automatic_updates.services.yml

@@ -62,6 +62,12 @@ services:
       - '@package_manager.failure_marker'
     calls:
       - ['setLogger', ['@logger.channel.automatic_updates']]
+  automatic_updates.requested_update_validator:
+    class: Drupal\automatic_updates\Validator\RequestedUpdateValidator
+    arguments:
+      - '@string_translation'
+    tags:
+      - { name: event_subscriber }
   automatic_updates.staged_projects_validator:
     class: Drupal\automatic_updates\Validator\StagedProjectsValidator
     arguments:

package_manager/tests/modules/fixture_manipulator/src/FixtureManipulator.php

@@ -190,7 +190,7 @@ class FixtureManipulator {
       // If we're going to be updating the package data, merge the incoming data
       // into what we already have.
       if ($package) {
-        $install_json_package = NestedArray::mergeDeep($data['packages'][$position], $install_json_package);
+        $install_json_package = $install_json_package + $data['packages'][$position];
       }
 
       // Remove the existing package; the array will be re-keyed by
@@ -283,6 +283,19 @@ class FixtureManipulator {
     return $this;
   }
 
+  /**
+   * Modifies core packages.
+   *
+   * @param string $version
+   *   Target version.
+   */
+  public function setCorePackageVersion(string $version): self {
+    $this->setVersion('drupal/core', $version);
+    $this->setVersion('drupal/core-recommended', $version);
+    $this->setVersion('drupal/core-dev', $version);
+    return $this;
+  }
+
   /**
    * Commits the changes to the directory.
    */

src/CronUpdater.php

@@ -161,6 +161,28 @@ class CronUpdater extends Updater {
   private function performUpdate(string $target_version, ?int $timeout): void {
     $project_info = new ProjectInfo('drupal');
 
+    if (!$this->isAvailable()) {
+      if ($project_info->isInstalledVersionSafe() && !$this->isApplying()) {
+        $this->logger->notice('Cron will not perform any updates because there is an existing stage and the current version of the site is secure.');
+        return;
+      }
+      if (!$project_info->isInstalledVersionSafe() && $this->isApplying()) {
+        $this->logger->notice(
+          'Cron will not perform any updates as an existing staged update is applying. The site is currently on an insecure version of Drupal core but will attempt to update to a secure version next time cron is run. This update may be applied manually at the <a href="%url">update form</a>.',
+          ['%url' => Url::fromRoute('update.report_update')->setAbsolute()->toString()],
+        );
+        return;
+      }
+    }
+
+    // Delete the existing staging area if not available and the site is
+    // currently on an insecure version.
+    if (!$project_info->isInstalledVersionSafe() && !$this->isAvailable() && !$this->isApplying()) {
+      // @todo Improve this in https://www.drupal.org/i/3325654.
+      $this->logger->notice('The existing stage was not in the process of being applied, so it was destroyed to allow updating the site to a secure version during cron.');
+      $this->destroy(TRUE);
+    }
+
     $installed_version = $project_info->getInstalledVersion();
     if (empty($installed_version)) {
       $this->logger->error('Unable to determine the current version of Drupal core.');

src/Validator/RequestedUpdateValidator.php

+<?php
+
+declare(strict_types = 1);
+
+namespace Drupal\automatic_updates\Validator;
+
+use Composer\Semver\Semver;
+use Drupal\automatic_updates\Updater;
+use Drupal\Core\StringTranslation\StringTranslationTrait;
+use Drupal\Core\StringTranslation\TranslationInterface;
+use Drupal\package_manager\Event\PreApplyEvent;
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
+
+/**
+ * Validates that requested packages have been updated.
+ */
+class RequestedUpdateValidator implements EventSubscriberInterface {
+
+  use StringTranslationTrait;
+
+  /**
+   * Constructs a RequestedUpdateValidator object.
+   *
+   * @param \Drupal\Core\StringTranslation\TranslationInterface $translation
+   *   The translation service.
+   */
+  public function __construct(TranslationInterface $translation) {
+    $this->setStringTranslation($translation);
+  }
+
+  /**
+   * Validates that requested packages have been updated to the right version.
+   *
+   * @param \Drupal\package_manager\Event\PreApplyEvent $event
+   *   The pre-apply event.
+   */
+  public function checkRequestedStagedVersion(PreApplyEvent $event): void {
+    $stage = $event->getStage();
+    if (!($stage instanceof Updater)) {
+      return;
+    }
+    $requested_package_versions = $stage->getPackageVersions();
+    $changed_stage_packages = $stage->getStageComposer()->getPackagesWithDifferentVersionsIn($stage->getActiveComposer());
+    if (empty($changed_stage_packages)) {
+      $event->addError([$this->t('No updates detected in the staging area.')]);
+      return;
+    }
+
+    // Check for all changed the packages if they are updated to the requested
+    // version.
+    foreach (['production', 'dev'] as $package_type) {
+      foreach ($requested_package_versions[$package_type] as $requested_package_name => $requested_version) {
+        if (array_key_exists($requested_package_name, $changed_stage_packages)) {
+          $staged_version = $changed_stage_packages[$requested_package_name]->getPrettyVersion();
+          if (!Semver::satisfies($staged_version, $requested_version)) {
+            $event->addError([
+              $this->t(
+                "The requested update to '@requested_package_name' to version '@requested_version' does not match the actual staged update to '@staged_version'.",
+                [
+                  '@requested_package_name' => $requested_package_name,
+                  '@requested_version' => $requested_version,
+                  '@staged_version' => $staged_version,
+                ]
+              ),
+            ]);
+          }
+        }
+        else {
+          $event->addError([
+            $this->t(
+              "The requested update to '@requested_package_name' to version '@requested_version' was not performed.",
+              [
+                '@requested_package_name' => $requested_package_name,
+                '@requested_version' => $requested_version,
+              ]
+            ),
+          ]);
+        }
+      }
+    }
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function getSubscribedEvents(): array {
+    $events[PreApplyEvent::class][] = ['checkRequestedStagedVersion'];
+    return $events;
+  }
+
+}

tests/src/Build/CoreUpdateTest.php

@@ -4,6 +4,7 @@ declare(strict_types = 1);
 
 namespace Drupal\Tests\automatic_updates\Build;
 
+use Behat\Mink\Element\DocumentElement;
 use Drupal\automatic_updates\CronUpdater;
 use Drupal\automatic_updates\Updater;
 use Drupal\Composer\Composer;
@@ -146,20 +147,7 @@ class CoreUpdateTest extends UpdateTestBase {
     $session = $mink->getSession();
     $page = $session->getPage();
     $assert_session = $mink->assertSession();
-
-    $this->visit('/admin/modules');
-    $assert_session->pageTextContains('There is a security update available for your version of Drupal.');
-    $page->clickLink('Update');
-
-    // Ensure that the update is prevented if the web root and/or vendor
-    // directories are not writable.
-    $this->assertReadOnlyFileSystemError(parse_url($session->getCurrentUrl(), PHP_URL_PATH));
-    $session->reload();
-
-    $assert_session->pageTextNotContains('There is a security update available for your version of Drupal.');
-    $page->pressButton('Update to 9.8.1');
-    $this->waitForBatchJob();
-    $assert_session->pageTextContains('Ready to update');
+    $this->coreUpdateTillUpdateReady($page);
     $page->pressButton('Continue');
     $this->waitForBatchJob();
     $assert_session->pageTextContains('Update complete!');
@@ -230,6 +218,22 @@ class CoreUpdateTest extends UpdateTestBase {
     $this->webAssert->statusMessageNotExists('warning');
   }
 
+  /**
+   * Tests stage is destroyed if not available and site is on insecure version.
+   */
+  public function testStageDestroyedIfNotAvailable(): void {
+    $this->createTestProject('RecommendedProject');
+    $mink = $this->getMink();
+    $session = $mink->getSession();
+    $page = $session->getPage();
+    $assert_session = $mink->assertSession();
+    $this->coreUpdateTillUpdateReady($page);
+    $this->visit('/admin/reports/status');
+    $assert_session->pageTextContains('Your site is ready for automatic updates.');
+    $page->clickLink('Run cron');
+    $this->assertUpdateSuccessful('9.8.1');
+  }
+
   /**
    * Asserts that the update is prevented if the filesystem isn't writable.
    *
@@ -373,4 +377,28 @@ class CoreUpdateTest extends UpdateTestBase {
     $this->assertCoreVersion($expected_version);
   }
 
+  /**
+   * Performs core update till update ready form.
+   *
+   * @param \Behat\Mink\Element\DocumentElement $page
+   *   The page element.
+   */
+  private function coreUpdateTillUpdateReady(DocumentElement $page): void {
+    $session = $this->getMink()->getSession();
+    $this->visit('/admin/modules');
+    $assert_session = $this->getMink()->assertSession($session);
+    $assert_session->pageTextContains('There is a security update available for your version of Drupal.');
+    $page->clickLink('Update');
+
+    // Ensure that the update is prevented if the web root and/or vendor
+    // directories are not writable.
+    $this->assertReadOnlyFileSystemError(parse_url($session->getCurrentUrl(), PHP_URL_PATH));
+    $session->reload();
+
+    $assert_session->pageTextNotContains('There is a security update available for your version of Drupal.');
+    $page->pressButton('Update to 9.8.1');
+    $this->waitForBatchJob();
+    $assert_session->pageTextContains('Ready to update');
+  }
+
 }

tests/src/Functional/AutomaticUpdatesFunctionalTestBase.php

@@ -39,11 +39,9 @@ abstract class AutomaticUpdatesFunctionalTestBase extends BrowserTestBase {
    * @param string $version
    *   The core version.
    */
-  protected function setCoreUpdate(string $version):void {
+  protected function setCoreUpdate(string $version): void {
     $stage_manipulator = new StageFixtureManipulator();
-    $stage_manipulator->setVersion('drupal/core', $version)
-      ->setVersion('drupal/core-recommended', $version)
-      ->setVersion('drupal/core-dev', $version)
+    $stage_manipulator->setCorePackageVersion($version)
       ->setReadyToCommit();
   }
 

tests/src/Functional/StatusCheckTest.php

@@ -486,7 +486,7 @@ class StatusCheckTest extends AutomaticUpdatesFunctionalTestBase {
       'automatic_updates',
       'automatic_updates_test',
     ]);
-
+    $this->checkForUpdates();
     // The error should be persistently visible, even after the checker stops
     // flagging it.
     $this->drupalGet('/admin/structure');
@@ -501,7 +501,7 @@ class StatusCheckTest extends AutomaticUpdatesFunctionalTestBase {
     // longer raising an error.
     $this->drupalGet('/admin/modules/update');
     $this->setCoreUpdate('9.8.1');
-    $assert_session->buttonExists('Update');
+    $assert_session->buttonExists('Update to 9.8.1');
     // Ensure that the previous results are still displayed on another admin
     // page, to confirm that the updater form is not discarding the previous
     // results by doing its checks.
@@ -509,7 +509,7 @@ class StatusCheckTest extends AutomaticUpdatesFunctionalTestBase {
     $assert_session->pageTextContains($message);
     // Proceed with the update.
     $this->drupalGet('/admin/modules/update');
-    $page->pressButton('Update');
+    $page->pressButton('Update to 9.8.1');
     $this->checkForMetaRefresh();
     $this->assertUpdateReady('9.8.1');
     $page->pressButton('Continue');

tests/src/Functional/UpdaterFormTest.php

@@ -5,6 +5,7 @@ declare(strict_types = 1);
 namespace Drupal\Tests\automatic_updates\Functional;
 
 use Drupal\automatic_updates_test\Datetime\TestTime;
+use Drupal\fixture_manipulator\StageFixtureManipulator;
 use Drupal\package_manager_test_validation\StagedDatabaseUpdateValidator;
 use Drupal\package_manager\Event\PostRequireEvent;
 use Drupal\package_manager\Event\PreApplyEvent;
@@ -390,6 +391,9 @@ class UpdaterFormTest extends AutomaticUpdatesFunctionalTestBase {
    * Tests that an exception is thrown if a previous apply failed.
    */
   public function testMarkerFileFailure(): void {
+    (new StageFixtureManipulator())
+      ->setCorePackageVersion('9.8.1')
+      ->setReadyToCommit();
     $session = $this->getSession();
     $assert_session = $this->assertSession();
     $page = $session->getPage();

tests/src/Kernel/CronUpdaterTest.php

@@ -9,6 +9,7 @@ use Drupal\automatic_updates_test\EventSubscriber\TestSubscriber1;
 use Drupal\Core\DependencyInjection\ContainerBuilder;
 use Drupal\Core\Logger\RfcLogLevel;
 use Drupal\Core\Url;
+use Drupal\fixture_manipulator\StageFixtureManipulator;
 use Drupal\package_manager\Event\PostApplyEvent;
 use Drupal\package_manager\Event\PostCreateEvent;
 use Drupal\package_manager\Event\PostDestroyEvent;
@@ -21,6 +22,7 @@ use Drupal\package_manager\Exception\StageValidationException;
 use Drupal\package_manager\ValidationResult;
 use Drupal\package_manager_bypass\Committer;
 use Drupal\Tests\automatic_updates\Traits\EmailNotificationsTestTrait;
+use Drupal\Tests\package_manager\Kernel\TestStage;
 use Drupal\Tests\package_manager\Traits\PackageManagerBypassTestTrait;
 use Drupal\Tests\user\Traits\UserCreationTrait;
 use Prophecy\Argument;
@@ -143,12 +145,15 @@ class CronUpdaterTest extends AutomaticUpdatesKernelTestBase {
    * @dataProvider providerUpdaterCalled
    */
   public function testUpdaterCalled(string $setting, array $release_data, bool $will_update): void {
+    $version = strpos($release_data['drupal'], '9.8.2') ? '9.8.2' : '9.8.1';
+    (new StageFixtureManipulator())
+      ->setCorePackageVersion($version)
+      ->setReadyToCommit();
     // Our form alter does not refresh information on available updates, so
     // ensure that the appropriate update data is loaded beforehand.
     $this->setReleaseMetadata($release_data);
     $this->setCoreVersion('9.8.0');
     update_get_available(TRUE);
-
     $this->config('automatic_updates.settings')->set('cron', $setting)->save();
 
     // Since we're just trying to ensure that all of Package Manager's services
@@ -246,10 +251,12 @@ class CronUpdaterTest extends AutomaticUpdatesKernelTestBase {
    * @dataProvider providerStageDestroyedOnError
    */
   public function testStageDestroyedOnError(string $event_class, string $exception_class): void {
+    (new StageFixtureManipulator())
+      ->setCorePackageVersion('9.8.1')
+      ->setReadyToCommit();
     $this->installConfig('automatic_updates');
     // @todo Remove in https://www.drupal.org/project/automatic_updates/issues/3284443
     $this->config('automatic_updates.settings')->set('cron', CronUpdater::SECURITY)->save();
-    $this->setCoreVersion('9.8.0');
     // Ensure that there is a security release to which we should update.
     $this->setReleaseMetadata([
       'drupal' => __DIR__ . "/../../../package_manager/tests/fixtures/release-history/drupal.9.8.1-security.xml",
@@ -338,6 +345,90 @@ class CronUpdaterTest extends AutomaticUpdatesKernelTestBase {
     }
   }
 
+  /**
+   * Tests stage is destroyed if not available and site is on insecure version.
+   */
+  public function testStageDestroyedIfNotAvailable(): void {
+    $stage = $this->createStage();
+    $stage->create();
+    $original_stage_directory = $stage->getStageDirectory();
+    $this->assertDirectoryExists($original_stage_directory);
+
+    $listener = function (PostRequireEvent $event) use (&$cron_stage_dir, $original_stage_directory): void {
+      $this->assertDirectoryDoesNotExist($original_stage_directory);
+      $cron_stage_dir = $this->container->get('package_manager.stager')->getInvocationArguments()[0][1]->resolve();
+      $this->assertSame($event->getStage()->getStageDirectory(), $cron_stage_dir);
+      $this->assertDirectoryExists($cron_stage_dir);
+    };
+    $this->container->get('event_dispatcher')->addListener(PostRequireEvent::class, $listener, PHP_INT_MAX);
+
+    $this->container->get('cron')->run();
+    $this->assertIsString($cron_stage_dir);
+    $this->assertNotEquals($original_stage_directory, $cron_stage_dir);
+    $this->assertDirectoryDoesNotExist($cron_stage_dir);
+    $this->assertTrue($this->logger->hasRecord('The existing stage was not in the process of being applied, so it was destroyed to allow updating the site to a secure version during cron.', (string) RfcLogLevel::NOTICE));
+  }
+
+  /**
+   * Tests stage is not destroyed if another update is applying.
+   */
+  public function testStageNotDestroyedIfApplying(): void {
+    $this->config('automatic_updates.settings')->set('cron', CronUpdater::ALL)->save();
+    $this->setReleaseMetadata([
+      'drupal' => __DIR__ . "/../../../package_manager/tests/fixtures/release-history/drupal.9.8.1-security.xml",
+    ]);
+    $this->setCoreVersion('9.8.0');
+    $stage = $this->createStage();
+    $stage->create();
+    $stage->require(['drupal/core:9.8.1']);
+    $stop_error = t('Stopping stage from applying');
+
+    // Add a PreApplyEvent event listener so we can attempt to run cron when
+    // another stage is applying.
+    $this->container->get('event_dispatcher')->addListener(PreApplyEvent::class, function (PreApplyEvent $event) use ($stop_error) {
+      // Ensure the stage that is applying the operation is not the cron
+      // updater.
+      $this->assertInstanceOf(TestStage::class, $event->getStage());
+      $this->container->get('cron')->run();
+      // We do not actually want to apply this operation it was just invoked to
+      // allow cron to be  attempted.
+      $event->addError([$stop_error]);
+    }, PHP_INT_MAX);
+
+    try {
+      $stage->apply();
+      $this->fail('Expected update to fail');
+    }
+    catch (StageValidationException $exception) {
+      $this->assertValidationResultsEqual([ValidationResult::createError([$stop_error])], $exception->getResults());
+    }
+
+    $this->assertTrue($this->logger->hasRecord("Cron will not perform any updates as an existing staged update is applying. The site is currently on an insecure version of Drupal core but will attempt to update to a secure version next time cron is run. This update may be applied manually at the <a href=\"%url\">update form</a>.", (string) RfcLogLevel::NOTICE));
+    $this->assertUpdateStagedTimes(1);
+  }
+
+  /**
+   * Tests stage is not destroyed if not available and site is on secure version.
+   */
+  public function testStageNotDestroyedIfSecure(): void {
+    $this->config('automatic_updates.settings')->set('cron', CronUpdater::ALL)->save();
+    $this->setReleaseMetadata([
+      'drupal' => __DIR__ . "/../../../package_manager/tests/fixtures/release-history/drupal.9.8.2.xml",
+    ]);
+    $this->setCoreVersion('9.8.1');
+    $stage = $this->createStage();
+    $stage->create();
+    $stage->require(['drupal/random']);
+    $this->assertUpdateStagedTimes(1);
+
+    // Trigger CronUpdater, the above should cause it to detect a stage that is
+    // applying.
+    $this->container->get('cron')->run();
+
+    $this->assertTrue($this->logger->hasRecord('Cron will not perform any updates because there is an existing stage and the current version of the site is secure.', (string) RfcLogLevel::NOTICE));
+    $this->assertUpdateStagedTimes(1);
+  }
+
   /**
    * Tests that CronUpdater::begin() unconditionally throws an exception.
    */
@@ -351,6 +442,9 @@ class CronUpdaterTest extends AutomaticUpdatesKernelTestBase {
    * Tests that email is sent when an unattended update succeeds.
    */
   public function testEmailOnSuccess(): void {
+    (new StageFixtureManipulator())
+      ->setCorePackageVersion('9.8.1')
+      ->setReadyToCommit();
     $this->container->get('cron')->run();
 
     // Ensure we sent a success message to all recipients.
@@ -395,6 +489,9 @@ END;
    * @dataProvider providerEmailOnFailure
    */
   public function testNonUrgentFailureEmail(string $event_class): void {
+    (new StageFixtureManipulator())
+      ->setCorePackageVersion('9.8.2')
+      ->setReadyToCommit();
     $this->setReleaseMetadata([
       'drupal' => __DIR__ . '/../../../package_manager/tests/fixtures/release-history/drupal.9.8.2.xml',
     ]);
@@ -436,6 +533,9 @@ END;
    * @dataProvider providerEmailOnFailure
    */
   public function testSecurityUpdateFailureEmail(string $event_class): void {
+    (new StageFixtureManipulator())
+      ->setCorePackageVersion('9.8.1')
+      ->setReadyToCommit();
     $results = [
       ValidationResult::createError(['Error while updating!']),
     ];
@@ -465,6 +565,9 @@ END;
    * Tests the failure e-mail when an unattended update fails to apply.
    */
   public function testApplyFailureEmail(): void {
+    (new StageFixtureManipulator())
+      ->setCorePackageVersion('9.8.1')
+      ->setReadyToCommit();
     $error = new \Exception('I drink your milkshake!');
     Committer::setException($error);
 

tests/src/Kernel/StatusCheck/CronServerValidatorTest.php

@@ -8,6 +8,7 @@ use Drupal\automatic_updates\CronUpdater;
 use Drupal\automatic_updates\Validator\CronServerValidator;
 use Drupal\Core\Logger\RfcLogLevel;
 use Drupal\Core\Url;
+use Drupal\fixture_manipulator\StageFixtureManipulator;
 use Drupal\package_manager\Event\PreApplyEvent;
 use Drupal\package_manager\Exception\StageValidationException;
 use Drupal\package_manager\ValidationResult;
@@ -98,6 +99,9 @@ class CronServerValidatorTest extends AutomaticUpdatesKernelTestBase {
    * @dataProvider providerCronServerValidation
    */
   public function testCronServerValidationDuringPreCreate(bool $alternate_port, string $server_api, string $cron_mode, array $expected_results): void {
+    (new StageFixtureManipulator())
+      ->setCorePackageVersion('9.8.1')
+      ->setReadyToCommit();
     $request = $this->container->get('request_stack')->getCurrentRequest();
     $this->assertNotEmpty($request);
     $this->assertSame(80, $request->getPort());
@@ -150,6 +154,9 @@ class CronServerValidatorTest extends AutomaticUpdatesKernelTestBase {
    * @dataProvider providerCronServerValidation
    */
   public function testCronServerValidationDuringPreApply(bool $alternate_port, string $server_api, string $cron_mode, array $expected_results): void {
+    (new StageFixtureManipulator())
+      ->setCorePackageVersion('9.8.1')
+      ->setReadyToCommit();
     $request = $this->container->get('request_stack')->getCurrentRequest();
     $this->assertNotEmpty($request);
     $this->assertSame(80, $request->getPort());

tests/src/Kernel/StatusCheck/RequestedUpdateValidatorTest.php

+<?php
+
+declare(strict_types = 1);
+
+namespace Drupal\Tests\automatic_updates\Kernel\StatusCheck;
+
+use Drupal\fixture_manipulator\StageFixtureManipulator;
+use Drupal\package_manager\Exception\StageValidationException;
+use Drupal\package_manager\ValidationResult;
+use Drupal\Tests\automatic_updates\Kernel\AutomaticUpdatesKernelTestBase;
+
+/**
+ * @coversDefaultClass \Drupal\automatic_updates\Validator\RequestedUpdateValidator
+ * @group automatic_updates
+ * @internal
+ */
+class RequestedUpdateValidatorTest extends AutomaticUpdatesKernelTestBase {
+
+  /**
+   * {@inheritdoc}
+   */
+  protected static $modules = [
+    'automatic_updates',
+    'automatic_updates_test',
+  ];
+
+  /**
+   * Tests error message is shown if the core version is not updated.
+   */
+  public function testErrorMessageOnCoreNotUpdated(): void {
+    // Update `drupal/core-recommended` to a version that does not match the
+    // requested version of '9.8.1'. This also does not update all packages that
+    // are expected to be updated when updating Drupal core.
+    // @see \Drupal\automatic_updates\Updater::begin()
+    // @see \Drupal\package_manager\ComposerUtility::getCorePackages()
+    (new StageFixtureManipulator())
+      ->setVersion('drupal/core-recommended', '9.8.2')
+      ->setReadyToCommit();
+    $this->setCoreVersion('9.8.0');
+    $this->setReleaseMetadata([
+      'drupal' => __DIR__ . '/../../../../package_manager/tests/fixtures/release-history/drupal.9.8.1-security.xml',
+    ]);
+    $this->container->get('module_installer')->install(['automatic_updates']);
+
+    /** @var \Drupal\automatic_updates\Updater $updater */
+    $updater = $this->container->get('automatic_updates.updater');
+    $updater->begin(['drupal' => '9.8.1']);
+    $updater->stage();
+
+    $expected_results = [
+      ValidationResult::createError([t("The requested update to 'drupal/core-recommended' to version '9.8.1' does not match the actual staged update to '9.8.2'.")]),
+      ValidationResult::createError([t("The requested update to 'drupal/core-dev' to version '9.8.1' was not performed.")]),
+    ];
+    try {
+      $updater->apply();
+      $this->fail('Expecting an exception.');
+    }
+    catch (StageValidationException $exception) {
+      $this->assertValidationResultsEqual($expected_results, $exception->getResults());
+    }
+  }
+
+  /**
+   * Tests error message is shown if there are no core packages in stage.
+   */
+  public function testErrorMessageOnEmptyCorePackages(): void {
+    (new StageFixtureManipulator())
+      ->removePackage('drupal/core')
+      ->removePackage('drupal/core-recommended')
+      ->removePackage('drupal/core-dev')
+      ->setReadyToCommit();
+
+    $this->setCoreVersion('9.8.0');
+    $this->setReleaseMetadata([
+      'drupal' => __DIR__ . '/../../../../package_manager/tests/fixtures/release-history/drupal.9.8.1-security.xml',
+    ]);
+    $this->container->get('module_installer')->install(['automatic_updates']);
+
+    /** @var \Drupal\automatic_updates\Updater $updater */
+    $updater = $this->container->get('automatic_updates.updater');
+    $updater->begin(['drupal' => '9.8.1']);
+    $updater->stage();
+    $this->expectErrorMessage('No updates detected in the staging area.');
+    $updater->apply();
+  }
+
+}

tests/src/Kernel/StatusCheck/ScaffoldFilePermissionsValidatorTest.php

@@ -4,6 +4,8 @@ declare(strict_types = 1);
 
 namespace Drupal\Tests\automatic_updates\Kernel\StatusCheck;
 
+use Drupal\fixture_manipulator\ActiveFixtureManipulator;
+use Drupal\fixture_manipulator\StageFixtureManipulator;
 use Drupal\package_manager\Exception\StageValidationException;
 use Drupal\package_manager\ValidationResult;
 use Drupal\Tests\automatic_updates\Kernel\AutomaticUpdatesKernelTestBase;
@@ -293,6 +295,27 @@ class ScaffoldFilePermissionsValidatorTest extends AutomaticUpdatesKernelTestBas
    * @dataProvider providerScaffoldFilesChanged
    */
   public function testScaffoldFilesChanged(array $write_protected_paths, array $active_scaffold_files, array $staged_scaffold_files, array $expected_results): void {
+    // Rewrite the active and staged installed.json files, inserting the given
+    // lists of scaffold files.
+    (new ActiveFixtureManipulator())
+      ->modifyPackage('drupal/core', [
+        'extra' => [
+          'drupal-scaffold' => [
+            'file-mapping' => $active_scaffold_files,
+          ],
+        ],
+      ])
+      ->commitChanges();
+    (new StageFixtureManipulator())
+      ->setCorePackageVersion('9.8.1')
+      ->modifyPackage('drupal/core', [
+        'extra' => [
+          'drupal-scaffold' => [
+            'file-mapping' => $staged_scaffold_files,
+          ],
+        ],
+      ])
+      ->setReadyToCommit();
     // Create fake scaffold files so we can test scenarios in which a scaffold
     // file that exists in the active directory is deleted in the stage
     // directory.
@@ -303,31 +326,6 @@ class ScaffoldFilePermissionsValidatorTest extends AutomaticUpdatesKernelTestBas
     $updater->begin(['drupal' => '9.8.1']);
     $updater->stage();
 
-    // Rewrite the active and staged installed.json files, inserting the given
-    // lists of scaffold files.
-    $installed = [
-      'packages' => [
-        [
-          'name' => 'drupal/core',
-          'version' => \Drupal::VERSION,
-          'extra' => [
-            'drupal-scaffold' => [
-              'file_mapping' => [],
-            ],
-          ],
-        ],
-      ],
-    ];
-    // Since the list of scaffold files is in a deeply nested array, reference
-    // it for readability.
-    $scaffold_files = &$installed['packages'][0]['extra']['drupal-scaffold']['file-mapping'];
-
-    // Change the list of scaffold files in the active and stage directories.
-    $scaffold_files = $active_scaffold_files;
-    file_put_contents($this->activeDir . '/vendor/composer/installed.json', json_encode($installed));
-    $scaffold_files = $staged_scaffold_files;
-    file_put_contents($updater->getStageDirectory() . '/vendor/composer/installed.json', json_encode($installed));
-
     $this->writeProtect($write_protected_paths);
 
     try {

tests/src/Kernel/StatusCheck/StagedDatabaseUpdateValidatorTest.php

@@ -5,6 +5,7 @@ declare(strict_types = 1);
 namespace Drupal\Tests\automatic_updates\Kernel\StatusCheck;
 
 use Drupal\Core\Logger\RfcLogLevel;
+use Drupal\fixture_manipulator\StageFixtureManipulator;
 use Drupal\package_manager\Event\PreApplyEvent;
 use Drupal\Tests\automatic_updates\Kernel\AutomaticUpdatesKernelTestBase;
 use ColinODell\PsrTestLogger\TestLogger;
@@ -93,6 +94,9 @@ class StagedDatabaseUpdateValidatorTest extends AutomaticUpdatesKernelTestBase {
    * Tests that no errors are raised if the stage has no DB updates.
    */
   public function testNoUpdates(): void {
+    (new StageFixtureManipulator())
+      ->setCorePackageVersion('9.8.1')
+      ->setReadyToCommit();
     $this->container->get('cron')->run();
     $this->assertFalse($this->logger->hasRecords((string) RfcLogLevel::ERROR));
   }
@@ -106,6 +110,9 @@ class StagedDatabaseUpdateValidatorTest extends AutomaticUpdatesKernelTestBase {
    * @dataProvider providerSuffixes
    */
   public function testFileDeleted(string $suffix): void {
+    (new StageFixtureManipulator())
+      ->setCorePackageVersion('9.8.1')
+      ->setReadyToCommit();
     $listener = function (PreApplyEvent $event) use ($suffix): void {
       $stage_dir = $event->getStage()->getStageDirectory();
       foreach ($this->extensions as $name => $path) {
@@ -114,7 +121,6 @@ class StagedDatabaseUpdateValidatorTest extends AutomaticUpdatesKernelTestBase {
     };
     $this->container->get('event_dispatcher')
       ->addListener(PreApplyEvent::class, $listener, PHP_INT_MAX);
-
     $this->container->get('cron')->run();
     $expected_message = "The update cannot proceed because possible database updates have been detected in the following extensions.\nSystem\nStark\n";
     $this->assertTrue($this->logger->hasRecord($expected_message, (string) RfcLogLevel::ERROR));
@@ -129,6 +135,9 @@ class StagedDatabaseUpdateValidatorTest extends AutomaticUpdatesKernelTestBase {
    * @dataProvider providerSuffixes
    */
   public function testFileChanged(string $suffix): void {
+    (new StageFixtureManipulator())
+      ->setCorePackageVersion('9.8.1')
+      ->setReadyToCommit();
     $listener = function (PreApplyEvent $event) use ($suffix): void {
       $stage_dir = $event->getStage()->getStageDirectory();
       foreach ($this->extensions as $name => $path) {
@@ -137,7 +146,6 @@ class StagedDatabaseUpdateValidatorTest extends AutomaticUpdatesKernelTestBase {
     };
     $this->container->get('event_dispatcher')
       ->addListener(PreApplyEvent::class, $listener, PHP_INT_MAX);
-
     $this->container->get('cron')->run();
     $expected_message = "The update cannot proceed because possible database updates have been detected in the following extensions.\nSystem\nStark\n";
     $this->assertTrue($this->logger->hasRecord($expected_message, (string) RfcLogLevel::ERROR));
@@ -152,6 +160,9 @@ class StagedDatabaseUpdateValidatorTest extends AutomaticUpdatesKernelTestBase {
    * @dataProvider providerSuffixes
    */
   public function testFileAdded(string $suffix): void {
+    (new StageFixtureManipulator())
+      ->setCorePackageVersion('9.8.1')
+      ->setReadyToCommit();
     $listener = function () use ($suffix): void {
       $active_dir = $this->container->get('package_manager.path_locator')
         ->getProjectRoot();

tests/src/Kernel/StatusCheck/StagedProjectsValidatorTest.php

@@ -106,6 +106,7 @@ class StagedProjectsValidatorTest extends AutomaticUpdatesKernelTestBase {
 
     $stage_manipulator = new StageFixtureManipulator();
     $stage_manipulator
+      ->setCorePackageVersion('9.8.1')
       ->addPackage([
         'name' => 'drupal/test_module2',
         'version' => '1.3.1',
@@ -165,6 +166,7 @@ class StagedProjectsValidatorTest extends AutomaticUpdatesKernelTestBase {
    */
   public function testProjectsRemoved(): void {
     (new ActiveFixtureManipulator())
+      ->setCorePackageVersion('9.8.0')
       ->addPackage([
         'name' => 'drupal/test_theme',
         'version' => '1.3.0',
@@ -217,6 +219,7 @@ class StagedProjectsValidatorTest extends AutomaticUpdatesKernelTestBase {
     // since it only cares about Drupal modules and themes.
       ->removePackage('other/removed')
       ->removePackage('other/dev-removed')
+      ->setCorePackageVersion('9.8.1')
       ->setReadyToCommit();
 
     $messages = [
@@ -241,6 +244,7 @@ class StagedProjectsValidatorTest extends AutomaticUpdatesKernelTestBase {
    */
   public function testVersionsChanged(): void {
     (new ActiveFixtureManipulator())
+      ->setCorePackageVersion('9.8.0')
       ->addPackage([
         'name' => 'drupal/test_module',
         'version' => '1.3.0',
@@ -278,6 +282,7 @@ class StagedProjectsValidatorTest extends AutomaticUpdatesKernelTestBase {
     // because it only cares about Drupal modules and themes.
       ->setVersion('other/changed', '1.3.2')
       ->setVersion('other/dev-changed', '1.3.2')
+      ->setCorePackageVersion('9.8.1')
       ->setReadyToCommit();
 
     $messages = [
@@ -303,6 +308,7 @@ class StagedProjectsValidatorTest extends AutomaticUpdatesKernelTestBase {
    */
   public function testNoErrors(): void {
     (new ActiveFixtureManipulator())
+      ->setCorePackageVersion('9.8.0')
       ->addPackage([
         'name' => 'drupal/test_module',
         'version' => '1.3.0',
@@ -347,7 +353,7 @@ class StagedProjectsValidatorTest extends AutomaticUpdatesKernelTestBase {
       ->commitChanges();
 
     $stage_manipulator = new StageFixtureManipulator();
-    $stage_manipulator->setVersion('drupal/core', '9.8.1')
+    $stage_manipulator->setCorePackageVersion('9.8.1')
     // The validator shouldn't care what happens to these packages, since it
     // only concerns itself with Drupal modules and themes.
       ->addPackage([

tests/src/Kernel/StatusCheck/StatusCheckerTest.php

@@ -8,6 +8,7 @@ use Drupal\automatic_updates\CronUpdater;
 use Drupal\automatic_updates\Updater;
 use Drupal\automatic_updates_test\EventSubscriber\TestSubscriber1;
 use Drupal\automatic_updates_test2\EventSubscriber\TestSubscriber2;
+use Drupal\fixture_manipulator\StageFixtureManipulator;
 use Drupal\package_manager\Event\StatusCheckEvent;
 use Drupal\system\SystemManager;
 use Drupal\Tests\automatic_updates\Kernel\AutomaticUpdatesKernelTestBase;
@@ -220,6 +221,9 @@ class StatusCheckerTest extends AutomaticUpdatesKernelTestBase {
    * Tests that stored validation results are deleted after an update.
    */
   public function testStoredResultsDeletedPostApply(): void {
+    (new StageFixtureManipulator())
+      ->setCorePackageVersion('9.8.1')
+      ->setReadyToCommit();
     $this->setCoreVersion('9.8.0');
     $this->setReleaseMetadata([
       'drupal' => __DIR__ . '/../../../../package_manager/tests/fixtures/release-history/drupal.9.8.1-security.xml',

tests/src/Kernel/UpdaterTest.php

@@ -6,6 +6,7 @@ namespace Drupal\Tests\automatic_updates\Kernel;
 
 use Drupal\automatic_updates\Exception\UpdateException;
 use Drupal\automatic_updates_test\EventSubscriber\TestSubscriber1;
+use Drupal\fixture_manipulator\StageFixtureManipulator;
 use Drupal\package_manager\Event\PreApplyEvent;
 use Drupal\package_manager\Event\PreCreateEvent;
 use Drupal\package_manager\Event\PreRequireEvent;
@@ -179,6 +180,10 @@ class UpdaterTest extends AutomaticUpdatesKernelTestBase {
    * @dataProvider providerCommitException
    */
   public function testCommitException(string $thrown_class, string $expected_class = NULL): void {
+    (new StageFixtureManipulator())
+      ->setCorePackageVersion('9.8.1')
+      ->setReadyToCommit();
+
     $updater = $this->container->get('automatic_updates.updater');
     $updater->begin([
       'drupal' => '9.8.1',