
+        $messages = $result->getMessages();
+        if (count($messages) > 1) {
+          array_unshift($messages, $result->getSummary());
+        }
+        $error_messages = array_merge($error_messages, $messages);
+      }
+    }
+
+    foreach ($error_messages as $error_message) {
+      $context['results']['errors'][] = $error_message;
+    }
+    throw $error;
+  }
+
+  /**
+   * Calls the updater's begin() method.
+   *
+   * @param string[] $project_versions
+   *   The project versions to be staged in the update, keyed by package name.
+   * @param array $context
+   *   The current context of the batch job.
+   *
+   * @see \Drupal\automatic_updates_extensions\ExtensionUpdater::begin()
+   */
+  public static function begin(array $project_versions, array &$context): void {
+    try {
+      $stage_id = static::getUpdater()->begin($project_versions);
+      \Drupal::service('session')->set(static::STAGE_ID_SESSION_KEY, $stage_id);
+    }
+    catch (\Throwable $e) {
+      static::handleException($e, $context);
+    }
+  }
+
+  /**
+   * Calls the updater's stageVersions() method.
+   *
+   * @param array $context
+   *   The current context of the batch job.
+   *
+   * @see \Drupal\automatic_updates\Updater::stage()
+   */
+  public static function stage(array &$context): void {
+    try {
+      $stage_id = \Drupal::service('session')->get(static::STAGE_ID_SESSION_KEY);
+      static::getUpdater()->claim($stage_id)->stage();
+    }
+    catch (\Throwable $e) {
+      static::clean($stage_id, $context);
+      static::handleException($e, $context);
+    }
+  }
+
+  /**
+   * Calls the updater's commit() method.
+   *
+   * @param string $stage_id
+   *   The stage ID.
+   * @param array $context
+   *   The current context of the batch job.
+   *
+   * @see \Drupal\automatic_updates\Updater::apply()
+   */
+  public static function commit(string $stage_id, array &$context): void {
+    try {
+      static::getUpdater()->claim($stage_id)->apply();
+    }
+    catch (\Throwable $e) {
+      static::handleException($e, $context);
+    }
+  }
+
+  /**
+   * Calls the updater's clean() method.
+   *
+   * @param string $stage_id
+   *   The stage ID.
+   * @param array $context
+   *   The current context of the batch job.
+   *
+   * @see \Drupal\automatic_updates\Updater::clean()
+   */
+  public static function clean(string $stage_id, array &$context): void {
+    try {
+      static::getUpdater()->claim($stage_id)->destroy();
+    }
+    catch (\Throwable $e) {
+      static::handleException($e, $context);
+    }
+  }
+
+  /**
+   * Finishes the stage batch job.
+   *
+   * @param bool $success
+   *   Indicate that the batch API tasks were all completed successfully.
+   * @param array $results
+   *   An array of all the results.
+   * @param array $operations
+   *   A list of the operations that had not been completed by the batch API.
+   */
+  public static function finishStage(bool $success, array $results, array $operations): ?RedirectResponse {
+    if ($success) {
+      $stage_id = \Drupal::service('session')->get(static::STAGE_ID_SESSION_KEY);
+      $url = Url::fromRoute('automatic_updates_extension.confirmation_page', [
+        'stage_id' => $stage_id,
+      ]);
+      return new RedirectResponse($url->setAbsolute()->toString());
+    }
+    static::handleBatchError($results);
+    return NULL;
+  }
+
+  /**
+   * Finishes the commit batch job.
+   *
+   * @param bool $success
+   *   Indicate that the batch API tasks were all completed successfully.
+   * @param array $results
+   *   An array of all the results.
+   * @param array $operations
+   *   A list of the operations that had not been completed by the batch API.
+   */
+  public static function finishCommit(bool $success, array $results, array $operations): ?RedirectResponse {
+    \Drupal::service('session')->remove(static::STAGE_ID_SESSION_KEY);
+
+    if ($success) {
+      $url = Url::fromRoute('automatic_updates.finish')
+        ->setAbsolute()
+        ->toString();
+      return new RedirectResponse($url);
+    }
+    static::handleBatchError($results);
+    return NULL;
+  }
+
+  /**
+   * Handles a batch job that finished with errors.
+   *
+   * @param array $results
+   *   The batch results.
+   */
+  protected static function handleBatchError(array $results): void {
+    if (isset($results['errors'])) {
+      foreach ($results['errors'] as $error) {
+        \Drupal::messenger()->addError($error);
+      }
+    }
+    else {
+      \Drupal::messenger()->addError("Update error");
+    }
+  }
+
+}

automatic_updates_extensions/src/ExtensionUpdater.php

@@ -2,10 +2,94 @@
 
 namespace Drupal\automatic_updates_extensions;
 
+use Drupal\automatic_updates\Exception\UpdateException;
+use Drupal\package_manager\Event\StageEvent;
+use Drupal\package_manager\Exception\StageValidationException;
 use Drupal\package_manager\Stage;
 
 /**
  * Defines a service to perform updates for modules and themes.
  */
 class ExtensionUpdater extends Stage {
+
+  /**
+   * Begins the update.
+   *
+   * @param string[] $project_versions
+   *   The versions of the packages to update to, keyed by package name.
+   *
+   * @return string
+   *   The unique ID of the stage.
+   *
+   * @throws \InvalidArgumentException
+   *   Thrown if no project version for Drupal core is provided.
+   */
+  public function begin(array $project_versions): string {
+    $composer = $this->getActiveComposer();
+    $package_versions = [
+      'production' => [],
+      'dev' => [],
+    ];
+
+    $require_dev = $composer->getComposer()
+      ->getPackage()
+      ->getDevRequires();
+    foreach ($project_versions as $project_name => $version) {
+      $package = "drupal/$project_name";
+      $group = array_key_exists($package, $require_dev) ? 'dev' : 'production';
+      $package_versions[$group][$package] = LegacyVersionUtility::convertToSemanticVersion($version);
+    }
+
+    // Ensure that package versions are available to pre-create event
+    // subscribers. We can't use ::setMetadata() here because it requires the
+    // stage to be claimed, but that only happens during ::create().
+    $this->tempStore->set(static::TEMPSTORE_METADATA_KEY, [
+      'packages' => $package_versions,
+    ]);
+    return parent::create();
+  }
+
+  /**
+   * Returns the package versions that will be required during the update.
+   *
+   * @return string[][]
+   *   An array with two sub-arrays: 'production' and 'dev'. Each is a set of
+   *   package versions, where the keys are package names and the values are
+   *   version constraints understood by Composer.
+   */
+  public function getPackageVersions(): array {
+    return $this->getMetadata('packages');
+  }
+
+  /**
+   * Stages the update.
+   */
+  public function stage(): void {
+    $this->checkOwnership();
+
+    // Convert an associative array of package versions, keyed by name, to
+    // command-line arguments in the form `vendor/name:version`.
+    $map = function (array $versions): array {
+      $requirements = [];
+      foreach ($versions as $package => $version) {
+        $requirements[] = "$package:$version";
+      }
+      return $requirements;
+    };
+    $versions = array_map($map, $this->getPackageVersions());
+    $this->require($versions['production'], $versions['dev']);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function dispatch(StageEvent $event, callable $on_error = NULL): void {
+    try {
+      parent::dispatch($event, $on_error);
+    }
+    catch (StageValidationException $e) {
+      throw new UpdateException($e->getResults(), $e->getMessage() ?: "Unable to complete the update because of errors.", $e->getCode(), $e);
+    }
+  }
+
 }

automatic_updates_extensions/src/Form/UpdateReady.php

+<?php
+
+namespace Drupal\automatic_updates_extensions\Form;
+
+use Drupal\automatic_updates_extensions\BatchProcessor;
+use Drupal\automatic_updates\BatchProcessor as AutoUpdatesBatchProcessor;
+use Drupal\automatic_updates_extensions\ExtensionUpdater;
+use Drupal\Core\Batch\BatchBuilder;
+use Drupal\Core\Extension\ModuleExtensionList;
+use Drupal\Core\Form\FormBase;
+use Drupal\Core\Form\FormStateInterface;
+use Drupal\Core\Messenger\MessengerInterface;
+use Drupal\Core\State\StateInterface;
+use Drupal\package_manager\Exception\StageException;
+use Drupal\package_manager\Exception\StageOwnershipException;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+
+/**
+ * Defines a form to commit staged updates.
+ *
+ * @internal
+ *   Form classes are internal.
+ */
+class UpdateReady extends FormBase {
+
+  /**
+   * The updater service.
+   *
+   * @var \Drupal\automatic_updates_extensions\ExtensionUpdater
+   */
+  protected $updater;
+
+  /**
+   * The state service.
+   *
+   * @var \Drupal\Core\State\StateInterface
+   */
+  protected $state;
+
+  /**
+   * The module list service.
+   *
+   * @var \Drupal\Core\Extension\ModuleExtensionList
+   */
+  protected $moduleList;
+
+  /**
+   * Constructs a new UpdateReady object.
+   *
+   * @param \Drupal\automatic_updates_extensions\ExtensionUpdater $updater
+   *   The updater service.
+   * @param \Drupal\Core\Messenger\MessengerInterface $messenger
+   *   The messenger service.
+   * @param \Drupal\Core\State\StateInterface $state
+   *   The state service.
+   * @param \Drupal\Core\Extension\ModuleExtensionList $module_list
+   *   The module list service.
+   */
+  public function __construct(ExtensionUpdater $updater, MessengerInterface $messenger, StateInterface $state, ModuleExtensionList $module_list) {
+    $this->updater = $updater;
+    $this->setMessenger($messenger);
+    $this->state = $state;
+    $this->moduleList = $module_list;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getFormId() {
+    return 'automatic_updates_update_ready_form';
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function create(ContainerInterface $container) {
+    return new static(
+      $container->get('automatic_updates_extensions.updater'),
+      $container->get('messenger'),
+      $container->get('state'),
+      $container->get('extension.list.module'),
+    );
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function buildForm(array $form, FormStateInterface $form_state, string $stage_id = NULL) {
+    try {
+      $this->updater->claim($stage_id);
+    }
+    catch (StageOwnershipException $e) {
+      $this->messenger()->addError($this->t('Cannot continue the update because another Composer operation is currently in progress.'));
+      return $form;
+    }
+
+    $messages = [];
+
+    // @todo Add logic to warn about possible new database updates. Determine if
+    //   \Drupal\automatic_updates\Validator\StagedDatabaseUpdateValidator
+    //   should be duplicated or changed so that it can work with other stages.
+    // @see \Drupal\automatic_updates\Validator\StagedDatabaseUpdateValidator
+    // @see \Drupal\automatic_updates\Form\UpdateReady::buildForm()
+
+    // Don't set any messages if the form has been submitted, because we don't
+    // want them to be set during form submit.
+    if (!$form_state->getUserInput()) {
+      foreach ($messages as $type => $messages_of_type) {
+        foreach ($messages_of_type as $message) {
+          $this->messenger()->addMessage($message, $type);
+        }
+      }
+    }
+
+    $form['actions'] = [
+      'cancel' => [
+        '#type' => 'submit',
+        '#value' => $this->t('Cancel update'),
+        '#submit' => ['::cancel'],
+      ],
+      '#type' => 'actions',
+    ];
+    $form['stage_id'] = [
+      '#type' => 'value',
+      '#value' => $stage_id,
+    ];
+
+    // @todo Display the project versions that will be update including any
+    //   dependencies that are Drupal projects.
+    $form['backup'] = [
+      '#prefix' => '<strong>',
+      '#markup' => $this->t('Back up your database and site before you continue. <a href=":backup_url">Learn how</a>.', [':backup_url' => 'https://www.drupal.org/node/22281']),
+      '#suffix' => '</strong>',
+    ];
+    $form['maintenance_mode'] = [
+      '#title' => $this->t('Perform updates with site in maintenance mode (strongly recommended)'),
+      '#type' => 'checkbox',
+      '#default_value' => TRUE,
+    ];
+    $form['actions']['submit'] = [
+      '#type' => 'submit',
+      '#value' => $this->t('Continue'),
+    ];
+
+    return $form;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function submitForm(array &$form, FormStateInterface $form_state) {
+    // Store maintenance_mode setting so we can restore it when done.
+    $this->getRequest()
+      ->getSession()
+      ->set(AutoUpdatesBatchProcessor::MAINTENANCE_MODE_SESSION_KEY, $this->state->get('system.maintenance_mode'));
+
+    if ($form_state->getValue('maintenance_mode')) {
+      $this->state->set('system.maintenance_mode', TRUE);
+    }
+    $stage_id = $form_state->getValue('stage_id');
+    $batch = (new BatchBuilder())
+      ->setTitle($this->t('Apply updates'))
+      ->setInitMessage($this->t('Preparing to apply updates'))
+      ->addOperation([BatchProcessor::class, 'commit'], [$stage_id])
+      ->addOperation([BatchProcessor::class, 'clean'], [$stage_id])
+      ->setFinishCallback([BatchProcessor::class, 'finishCommit'])
+      ->toArray();
+
+    batch_set($batch);
+  }
+
+  /**
+   * Cancels the in-progress update.
+   */
+  public function cancel(array &$form, FormStateInterface $form_state): void {
+    try {
+      $this->updater->destroy();
+      $this->messenger()->addStatus($this->t('The update was successfully cancelled.'));
+      $form_state->setRedirect('automatic_updates_extensions.report_update');
+    }
+    catch (StageException $e) {
+      $this->messenger()->addError($e->getMessage());
+    }
+  }
+
+}

automatic_updates_extensions/src/Form/UpdaterForm.php

@@ -4,7 +4,9 @@ namespace Drupal\automatic_updates_extensions\Form;
 
 use Drupal\automatic_updates\Event\ReadinessCheckEvent;
 use Drupal\automatic_updates\Validation\ReadinessTrait;
+use Drupal\automatic_updates_extensions\BatchProcessor;
 use Drupal\automatic_updates_extensions\ExtensionUpdater;
+use Drupal\Core\Batch\BatchBuilder;
 use Drupal\Core\Form\FormBase;
 use Drupal\Core\Form\FormStateInterface;
 use Drupal\system\SystemManager;
@@ -174,7 +176,18 @@ class UpdaterForm extends FormBase {
     $selected_projects = array_filter($projects);
     $recommended_versions = $form_state->getValue('recommended_versions');
     $selected_versions = array_intersect_key($recommended_versions, $selected_projects);
-    $this->messenger()->addMessage(print_r($selected_versions, TRUE));
+    $batch = (new BatchBuilder())
+      ->setTitle($this->t('Downloading updates'))
+      ->setInitMessage($this->t('Preparing to download updates'))
+      ->addOperation(
+        [BatchProcessor::class, 'begin'],
+        [$selected_versions]
+      )
+      ->addOperation([BatchProcessor::class, 'stage'])
+      ->setFinishCallback([BatchProcessor::class, 'finishStage'])
+      ->toArray();
+
+    batch_set($batch);
   }
 
   /**

automatic_updates_extensions/src/LegacyVersionUtility.php

+<?php
+
+namespace Drupal\automatic_updates_extensions;
+
+use Drupal\Core\Extension\ExtensionVersion;
+
+/**
+ * A utility class for dealing with legacy version numbers.
+ *
+ * @internal
+ *    This is an internal utility class that could change in any release and
+ *    should not be used by external code.
+ */
+final class LegacyVersionUtility {
+
+  /**
+   * Converts a version number to a semantic version if needed.
+   *
+   * @param string $version
+   *   The version number.
+   *
+   * @return string
+   *   The version number, converted if needed.
+   */
+  public static function convertToSemanticVersion(string $version): string {
+    if (self::isLegacyVersion($version)) {
+      $version = substr($version, 4);
+      $version_parts = explode('-', $version);
+      $version = $version_parts[0] . '.0';
+      if (count($version_parts) === 2) {
+        $version .= '-' . $version_parts[1];
+      }
+      return $version;
+    }
+    else {
+      return $version;
+    }
+  }
+
+  /**
+   * Converts a version number to a legacy version if needed and possible.
+   *
+   * @param string $version_string
+   *   The version number.
+   *
+   * @return string
+   *   The version number, converted if needed, or NULL if not possible. Only
+   *   semantic version numbers that have patch level of 0 can be converted into
+   *   legacy version numbers.
+   */
+  public static function convertToLegacyVersion($version_string): ?string {
+    if (self::isLegacyVersion($version_string)) {
+      return $version_string;
+    }
+    $version = ExtensionVersion::createFromVersionString($version_string);
+    if ($extra = $version->getVersionExtra()) {
+      $version_string_without_extra = str_replace("-$extra", '', $version_string);
+    }
+    else {
+      $version_string_without_extra = $version_string;
+    }
+    [,, $patch] = explode('.', $version_string_without_extra);
+    // A semantic version can only be converted to legacy if it's patch level is
+    // '0'.
+    if ($patch !== '0') {
+      return NULL;
+    }
+    return '8.x-' . $version->getMajorVersion() . '.' . $version->getMinorVersion() . ($extra ? "-$extra" : '');
+  }
+
+  /**
+   * Determines if a version is legacy.
+   *
+   * @param string $version
+   *   The version number.
+   *
+   * @return bool
+   *   TRUE if the version is a legacy version number, otherwise FALSE.
+   */
+  private static function isLegacyVersion(string $version): bool {
+    return stripos($version, '8.x-') === 0;
+  }
+
+}

automatic_updates_extensions/src/Validator/UpdateReleaseValidator.php

+<?php
+
+namespace Drupal\automatic_updates_extensions\Validator;
+
+use Drupal\automatic_updates\ProjectInfo;
+use Drupal\automatic_updates_extensions\ExtensionUpdater;
+use Drupal\automatic_updates_extensions\LegacyVersionUtility;
+use Drupal\Core\StringTranslation\StringTranslationTrait;
+use Drupal\package_manager\Event\PreCreateEvent;
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
+
+/**
+ * Validates that updated projects are secure and supported.
+ */
+class UpdateReleaseValidator implements EventSubscriberInterface {
+
+  use StringTranslationTrait;
+
+  /**
+   * Checks that the update projects are secure and supported.
+   *
+   * @param \Drupal\package_manager\Event\PreCreateEvent $event
+   *   The event object.
+   */
+  public function checkRelease(PreCreateEvent $event): void {
+    $stage = $event->getStage();
+    // This check only works with Automatic Updates Extensions.
+    if (!$stage instanceof ExtensionUpdater) {
+      return;
+    }
+
+    $all_versions = $stage->getPackageVersions();
+    $messages = [];
+    foreach (['production', 'dev'] as $package_type) {
+      foreach ($all_versions[$package_type] as $package_name => $sematic_version) {
+        $package_parts = explode('/', $package_name);
+        $project_name = $package_parts[1];
+        // If the version isn't in the list of installable releases, then it
+        // isn't secure and supported and the user should receive an error.
+        $releases = (new ProjectInfo($project_name))->getInstallableReleases();
+        $is_missing_version = FALSE;
+        if (empty($releases)) {
+          $is_missing_version = TRUE;
+        }
+        elseif (!array_key_exists($sematic_version, $releases)) {
+          $legacy_version = LegacyVersionUtility::convertToLegacyVersion($sematic_version);
+          if ($legacy_version) {
+            if (!array_key_exists($legacy_version, $releases)) {
+              // If we cannot find the version using semantic or legacy then the
+              // version is missing.
+              $is_missing_version = TRUE;
+            }
+          }
+          else {
+            // If we cannot convert the semantic version into a legacy version
+            // then the version is missing.
+            $is_missing_version = TRUE;
+          }
+        }
+        if ($is_missing_version) {
+          $messages[] = $this->t('Project @project_name to version @version', [
+            '@project_name' => $project_name,
+            '@version' => $sematic_version,
+          ]);
+        }
+
+      }
+    }
+    if ($messages) {
+      $summary = $this->formatPlural(
+        count($messages),
+        'Cannot update because the following project version is not in the list of installable releases.',
+        'Cannot update because the following project versions are not in the list of installable releases.'
+      );
+      $event->addError($messages, $summary);
+    }
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function getSubscribedEvents() {
+    return [
+      PreCreateEvent::class => 'checkRelease',
+    ];
+  }
+
+}

automatic_updates_extensions/tests/fixtures/fake-site/composer.json

+{
+    "require": {
+        "drupal/core-recommended": "^9",
+        "drupal/my_module": "^9"
+    },
+    "require-dev": {
+        "drupal/my_dev_module": "^9"
+    }
+}

automatic_updates_extensions/tests/fixtures/fake-site/composer.lock

+{
+    "packages": [
+        {
+            "name": "drupal/core-recommended",
+            "version": "9.8.0",
+            "require": {
+                "drupal/core": "9.8.0"
+            }
+        },
+        {
+            "name": "drupal/my_module",
+            "version": "9.8.0"
+        }
+    ],
+    "packages-dev": [
+        {
+            "name": "drupal/my_dev_module",
+            "version": "9.8.1"
+        }
+    ]
+}

automatic_updates_extensions/tests/fixtures/fake-site/vendor/composer/installed.json

+{
+    "packages": [
+        {
+            "name": "drupal/core-recommended",
+            "version": "9.8.0",
+            "require": {
+                "drupal/core": "9.8.0"
+            }
+        },
+        {
+            "name": "drupal/core",
+            "version": "9.8.0"
+        },
+        {
+            "name": "drupal/my_module",
+            "version": "9.8.0"
+        },
+        {
+            "name": "drupal/my_dev_module",
+            "version": "9.8.1"
+        }
+    ],
+    "dev": true,
+    "dev-package-names": [
+        "drupal/my_dev_module"
+    ]
+}

automatic_updates_extensions/tests/fixtures/release-history/aaa_update_test.1.1.xml

+<?xml version="1.0" encoding="utf-8"?>
+<!-- Test legacy versions -->
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>AAA Update test</title>
+<short_name>aaa_update_test</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.x-2.,8.x-1.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/aaa_update_test</link>
+  <terms>
+   <term><name>Projects</name><value>AAA Update test project</value></term>
+  </terms>
+<releases>
+  <release>
+    <name>AAA Update test 8.x-3.0</name>
+    <version>8.x-3.0</version>
+    <tag>8.x-3.0</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-3-0-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8-3-0.tar.gz</download_link>
+    <date>1584195300</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+ <release>
+   <name>AAA Update test 8.x-2.1</name>
+   <version>8.x-2.1</version>
+   <tag>8.x-2.1</tag>
+   <status>published</status>
+   <release_link>http://example.com/aaa_update_test-8-x-2-1-release</release_link>
+   <download_link>http://example.com/aaa_update_test-8-x-2-1.tar.gz</download_link>
+   <date>1581603300</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>AAA Update test 8.x-2.1-beta1</name>
+   <version>8.x-2.1-beta1</version>
+   <tag>8.x-2.1-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/aaa_update_test-8-x-2-1-beta1-release</release_link>
+   <download_link>http://example.com/aaa_update_test-8-x-2-1-beta1.tar.gz</download_link>
+   <date>1579011300</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>AAA Update test 8.x-2.1-alpha1</name>
+   <version>8.x-2.1-alpha1</version>
+   <tag>8.x-2.1-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/aaa_update_test-8-x-2-1-alpha1-release</release_link>
+   <download_link>http://example.com/aaa_update_test-8-x-2-1-alpha1.tar.gz</download_link>
+   <date>1576419300</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>AAA Update test 8.x-2.0</name>
+   <version>8.x-2.0</version>
+   <tag>8.x-2.0</tag>
+   <status>published</status>
+   <release_link>http://example.com/aaa_update_test-8-x-2-0-release</release_link>
+   <download_link>http://example.com/aaa_update_test-8-x-2-0.tar.gz</download_link>
+   <date>1573827300</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>AAA Update test 8.x-2.0-beta1</name>
+   <version>8.x-2.0-beta1</version>
+   <tag>8.x-2.0-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/aaa_update_test-8-x-2-0-beta1-release</release_link>
+   <download_link>http://example.com/aaa_update_test-8-x-2-0-beta1.tar.gz</download_link>
+   <date>1571235300</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>AAA Update test 8.x-2.0-alpha1</name>
+   <version>8.x-2.0-alpha1</version>
+   <tag>8.x-2.0-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/aaa_update_test-8-x-2-0-alpha1-release</release_link>
+   <download_link>http://example.com/aaa_update_test-8-x-2-0-alpha1.tar.gz</download_link>
+   <date>1568643300</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>AAA Update test 8.x-1.1</name>
+   <version>8.x-1.1</version>
+   <tag>8.x-1.1</tag>
+   <status>published</status>
+   <release_link>http://example.com/aaa_update_test-8-x-1-1-release</release_link>
+   <download_link>http://example.com/aaa_update_test-8-x-1-1.tar.gz</download_link>
+   <date>1566051300</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>AAA Update test 8.x-1.1-beta1</name>
+   <version>8.x-1.1-beta1</version>
+   <tag>8.x-1.1-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/aaa_update_test-8-x-1-1-beta1-release</release_link>
+   <download_link>http://example.com/aaa_update_test-8-x-1-1-beta1.tar.gz</download_link>
+   <date>1563459300</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>AAA Update test 8.x-1.1-alpha1</name>
+   <version>8.x-1.1-alpha1</version>
+   <tag>8.x-1.1-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/aaa_update_test-8-x-1-1-alpha1-release</release_link>
+   <download_link>http://example.com/aaa_update_test-8-x-1-1-alpha1.tar.gz</download_link>
+   <date>1560867300</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>AAA Update test 8.x-1.0</name>
+   <version>8.x-1.0</version>
+   <tag>8.x-1.0</tag>
+   <status>published</status>
+   <release_link>http://example.com/aaa_update_test-8-x-1-0-release</release_link>
+   <download_link>http://example.com/aaa_update_test-8-x-1-0.tar.gz</download_link>
+   <date>1558275300</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>AAA Update test 8.x-1.0-beta1</name>
+   <version>8.x-1.0-beta1</version>
+   <tag>8.x-1.0-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/aaa_update_test-8-x-1-0-beta1-release</release_link>
+   <download_link>http://example.com/aaa_update_test-8-x-1-0-beta1.tar.gz</download_link>
+   <date>1555683300</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>AAA Update test 8.x-1.0-alpha1</name>
+   <version>8.x-1.0-alpha1</version>
+   <tag>8.x-1.0-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/aaa_update_test-8-x-1-0-alpha1-release</release_link>
+   <download_link>http://example.com/aaa_update_test-8-x-1-0-alpha1.tar.gz</download_link>
+   <date>1553091300</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+</releases>
+</project>

automatic_updates_extensions/tests/fixtures/release-history/alpha.1.1.0.xml

+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>Alpha</title>
+<short_name>alpha</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>1.1.,1.0.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/alpha</link>
+  <terms>
+   <term><name>Projects</name><value>Alpha project</value></term>
+  </terms>
+<releases>
+  <release>
+    <name>Alpha 1.1.0</name>
+    <version>1.1.0</version>
+    <tag>1.1.0</tag>
+    <status>published</status>
+    <release_link>http://example.com/alpha-1-1-0-release</release_link>
+    <download_link>http://example.com/alpha-1-1-0.tar.gz</download_link>
+    <date>1584195300</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+ <release>
+   <name>Alpha 1.0.0</name>
+   <version>1.0.0</version>
+   <tag>1.0.0</tag>
+   <status>published</status>
+   <release_link>http://example.com/alpha-1-0-0-release</release_link>
+   <download_link>http://example.com/alpha-1-0-0.tar.gz</download_link>
+   <date>1581603300</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+</releases>
+</project>

tests/fixtures/release-history/semver_test.1.1.xml → automatic_updates_extensions/tests/fixtures/release-history/semver_test.1.1.xml

@@ -11,7 +11,6 @@
   </terms>
 <releases>
   <release>
-    <!-- This release is not in a supported branch; therefore it should not be recommended. -->
     <name>Semver Test 8.2.0</name>
     <version>8.2.0</version>
     <tag>8.2.0</tag>