security updates reported but not actually available (recommended==installed)

Question

I installed Drupal 9.3.6.

At /admin/reports/status, I see the error:

There are security updates available for one or more of your modules or themes

and at /admin/modules/update, two modules are listed: PHP 8.x-1.1 and Remote Stream Wrapper 8.x-1.5.

However, for both these modules the recommended version is the already-installed version.

• How do I see more details about the reason for the errors?
• Alternatively, can I make Drupal ignore these two modules?

Answer 1

There are security updates available for one or more of your modules or themes isn't the more appropriate message that is correct in every case. It assumes that, once a release has been marked as insecure, a new release is created, but that doesn't always happen, for example because the project owner or one of the maintainers failed to fix the security issue.

In the specific case:

• All the releases for the PHP module has been marked insecure; this means you cannot install a release that isn't marked insecure
• The 8.x-1.5 release for the Remote Stream Wrapper module has been marked insecure; there aren't more recent releases and the project has been marked unsupported

Implementing hook_update_status_alter() in a module, you can set those modules as ignored.

use Drupal\update\UpdateFetcherInterface;

function mymodule_update_status_alter(&$projects) {
  if (isset($projects['php'])) {
    $projects['php']['status'] = UpdateFetcherInterface::UNKNOWN;
    $projects['php']['reason'] = t('MyModule prevents Drupal from receiving information about module updates .');
  }
  if (isset($projects['remote_stream_wrapper'])) {
    $projects['remote_stream_wrapper']['status'] = UpdateFetcherInterface::UNKNOWN;
    $projects['php']['reason'] = t('MyModule prevents Drupal from receiving information about module updates .');
  }
}

Answer 2

Sometimes Drupal messages regarding module updates can be outdated and can be fixed by manual check for updates from the /admin/reports/updates page:

Also, some error messages can be shown because of the "Remote Stream Wrapper" module's status:

To avoid receiving such messages you can:

1. Uninstall the Update MAnager module.
2. Try to use the hook_update_projects_alter