How do I update modules with security release only using composer?

Question

On a Drupal 8 site, using the drupal-composer/drupal-project template, how would I go about updating only those modules which have a security release?

Our policy is to not update any module in our monthly maintenance routine unless it has a security update.

Ideally I'd like to find a solution which could be automated.

Answer 1

(I am using Drupal 7 modules as example, but just because there are more examples of security updates for Drupal 7 modules.)

Without custom coding, it's not possible. Drupal.org doesn't use a different name schema for security updates. From the version number you cannot know that version 7.x-3.14 of the Views module was a security update, while version 7.x-3.13 was not a security update.

That information is kept in https://updates.drupal.org/release-history/views/7.x, for the Drupal 7 version of the Views module, or in general in https://updates.drupal.org/release-history/<project short name>/<Drupal version>.
In the list of terms associated with a release, a Release type term whose value is Security update means the release is a security update.

<release>
  <name>views 7.x-3.14</name>
  <version>7.x-3.14</version>
  <tag>7.x-3.14</tag>
  <version_major>3</version_major>
  <version_patch>14</version_patch>
  <status>published</status>
  <release_link>
    https://www.drupal.org/project/views/releases/7.x-3.14
  </release_link>
  <download_link>
    https://ftp.drupal.org/files/projects/views-7.x-3.14.tar.gz
  </download_link>
  <date>1466019539</date>
  <mdhash>168bb684c8f34297be94b03c797841e5</mdhash>
  <filesize>1656594</filesize>
  <files>...</files>
  <terms>
    <term>
      <name>Release type</name>
      <value>Security update</value>
    </term>
    <term>
      <name>Release type</name>
      <value>Bug fixes</value>
    </term>
  </terms>
</release> 

The classes under the \Drupal\update namespace can help in writing the required code. UpdateProcessor::parseXml() is the method used to parse the XML data for a single project, but you would probably need to access one of the services Drupal implements.