With Drupal projects moving towards composer based workflows in Drupal 8 - the updates system should likely alert about updates not just in modules themselves, but in composer dependencies.

This may need some further discussion planning - as it could become complex.

Comments

hestenet created an issue. See original summary.

hestenet’s picture

hestenet
He/Him
Location Portland, OR 🇺🇸
CreditAttribution: hestenet at Drupal Association commented
Issue tags: +Composer
Mixologic’s picture

Mixologic
He/Him/His
Primary language English
Location Portland, OR
CreditAttribution: Mixologic at Drupal Association commented
Status: Active » Closed (won't fix)

actually, this should be on the maintainers to create new releases if their dependencies get out of date/insecure, and as such is already handled by our current release process.