only in patch2:
unchanged:
--- a/core/modules/update/update.report.inc
+++ b/core/modules/update/update.report.inc
@@ -5,6 +5,7 @@
  * Code required only when rendering the available updates report.
  */
 
+use Drupal\Component\Utility\Html;
 use Drupal\Core\Template\Attribute;
 use Drupal\Core\Url;
 use Drupal\update\ProjectRelease;
@@ -149,6 +150,7 @@ function template_preprocess_update_project_status(&$variables) {
 
   // Set the project title and URL.
   $variables['title'] = (isset($project['title'])) ? $project['title'] : $project['name'];
+  $variables['title'] = Html::decodeEntities($variables['title']);
   $variables['url'] = (isset($project['link'])) ? Url::fromUri($project['link'])->toString() : NULL;
 
   $variables['install_type'] = $project['install_type'];