Highly critical service advisories are now displayed to administrators

Certain highly critical security advisories (SAs) and public service announcements (PSAs) will be displayed on the status report page and certain admin pages to users who have the 'administer site configuration' permission. Examples of past announcements that would have been included in this new feed:

• Critical Release - PSA-2019-02-19
• SA-CORE-2019-003 Notice of increased risk and Additional exploit path - PSA-2019-02-22
• Drupal Core - Highly Critical - Public Service announcement - PSA-2018-002

While it is recommended to leave this functionality enabled, sites that do not want these advisories to be fetched from Drupal.org can add this line in settings.php:
$config['system.advisories']['enabled'] = FALSE;

For more information on this new functionality see Responding to critical security update advisories

API additions

1. A new service, system.sa_fetcher, has been added to the System module to retrieve the advisories that are relevant for the current site. This class cannot be extended. To retrieve the advisories, use this code:
   \Drupal::service('system.sa_fetcher')->getSecurityAdvisories();

   See \Drupal\system\SecurityAdvisories\SecurityAdvisoriesFetcher::getSecurityAdvisories() for detailed documentation.

2. A new system.advisories config object comes with the System module. It contains two settings:
   • enabled: Controls whether the advisories will automatically be fetched during cron.
   • interval_hours: How often advisories will be fetched.

Testing

Fetching of these security advisories is disabled during functional tests. If a test needs this functionality, it must unset the configuration by overriding \Drupal\Core\Test\FunctionalTestSetupTrait::writeSettings(). For example,\Drupal\Tests\system\Functional\SecurityAdvisories\SecurityAdvisoryTest() does this:

protected function writeSettings(array $settings): void {
  // Unset 'system.advisories' to allow testing enabling and disabling this
  // setting.
  unset($settings['config']['system.advisories']);
  parent::writeSettings($settings);
}

Any test that enables this functionality is responsible for mocking the Drupal.org advisories JSON feed in order to avoid making outbound HTTP requests during the test. See the advisory_feed_test test module for example of how to achieve this.