By macsim on
Change record status:
Published (View all published change records)
Project:
Introduced in branch:
11.5.x
Introduced in version:
11.5.0
Issue links:
Description:
The update_fetch_with_http_fallback setting is deprecated.
This setting allowed sites to fall back to HTTP when HTTPS requests to updates.drupal.org failed. Using HTTP for update requests exposes sites to potential man-in-the-middle attacks and should not be used. Sites that explicitly set $settings['update_fetch_with_http_fallback'] = TRUE; in settings.php should remove that line.
If your site relies on this setting because HTTPS connections to updates.drupal.org are failing, resolve the underlying SSL/TLS issue instead. See https://www.drupal.org/docs/system-requirements/php-requirements#openssl
Impacts:
Module developers
