How do I list modules on my site that are not covered by the Drupal security advisory policy?

Question

We have a number of contributed modules installed on a Drupal 7 site, but there doesn't seem to be an easy way to see those covered by the Drupal security advisory policy, without copy-pasting each module name into the address bar and manually checking the page.

Is there a way to do this with Drush?

Answer 1

I'm not aware of a report (a good home for such a thing might be the Site Audit project? (#2882555)

Here's a very quick report for D7 that shows:

• Custom modules
• Modules without a release covered by Security Policy

You can download this and use it with drush scr, or copy it for drush eval directly. Feel free to improve on it!

<?php
$projects = update_get_available(true);
$uncovered = [];
foreach ($projects as $name => $project) {
  if (!isset($project["releases"])) {
    $uncovered[$name] = "No releases found";
  }
  else {
    $latest_release = reset($project["releases"]);
    if (!empty($latest_release["security"])) {
      $uncovered[$name] = $latest_release["security"];
    }
  }
};
print_r($uncovered);