We have a number of contributed modules installed on a Drupal 7 site, but there doesn't seem to be an easy way to see those covered by the Drupal security advisory policy, without copy-pasting each module name into the address bar and manually checking the page.

Is there a way to do this with Drush?


I'm not aware of a report (a good home for such a thing might be the Site Audit project? (#2882555)

Here's a very quick report for D7 that shows:

  • Custom modules
  • Modules without a release covered by Security Policy

You can download this and use it with drush scr, or copy it for drush eval directly. Feel free to improve on it!

$projects = update_get_available(true);
$uncovered = [];
foreach ($projects as $name => $project) {
  if (!isset($project["releases"])) {
    $uncovered[$name] = "No releases found";
  else {
    $latest_release = reset($project["releases"]);
    if (!empty($latest_release["security"])) {
      $uncovered[$name] = $latest_release["security"];
  • 1
    I don't have time to improve the code right know, but I can at least report that it doesn't work. Modules that have stable releases (covered by the security advisory policy) will be reported as uncovered by the script if they have a alpha release for the next version. This can be confirmed by testing the script with the Media module. In addition the script should check if a stable version is in fact installed ... – hansfn Jun 1 '17 at 7:19
  • Thanks @hansfn, good point: code above assumes we're checking the latest release is covered by security release. I'll leave as is, improvements welcome! (Happy to update answer from the linked issue or gist.) – Chris Burgess Jun 2 '17 at 0:07
  • 1
    Howdy, I'm the Site Audit author, happy to include that functionality in there. I honestly don't want to maintain a list, but leveraging drush & update_get_available sounds like a great solution. Will follow-up more in the issue. – jonpeck Jun 2 '17 at 1:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.