LocaleConfigManager::getTranslatableDefaultConfig() reads config from uninstalled modules

Problem/Motivation

\Drupal\locale\LocaleConfigManager::getTranslatableDefaultConfig() reads shipped configuration from any module (or theme) that it finds on the filesystem. This includes uninstalled modules.

As it is being called from \Drupal\locale\LocaleConfigManager::updateConfigTranslations(), which is called when installing modules or themes, this can result in existing configuration translations being deleted from the system incorectly. That is loss of user data, which is why this is marked as critical.

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes