Right now the public JSON feed of PSAs provided by Drupal.org only includes the PSAs that are explicitly flagged by the security team for display in this feed. This is because we (rightly) only want to some critical PSAs to actually result in a warning directly in Drupal's Admin UI as part of this auto-update initiative.

However, it might be valuable to instead provide a feed of all PSAs, still allow the security team to designate which ones they believe to be critical enough to push to site owners, and instead use logic within the module to only display the ones we feel are relevant.

This offers two potential advantages:

  • The JSON feed could be used more broadly for the creation of other community tools.
  • We could even have a feature in the automatic_updates module which allows admins to tweak how verbose the PSA notices are:
    • Recommended-only - Display only the PSAs recommended by the Security team
    • Highly-Critical - Display all PSAs labeled 'highly critical'
    • Critical and above - Display all PSAs labeled 'critical' and above
    • ...
    • All PSAs - Display all PSAs

Comments

hestenet created an issue. See original summary.

hestenet’s picture

hestenet
He/Him
Location Portland, OR 🇺🇸
commented
Issue summary: View changes
tedbow’s picture

tedbow
he/him
Primary language English
Location Ithaca, NY, USA
commented

This has come up again for the core issue #3041885: Display relevant Security Advisories data for Drupal

If the feed is going to have other items added to it then we could get a field in the feed now like level or something.

Core could filter on it now even if we know now that all items will be "Highly-Critical". This way we could choose to add more items later at different levels and core would still only display "Highly-Critical" items.

If #3041885 gets committed and released before we add this field to the feed it will be very difficult to add items to the feed later because older version of core that don't know about the field would start to show all items in the feed regardless of level.

We could also add logic to the contrib module filter on this for just "Highly-Critical" now and release a new version and then later add the possibility to have the admin select the level when there are actually more items in the feed.