On a site where the features module still has to be updated for the latest security release the audit report says it's all OK.

I checked in the code and pm-updatestatus returnes 'SECURITY UPDATE available' for the module.

CommentFileSizeAuthor
#2 security_100_while-2709759-2.patch394 byteshelmo
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

helmo created an issue. See original summary.

helmo’s picture

helmo CreditAttribution: helmo as a volunteer and at Initfour websolutions commented
Status: Active » Needs review
FileSize
security_100_while-2709759-2.patch394 bytes

Some more info... the 100% came from Check/Security/MenuRouter.php which only checks for very specific problems. As that's the only item currently under 'Security' it's confusing. I suggest calling it 'Additional Security checks', see patch.

Additionally, the 'System status' calculated 94% while having security updates ...
When a site has many modules reporting something via hook_requirements current algorithm is less suitable. 

count($requirements_with_severity) == 33

for me.

You could argue that we should not report on a problem twice ... as it's already included in 'Extensions'. But the core security should not fall under 'Extensions'.

I faked running Drupal 7.1 and still got 89% for 'Status'.