[Policy] Unpublish modules without full Update manager support

Is there an example of a module preventing updates from happening? Update Manager support is a feature of D.O. and the project module, not of individual modules, and the only way I can think of whereby a module would not fully support the update manager module would be to deliberately *remove* support by implementing hook_update_projects_alter() and remove itself from the list of projects that need to check for updates, or by implementing hook_update_status_alter() and change the data returned from update status manager to always report the same thing.

I would agree that if somebody went to those lengths, their module should be unpublished.

I could see someone using a project page to point to a repo on github. I think the only project that this has been allowed with is Drush. But drush is not really a module. There are projects like OG that use github for dev, but sync the repos back to drupal for releases. Since they do the releases on d.o they get update manager support.

#2753921: Disable update manager for Address

Let’s separate update manager, Drupal downloading and updating modules via its own UI, from update status, Drupal checking for updates, if at all possible. Update status is indeed vital. I think update manager is more unclear.

Modules that have dependencies that need to be downloaded/upgraded, either via Composer or not, won't currently work completely with update manager, which doesn't know how to get the dependencies. Handling that gracefully should be doable, although increasing reliance on Composer dependencies should get some solution.

Mixing and matching different ways to install/update projects on a single site won't end well. Threatening project maintainers with policies does not help. Work on #2755809: Modules require composer updates can crash sites after update via update manager is the best path forward I see.

I hadn't actually read #2755809: Modules require composer updates can crash sites after update via update manager yet when I commented.

A quick search shows #2477789: Use composer to build sites looks like the best core issue for this, with plenty of discussion.

I'm going to go ahead close this issue. If we do anything along these lines, I could see a security team policy of considering bypassing update status a security issue.

https://www.drupal.org/node/2494073 Is where the notify the end user about their unmet dependencies exists.