automatic_updates_extensions/src/Form/UpdateReady.php

 <?php
 
+declare(strict_types = 1);
+
 namespace Drupal\automatic_updates_extensions\Form;
 
+use Drupal\automatic_updates\Form\UpdateFormBase;
+use Drupal\package_manager\ComposerInspector;
+use Drupal\package_manager\Exception\StageFailureMarkerException;
+use Drupal\package_manager\InstalledPackage;
+use Drupal\package_manager\PathLocator;
+use Drupal\package_manager\ProjectInfo;
+use Drupal\package_manager\ValidationResult;
 use Drupal\automatic_updates_extensions\BatchProcessor;
 use Drupal\automatic_updates\BatchProcessor as AutoUpdatesBatchProcessor;
-use Drupal\automatic_updates_extensions\ExtensionUpdater;
+use Drupal\automatic_updates_extensions\ExtensionUpdateStage;
 use Drupal\Core\Batch\BatchBuilder;
 use Drupal\Core\Extension\ModuleExtensionList;
-use Drupal\Core\Form\FormBase;
 use Drupal\Core\Form\FormStateInterface;
+use Drupal\Core\Render\RendererInterface;
 use Drupal\Core\Messenger\MessengerInterface;
 use Drupal\Core\State\StateInterface;
+use Drupal\Core\StringTranslation\TranslatableMarkup;
 use Drupal\package_manager\Exception\StageException;
 use Drupal\package_manager\Exception\StageOwnershipException;
+use Drupal\system\SystemManager;
 use Symfony\Component\DependencyInjection\ContainerInterface;
+use Symfony\Component\EventDispatcher\EventDispatcherInterface;
 
 /**
  * Defines a form to commit staged updates.
  *
  * @internal
- *   Form classes are internal.
+ *   Form classes are internal and should not be used by external code.
  */
-final class UpdateReady extends FormBase {
-
-  /**
-   * The updater service.
-   *
-   * @var \Drupal\automatic_updates_extensions\ExtensionUpdater
-   */
-  protected $updater;
-
-  /**
-   * The state service.
-   *
-   * @var \Drupal\Core\State\StateInterface
-   */
-  protected $state;
-
-  /**
-   * The module list service.
-   *
-   * @var \Drupal\Core\Extension\ModuleExtensionList
-   */
-  protected $moduleList;
+final class UpdateReady extends UpdateFormBase {
 
   /**
    * Constructs a new UpdateReady object.
    *
-   * @param \Drupal\automatic_updates_extensions\ExtensionUpdater $updater
-   *   The updater service.
+   * @param \Drupal\automatic_updates_extensions\ExtensionUpdateStage $stage
+   *   The update stage service.
    * @param \Drupal\Core\Messenger\MessengerInterface $messenger
    *   The messenger service.
    * @param \Drupal\Core\State\StateInterface $state
    *   The state service.
-   * @param \Drupal\Core\Extension\ModuleExtensionList $module_list
+   * @param \Drupal\Core\Extension\ModuleExtensionList $moduleList
    *   The module list service.
+   * @param \Drupal\Core\Render\RendererInterface $renderer
+   *   The renderer service.
+   * @param \Symfony\Component\EventDispatcher\EventDispatcherInterface $eventDispatcher
+   *   Event dispatcher service.
+   * @param \Drupal\package_manager\ComposerInspector $composerInspector
+   *   The Composer inspector service.
+   * @param \Drupal\package_manager\PathLocator $pathLocator
+   *   The path locator service.
    */
-  public function __construct(ExtensionUpdater $updater, MessengerInterface $messenger, StateInterface $state, ModuleExtensionList $module_list) {
-    $this->updater = $updater;
+  public function __construct(
+    private readonly ExtensionUpdateStage $stage,
+    MessengerInterface $messenger,
+    private readonly StateInterface $state,
+    private readonly ModuleExtensionList $moduleList,
+    private readonly RendererInterface $renderer,
+    private readonly EventDispatcherInterface $eventDispatcher,
+    private readonly ComposerInspector $composerInspector,
+    private readonly PathLocator $pathLocator,
+  ) {
     $this->setMessenger($messenger);
-    $this->state = $state;
-    $this->moduleList = $module_list;
   }
 
   /**
@@ -75,10 +80,14 @@ final class UpdateReady extends FormBase {
    */
   public static function create(ContainerInterface $container) {
     return new static(
-      $container->get('automatic_updates_extensions.updater'),
+      $container->get(ExtensionUpdateStage::class),
       $container->get('messenger'),
       $container->get('state'),
       $container->get('extension.list.module'),
+      $container->get('renderer'),
+      $container->get('event_dispatcher'),
+      $container->get(ComposerInspector::class),
+      $container->get(PathLocator::class),
     );
   }
 
@@ -87,21 +96,19 @@ final class UpdateReady extends FormBase {
    */
   public function buildForm(array $form, FormStateInterface $form_state, string $stage_id = NULL) {
     try {
-      $this->updater->claim($stage_id);
+      $this->stage->claim($stage_id);
     }
-    catch (StageOwnershipException $e) {
+    catch (StageOwnershipException) {
       $this->messenger()->addError($this->t('Cannot continue the update because another Composer operation is currently in progress.'));
       return $form;
     }
+    catch (StageFailureMarkerException $e) {
+      $this->messenger()->addError($e->getMessage());
+      return $form;
+    }
 
     $messages = [];
 
-    // @todo Add logic to warn about possible new database updates. Determine if
-    //   \Drupal\automatic_updates\Validator\StagedDatabaseUpdateValidator
-    //   should be duplicated or changed so that it can work with other stages.
-    // @see \Drupal\automatic_updates\Validator\StagedDatabaseUpdateValidator
-    // @see \Drupal\automatic_updates\Form\UpdateReady::buildForm()
-
     // Don't set any messages if the form has been submitted, because we don't
     // want them to be set during form submit.
     if (!$form_state->getUserInput()) {
@@ -124,12 +131,14 @@ final class UpdateReady extends FormBase {
       '#type' => 'value',
       '#value' => $stage_id,
     ];
-
-    // @todo Display the project versions that will be update including any
-    //   dependencies that are Drupal projects.
+    $form['package_updates'] = $this->showUpdates();
     $form['backup'] = [
       '#prefix' => '<strong>',
-      '#markup' => $this->t('Back up your database and site before you continue. <a href=":backup_url">Learn how</a>.', [':backup_url' => 'https://www.drupal.org/node/22281']),
+      '#type' => 'checkbox',
+      '#title' => $this->t('Warning: Updating contributed modules or themes may leave your site inoperable or looking wrong.'),
+      '#description' => $this->t('Back up your database and site before you continue. <a href=":backup_url">Learn how</a>. Each contributed module or theme may follow different standards for backwards compatibility, may or may not have tests, and may add or remove features in any release. For these reasons, it is highly recommended that you test this update in a development environment first.', [':backup_url' => 'https://www.drupal.org/node/22281']),
+      '#required' => TRUE,
+      '#default_value' => FALSE,
       '#suffix' => '</strong>',
     ];
     $form['maintenance_mode'] = [
@@ -137,6 +146,18 @@ final class UpdateReady extends FormBase {
       '#type' => 'checkbox',
       '#default_value' => TRUE,
     ];
+
+    // Don't run the status checks once the form has been submitted.
+    if (!$form_state->getUserInput()) {
+      $results = $this->runStatusCheck($this->stage, $this->eventDispatcher);
+      // This will have no effect if $results is empty.
+      $this->displayResults($results, $this->renderer);
+      // If any errors occurred, return the form early so the user cannot
+      // continue.
+      if (ValidationResult::getOverallSeverity($results) === SystemManager::REQUIREMENT_ERROR) {
+        return $form;
+      }
+    }
     $form['actions']['submit'] = [
       '#type' => 'submit',
       '#value' => $this->t('Continue'),
@@ -162,6 +183,7 @@ final class UpdateReady extends FormBase {
       ->setTitle($this->t('Apply updates'))
       ->setInitMessage($this->t('Preparing to apply updates'))
       ->addOperation([BatchProcessor::class, 'commit'], [$stage_id])
+      ->addOperation([BatchProcessor::class, 'postApply'], [$stage_id])
       ->addOperation([BatchProcessor::class, 'clean'], [$stage_id])
       ->setFinishCallback([BatchProcessor::class, 'finishCommit'])
       ->toArray();
@@ -174,7 +196,7 @@ final class UpdateReady extends FormBase {
    */
   public function cancel(array &$form, FormStateInterface $form_state): void {
     try {
-      $this->updater->destroy();
+      $this->stage->destroy();
       $this->messenger()->addStatus($this->t('The update was successfully cancelled.'));
       $form_state->setRedirect('automatic_updates_extensions.report_update');
     }
@@ -183,4 +205,115 @@ final class UpdateReady extends FormBase {
     }
   }
 
+  /**
+   * Displays all projects that will be updated.
+   *
+   * @return mixed[][]
+   *   A render array displaying packages that will be updated.
+   */
+  private function showUpdates(): array {
+    // Get packages that were updated in the stage directory.
+    $installed_packages = $this->composerInspector->getInstalledPackagesList($this->pathLocator->getProjectRoot());
+    $staged_packages = $this->composerInspector->getInstalledPackagesList($this->stage->getStageDirectory());
+    $updated_packages = $staged_packages->getPackagesWithDifferentVersionsIn($installed_packages);
+
+    // Build a list of package names that were updated by user request.
+    $updated_by_request = [];
+    foreach ($this->stage->getPackageVersions() as $group) {
+      $updated_by_request = array_merge($updated_by_request, array_keys($group));
+    }
+
+    $updated_by_request_info = [];
+    $updated_project_info = [];
+    $supported_package_types = ['drupal-module', 'drupal-theme'];
+
+    // Compile an array of relevant information about the packages that will be
+    // updated.
+    foreach ($updated_packages as $name => $updated_package) {
+      // Ignore anything that isn't a module or a theme.
+      if (!in_array($updated_package->type, $supported_package_types, TRUE)) {
+        continue;
+      }
+      $updated_project_info[$name] = [
+        'title' => $this->getProjectTitleFromPackage($updated_package),
+        'installed_version' => $installed_packages[$updated_package->name]->version,
+        'updated_version' => $updated_package->version,
+      ];
+    }
+
+    foreach ($updated_packages as $name => $updated_package) {
+      // Sort the updated packages into two groups: the ones that were updated
+      // at the request of the user, and the ones that got updated anyway
+      // (probably due to Composer's dependency resolution).
+      if (in_array($name, $updated_by_request, TRUE)) {
+        $updated_by_request_info[$name] = $updated_project_info[$name];
+        unset($updated_project_info[$name]);
+      }
+    }
+    $output = [];
+    if ($updated_by_request_info) {
+      // Create the list of messages for the packages updated by request.
+      $output['requested'] = $this->getUpdatedPackagesItemList($updated_by_request_info, $this->t('The following projects will be updated:'));
+    }
+
+    if ($updated_project_info) {
+      // Create the list of messages for packages that were updated
+      // incidentally.
+      $output['dependencies'] = $this->getUpdatedPackagesItemList($updated_project_info, $this->t('The following dependencies will also be updated:'));
+    }
+    return $output;
+  }
+
+  /**
+   * Gets the human-readable project title for a Composer package.
+   *
+   * @param \Drupal\package_manager\InstalledPackage $package
+   *   The installed package.
+   *
+   * @return string
+   *   The human-readable title of the project. If no project information is
+   *   available, the package name is returned.
+   */
+  private function getProjectTitleFromPackage(InstalledPackage $package): string {
+    $project_name = $package->getProjectName();
+    if (!$project_name) {
+      return $package->name;
+    }
+    $project_info = new ProjectInfo($project_name);
+    $project_data = $project_info->getProjectInfo();
+    if ($project_data) {
+      return $project_data['title'];
+    }
+    else {
+      return $package->name;
+    }
+  }
+
+  /**
+   * Generates an item list of packages that will be updated.
+   *
+   * @param array[] $updated_packages
+   *   An array of packages that will be updated, each sub-array containing the
+   *   project title, installed version, and target version.
+   * @param \Drupal\Core\StringTranslation\TranslatableMarkup $item_list_title
+   *   The title of the generated item list.
+   *
+   * @return array
+   *   A render array for the generated item list.
+   */
+  private function getUpdatedPackagesItemList(array $updated_packages, TranslatableMarkup $item_list_title): array {
+    $create_message_for_project = function (array $project): TranslatableMarkup {
+      return $this->t('@title from @from_version to @to_version', [
+        '@title' => $project['title'],
+        '@from_version' => $project['installed_version'],
+        '@to_version' => $project['updated_version'],
+      ]);
+    };
+    return [
+      '#theme' => 'item_list',
+      '#prefix' => '<p>' . $item_list_title . '</p>',
+      '#items' => array_map($create_message_for_project, $updated_packages),
+    ];
+  }
+
 }

automatic_updates_extensions/src/Form/UpdaterForm.php

 <?php
 
+declare(strict_types = 1);
+
 namespace Drupal\automatic_updates_extensions\Form;
 
-use Drupal\automatic_updates\Event\ReadinessCheckEvent;
-use Drupal\automatic_updates\Validation\ReadinessTrait;
+use Drupal\automatic_updates\Form\UpdateFormBase;
 use Drupal\automatic_updates_extensions\BatchProcessor;
-use Drupal\automatic_updates_extensions\ExtensionUpdater;
+use Drupal\automatic_updates_extensions\ExtensionUpdateStage;
 use Drupal\Core\Batch\BatchBuilder;
-use Drupal\Core\Form\FormBase;
 use Drupal\Core\Form\FormStateInterface;
+use Drupal\Core\State\StateInterface;
+use Drupal\Core\Messenger\MessengerInterface;
 use Drupal\Core\Render\RendererInterface;
+use Drupal\Core\Url;
+use Drupal\package_manager\ComposerInspector;
+use Drupal\package_manager\Exception\StageFailureMarkerException;
+use Drupal\package_manager\FailureMarker;
+use Drupal\package_manager\PathLocator;
+use Drupal\package_manager\ProjectInfo;
+use Drupal\package_manager\ValidationResult;
 use Drupal\system\SystemManager;
+use Drupal\update\ProjectRelease;
 use Drupal\update\UpdateManagerInterface;
 use Symfony\Component\DependencyInjection\ContainerInterface;
 use Symfony\Component\EventDispatcher\EventDispatcherInterface;
@@ -19,59 +29,52 @@ use Symfony\Component\EventDispatcher\EventDispatcherInterface;
  * A form for selecting extension updates.
  *
  * @internal
- *   Form classes are internal.
+ *   Form classes are internal and should not be used by external code.
  */
-final class UpdaterForm extends FormBase {
-
-  use ReadinessTrait;
-
-  /**
-   * The extension updater service.
-   *
-   * @var \Drupal\automatic_updates_extensions\ExtensionUpdater
-   */
-  private $extensionUpdater;
-
-  /**
-   * The event dispatcher service.
-   *
-   * @var \Symfony\Component\EventDispatcher\EventDispatcherInterface
-   */
-  private $eventDispatcher;
-
-  /**
-   * The renderer service.
-   *
-   * @var \Drupal\Core\Render\RendererInterface
-   */
-  private $renderer;
+final class UpdaterForm extends UpdateFormBase {
 
   /**
    * {@inheritdoc}
    */
   public static function create(ContainerInterface $container) {
     return new static(
-      $container->get('automatic_updates_extensions.updater'),
+      $container->get(ExtensionUpdateStage::class),
       $container->get('event_dispatcher'),
-      $container->get('renderer')
+      $container->get('renderer'),
+      $container->get('state'),
+      $container->get(FailureMarker::class),
+      $container->get(ComposerInspector::class),
+      $container->get(PathLocator::class),
     );
   }
 
   /**
    * Constructs a new UpdaterForm object.
    *
-   * @param \Drupal\automatic_updates_extensions\ExtensionUpdater $extension_updater
-   *   The extension updater service.
-   * @param \Symfony\Component\EventDispatcher\EventDispatcherInterface $event_dispatcher
+   * @param \Drupal\automatic_updates_extensions\ExtensionUpdateStage $stage
+   *   The extension update stage service.
+   * @param \Symfony\Component\EventDispatcher\EventDispatcherInterface $eventDispatcher
    *   The extension event dispatcher service.
    * @param \Drupal\Core\Render\RendererInterface $renderer
    *   The renderer service.
+   * @param \Drupal\Core\State\StateInterface $state
+   *   The state service.
+   * @param \Drupal\package_manager\FailureMarker $failureMarker
+   *   The failure marker service.
+   * @param \Drupal\package_manager\ComposerInspector $composerInspector
+   *   The Composer inspector service.
+   * @param \Drupal\package_manager\PathLocator $pathLocator
+   *   The path locator service.
    */
-  public function __construct(ExtensionUpdater $extension_updater, EventDispatcherInterface $event_dispatcher, RendererInterface $renderer) {
-    $this->extensionUpdater = $extension_updater;
-    $this->eventDispatcher = $event_dispatcher;
-    $this->renderer = $renderer;
-  }
+  public function __construct(
+    private readonly ExtensionUpdateStage $stage,
+    private readonly EventDispatcherInterface $eventDispatcher,
+    private readonly RendererInterface $renderer,
+    private readonly StateInterface $state,
+    private readonly FailureMarker $failureMarker,
+    private readonly ComposerInspector $composerInspector,
+    private readonly PathLocator $pathLocator,
+  ) {}
 
   /**
    * {@inheritdoc}
@@ -84,6 +87,13 @@ final class UpdaterForm extends FormBase {
    * {@inheritdoc}
    */
   public function buildForm(array $form, FormStateInterface $form_state) {
+    try {
+      $this->failureMarker->assertNotExists();
+    }
+    catch (StageFailureMarkerException $e) {
+      $this->messenger()->addError($e->getMessage());
+      return $form;
+    }
     $update_projects = $this->getRecommendedModuleUpdates();
     $options = [];
     $recommended_versions = [];
@@ -101,10 +111,16 @@ final class UpdaterForm extends FormBase {
         default:
           $status_message = '';
       }
+      $project_release = ProjectRelease::createFromArray($update_project['releases'][$update_project['recommended']]);
       $options[$project_name] = [
         $update_project['title'] . $status_message,
         $update_project['existing_version'],
-        $update_project['recommended'],
+        $this->t(
+          '@version (<a href=":url">Release notes</a>)',
+          [
+            '@version' => $project_release->getVersion(),
+            ':url' => $project_release->getReleaseUrl(),
+          ]),
       ];
       $recommended_versions[$project_name] = $update_project['recommended'];
     }
@@ -122,23 +138,27 @@ final class UpdaterForm extends FormBase {
       '#options' => $options,
       '#empty' => $this->t('There are no available updates.'),
       '#attributes' => ['class' => ['update-recommended']],
+      '#required' => TRUE,
+      '#required_error' => t('Select one or more projects.'),
     ];
 
     if ($form_state->getUserInput()) {
       $results = [];
     }
     else {
-      $event = new ReadinessCheckEvent($this->extensionUpdater);
-      $this->eventDispatcher->dispatch($event);
-      $results = $event->getResults();
+      $results = $this->runStatusCheck($this->stage, $this->eventDispatcher);
     }
-    $this->displayResults($results, $this->messenger(), $this->renderer);
-    $security_level = $this->getOverallSeverity($results);
+    $this->displayResults($results, $this->renderer);
+    $security_level = ValidationResult::getOverallSeverity($results);
 
     if ($update_projects && $security_level !== SystemManager::REQUIREMENT_ERROR) {
       $form['actions'] = $this->actions($form_state);
     }
 
+    $form['last_check'] = [
+      '#theme' => 'update_last_check',
+      '#last' => $this->state->get('update.last_check', 0),
+    ];
     return $form;
   }
 
@@ -151,9 +171,9 @@ final class UpdaterForm extends FormBase {
    * @return mixed[][]
    *   The form's actions elements.
    */
-  protected function actions(FormStateInterface $form_state): array {
+  private function actions(FormStateInterface $form_state): array {
     $actions = ['#type' => 'actions'];
-    if (!$this->extensionUpdater->isAvailable()) {
+    if (!$this->stage->isAvailable()) {
       // If the form has been submitted do not display this error message
       // because ::deleteExistingUpdate() may run on submit. The message will
       // still be displayed on form build if needed.
@@ -179,7 +199,7 @@ final class UpdaterForm extends FormBase {
    * Submit function to delete an existing in-progress update.
    */
   public function deleteExistingUpdate(): void {
-    $this->extensionUpdater->destroy(TRUE);
+    $this->stage->destroy(TRUE);
     $this->messenger()->addMessage($this->t("Staged update deleted"));
   }
 
@@ -208,27 +228,68 @@ final class UpdaterForm extends FormBase {
   /**
    * Gets the modules that require updates.
    *
-   * @return array
+   * @return mixed[]
    *   Modules that require updates.
    */
   private function getRecommendedModuleUpdates(): array {
+    $supported_project_types = [
+      "module", "module-disabled", "theme", "theme-disabled",
+    ];
     $available_updates = update_get_available(TRUE);
     if (empty($available_updates)) {
       $this->messenger()->addError('There was a problem getting update information. Try again later.');
       return [];
     }
 
-    $project_data = update_calculate_project_data($available_updates);
+    $all_projects_data = update_calculate_project_data($available_updates);
     $outdated_modules = [];
-    foreach ($project_data as $project_name => $project_info) {
-      if ($project_info['project_type'] === 'module' || $project_info['project_type'] === 'module-disabled') {
-        if ($project_info['status'] !== UpdateManagerInterface::CURRENT) {
-          if (!empty($project_info['recommended'])) {
-            $outdated_modules[$project_name] = $project_info;
+    $installed_packages = $this->composerInspector->getInstalledPackagesList($this->pathLocator->getProjectRoot());
+    $non_supported_update_statuses = [];
+    foreach ($all_projects_data as $project_name => $project_data) {
+      if (in_array($project_data['project_type'], $supported_project_types, TRUE)) {
+        if ($project_data['status'] !== UpdateManagerInterface::CURRENT) {
+          if ($installed_packages->getPackageByDrupalProjectName($project_name) === NULL) {
+            $non_supported_update_statuses[] = $project_data['status'];
+            continue;
+          }
+          $project_information = new ProjectInfo($project_name);
+          $installable_versions = array_keys($project_information->getInstallableReleases());
+          if (!empty($project_data['recommended']) && in_array($project_data['recommended'], $installable_versions, TRUE)) {
+            $outdated_modules[$project_name] = $project_data;
+          }
+          else {
+            $non_supported_update_statuses[] = $project_data['status'];
           }
         }
       }
     }
+    if ($non_supported_update_statuses) {
+      $message_status = array_intersect([UpdateManagerInterface::NOT_SECURE, UpdateManagerInterface::NOT_SUPPORTED, UpdateManagerInterface::REVOKED], $non_supported_update_statuses) ?
+        MessengerInterface::TYPE_ERROR :
+        MessengerInterface::TYPE_STATUS;
+      if ($outdated_modules) {
+        $this->messenger()->addMessage(
+          $this->t(
+            'Other updates were found, but they must be performed manually. See <a href=":url">the list of available updates</a> for more information.',
+            [
+              ':url' => Url::fromRoute('update.status')->toString(),
+            ]
+          ),
+          $message_status
+        );
+      }
+      else {
+        $this->messenger()->addMessage(
+          $this->t(
+            'Updates were found, but they must be performed manually. See <a href=":url">the list of available updates</a> for more information.',
+            [
+              ':url' => Url::fromRoute('update.status')->toString(),
+            ]
+          ),
+          $message_status
+        );
+      }
+    }
     return $outdated_modules;
   }
 

automatic_updates_extensions/src/Validator/ForbidCoreChangesValidator.php

+<?php
+
+declare(strict_types=1);
+
+namespace Drupal\automatic_updates_extensions\Validator;
+
+use Drupal\Core\StringTranslation\StringTranslationTrait;
+use Drupal\Core\Url;
+use Drupal\package_manager\ComposerInspector;
+use Drupal\package_manager\Event\PreApplyEvent;
+use Drupal\package_manager\Event\StatusCheckEvent;
+use Drupal\package_manager\InstalledPackagesList;
+use Drupal\package_manager\PathLocator;
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
+
+/**
+ * Validates that no changes were made to Drupal Core packages.
+ *
+ * @internal
+ *   This is an internal part of Automatic Updates and may be changed or removed
+ *   at any time without warning. External code should not interact with this
+ *   class.
+ */
+final class ForbidCoreChangesValidator implements EventSubscriberInterface {
+
+  use StringTranslationTrait;
+
+  public function __construct(
+    private readonly PathLocator $pathLocator,
+    private readonly ComposerInspector $composerInspector,
+  ) {}
+
+  /**
+   * Validates the staged packages.
+   *
+   * @param \Drupal\package_manager\Event\StatusCheckEvent|\Drupal\package_manager\Event\PreApplyEvent $event
+   *   The event object.
+   */
+  public function validateStagedCorePackages(StatusCheckEvent|PreApplyEvent $event): void {
+    $stage = $event->stage;
+    // We only want to do this check if the stage belongs to Automatic Updates
+    // Extensions.
+    if ($stage->getType() !== 'automatic_updates_extensions:attended' || !$stage->stageDirectoryExists()) {
+      return;
+    }
+    $active_core_packages = $this->getInstalledCorePackages($this->pathLocator->getProjectRoot());
+    $stage_core_packages = $this->getInstalledCorePackages($stage->getStageDirectory());
+
+    $new_packages = $stage_core_packages->getPackagesNotIn($active_core_packages);
+    $removed_packages = $active_core_packages->getPackagesNotIn($stage_core_packages);
+    $changed_packages = $active_core_packages->getPackagesWithDifferentVersionsIn($stage_core_packages);
+
+    $error_messages = [];
+    foreach ($new_packages as $new_package) {
+      $error_messages[] = $this->t("'@name' installed.", ['@name' => $new_package->name]);
+    }
+    foreach ($removed_packages as $removed_package) {
+      $error_messages[] = $this->t("'@name' removed.", ['@name' => $removed_package->name]);
+    }
+    foreach ($changed_packages as $name => $updated_package) {
+      $error_messages[] = $this->t(
+        "'@name' version changed from @active_version to @staged_version.",
+        [
+          '@name' => $updated_package->name,
+          '@staged_version' => $stage_core_packages[$name]->version,
+          '@active_version' => $updated_package->version,
+        ]
+      );
+
+    }
+    if ($error_messages) {
+      $event->addError($error_messages, $this->t(
+        'Updating Drupal Core while updating extensions is currently not supported. Use <a href=":url">this form</a> to update Drupal core. The following changes were made to the Drupal core packages:',
+        [':url' => Url::fromRoute('update.report_update')->toString()]
+      ));
+    }
+  }
+
+  /**
+   * Gets all the installed core packages for a given project root.
+   *
+   * This method differs from
+   * \Drupal\package_manager\ComposerInspector::getInstalledPackagesList in that
+   * it ensures that the 'drupal/core' is included in the list if present.
+   *
+   * @param string $composer_root
+   *   The path to the composer root.
+   *
+   * @return \Drupal\package_manager\InstalledPackagesList
+   *   The installed core packages.
+   */
+  private function getInstalledCorePackages(string $composer_root): InstalledPackagesList {
+    $installed_package_list = $this->composerInspector->getInstalledPackagesList($composer_root);
+    $core_packages = $installed_package_list->getCorePackages();
+    if (isset($installed_package_list['drupal/core']) && !isset($core_packages['drupal/core'])) {
+      $core_packages = new InstalledPackagesList(array_merge($core_packages->getArrayCopy(), ['drupal/core' => $installed_package_list['drupal/core']]));
+    }
+    return $core_packages;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function getSubscribedEvents(): array {
+    $events[StatusCheckEvent::class][] = ['validateStagedCorePackages'];
+    $events[PreApplyEvent::class][] = ['validateStagedCorePackages'];
+    return $events;
+  }
+
+}

automatic_updates_extensions/src/Validator/PackagesInstalledWithComposerValidator.php

-<?php
-
-namespace Drupal\automatic_updates_extensions\Validator;
-
-use Composer\Package\PackageInterface;
-use Drupal\automatic_updates_extensions\ExtensionUpdater;
-use Drupal\Core\StringTranslation\StringTranslationTrait;
-use Drupal\Core\StringTranslation\TranslationInterface;
-use Drupal\package_manager\Event\PreApplyEvent;
-use Drupal\package_manager\Event\PreCreateEvent;
-use Drupal\package_manager\Event\PreOperationStageEvent;
-use Symfony\Component\EventDispatcher\EventSubscriberInterface;
-
-/**
- * Validates packages are installed via Composer.
- */
-class PackagesInstalledWithComposerValidator implements EventSubscriberInterface {
-
-  use StringTranslationTrait;
-
-  /**
-   * Constructs a InstalledPackagesValidator object.
-   *
-   * @param \Drupal\Core\StringTranslation\TranslationInterface $translation
-   *   The translation service.
-   */
-  public function __construct(TranslationInterface $translation) {
-    $this->setStringTranslation($translation);
-  }
-
-  /**
-   * Validates that packages are installed with composer or not.
-   *
-   * @param \Drupal\package_manager\Event\PreOperationStageEvent $event
-   *   The event object.
-   */
-  public function checkPackagesInstalledWithComposer(PreOperationStageEvent $event): void {
-    $stage = $event->getStage();
-    if ($stage instanceof ExtensionUpdater) {
-      $active_composer = $stage->getActiveComposer();
-      $installed_packages = $active_composer->getInstalledPackages();
-      $missing_packages = [];
-      if ($event instanceof PreCreateEvent) {
-        $package_versions = $stage->getPackageVersions();
-        foreach (['production', 'dev'] as $package_type) {
-          $missing_packages = array_merge($missing_packages, array_diff_key($package_versions[$package_type], $installed_packages));
-        }
-      }
-      else {
-        $missing_packages = $stage->getStageComposer()
-          ->getPackagesNotIn($active_composer);
-        // For new dependency added in the stage will are only concerned with
-        // ones that are Drupal projects that have Update XML from Drupal.org
-        // Since the Update module does allow use to check any of these projects
-        // if they don't exist in the active code base. Other types of projects
-        // even if they are in the 'drupal/' namespace they would not have
-        // Update XML on Drupal.org so it doesn't matter if they are in the
-        // active codebase or not.
-        $types = [
-          'drupal-module',
-          'drupal-theme',
-          'drupal-profile',
-        ];
-        $filter = function (PackageInterface $package) use ($types): bool {
-          return in_array($package->getType(), $types);
-        };
-        $missing_packages = array_filter($missing_packages, $filter);
-        // Saving only the packages whose name starts with drupal/.
-        $missing_packages = array_filter($missing_packages, function (string $key) {
-          return strpos($key, 'drupal/') === 0;
-        }, ARRAY_FILTER_USE_KEY);
-      }
-      if ($missing_packages) {
-        $missing_projects = [];
-        foreach ($missing_packages as $package => $version) {
-          // Removing drupal/ from package name for better user presentation.
-          $project = str_replace('drupal/', '', $package);
-          $missing_projects[] = $project;
-        }
-        if ($missing_projects) {
-          $event->addError($missing_projects, $this->t('Automatic Updates can only update projects that were installed via Composer. The following packages are not installed through composer:'));
-        }
-      }
-    }
-  }
-
-  /**
-   * {@inheritdoc}
-   */
-  public static function getSubscribedEvents() {
-    return [
-      PreCreateEvent::class => 'checkPackagesInstalledWithComposer',
-      PreApplyEvent::class => 'checkPackagesInstalledWithComposer',
-    ];
-  }
-
-}

automatic_updates_extensions/src/Validator/RequestedUpdateValidator.php

+<?php
+
+declare(strict_types=1);
+
+namespace Drupal\automatic_updates_extensions\Validator;
+
+use Composer\Semver\Semver;
+use Drupal\Core\StringTranslation\StringTranslationTrait;
+use Drupal\package_manager\ComposerInspector;
+use Drupal\package_manager\Event\PreApplyEvent;
+use Drupal\package_manager\Event\StatusCheckEvent;
+use Drupal\package_manager\PathLocator;
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
+
+/**
+ * Validates that requested packages have been updated.
+ *
+ * @internal
+ *   This is an internal part of Automatic Updates and may be changed or removed
+ *   at any time without warning. External code should not interact with this
+ *   class.
+ */
+final class RequestedUpdateValidator implements EventSubscriberInterface {
+
+  use StringTranslationTrait;
+
+  /**
+   * Constructs a RequestedUpdateValidator object.
+   *
+   * @param \Drupal\package_manager\ComposerInspector $composerInspector
+   *   The Composer inspector service.
+   * @param \Drupal\package_manager\PathLocator $pathLocator
+   *   The path locator service.
+   */
+  public function __construct(
+    private readonly ComposerInspector $composerInspector,
+    private readonly PathLocator $pathLocator,
+  ) {}
+
+  /**
+   * Validates that requested packages have been updated to the right version.
+   *
+   * @param \Drupal\package_manager\Event\PreApplyEvent|\Drupal\package_manager\Event\StatusCheckEvent $event
+   *   The pre-apply event.
+   */
+  public function checkRequestedStagedVersion(PreApplyEvent|StatusCheckEvent $event): void {
+    $stage = $event->stage;
+    if ($stage->getType() !== 'automatic_updates_extensions:attended' || !$stage->stageDirectoryExists()) {
+      return;
+    }
+    $requested_package_versions = $stage->getPackageVersions();
+    $active = $this->composerInspector->getInstalledPackagesList($this->pathLocator->getProjectRoot());
+    $staged = $this->composerInspector->getInstalledPackagesList($event->stage->getStageDirectory());
+    $changed_stage_packages = $staged->getPackagesWithDifferentVersionsIn($active)->getArrayCopy();
+
+    if (empty($changed_stage_packages)) {
+      $event->addError([$this->t('No updates detected in the staging area.')]);
+      return;
+    }
+
+    // Check for all changed the packages if they are updated to the requested
+    // version.
+    foreach (['production', 'dev'] as $package_type) {
+      foreach ($requested_package_versions[$package_type] as $requested_package_name => $requested_version) {
+        if (array_key_exists($requested_package_name, $changed_stage_packages)) {
+          $staged_version = $changed_stage_packages[$requested_package_name]->version;
+          if (!Semver::satisfies($staged_version, $requested_version)) {
+            $event->addError([
+              $this->t(
+                "The requested update to '@requested_package_name' to version '@requested_version' does not match the actual staged update to '@staged_version'.",
+                [
+                  '@requested_package_name' => $requested_package_name,
+                  '@requested_version' => $requested_version,
+                  '@staged_version' => $staged_version,
+                ]
+              ),
+            ]);
+          }
+        }
+        else {
+          $event->addError([
+            $this->t(
+              "The requested update to '@requested_package_name' to version '@requested_version' was not performed.",
+              [
+                '@requested_package_name' => $requested_package_name,
+                '@requested_version' => $requested_version,
+              ]
+            ),
+          ]);
+        }
+      }
+    }
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function getSubscribedEvents(): array {
+    $events[StatusCheckEvent::class][] = ['checkRequestedStagedVersion'];
+    $events[PreApplyEvent::class][] = ['checkRequestedStagedVersion'];
+    return $events;
+  }
+
+}

automatic_updates_extensions/src/Validator/UpdateReleaseValidator.php

 <?php
 
+declare(strict_types = 1);
+
 namespace Drupal\automatic_updates_extensions\Validator;
 
-use Drupal\automatic_updates\ProjectInfo;
-use Drupal\automatic_updates_extensions\ExtensionUpdater;
-use Drupal\automatic_updates\LegacyVersionUtility;
+use Drupal\package_manager\ComposerInspector;
+use Drupal\package_manager\PathLocator;
+use Drupal\package_manager\ProjectInfo;
+use Drupal\package_manager\LegacyVersionUtility;
 use Drupal\Core\StringTranslation\StringTranslationTrait;
 use Drupal\package_manager\Event\PreCreateEvent;
 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
@@ -15,11 +18,67 @@ use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  * @internal
  *   This class is an internal part of the module's update handling and
  *   should not be used by external code.
+ *
+ * @todo Decide if this validator can be removed completely in
+ *    https://www.drupal.org/i/3351091.
  */
 final class UpdateReleaseValidator implements EventSubscriberInterface {
 
   use StringTranslationTrait;
 
+  /**
+   * Constructs an UpdateReleaseValidator object.
+   *
+   * @param \Drupal\package_manager\ComposerInspector $composerInspector
+   *   The Composer inspector service.
+   * @param \Drupal\package_manager\PathLocator $pathLocator
+   *   The path locator service.
+   */
+  public function __construct(
+    private readonly ComposerInspector $composerInspector,
+    private readonly PathLocator $pathLocator
+  ) {}
+
+  /**
+   * Checks if the given version of a project is supported.
+   *
+   * Checks if the given version of the given project is in the core update
+   * system's list of known, secure, installable releases of that project.
+   * considered a supported release by verifying if the project is found in the
+   * core update system's list of known, secure, and installable releases.
+   *
+   * @param string $name
+   *   The name of the project.
+   * @param string $semantic_version
+   *   A semantic version number for the project.
+   *
+   * @return bool
+   *   TRUE if the given version of the project is supported, otherwise FALSE.
+   *   given version is not supported will return FALSE.
+   */
+  private function isSupportedRelease(string $name, string $semantic_version): bool {
+    $supported_releases = (new ProjectInfo($name))->getInstallableReleases();
+    if (!$supported_releases) {
+      return FALSE;
+    }
+
+    // If this version is found in the list of installable releases, it is
+    // secured and supported.
+    if (array_key_exists($semantic_version, $supported_releases)) {
+      return TRUE;
+    }
+    // If the semantic version number wasn't in the list of
+    // installable releases, convert it to a legacy version number and see
+    // if the version number is in the list.
+    $legacy_version = LegacyVersionUtility::convertToLegacyVersion($semantic_version);
+    if ($legacy_version && array_key_exists($legacy_version, $supported_releases)) {
+      return TRUE;
+    }
+    // Neither the semantic version nor the legacy version are in the list
+    // of installable releases, so the release isn't supported.
+    return FALSE;
+  }
+
   /**
    * Checks that the update projects are secure and supported.
    *
@@ -27,47 +86,26 @@ final class UpdateReleaseValidator implements EventSubscriberInterface {
    *   The event object.
    */
   public function checkRelease(PreCreateEvent $event): void {
-    $stage = $event->getStage();
+    $stage = $event->stage;
     // This check only works with Automatic Updates Extensions.
-    if (!$stage instanceof ExtensionUpdater) {
+    if ($stage->getType() !== 'automatic_updates_extensions:attended') {
       return;
     }
 
+    $active_packages = $this->composerInspector->getInstalledPackagesList($this->pathLocator->getProjectRoot());
     $all_versions = $stage->getPackageVersions();
     $messages = [];
     foreach (['production', 'dev'] as $package_type) {
       foreach ($all_versions[$package_type] as $package_name => $sematic_version) {
-        $package_parts = explode('/', $package_name);
-        $project_name = $package_parts[1];
+        $project_name = $active_packages[$package_name]->getProjectName();
         // If the version isn't in the list of installable releases, then it
         // isn't secure and supported and the user should receive an error.
-        $releases = (new ProjectInfo($project_name))->getInstallableReleases();
-        $is_missing_version = FALSE;
-        if (empty($releases)) {
-          $is_missing_version = TRUE;
-        }
-        elseif (!array_key_exists($sematic_version, $releases)) {
-          $legacy_version = LegacyVersionUtility::convertToLegacyVersion($sematic_version);
-          if ($legacy_version) {
-            if (!array_key_exists($legacy_version, $releases)) {
-              // If we cannot find the version using semantic or legacy then the
-              // version is missing.
-              $is_missing_version = TRUE;
-            }
-          }
-          else {
-            // If we cannot convert the semantic version into a legacy version
-            // then the version is missing.
-            $is_missing_version = TRUE;
-          }
-        }
-        if ($is_missing_version) {
+        if (!$this->isSupportedRelease($project_name, $sematic_version)) {
           $messages[] = $this->t('Project @project_name to version @version', [
             '@project_name' => $project_name,
             '@version' => $sematic_version,
           ]);
         }
-
       }
     }
     if ($messages) {
@@ -83,7 +121,7 @@ final class UpdateReleaseValidator implements EventSubscriberInterface {
   /**
    * {@inheritdoc}
    */
-  public static function getSubscribedEvents() {
+  public static function getSubscribedEvents(): array {
     return [
       PreCreateEvent::class => 'checkRelease',
     ];

automatic_updates_extensions/tests/fixtures/fake-site/composer.json

-{
-    "require": {
-        "drupal/core-recommended": "^9",
-        "drupal/my_module": "^9"
-    },
-    "require-dev": {
-        "drupal/my_dev_module": "^9"
-    }
-}

automatic_updates_extensions/tests/fixtures/fake-site/composer.lock

-{
-    "packages": [
-        {
-            "name": "drupal/core-recommended",
-            "version": "9.8.0",
-            "require": {
-                "drupal/core": "9.8.0"
-            }
-        },
-        {
-            "name": "drupal/my_module",
-            "version": "9.8.0"
-        }
-    ],
-    "packages-dev": [
-        {
-            "name": "drupal/my_dev_module",
-            "version": "9.8.1"
-        }
-    ]
-}

automatic_updates_extensions/tests/fixtures/fake-site/vendor/composer/installed.json

-{
-    "packages": [
-        {
-            "name": "drupal/core-recommended",
-            "version": "9.8.0",
-            "require": {
-                "drupal/core": "9.8.0"
-            }
-        },
-        {
-            "name": "drupal/core",
-            "version": "9.8.0",
-            "extra": {
-                "drupal-scaffold": {
-                    "file-mapping": {}
-                }
-            }
-        },
-        {
-            "name": "drupal/my_module",
-            "version": "9.8.0"
-        },
-        {
-            "name": "drupal/my_dev_module",
-            "version": "9.8.1"
-        }
-    ],
-    "dev": true,
-    "dev-package-names": [
-        "drupal/my_dev_module"
-    ]
-}

automatic_updates_extensions/tests/fixtures/new_module/1.0.0/new_module.info.yml → automatic_updates_extensions/tests/fixtures/new_module/1.0.0/new_module.info.yml.hide

 name: 'New module'
 type: module
-core_version_requirement: ^9
+core_version_requirement: ^9.7 || ^10
+project: new_module

automatic_updates_extensions/tests/fixtures/new_module/1.1.0/new_module.info.yml → automatic_updates_extensions/tests/fixtures/new_module/1.1.0/new_module.info.yml.hide

 name: 'New module'
 type: module
-core_version_requirement: ^9
+core_version_requirement: ^9.7 || ^10
+project: new_module

automatic_updates_extensions/tests/fixtures/packages_installed_with_composer_validator/active.installed.json

-{
-    "packages": [
-        {
-            "name": "drupal/core-recommended",
-            "version": "9.8.0",
-            "require": {
-                "drupal/core": "9.8.0"
-            }
-        },
-        {
-            "name": "drupal/core",
-            "version": "9.8.0"
-        },
-        {
-            "name": "drupal/my_module",
-            "version": "9.8.0",
-            "type": "drupal-module"
-        },
-        {
-            "name": "drupal/my_dev_module",
-            "version": "9.8.1",
-            "type": "drupal-module"
-        },
-        {
-          "name": "drupal/existing_module",
-          "version": "9.8.0",
-          "type": "drupal-module"
-        },
-        {
-          "name": "drupal/existing_theme",
-          "version": "9.8.0",
-          "type": "drupal-theme"
-        },
-        {
-          "name": "drupal/existing_profile",
-          "version": "9.8.0",
-          "type": "drupal-profile"
-        }
-    ],
-    "dev": true,
-    "dev-package-names": [
-        "drupal/my_dev_module"
-    ]
-}

automatic_updates_extensions/tests/fixtures/packages_installed_with_composer_validator/module_not_installed.staged.installed.json

-{
-    "packages": [
-        {
-            "name": "drupal/core-recommended",
-            "version": "9.8.0",
-            "require": {
-                "drupal/core": "9.8.0"
-            }
-        },
-        {
-            "name": "drupal/core",
-            "version": "9.8.0"
-        },
-        {
-            "name": "drupal/my_module",
-            "version": "9.8.0",
-            "type": "drupal-module"
-        },
-        {
-            "name": "drupal/my_dev_module",
-            "version": "9.8.1",
-            "type": "drupal-module"
-        },
-        {
-          "name": "drupal/new_module",
-          "version": "9.8.0",
-          "type": "drupal-module"
-        }
-    ],
-    "dev": true,
-    "dev-package-names": [
-        "drupal/my_dev_module"
-    ]
-}

automatic_updates_extensions/tests/fixtures/packages_installed_with_composer_validator/module_theme_profile_dependency_not_installed.staged.installed.json

-{
-    "packages": [
-        {
-            "name": "drupal/core-recommended",
-            "version": "9.8.0",
-            "require": {
-                "drupal/core": "9.8.0"
-            }
-        },
-        {
-            "name": "drupal/core",
-            "version": "9.8.0"
-        },
-        {
-            "name": "drupal/my_module",
-            "version": "9.8.0",
-            "type": "drupal-module"
-        },
-        {
-            "name": "drupal/my_dev_module",
-            "version": "9.8.1",
-            "type": "drupal-module"
-        },
-        {
-          "name": "drupal/new_module",
-          "version": "9.8.0",
-          "type": "drupal-module"
-        },
-        {
-          "name": "not-drupal/new_module1",
-          "version": "9.8.0",
-          "type": "drupal-module"
-        },
-        {
-          "name": "drupal/new_theme",
-          "version": "9.8.0",
-          "type": "drupal-theme"
-        },
-        {
-          "name": "drupal/new_profile",
-          "version": "9.8.0",
-          "type": "drupal-profile"
-        },
-        {
-          "name": "drupal/new_dependency",
-          "version": "9.8.0",
-          "type": "drupal-library"
-        }
-    ],
-    "dev": true,
-    "dev-package-names": [
-        "drupal/my_dev_module"
-    ]
-}

automatic_updates_extensions/tests/fixtures/packages_installed_with_composer_validator/profile_not_installed.staged.installed.json

-{
-    "packages": [
-        {
-            "name": "drupal/core-recommended",
-            "version": "9.8.0",
-            "require": {
-                "drupal/core": "9.8.0"
-            }
-        },
-        {
-            "name": "drupal/core",
-            "version": "9.8.0"
-        },
-        {
-            "name": "drupal/my_module",
-            "version": "9.8.0",
-            "type": "drupal-module"
-        },
-        {
-            "name": "drupal/my_dev_module",
-            "version": "9.8.1",
-            "type": "drupal-module"
-        },
-        {
-          "name": "drupal/new_profile",
-          "version": "9.8.0",
-          "type": "drupal-profile"
-        }
-    ],
-    "dev": true,
-    "dev-package-names": [
-        "drupal/my_dev_module"
-    ]
-}

automatic_updates_extensions/tests/fixtures/packages_installed_with_composer_validator/theme_not_installed.staged.installed.json

-{
-    "packages": [
-        {
-            "name": "drupal/core-recommended",
-            "version": "9.8.0",
-            "require": {
-                "drupal/core": "9.8.0"
-            }
-        },
-        {
-            "name": "drupal/core",
-            "version": "9.8.0"
-        },
-        {
-            "name": "drupal/my_module",
-            "version": "9.8.0",
-            "type": "drupal-module"
-        },
-        {
-            "name": "drupal/my_dev_module",
-            "version": "9.8.1",
-            "type": "drupal-module"
-        },
-        {
-          "name": "drupal/new_theme",
-          "version": "9.8.0",
-          "type": "drupal-theme"
-        }
-    ],
-    "dev": true,
-    "dev-package-names": [
-        "drupal/my_dev_module"
-    ]
-}

automatic_updates_extensions/tests/fixtures/release-history/alpha.1.1.0.xml

 <?xml version="1.0" encoding="utf-8"?>
+<!--
+This fixture is used by  \Drupal\Tests\automatic_updates_extensions\Build\ModuleUpdateTest.
+
+Contains metadata about the following (fake) releases of alpha module, all of which are secure, in order:
+- 1.1.0
+- 1.0.0
+-->
 <project xmlns:dc="http://purl.org/dc/elements/1.1/">
 <title>Alpha</title>
 <short_name>alpha</short_name>

automatic_updates_extensions/tests/fixtures/release-history/automatic_updates_extensions_test_theme.1.1.xml

+<?xml version="1.0" encoding="utf-8"?>
+<!--
+This fixture is used by \Drupal\Tests\automatic_updates_extensions\Functional\UpdaterFormTest.
+
+Contains metadata about the following (fake) releases of automatic_updates_extensions_test_theme, all of which are secure, in order:
+- 3.0.0
+- 8.x-2.1
+- 8.x-2.0
+-->
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+  <title>Automatic Updates Extensions Test Theme</title>
+  <short_name>automatic_updates_extensions_test_theme</short_name>
+  <dc:creator>drupal</dc:creator>
+  <type>project_theme</type>
+  <supported_branches>8.x-2.,3.0.</supported_branches>
+  <project_status>published</project_status>
+  <link>http://example.com/project/automatic_updates_extensions_test_theme</link>
+  <terms>
+    <term>
+      <name>Projects</name>
+      <value>Themes</value>
+    </term>
+    <term>
+      <name>Maintenance status</name>
+      <value>Minimally maintained</value>
+    </term>
+    <term>
+      <name>Development status</name>
+      <value>Under active development</value>
+    </term>
+  </terms>
+  <releases>
+    <release>
+      <name>automatic_updates_extensions_test_theme 3.0.0</name>
+      <version>3.0.0</version>
+      <tag>3.0.0</tag>
+      <status>published</status>
+      <release_link>http://example.com/automatic_updates_extensions_test_theme-3-0-0-release</release_link>
+      <download_link>http://example.com/automatic_updates_extensions_test_theme-3.0.0.tar.gz</download_link>
+      <date>1597793786</date>
+      <files>
+        <file>
+          <url>http://example.com/automatic_updates_extensions_test_theme-3.0.0.tar.gz</url>
+          <archive_type>tar.gz</archive_type>
+          <md5>43956be126b27d718ecffd0b17244aa1</md5>
+          <size>196080</size>
+          <filedate>1597793786</filedate>
+        </file>
+        <file>
+          <url>http://example.com/automatic_updates_extensions_test_theme-3.0.0.zip</url>
+          <archive_type>zip</archive_type>
+          <md5>5d24ec88ac4755af6ccbe6ef5ff8b3c9</md5>
+          <size>200399</size>
+          <filedate>1597793786</filedate>
+        </file>
+      </files>
+      <security covered="1">Covered by Drupal's security advisory policy</security>
+      <core_compatibility>^8 || ^9</core_compatibility>
+    </release>
+    <release>
+      <name>automatic_updates_extensions_test_theme 8.x-2.1</name>
+      <version>8.x-2.1</version>
+      <tag>8.x-2.1</tag>
+      <status>published</status>
+      <release_link>http://example.com/automatic_updates_extensions_test_theme-8-x-2-1-release</release_link>
+      <download_link>http://example.com/automatic_updates_extensions_test_theme-8.x-2.1.tar.gz</download_link>
+      <date>1597793786</date>
+      <files>
+        <file>
+          <url>http://example.com/automatic_updates_extensions_test_theme-8.x-2.1.tar.gz</url>
+          <archive_type>tar.gz</archive_type>
+          <md5>43956be126b27d718ecffd0b17244aa1</md5>
+          <size>196080</size>
+          <filedate>1597793786</filedate>
+        </file>
+        <file>
+          <url>http://example.com/automatic_updates_extensions_test_theme-8.x-2.1.zip</url>
+          <archive_type>zip</archive_type>
+          <md5>5d24ec88ac4755af6ccbe6ef5ff8b3c9</md5>
+          <size>200399</size>
+          <filedate>1597793786</filedate>
+        </file>
+      </files>
+      <terms>
+        <term>
+          <name>Release type</name>
+          <value>Bug fixes</value>
+        </term>
+      </terms>
+      <security covered="1">Covered by Drupal's security advisory policy</security>
+      <core_compatibility>8.x</core_compatibility>
+    </release>
+    <release>
+      <name>automatic_updates_extensions_test_theme 8.x-2.0</name>
+      <version>8.x-2.0</version>
+      <tag>8.x-2.0</tag>
+      <status>published</status>
+      <release_link>http://example.com/automatic_updates_extensions_test_theme-8-x-2-0-release</release_link>
+      <download_link>http://example.com/automatic_updates_extensions_test_theme-8.x-2.0.tar.gz</download_link>
+      <date>1597793786</date>
+      <files>
+        <file>
+          <url>http://example.com/automatic_updates_extensions_test_theme-8.x-2.0.tar.gz</url>
+          <archive_type>tar.gz</archive_type>
+          <md5>43956be126b27d718ecffd0b17244aa1</md5>
+          <size>196080</size>
+          <filedate>1597793786</filedate>
+        </file>
+        <file>
+          <url>http://example.com/automatic_updates_extensions_test_theme-8.x-2.0.zip</url>
+          <archive_type>zip</archive_type>
+          <md5>5d24ec88ac4755af6ccbe6ef5ff8b3c9</md5>
+          <size>200399</size>
+          <filedate>1597793786</filedate>
+        </file>
+      </files>
+      <terms>
+        <term>
+          <name>Release type</name>
+          <value>Bug fixes</value>
+        </term>
+      </terms>
+      <security covered="1">Covered by Drupal's security advisory policy</security>
+      <core_compatibility>8.x</core_compatibility>
+    </release>
+  </releases>
+</project>

automatic_updates_extensions/tests/fixtures/release-history/new_module.1.1.0.xml

 <?xml version="1.0" encoding="utf-8"?>
+<!--
+This fixture is used by  \Drupal\Tests\automatic_updates_extensions\Build\ModuleUpdateTest.
+
+Contains metadata about the following (fake) releases of new_module, all of which are secure, in order:
+- 1.1.0
+- 1.0.0
+-->
 <project xmlns:dc="http://purl.org/dc/elements/1.1/">
 <title>New Module</title>
 <short_name>new_module</short_name>

automatic_updates_extensions/tests/fixtures/release-history/semver_test.1.1.xml

 <?xml version="1.0" encoding="utf-8"?>
+<!--
+This fixture is used by \Drupal\Tests\automatic_updates_extensions\Functional\UpdaterFormTest.
+
+Contains metadata about the following (fake) releases of semver_test module, all of which are secure, in order:
+- 8.2.0, which is in an unsupported branch
+- 8.1.1
+- 8.1.1-beta1
+- 8.1.1-alpha1
+- 8.1.0
+- 8.1.0-beta1
+- 8.1.0-alpha1
+- 8.0.1
+- 8.0.1-beta1
+- 8.0.1-alpha1
+- 8.0.0
+- 8.0.0-beta1
+- 8.0.0-alpha1
+-->
 <project xmlns:dc="http://purl.org/dc/elements/1.1/">
 <title>Semver Test</title>
 <short_name>semver_test</short_name>