Warning: Undefined array key "title" in Drupal\update\ProjectSecurityRequirement::createFromProjectDataAndSecurityCoverageInfo()

Problem/Motivation

While running update.php on Drupal 10.2, the following warning is triggered:

Warning: Undefined array key "title" in Drupal\update\ProjectSecurityRequirement::createFromProjectDataAndSecurityCoverageInfo()

This occurs during update status checks and can be reproduced consistently.

Steps to reproduce

1. Install Drupal 10.2.
2. Ensure Update Manager (core update module) is enabled.
3. Run /update.php.
4. Observe PHP warning during the update process.

Actual result

The following PHP warning is displayed:

Warning: Undefined array key "title" in Drupal\update\ProjectSecurityRequirement::createFromProjectDataAndSecurityCoverageInfo()

Debugging shows that the issue originates from:

core/modules/update/src/ProjectSecurityRequirement.php:103

if (isset($project_data['existing_version'])) {
  [$major, $minor] = explode('.', $project_data['existing_version']);
  $existing_version = "$major.$minor";
  $next_version = "$major." . ((int) $minor + 1);
  return new static($project_data['title'], $security_coverage_info, $existing_version, $next_version);
}

The code assumes $project_data['title'] exists.

However, the announcements feed project entry (from Update Manager data) does not always contain a title key, which results in the undefined array key warning.

Expected result

update.php should run without PHP warnings.

The code should safely handle cases where title is missing in $project_data.

Additional context

While debugging, it was observed that the announcements feed project data does not include a title value, which leads to the warning when creating ProjectSecurityRequirement objects.

This appears to be an edge case where project data returned by the update system does not match the assumptions in ProjectSecurityRequirement::createFromProjectDataAndSecurityCoverageInfo().

Screenshot:

Proposed resolution

Add a defensive check before accessing $project_data['title'], for example:

$title = $project_data['title'] ?? $project_data['name'] ?? 'Unknown';
return new static($title, $security_coverage_info, $existing_version, $next_version);

Alternatively, ensure all project data provided to this method always includes a title.

Environment

• Drupal: 10.2.x
• PHP: (add version)
• Reproducible: Yes