How to get rid of 'security updates available' warnings?

Question

I am using the ShareThis module on my website. Unfortunately, recent release 2.3 is flagged as a security update, but it is has a major bug (settings can't be saved). I have reverted to release 2.2.

The consequence is that 'security updates available' warnings are displayed all the time in administration screens. Is it possible to get rid of them? I tried to find an option, but could not find any.

Answer 1

I had a similar problem recently (see How do I avoid checking for updates for a specific module?) and managed to get around it using hook_update_projects_alter(). You can use it to easily remove any module that you don't want to be part of the update process:

function MYMODULE_update_projects_alter(&$projects) {
  $blacklist = array(
    'sharethis',
    // Any others you might want
  );

  foreach ($blacklist as $module) {
    unset($projects[$module]);
  }
}

As Drupal no longer considers any module you put in the $blacklist array as one that needs to be updated, you should stop getting the security warning.

It would probably be a good idea to keep an eye on the progress of the bug in the ShareThis module so that you can remove this restriction when possible.

Answer 2

I'd say the right way to get rid of it is to fix the bug (e.g. by reviewing the patch in that issue) and deploying that patch on your server.

The vulnerability in the module is pretty serious. It would allow an attacker to take over your site. You don't want to be running an outdated version of the module if at all possible.