Index: commands/pm/pm.drush.inc
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/drush/commands/pm/pm.drush.inc,v
retrieving revision 1.139
diff -u -p -r1.139 pm.drush.inc
--- commands/pm/pm.drush.inc	21 Nov 2010 14:58:37 -0000	1.139
+++ commands/pm/pm.drush.inc	23 Nov 2010 18:26:30 -0000
@@ -105,6 +105,7 @@ function pm_drush_command() {
     ),
   );
   $update_options = array(
+    '--security-only' => 'Only update modules that have security updates available. However, if there were other releases of a module between the installed version the security update, other changes to features or functionality may occur.',
     '--lock' => 'Add a persistent lock to remove the specified projects from consideration during updates.  Locks may be removed with the --unlock parameter, or overridden by specifically naming the module as a parameter to pm-update or pm-updatecode.  The lock does not affect pm-download.',
   );
   $update_suboptions = array(
Index: commands/pm/updatecode.pm.inc
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/drush/commands/pm/updatecode.pm.inc,v
retrieving revision 1.21
diff -u -p -r1.21 updatecode.pm.inc
--- commands/pm/updatecode.pm.inc	22 Nov 2010 06:15:45 -0000	1.21
+++ commands/pm/updatecode.pm.inc	23 Nov 2010 18:26:30 -0000
@@ -15,6 +15,9 @@ function drush_pm_updatecode() {
   // Get update status information.
   $projects = _pm_get_update_info();
 
+  // Find only security updates
+  $security = drush_get_option('security-only');
+
   // Process locks specified on the command line.
   $locked_list = drush_pm_update_lock($projects, drush_get_option_list('lock'), drush_get_option_list('unlock'), drush_get_option('lock-message'));
 
@@ -74,6 +77,9 @@ function drush_pm_updatecode() {
   if (drush_get_context('DRUSH_PIPE')) {
     $pipe = "";
     foreach($projects as $project){
+      if ($security && $project['status'] != UPDATE_NOT_SECURE) {
+        continue;
+      }
       $pipe .= $project['name']. " ";
       $pipe .= $project['existing_version']. " ";
       $pipe .= $project['candidate_version']. " ";
@@ -147,7 +153,12 @@ function drush_pm_updatecode() {
   }
 
   if (empty($updateable)) {
-    return drush_log(dt('No code updates available.'), 'ok');
+    if ($security) {
+      return drush_log(dt('No security updates available.'), 'ok');
+    }
+    else {
+      return drush_log(dt('No code updates available.'), 'ok');
+    }
   }
 
   // Offer to update to the identified releases
@@ -280,7 +291,12 @@ function pm_update_packages($projects) {
     $print .= $project['title'] . " [" . $project['name'] . '-' . $project['candidate_version'] . "], ";
   }
   // We print the list of the projects that need to be updated.
-  drush_print(dt('Code updates will be made to the following projects:'));
+  if (drush_get_option('security-only')) {
+    drush_print(dt('Security updates will be made to the following projects:'));
+  }
+  else {
+    drush_print(dt('Code updates will be made to the following projects:'));
+  }
   drush_print(substr($print, 0, strlen($print)-2));
 
   // Print the release notes for projects to be updated. Ask before if
@@ -435,6 +451,10 @@ function pm_project_filter(&$projects, &
     }
     if (!empty($project['updateable'])) {
       $updateable[$key] = $project;
+      // Find only security updates
+      if (drush_get_option('security-only') && ($project['status'] != UPDATE_NOT_SECURE)) {
+        unset($updateable[$key]);
+      }
     }
     $rows[] = array($project['title'], $project['existing_version'], $projects[$key]['candidate_version'], $status);
   }