Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.Problem/Motivation
User is able to attempt updates that don't meet composer.json's minimum stability requirement.
Steps to reproduce
- Install Drupal CMS using Composer.
- 'Extend > Updates' shows an available update for the Drupal CMS 11.3 release candidate. There is a big blue ‘update’ button next to it.
- Press the button. Greeted by a big red wall of error text — can’t update to the RC, because the composer file’s min stability is ‘stable’.
Proposed resolution
Don't prompt the user for or allow updates that don't meet the minimum stability requirement.
(Updated to better reflect the issue)
| Comment | File | Size | Author |
|---|---|---|---|
| #4 | Screenshot from 2025-12-08 19-33-50.png | 475.6 KB | catch |
| #4 | Screenshot from 2025-12-08 19-33-05.png | 260.32 KB | catch |
| #4 | Screenshot from 2025-12-08 19-13-07.png | 102.72 KB | catch |
Comments
Comment #2
mrogers commentedComment #3
mrogers commentedComment #4
catchEven if an available update meets the minimum stability criteria, I don't think automatic updates should ever recommend updating from a stable release to an unstable release. e.g. it should behave like
prefer-stable: trueregardless of minimum stability.Uploading a screenshot of how this looks on admin/reports/updates/update with core 11.2.9 installed when 11.3.0-rc1 is available. It is indeed a big button.
Automatic updates also appears to add an 'Update now' link on the update status report - adding a screenshot of that, and one with just core + standard profile installed for comparison.
That link is added in
automatic_updates_preprocess_update_project_status()specifically for core. Might need its own issue.Comment #5
pameeela commentedComment #6
catchBumping to major. Could be critical but while it's an uncaught fatal error you are at least prevented from doing the thing you're not supposed to do, just in a very confusing way.
We might need a separate issue for the update status alters, I would personally think about removing them and adding a link at the top.
Comment #7
phenaproximaI think what we can do here, as a somewhat quick-fix, is to decorate core's
ComposerMinimumStabilityValidatorso that it runs on status check, with the pre-knowledge (supplied by Automatic Updates) of which core version we intend to get. This would not prevent the "You have an update available!" message from appearing, but it would prevent the invalid update from being initiated in the first place.Comment #8
pameeela commentedCompletely agree, of course that is no good!
Sounds like @phenaproxima is on to an incremental improvement for now.