first commit

web/core/modules/update/config/install/update.settings.yml

@@ -0,0 +1,10 @@
+check:
+  disabled_extensions: false
+  interval_days: 1
+fetch:
+  url: ''
+  max_attempts: 2
+  timeout: 30
+notification:
+  emails: {  }
+  threshold: all

web/core/modules/update/config/schema/update.schema.yml

@@ -0,0 +1,42 @@
+# Schema for the configuration files of the Update module.
+
+update.settings:
+  type: config_object
+  label: 'Update settings'
+  mapping:
+    check:
+      type: mapping
+      label: 'Check settings'
+      mapping:
+        disabled_extensions:
+          type: boolean
+          label: 'Check for updates of uninstalled modules and themes'
+        interval_days:
+          type: integer
+          label: 'Days since last check'
+    fetch:
+      type: mapping
+      label: 'Fetch settings'
+      mapping:
+        url:
+          type: uri
+          label: 'URL for fetching available update data'
+        max_attempts:
+          type: integer
+          label: 'Maximum attempts'
+        timeout:
+          type: integer
+          label: 'Timeout in seconds'
+    notification:
+      type: mapping
+      label: 'Notification settings'
+      mapping:
+        emails:
+          type: sequence
+          label: 'Email addresses to notify when updates are available'
+          sequence:
+            type: email
+            label: 'Email'
+        threshold:
+          type: string
+          label: 'Email notification threshold'

web/core/modules/update/css/update.admin.theme.css

@@ -0,0 +1,63 @@
+/**
+ * @file
+ * Styles used by the Update Manager module.
+ */
+
+.project-update__title {
+  font-size: 110%;
+  font-weight: bold;
+}
+.project-update__status {
+  float: right; /* LTR */
+  font-size: 110%;
+}
+[dir="rtl"] .project-update__status {
+  float: left;
+}
+.project-update__status--not-supported {
+  float: left; /* LTR */
+}
+[dir="rtl"] .project-update__status--not-supported {
+  float: right;
+}
+.project-update__status--security-error {
+  color: #970f00;
+  font-weight: bold;
+}
+
+.project-update__status-icon {
+  padding-left: 0.5em; /* LTR */
+}
+[dir="rtl"] .project-update__status-icon {
+  padding-right: 0.5em;
+  padding-left: 0;
+}
+.project-update__details {
+  padding: 1em 1em 0.25em 1em;
+}
+
+.project-update__version {
+  padding: 1em 0;
+}
+.project-update__version-date {
+  white-space: nowrap;
+}
+.project-update__version-details {
+  padding-right: 0.5em; /* LTR */
+}
+[dir="rtl"] .project-update__version-details {
+  padding-left: 0.5em;
+  direction: ltr; /* Version numbers should always be LTR. */
+}
+.project-update__version-links {
+  padding-right: 1em; /* LTR */
+  list-style-type: none;
+  text-align: right; /* LTR */
+}
+[dir="rtl"] .project-update__version-links {
+  padding-left: 1em;
+  text-align: left;
+}
+.project-update__version--recommended-strong .project-update__version-title {
+  font-weight: bold;
+}

web/core/modules/update/migrations/state/update.migrate_drupal.yml

@@ -0,0 +1,5 @@
+finished:
+  6:
+    update: update
+  7:
+    update: update

web/core/modules/update/migrations/update_settings.yml

@@ -0,0 +1,24 @@
+id: update_settings
+label: Update configuration
+migration_tags:
+  - Drupal 6
+  - Drupal 7
+  - Configuration
+source:
+  plugin: variable
+  variables:
+    - update_max_fetch_attempts
+    - update_fetch_url
+    - update_notification_threshold
+    - update_notify_emails
+    - update_check_frequency
+  source_module: update
+process:
+  'fetch/max_attempts': update_max_fetch_attempts
+  'fetch/url': update_fetch_url
+  'notification/threshold': update_notification_threshold
+  'notification/emails': update_notify_emails
+  'check/interval_days': update_check_frequency
+destination:
+  plugin: config
+  config_name: update.settings

web/core/modules/update/src/Access/UpdateManagerAccessCheck.php

@@ -0,0 +1,43 @@
+<?php
+
+namespace Drupal\update\Access;
+
+use Drupal\Core\Access\AccessResult;
+use Drupal\Core\Routing\Access\AccessInterface;
+use Drupal\Core\Site\Settings;
+
+/**
+ * Determines whether allow authorized operations is set.
+ */
+class UpdateManagerAccessCheck implements AccessInterface {
+
+  /**
+   * Settings Service.
+   *
+   * @var \Drupal\Core\Site\Settings
+   */
+  protected $settings;
+
+  /**
+   * Constructs a UpdateManagerAccessCheck object.
+   *
+   * @param \Drupal\Core\Site\Settings $settings
+   *   The read-only settings container.
+   */
+  public function __construct(Settings $settings) {
+    $this->settings = $settings;
+  }
+
+  /**
+   * Checks access.
+   *
+   * @return \Drupal\Core\Access\AccessResultInterface
+   *   The access result.
+   */
+  public function access() {
+    // Uncacheable because the access result depends on a Settings key-value
+    // pair, and can therefore change at any time.
+    return AccessResult::allowedIf($this->settings->get('allow_authorize_operations', TRUE))->setCacheMaxAge(0);
+  }
+
+}

web/core/modules/update/src/Controller/UpdateController.php

@@ -0,0 +1,75 @@
+<?php
+
+namespace Drupal\update\Controller;
+
+use Drupal\update\UpdateManagerInterface;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+use Drupal\Core\Controller\ControllerBase;
+
+/**
+ * Controller routines for update routes.
+ */
+class UpdateController extends ControllerBase {
+
+  /**
+   * Update manager service.
+   *
+   * @var \Drupal\update\UpdateManagerInterface
+   */
+  protected $updateManager;
+
+  /**
+   * Constructs update status data.
+   *
+   * @param \Drupal\update\UpdateManagerInterface $update_manager
+   *   Update Manager Service.
+   */
+  public function __construct(UpdateManagerInterface $update_manager) {
+    $this->updateManager = $update_manager;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function create(ContainerInterface $container) {
+    return new static(
+      $container->get('update.manager')
+    );
+  }
+
+  /**
+   * Returns a page about the update status of projects.
+   *
+   * @return array
+   *   A build array with the update status of projects.
+   */
+  public function updateStatus() {
+    $build = [
+      '#theme' => 'update_report',
+    ];
+    if ($available = update_get_available(TRUE)) {
+      $this->moduleHandler()->loadInclude('update', 'compare.inc');
+      $build['#data'] = update_calculate_project_data($available);
+    }
+    return $build;
+  }
+
+  /**
+   * Manually checks the update status without the use of cron.
+   */
+  public function updateStatusManually() {
+    $this->updateManager->refreshUpdateData();
+    $batch = [
+      'operations' => [
+        [[$this->updateManager, 'fetchDataBatch'], []],
+      ],
+      'finished' => 'update_fetch_data_finished',
+      'title' => t('Checking available update data'),
+      'progress_message' => t('Trying to check available update data ...'),
+      'error_message' => t('Error checking available update data.'),
+    ];
+    batch_set($batch);
+    return batch_process('admin/reports/updates');
+  }
+
+}

web/core/modules/update/src/Form/UpdateManagerInstall.php

@@ -0,0 +1,269 @@
+<?php
+
+namespace Drupal\update\Form;
+
+use Drupal\Core\Archiver\ArchiverManager;
+use Drupal\Core\Extension\ModuleHandlerInterface;
+use Drupal\Core\File\FileSystemInterface;
+use Drupal\Core\FileTransfer\Local;
+use Drupal\Core\Form\FormBase;
+use Drupal\Core\Form\FormStateInterface;
+use Drupal\Core\Updater\Updater;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Configure update settings for this site.
+ *
+ * @internal
+ */
+class UpdateManagerInstall extends FormBase {
+
+  /**
+   * The module handler.
+   *
+   * @var \Drupal\Core\Extension\ModuleHandlerInterface
+   */
+  protected $moduleHandler;
+
+  /**
+   * The root location under which installed projects will be saved.
+   *
+   * @var string
+   */
+  protected $root;
+
+  /**
+   * The site path.
+   *
+   * @var string
+   */
+  protected $sitePath;
+
+  /**
+   * The archiver plugin manager service.
+   *
+   * @var \Drupal\Core\Archiver\ArchiverManager
+   */
+  protected $archiverManager;
+
+  /**
+   * Constructs a new UpdateManagerInstall.
+   *
+   * @param string $root
+   *   The root location under which installed projects will be saved.
+   * @param \Drupal\Core\Extension\ModuleHandlerInterface $module_handler
+   *   The module handler.
+   * @param string $site_path
+   *   The site path.
+   * @param \Drupal\Core\Archiver\ArchiverManager $archiver_manager
+   *   The archiver plugin manager service.
+   */
+  public function __construct($root, ModuleHandlerInterface $module_handler, $site_path, ArchiverManager $archiver_manager) {
+    $this->root = $root;
+    $this->moduleHandler = $module_handler;
+    $this->sitePath = $site_path;
+    $this->archiverManager = $archiver_manager;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getFormId() {
+    return 'update_manager_install_form';
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function create(ContainerInterface $container) {
+    return new static(
+      $container->get('update.root'),
+      $container->get('module_handler'),
+      $container->get('site.path'),
+      $container->get('plugin.manager.archiver')
+    );
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function buildForm(array $form, FormStateInterface $form_state) {
+    $this->moduleHandler->loadInclude('update', 'inc', 'update.manager');
+    if (!_update_manager_check_backends($form, 'install')) {
+      return $form;
+    }
+
+    $form['help_text'] = [
+      '#prefix' => '<p>',
+      '#markup' => $this->t('You can find <a href=":module_url">modules</a> and <a href=":theme_url">themes</a> on <a href=":drupal_org_url">drupal.org</a>. The following file extensions are supported: %extensions.', [
+        ':module_url' => 'https://www.drupal.org/project/modules',
+        ':theme_url' => 'https://www.drupal.org/project/themes',
+        ':drupal_org_url' => 'https://www.drupal.org',
+        '%extensions' => $this->archiverManager->getExtensions(),
+      ]),
+      '#suffix' => '</p>',
+    ];
+
+    $form['project_url'] = [
+      '#type' => 'url',
+      '#title' => $this->t('Install from a URL'),
+      '#description' => $this->t('For example: %url', ['%url' => 'https://ftp.drupal.org/files/projects/name.tar.gz']),
+    ];
+
+    $form['information'] = [
+      '#prefix' => '<strong>',
+      '#markup' => $this->t('Or'),
+      '#suffix' => '</strong>',
+    ];
+
+    $form['project_upload'] = [
+      '#type' => 'file',
+      '#title' => $this->t('Upload a module or theme archive to install'),
+      '#description' => $this->t('For example: %filename from your local computer', ['%filename' => 'name.tar.gz']),
+    ];
+
+    $form['actions'] = ['#type' => 'actions'];
+    $form['actions']['submit'] = [
+      '#type' => 'submit',
+      '#button_type' => 'primary',
+      '#value' => $this->t('Install'),
+    ];
+
+    return $form;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function validateForm(array &$form, FormStateInterface $form_state) {
+    $all_files = $this->getRequest()->files->get('files', []);
+    if (!($form_state->getValue('project_url') xor !empty($all_files['project_upload']))) {
+      $form_state->setErrorByName('project_url', $this->t('You must either provide a URL or upload an archive file to install.'));
+    }
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function submitForm(array &$form, FormStateInterface $form_state) {
+    $local_cache = NULL;
+    $all_files = $this->getRequest()->files->get('files', []);
+    if ($form_state->getValue('project_url')) {
+      $local_cache = update_manager_file_get($form_state->getValue('project_url'));
+      if (!$local_cache) {
+        $this->messenger()->addError($this->t('Unable to retrieve Drupal project from %url.', ['%url' => $form_state->getValue('project_url')]));
+        return;
+      }
+    }
+    elseif (!empty($all_files['project_upload'])) {
+      $validators = ['file_validate_extensions' => [$this->archiverManager->getExtensions()]];
+      if (!($finfo = file_save_upload('project_upload', $validators, NULL, 0, FileSystemInterface::EXISTS_REPLACE))) {
+        // Failed to upload the file. file_save_upload() calls
+        // \Drupal\Core\Messenger\MessengerInterface::addError() on failure.
+        return;
+      }
+      $local_cache = $finfo->getFileUri();
+    }
+
+    $directory = _update_manager_extract_directory();
+    try {
+      $archive = update_manager_archive_extract($local_cache, $directory);
+    }
+    catch (\Exception $e) {
+      $this->messenger()->addError($e->getMessage());
+      return;
+    }
+
+    $files = $archive->listContents();
+    if (!$files) {
+      $this->messenger()->addError($this->t('Provided archive contains no files.'));
+      return;
+    }
+
+    // Unfortunately, we can only use the directory name to determine the
+    // project name. Some archivers list the first file as the directory (i.e.,
+    // MODULE/) and others list an actual file (i.e., MODULE/README.TXT).
+    $project = strtok($files[0], '/\\');
+
+    $archive_errors = $this->moduleHandler->invokeAll('verify_update_archive', [$project, $local_cache, $directory]);
+    if (!empty($archive_errors)) {
+      $this->messenger()->addError(array_shift($archive_errors));
+      // @todo: Fix me in D8: We need a way to set multiple errors on the same
+      // form element and have all of them appear!
+      if (!empty($archive_errors)) {
+        foreach ($archive_errors as $error) {
+          $this->messenger()->addError($error);
+        }
+      }
+      return;
+    }
+
+    // Make sure the Updater registry is loaded.
+    drupal_get_updaters();
+
+    $project_location = $directory . '/' . $project;
+    try {
+      $updater = Updater::factory($project_location, $this->root);
+    }
+    catch (\Exception $e) {
+      $this->messenger()->addError($e->getMessage());
+      return;
+    }
+
+    try {
+      $project_title = Updater::getProjectTitle($project_location);
+    }
+    catch (\Exception $e) {
+      $this->messenger()->addError($e->getMessage());
+      return;
+    }
+
+    if (!$project_title) {
+      $this->messenger()->addError($this->t('Unable to determine %project name.', ['%project' => $project]));
+    }
+
+    if ($updater->isInstalled()) {
+      $this->messenger()->addError($this->t('%project is already installed.', ['%project' => $project_title]));
+      return;
+    }
+
+    $project_real_location = \Drupal::service('file_system')->realpath($project_location);
+    $arguments = [
+      'project' => $project,
+      'updater_name' => get_class($updater),
+      'local_url' => $project_real_location,
+    ];
+
+    // This process is inherently difficult to test therefore use a state flag.
+    $test_authorize = FALSE;
+    if (drupal_valid_test_ua()) {
+      $test_authorize = \Drupal::state()->get('test_uploaders_via_prompt', FALSE);
+    }
+    // If the owner of the directory we extracted is the same as the owner of
+    // our configuration directory (e.g. sites/default) where we're trying to
+    // install the code, there's no need to prompt for FTP/SSH credentials.
+    // Instead, we instantiate a Drupal\Core\FileTransfer\Local and invoke
+    // update_authorize_run_install() directly.
+    if (fileowner($project_real_location) == fileowner($this->sitePath) && !$test_authorize) {
+      $this->moduleHandler->loadInclude('update', 'inc', 'update.authorize');
+      $filetransfer = new Local($this->root, \Drupal::service('file_system'));
+      $response = call_user_func_array('update_authorize_run_install', array_merge([$filetransfer], $arguments));
+      if ($response instanceof Response) {
+        $form_state->setResponse($response);
+      }
+    }
+
+    // Otherwise, go through the regular workflow to prompt for FTP/SSH
+    // credentials and invoke update_authorize_run_install() indirectly with
+    // whatever FileTransfer object authorize.php creates for us.
+    else {
+      // The page title must be passed here to ensure it is initially used when
+      // authorize.php loads for the first time with the FTP/SSH credentials
+      // form.
+      system_authorized_init('update_authorize_run_install', __DIR__ . '/../../update.authorize.inc', $arguments, $this->t('Update manager'));
+      $form_state->setRedirectUrl(system_authorized_get_url());
+    }
+  }
+
+}

web/core/modules/update/src/Form/UpdateManagerUpdate.php

@@ -0,0 +1,392 @@
+<?php
+
+namespace Drupal\update\Form;
+
+use Drupal\Core\Extension\ModuleHandlerInterface;
+use Drupal\Core\Form\FormBase;
+use Drupal\Core\Form\FormStateInterface;
+use Drupal\Core\Link;
+use Drupal\Core\State\StateInterface;
+use Drupal\Core\Url;
+use Drupal\update\UpdateFetcherInterface;
+use Drupal\update\UpdateManagerInterface;
+use Drupal\update\ModuleVersion;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+
+/**
+ * Configure update settings for this site.
+ *
+ * @internal
+ */
+class UpdateManagerUpdate extends FormBase {
+
+  /**
+   * The module handler.
+   *
+   * @var \Drupal\Core\Extension\ModuleHandlerInterface
+   */
+  protected $moduleHandler;
+
+  /**
+   * The Drupal state storage service.
+   *
+   * @var \Drupal\Core\State\StateInterface
+   */
+  protected $state;
+
+  /**
+   * Constructs a new UpdateManagerUpdate object.
+   *
+   * @param \Drupal\Core\Extension\ModuleHandlerInterface $module_handler
+   *   The module handler.
+   * @param \Drupal\Core\State\StateInterface $state
+   *   The state service.
+   */
+  public function __construct(ModuleHandlerInterface $module_handler, StateInterface $state) {
+    $this->moduleHandler = $module_handler;
+    $this->state = $state;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getFormId() {
+    return 'update_manager_update_form';
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function create(ContainerInterface $container) {
+    return new static(
+      $container->get('module_handler'),
+      $container->get('state')
+    );
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function buildForm(array $form, FormStateInterface $form_state) {
+    $this->moduleHandler->loadInclude('update', 'inc', 'update.manager');
+
+    $last_markup = [
+      '#theme' => 'update_last_check',
+      '#last' => $this->state->get('update.last_check') ?: 0,
+    ];
+    $form['last_check'] = [
+      '#markup' => \Drupal::service('renderer')->render($last_markup),
+    ];
+
+    if (!_update_manager_check_backends($form, 'update')) {
+      return $form;
+    }
+
+    $available = update_get_available(TRUE);
+    if (empty($available)) {
+      $form['message'] = [
+        '#markup' => $this->t('There was a problem getting update information. Try again later.'),
+      ];
+      return $form;
+    }
+
+    $form['#attached']['library'][] = 'update/drupal.update.admin';
+
+    // This will be a nested array. The first key is the kind of project, which
+    // can be either 'enabled', 'disabled', 'manual' (projects which require
+    // manual updates, such as core). Then, each subarray is an array of
+    // projects of that type, indexed by project short name, and containing an
+    // array of data for cells in that project's row in the appropriate table.
+    $projects = [];
+
+    // This stores the actual download link we're going to update from for each
+    // project in the form, regardless of if it's enabled or disabled.
+    $form['project_downloads'] = ['#tree' => TRUE];
+    $this->moduleHandler->loadInclude('update', 'inc', 'update.compare');
+    $project_data = update_calculate_project_data($available);
+    foreach ($project_data as $name => $project) {
+      // Filter out projects which are up to date already.
+      if ($project['status'] == UpdateManagerInterface::CURRENT) {
+        continue;
+      }
+      // The project name to display can vary based on the info we have.
+      if (!empty($project['title'])) {
+        if (!empty($project['link'])) {
+          $project_name = Link::fromTextAndUrl($project['title'], Url::fromUri($project['link']))->toString();
+        }
+        else {
+          $project_name = $project['title'];
+        }
+      }
+      elseif (!empty($project['info']['name'])) {
+        $project_name = $project['info']['name'];
+      }
+      else {
+        $project_name = $name;
+      }
+      if ($project['project_type'] == 'theme' || $project['project_type'] == 'theme-disabled') {
+        $project_name .= ' ' . $this->t('(Theme)');
+      }
+
+      if (empty($project['recommended'])) {
+        // If we don't know what to recommend they upgrade to, we should skip
+        // the project entirely.
+        continue;
+      }
+
+      $recommended_release = $project['releases'][$project['recommended']];
+      $recommended_version = '{{ release_version }} (<a href="{{ release_link }}" title="{{ project_title }}">{{ release_notes }}</a>)';
+      $recommended_version_parser = ModuleVersion::createFromVersionString($recommended_release['version']);
+      if ($recommended_version_parser->getMajorVersion() != $project['existing_major']) {
+        $recommended_version .= '<div title="{{ major_update_warning_title }}" class="update-major-version-warning">{{ major_update_warning_text }}</div>';
+      }
+
+      $recommended_version = [
+        '#type' => 'inline_template',
+        '#template' => $recommended_version,
+        '#context' => [
+          'release_version' => $recommended_release['version'],
+          'release_link' => $recommended_release['release_link'],
+          'project_title' => $this->t('Release notes for @project_title', ['@project_title' => $project['title']]),
+          'major_update_warning_title' => $this->t('Major upgrade warning'),
+          'major_update_warning_text' => $this->t('This update is a major version update which means that it may not be backwards compatible with your currently running version. It is recommended that you read the release notes and proceed at your own risk.'),
+          'release_notes' => $this->t('Release notes'),
+        ],
+      ];
+
+      // Create an entry for this project.
+      $entry = [
+        'title' => $project_name,
+        'installed_version' => $project['existing_version'],
+        'recommended_version' => ['data' => $recommended_version],
+      ];
+
+      switch ($project['status']) {
+        case UpdateManagerInterface::NOT_SECURE:
+        case UpdateManagerInterface::REVOKED:
+          $entry['title'] .= ' ' . $this->t('(Security update)');
+          $entry['#weight'] = -2;
+          $type = 'security';
+          break;
+
+        case UpdateManagerInterface::NOT_SUPPORTED:
+          $type = 'unsupported';
+          $entry['title'] .= ' ' . $this->t('(Unsupported)');
+          $entry['#weight'] = -1;
+          break;
+
+        case UpdateFetcherInterface::UNKNOWN:
+        case UpdateFetcherInterface::NOT_FETCHED:
+        case UpdateFetcherInterface::NOT_CHECKED:
+        case UpdateManagerInterface::NOT_CURRENT:
+          $type = 'recommended';
+          break;
+
+        default:
+          // Jump out of the switch and onto the next project in foreach.
+          continue 2;
+      }
+
+      // Use the project title for the tableselect checkboxes.
+      $entry['title'] = [
+        'data' => [
+          '#title' => $entry['title'],
+          '#markup' => $entry['title'],
+        ],
+      ];
+      $entry['#attributes'] = ['class' => ['update-' . $type]];
+
+      // Drupal core needs to be upgraded manually.
+      $needs_manual = $project['project_type'] == 'core';
+
+      // If the recommended release for a contributed project is not compatible
+      // with the currently installed version of core, list that project in a
+      // separate table. To determine if the release is compatible, we inspect
+      // the 'core_compatible' key from the release info array. If it's not
+      // defined, it means we can't determine compatibility requirements (or
+      // we're looking at core), so we assume it is compatible.
+      $compatible = $recommended_release['core_compatible'] ?? TRUE;
+
+      if ($needs_manual) {
+        $this->removeCheckboxFromRow($entry);
+        $projects['manual'][$name] = $entry;
+      }
+      elseif (!$compatible) {
+        $this->removeCheckboxFromRow($entry);
+        // If the release has a core_compatibility_message, inject it.
+        if (!empty($recommended_release['core_compatibility_message'])) {
+          // @todo In https://www.drupal.org/project/drupal/issues/3121769
+          //   refactor this into something theme-friendly so we don't have a
+          //   classless <div> here.
+          $entry['data']['recommended_version']['data']['#template'] .= ' <div>{{ core_compatibility_message }}</div>';
+          $entry['data']['recommended_version']['data']['#context']['core_compatibility_message'] = $recommended_release['core_compatibility_message'];
+        }
+        $projects['not-compatible'][$name] = $entry;
+      }
+      else {
+        $form['project_downloads'][$name] = [
+          '#type' => 'value',
+          '#value' => $recommended_release['download_link'],
+        ];
+
+        // Based on what kind of project this is, save the entry into the
+        // appropriate subarray.
+        switch ($project['project_type']) {
+          case 'module':
+          case 'theme':
+            $projects['enabled'][$name] = $entry;
+            break;
+
+          case 'module-disabled':
+          case 'theme-disabled':
+            $projects['disabled'][$name] = $entry;
+            break;
+        }
+      }
+    }
+
+    if (empty($projects)) {
+      $form['message'] = [
+        '#markup' => $this->t('All of your projects are up to date.'),
+      ];
+      return $form;
+    }
+
+    $headers = [
+      'title' => [
+        'data' => $this->t('Name'),
+        'class' => ['update-project-name'],
+      ],
+      'installed_version' => $this->t('Installed version'),
+      'recommended_version' => $this->t('Recommended version'),
+    ];
+
+    if (!empty($projects['enabled'])) {
+      $form['projects'] = [
+        '#type' => 'tableselect',
+        '#header' => $headers,
+        '#options' => $projects['enabled'],
+      ];
+      if (!empty($projects['disabled'])) {
+        $form['projects']['#prefix'] = '<h2>' . $this->t('Enabled') . '</h2>';
+      }
+    }
+
+    if (!empty($projects['disabled'])) {
+      $form['disabled_projects'] = [
+        '#type' => 'tableselect',
+        '#header' => $headers,
+        '#options' => $projects['disabled'],
+        '#weight' => 1,
+        '#prefix' => '<h2>' . $this->t('Disabled') . '</h2>',
+      ];
+    }
+
+    // If either table has been printed yet, we need a submit button and to
+    // validate the checkboxes.
+    if (!empty($projects['enabled']) || !empty($projects['disabled'])) {
+      $form['actions'] = ['#type' => 'actions'];
+      $form['actions']['submit'] = [
+        '#type' => 'submit',
+        '#value' => $this->t('Download these updates'),
+      ];
+    }
+
+    if (!empty($projects['manual'])) {
+      $prefix = '<h2>' . $this->t('Manual updates required') . '</h2>';
+      $prefix .= '<p>' . $this->t('Automatic updates of Drupal core are not supported at this time.') . '</p>';
+      $form['manual_updates'] = [
+        '#type' => 'table',
+        '#header' => $headers,
+        '#rows' => $projects['manual'],
+        '#prefix' => $prefix,
+        '#weight' => 120,
+      ];
+    }
+
+    if (!empty($projects['not-compatible'])) {
+      $form['not_compatible'] = [
+        '#type' => 'table',
+        '#header' => $headers,
+        '#rows' => $projects['not-compatible'],
+        '#prefix' => '<h2>' . $this->t('Not compatible') . '</h2>',
+        '#weight' => 150,
+      ];
+    }
+
+    return $form;
+  }
+
+  /**
+   * Prepares a row entry for use in a regular table, not a 'tableselect'.
+   *
+   * There are no checkboxes in the 'Manual updates' or 'Not compatible' tables,
+   * so they will be rendered by '#theme' => 'table', not 'tableselect'. Since
+   * the data formats are incompatible, this method converts to the format
+   * expected by '#theme' => 'table'. Generally, rows end up in the main tables
+   * that have a checkbox to allow the site admin to select which missing
+   * updates to install. This method is only used for the special case tables
+   * that have no such checkbox.
+   *
+   * @todo In https://www.drupal.org/project/drupal/issues/3121775 refactor
+   *   self::buildForm() so that we don't need this method at all.
+   *
+   * @param array[] $row
+   *   The render array for a table row.
+   */
+  protected function removeCheckboxFromRow(array &$row) {
+    unset($row['#weight']);
+    $attributes = $row['#attributes'];
+    unset($row['#attributes']);
+    $row = [
+      'data' => $row,
+    ] + $attributes;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function validateForm(array &$form, FormStateInterface $form_state) {
+    if (!$form_state->isValueEmpty('projects')) {
+      $enabled = array_filter($form_state->getValue('projects'));
+    }
+    if (!$form_state->isValueEmpty('disabled_projects')) {
+      $disabled = array_filter($form_state->getValue('disabled_projects'));
+    }
+    if (empty($enabled) && empty($disabled)) {
+      $form_state->setErrorByName('projects', $this->t('You must select at least one project to update.'));
+    }
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function submitForm(array &$form, FormStateInterface $form_state) {
+    $this->moduleHandler->loadInclude('update', 'inc', 'update.manager');
+    $projects = [];
+    foreach (['projects', 'disabled_projects'] as $type) {
+      if (!$form_state->isValueEmpty($type)) {
+        $projects = array_merge($projects, array_keys(array_filter($form_state->getValue($type))));
+      }
+    }
+    $operations = [];
+    foreach ($projects as $project) {
+      $operations[] = [
+        'update_manager_batch_project_get',
+        [
+          $project,
+          $form_state->getValue(['project_downloads', $project]),
+        ],
+      ];
+    }
+    $batch = [
+      'title' => $this->t('Downloading updates'),
+      'init_message' => $this->t('Preparing to download selected updates'),
+      'operations' => $operations,
+      'finished' => 'update_manager_download_batch_finished',
+      'file' => drupal_get_path('module', 'update') . '/update.manager.inc',
+    ];
+    batch_set($batch);
+  }
+
+}

web/core/modules/update/src/Form/UpdateReady.php

@@ -0,0 +1,174 @@
+<?php
+
+namespace Drupal\update\Form;
+
+use Drupal\Core\Extension\ModuleHandlerInterface;
+use Drupal\Core\FileTransfer\Local;
+use Drupal\Core\Form\FormBase;
+use Drupal\Core\Form\FormStateInterface;
+use Drupal\Core\State\StateInterface;
+use Drupal\Core\Updater\Updater;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Configure update settings for this site.
+ *
+ * @internal
+ */
+class UpdateReady extends FormBase {
+
+  /**
+   * The root location under which updated projects will be saved.
+   *
+   * @var string
+   */
+  protected $root;
+
+  /**
+   * The module handler.
+   *
+   * @var \Drupal\Core\Extension\ModuleHandlerInterface
+   */
+  protected $moduleHandler;
+
+  /**
+   * The state key value store.
+   *
+   * @var \Drupal\Core\State\StateInterface
+   */
+  protected $state;
+
+  /**
+   * The Site path.
+   *
+   * @var string
+   */
+  protected $sitePath;
+
+  /**
+   * Constructs a new UpdateReady object.
+   *
+   * @param string $root
+   *   The root location under which updated projects will be saved.
+   * @param \Drupal\Core\Extension\ModuleHandlerInterface $module_handler
+   *   The object that manages enabled modules in a Drupal installation.
+   * @param \Drupal\Core\State\StateInterface $state
+   *   The state key value store.
+   * @param string $site_path
+   *   The site path.
+   */
+  public function __construct($root, ModuleHandlerInterface $module_handler, StateInterface $state, $site_path) {
+    $this->root = $root;
+    $this->moduleHandler = $module_handler;
+    $this->state = $state;
+    $this->sitePath = $site_path;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getFormId() {
+    return 'update_manager_update_ready_form';
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function create(ContainerInterface $container) {
+    return new static(
+      $container->get('update.root'),
+      $container->get('module_handler'),
+      $container->get('state'),
+      $container->get('site.path')
+    );
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function buildForm(array $form, FormStateInterface $form_state) {
+    $this->moduleHandler->loadInclude('update', 'inc', 'update.manager');
+    if (!_update_manager_check_backends($form, 'update')) {
+      return $form;
+    }
+
+    $form['backup'] = [
+      '#prefix' => '<strong>',
+      '#markup' => $this->t('Back up your database and site before you continue. <a href=":backup_url">Learn how</a>.', [':backup_url' => 'https://www.drupal.org/node/22281']),
+      '#suffix' => '</strong>',
+    ];
+
+    $form['maintenance_mode'] = [
+      '#title' => $this->t('Perform updates with site in maintenance mode (strongly recommended)'),
+      '#type' => 'checkbox',
+      '#default_value' => TRUE,
+    ];
+
+    $form['actions'] = ['#type' => 'actions'];
+    $form['actions']['submit'] = [
+      '#type' => 'submit',
+      '#value' => $this->t('Continue'),
+    ];
+
+    return $form;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function submitForm(array &$form, FormStateInterface $form_state) {
+    $session = $this->getRequest()->getSession();
+    // Store maintenance_mode setting so we can restore it when done.
+    $session->set('maintenance_mode', $this->state->get('system.maintenance_mode'));
+    if ($form_state->getValue('maintenance_mode') == TRUE) {
+      $this->state->set('system.maintenance_mode', TRUE);
+    }
+
+    $projects = $session->remove('update_manager_update_projects');
+    if ($projects) {
+      // Make sure the Updater registry is loaded.
+      drupal_get_updaters();
+
+      $updates = [];
+      $directory = _update_manager_extract_directory();
+
+      $project_real_location = NULL;
+      foreach ($projects as $project => $url) {
+        $project_location = $directory . '/' . $project;
+        $updater = Updater::factory($project_location, $this->root);
+        $project_real_location = \Drupal::service('file_system')->realpath($project_location);
+        $updates[] = [
+          'project' => $project,
+          'updater_name' => get_class($updater),
+          'local_url' => $project_real_location,
+        ];
+      }
+
+      // If the owner of the last directory we extracted is the same as the
+      // owner of our configuration directory (e.g. sites/default) where we're
+      // trying to install the code, there's no need to prompt for FTP/SSH
+      // credentials. Instead, we instantiate a Drupal\Core\FileTransfer\Local
+      // and invoke update_authorize_run_update() directly.
+      if (fileowner($project_real_location) == fileowner($this->sitePath)) {
+        $this->moduleHandler->loadInclude('update', 'inc', 'update.authorize');
+        $filetransfer = new Local($this->root, \Drupal::service('file_system'));
+        $response = update_authorize_run_update($filetransfer, $updates);
+        if ($response instanceof Response) {
+          $form_state->setResponse($response);
+        }
+      }
+      // Otherwise, go through the regular workflow to prompt for FTP/SSH
+      // credentials and invoke update_authorize_run_update() indirectly with
+      // whatever FileTransfer object authorize.php creates for us.
+      else {
+        // The page title must be passed here to ensure it is initially used
+        // when authorize.php loads for the first time with the FTP/SSH
+        // credentials form.
+        system_authorized_init('update_authorize_run_update', __DIR__ . '/../../update.authorize.inc', [$updates], $this->t('Update manager'));
+        $form_state->setRedirectUrl(system_authorized_get_url());
+      }
+    }
+  }
+
+}

web/core/modules/update/src/ModuleVersion.php

@@ -0,0 +1,131 @@
+<?php
+
+namespace Drupal\update;
+
+/**
+ * Provides a module version value object.
+ *
+ * @internal
+ *
+ * @see https://www.drupal.org/drupalorg/docs/apis/update-status-xml.
+ */
+final class ModuleVersion {
+
+  /**
+   * The '8.x-' prefix is used on contrib module version numbers.
+   *
+   * @var string
+   */
+  const CORE_PREFIX = '8.x-';
+
+  /**
+   * The major version.
+   *
+   * @var string
+   */
+  protected $majorVersion;
+
+  /**
+   * The version extra string.
+   *
+   * For example, if the module version is '2.0.3-alpha1', then the version
+   * extra string is 'alpha1'.
+   *
+   * @var string|null
+   */
+  protected $versionExtra;
+
+  /**
+   * Constructs a module version object from a version string.
+   *
+   * @param string $version_string
+   *   The version string.
+   *
+   * @return \Drupal\update\ModuleVersion
+   *   The module version instance.
+   */
+  public static function createFromVersionString($version_string) {
+    $original_version = $version_string;
+    if (strpos($version_string, static::CORE_PREFIX) === 0 && $version_string !== '8.x-dev') {
+      $version_string = preg_replace('/8\.x-/', '', $version_string, 1);
+    }
+    else {
+      // Ensure the version string has no unsupported core prefixes.
+      $dot_x_position = strpos($version_string, '.x-');
+      if ($dot_x_position === 1 || $dot_x_position === 2) {
+        $after_core_prefix = explode('.x-', $version_string)[1];
+        if ($after_core_prefix !== 'dev') {
+          throw new \UnexpectedValueException("Unexpected version core prefix in $version_string. The only core prefix expected in \Drupal\update\ModuleVersion is: 8.x-");
+        }
+      }
+    }
+    $version_parts = explode('.', $version_string);
+    $major_version = $version_parts[0];
+    $version_parts_count = count($version_parts);
+    $last_part_split = explode('-', $version_parts[count($version_parts) - 1]);
+    $version_extra = count($last_part_split) === 1 ? NULL : $last_part_split[1];
+    if ($version_parts_count > 3 || $version_parts_count < 2
+       || !is_numeric($major_version)
+       || ($version_parts_count === 3 && !is_numeric($version_parts[1]))
+      // The only case where a non-numeric version part other the extra part is
+      // allowed is in development versions like 8.x-1.x-dev, 1.2.x-dev or
+      // 1.x-dev.
+       || (!is_numeric($last_part_split[0]) && $last_part_split !== 'x' && $version_extra !== 'dev')) {
+      throw new \UnexpectedValueException("Unexpected version number in: $original_version");
+    }
+    return new static($major_version, $version_extra);
+  }
+
+  /**
+   * Constructs a ModuleVersion object.
+   *
+   * @param string $major_version
+   *   The major version.
+   * @param string|null $version_extra
+   *   The extra version string.
+   */
+  private function __construct($major_version, $version_extra) {
+    $this->majorVersion = $major_version;
+    $this->versionExtra = $version_extra;
+  }
+
+  /**
+   * Constructs a module version object from a support branch.
+   *
+   * This can be used to determine the major version of the branch.
+   * ::getVersionExtra() will always return NULL for branches.
+   *
+   * @param string $branch
+   *   The support branch.
+   *
+   * @return \Drupal\update\ModuleVersion
+   *   The module version instance.
+   */
+  public static function createFromSupportBranch($branch) {
+    if (substr($branch, -1) !== '.') {
+      throw new \UnexpectedValueException("Invalid support branch: $branch");
+    }
+    return static::createFromVersionString($branch . '0');
+  }
+
+  /**
+   * Gets the major version.
+   *
+   * @return string
+   *   The major version.
+   */
+  public function getMajorVersion() {
+    return $this->majorVersion;
+  }
+
+  /**
+   * Gets the version extra string at the end of the version number.
+   *
+   * @return string|null
+   *   The version extra string if available, or otherwise NULL.
+   */
+  public function getVersionExtra() {
+    return $this->versionExtra;
+  }
+
+}

web/core/modules/update/src/ProjectCoreCompatibility.php

@@ -0,0 +1,229 @@
+<?php
+
+namespace Drupal\update;
+
+use Composer\Semver\Semver;
+use Composer\Semver\VersionParser;
+use Drupal\Core\StringTranslation\StringTranslationTrait;
+
+/**
+ * Utility class to set core compatibility messages for project releases.
+ *
+ * @internal
+ *   This class implements logic used by update_calculate_project_status(). It
+ *   should not be called directly.
+ */
+final class ProjectCoreCompatibility {
+
+  use StringTranslationTrait;
+
+  /**
+   * The currently installed version of Drupal core.
+   *
+   * @var string
+   */
+  protected $existingCoreVersion;
+
+  /**
+   * Cache of core versions that are available for updates.
+   *
+   * @var string[]
+   */
+  protected $possibleCoreUpdateVersions;
+
+  /**
+   * Cache of core compatibility messages per core version constraint.
+   *
+   * Keys are core version constraint strings, values are human-readable
+   * messages about the versions of core that version constraint maps to.
+   *
+   * This list is cached since many project releases will use the same core
+   * compatibility constraint.
+   *
+   * @var string[]
+   */
+  protected $compatibilityMessages = [];
+
+  /**
+   * Constructs a ProjectCoreCompatibility object.
+   *
+   * @param array $core_data
+   *   The project data for Drupal core as returned by
+   *   \Drupal\update\UpdateManagerInterface::getProjects() and then processed
+   *   by update_process_project_info() and
+   *   update_calculate_project_update_status().
+   * @param array $core_releases
+   *   The Drupal core available releases.
+   *
+   * @see \Drupal\update\UpdateManagerInterface::getProjects()
+   * @see update_process_project_info()
+   * @see update_calculate_project_update_status()
+   */
+  public function __construct(array $core_data, array $core_releases) {
+    if (isset($core_data['existing_version'])) {
+      $this->existingCoreVersion = $core_data['existing_version'];
+      $this->possibleCoreUpdateVersions = $this->getPossibleCoreUpdateVersions($core_releases);
+    }
+  }
+
+  /**
+   * Gets the core versions that should be considered for compatibility ranges.
+   *
+   * @param array $core_releases
+   *   The Drupal core available releases.
+   *
+   * @return string[]
+   *   The core version numbers that are possible to update the site to.
+   */
+  protected function getPossibleCoreUpdateVersions(array $core_releases) {
+    if (!isset($core_releases[$this->existingCoreVersion])) {
+      // If we can't determine the existing version of core then we can't
+      // calculate the core compatibility of a given release based on core
+      // versions after the existing version.
+      return [];
+    }
+    $core_release_versions = array_keys($core_releases);
+    $possible_core_update_versions = Semver::satisfiedBy($core_release_versions, '>= ' . $this->existingCoreVersion);
+    $possible_core_update_versions = Semver::sort($possible_core_update_versions);
+    $possible_core_update_versions = array_filter($possible_core_update_versions, function ($version) {
+      return VersionParser::parseStability($version) === 'stable';
+    });
+    return $possible_core_update_versions;
+  }
+
+  /**
+   * Sets core compatibility messages for project releases.
+   *
+   * @param array &$project_data
+   *   The project data as returned by
+   *   \Drupal\update\UpdateManagerInterface::getProjects() and then processed
+   *   by update_process_project_info() and
+   *   update_calculate_project_update_status(). If set, the following keys are
+   *   used in this method:
+   *   - recommended (string): A project version number.
+   *   - latest_version (string): A project version number.
+   *   - also (string[]): Project version numbers.
+   *   - releases (array[]): An array where the keys are project version numbers
+   *     and the values are arrays of project release information.
+   *   - security updates (array[]): An array of project release information.
+   *
+   * @see \Drupal\update\UpdateManagerInterface::getProjects()
+   * @see update_process_project_info()
+   * @see update_calculate_project_update_status()
+   */
+  public function setReleaseMessage(array &$project_data) {
+    if (empty($this->possibleCoreUpdateVersions)) {
+      return;
+    }
+
+    // Get the various releases that will need to have core compatibility
+    // messages added to them.
+    $releases_to_set = [];
+    $versions = [];
+    if (!empty($project_data['recommended'])) {
+      $versions[] = $project_data['recommended'];
+    }
+    if (!empty($project_data['latest_version'])) {
+      $versions[] = $project_data['latest_version'];
+    }
+    if (!empty($project_data['also'])) {
+      $versions = array_merge($versions, $project_data['also']);
+    }
+    foreach ($versions as $version) {
+      if (isset($project_data['releases'][$version])) {
+        $releases_to_set[] = &$project_data['releases'][$version];
+      }
+    }
+    if (!empty($project_data['security updates'])) {
+      foreach ($project_data['security updates'] as &$security_update) {
+        $releases_to_set[] = &$security_update;
+      }
+    }
+    foreach ($releases_to_set as &$release) {
+      if (!empty($release['core_compatibility'])) {
+        $release['core_compatible'] = $this->isCoreCompatible($release['core_compatibility']);
+        $release['core_compatibility_message'] = $this->createMessageFromCoreCompatibility($release['core_compatibility']);
+      }
+    }
+  }
+
+  /**
+   * Determines if a release is compatible with the currently installed core.
+   *
+   * @param string $core_compatibility_constraint
+   *   A semantic version constraint.
+   *
+   * @return bool
+   *   TRUE if the given constraint is satisfied by the currently installed
+   *   version of Drupal core, otherwise FALSE.
+   */
+  protected function isCoreCompatible($core_compatibility_constraint) {
+    return Semver::satisfies($this->existingCoreVersion, $core_compatibility_constraint);
+  }
+
+  /**
+   * Creates core a compatibility message from a semantic version constraint.
+   *
+   * @param string $core_compatibility_constraint
+   *   A semantic version constraint.
+   *
+   * @return string
+   *   The core compatibility message.
+   */
+  protected function createMessageFromCoreCompatibility($core_compatibility_constraint) {
+    if (!isset($this->compatibilityMessages[$core_compatibility_constraint])) {
+      $core_compatibility_ranges = $this->getCompatibilityRanges($core_compatibility_constraint);
+      $range_messages = [];
+      foreach ($core_compatibility_ranges as $core_compatibility_range) {
+        if (count($core_compatibility_range) === 2) {
+          $range_messages[] = $this->t('@low_version_number to @high_version_number', ['@low_version_number' => $core_compatibility_range[0], '@high_version_number' => $core_compatibility_range[1]]);
+        }
+        else {
+          $range_messages[] = $core_compatibility_range[0];
+        }
+      }
+      $this->compatibilityMessages[$core_compatibility_constraint] = $this->t('Requires Drupal core:') . ' ' . implode(', ', $range_messages);
+    }
+    return $this->compatibilityMessages[$core_compatibility_constraint];
+  }
+
+  /**
+   * Gets the compatibility ranges for a semantic version constraint.
+   *
+   * @param string $core_compatibility_constraint
+   *   A semantic version constraint.
+   *
+   * @return array[]
+   *   An array compatibility ranges. If a range array has 2 elements then this
+   *   denotes a range of compatibility between and including the 2 versions. If
+   *   the range has 1 element then it denotes compatibility with a single
+   *   version.
+   */
+  protected function getCompatibilityRanges($core_compatibility_constraint) {
+    $compatibility_ranges = [];
+    foreach ($this->possibleCoreUpdateVersions as $possible_core_update_version) {
+      if (Semver::satisfies($possible_core_update_version, $core_compatibility_constraint)) {
+        if (empty($range)) {
+          $range[] = $possible_core_update_version;
+        }
+        else {
+          $range[1] = $possible_core_update_version;
+        }
+      }
+      else {
+        // If core version does not satisfy the constraint and there is a non
+        // empty range, add it to the list of ranges.
+        if (!empty($range)) {
+          $compatibility_ranges[] = $range;
+          // Start a new range.
+          $range = [];
+        }
+      }
+    }
+    if (!empty($range)) {
+      $compatibility_ranges[] = $range;
+    }
+    return $compatibility_ranges;
+  }
+
+}

web/core/modules/update/src/ProjectSecurityData.php

@@ -0,0 +1,250 @@
+<?php
+
+namespace Drupal\update;
+
+/**
+ * Calculates a project's security coverage information.
+ *
+ * @internal
+ *   This class implements logic to determine security coverage for Drupal core
+ *   according to Drupal core security policy. It should not be called directly.
+ */
+final class ProjectSecurityData {
+
+  /**
+   * The number of minor versions of Drupal core that receive security coverage.
+   *
+   * For example, if this value is 2 and the existing version is 9.0.1, the
+   * 9.0.x branch will receive security coverage until the release of version
+   * 9.2.0.
+   *
+   * @todo In https://www.drupal.org/node/2998285 determine if we want this
+   *   policy to be expressed in the updates.drupal.org feed, instead of relying
+   *   on a hard-coded constant.
+   *
+   * @see https://www.drupal.org/core/release-cycle-overview
+   */
+  const CORE_MINORS_WITH_SECURITY_COVERAGE = 2;
+
+  /**
+   * Define constants for versions with security coverage end dates.
+   *
+   * Two types of constants are supported:
+   * - SECURITY_COVERAGE_END_DATE_[VERSION_MAJOR]_[VERSION_MINOR]: A date in
+   *   'Y-m-d' or 'Y-m' format.
+   * - SECURITY_COVERAGE_ENDING_WARN_DATE_[VERSION_MAJOR]_[VERSION_MINOR]: A
+   *   date in 'Y-m-d' format.
+   *
+   * @see \Drupal\update\ProjectSecurityRequirement::getDateEndRequirement()
+   */
+  const SECURITY_COVERAGE_END_DATE_8_8 = '2020-12-02';
+
+  const SECURITY_COVERAGE_ENDING_WARN_DATE_8_8 = '2020-06-02';
+
+  const SECURITY_COVERAGE_END_DATE_8_9 = '2021-11';
+
+  /**
+   * The existing (currently installed) version of the project.
+   *
+   * Because this class only handles the Drupal core project, values will be
+   * semantic version numbers such as 8.8.0, 8.8.0-alpha1, or 9.0.0.
+   *
+   * @var string|null
+   */
+  protected $existingVersion;
+
+  /**
+   * Releases as returned by update_get_available().
+   *
+   * @var array
+   *
+   * Each release item in the array has metadata about that release. This class
+   * uses the keys:
+   * - status (string): The status of the release.
+   * - version (string): The version number of the release.
+   *
+   * @see update_get_available()
+   */
+  protected $releases;
+
+  /**
+   * Constructs a ProjectSecurityData object.
+   *
+   * @param string $existing_version
+   *   The existing (currently installed) version of the project.
+   * @param array $releases
+   *   Project releases as returned by update_get_available().
+   */
+  private function __construct($existing_version = NULL, array $releases = []) {
+    $this->existingVersion = $existing_version;
+    $this->releases = $releases;
+  }
+
+  /**
+   * Creates a ProjectSecurityData object from project data and releases.
+   *
+   * @param array $project_data
+   *   Project data from Drupal\update\UpdateManagerInterface::getProjects() and
+   *   processed by update_process_project_info().
+   * @param array $releases
+   *   Project releases as returned by update_get_available().
+   *
+   * @return static
+   */
+  public static function createFromProjectDataAndReleases(array $project_data, array $releases) {
+    if (!($project_data['project_type'] === 'core' && $project_data['name'] === 'drupal')) {
+      // Only Drupal core has an explicit coverage range.
+      return new static();
+    }
+    return new static($project_data['existing_version'], $releases);
+  }
+
+  /**
+   * Gets the security coverage information for a project.
+   *
+   * Currently only Drupal core is supported.
+   *
+   * @return array
+   *   The security coverage information, or an empty array if no security
+   *   information is available for the project. If security coverage is based
+   *   on release of a specific version, the array will have the following
+   *   keys:
+   *   - security_coverage_end_version (string): The minor version the existing
+   *     version will receive security coverage until.
+   *   - additional_minors_coverage (int): The number of additional minor
+   *     versions the existing version will receive security coverage.
+   *   If the security coverage is based on a specific date, the array will have
+   *   the following keys:
+   *   - security_coverage_end_date (string): The month or date security
+   *     coverage will end for the existing version. It can be in either
+   *     'YYYY-MM' or 'YYYY-MM-DD' format.
+   *   - (optional) security_coverage_ending_warn_date (string): The date, in
+   *     the format 'YYYY-MM-DD', after which a warning should be displayed
+   *     about upgrading to another version.
+   */
+  public function getCoverageInfo() {
+    if (empty($this->releases[$this->existingVersion])) {
+      // If the existing version does not have a release, we cannot get the
+      // security coverage information.
+      return [];
+    }
+    $info = [];
+    $existing_release_version = ModuleVersion::createFromVersionString($this->existingVersion);
+
+    // Check if the installed version has a specific end date defined.
+    $version_suffix = $existing_release_version->getMajorVersion() . '_' . $this->getSemanticMinorVersion($this->existingVersion);
+    if (defined("self::SECURITY_COVERAGE_END_DATE_$version_suffix")) {
+      $info['security_coverage_end_date'] = constant("self::SECURITY_COVERAGE_END_DATE_$version_suffix");
+      $info['security_coverage_ending_warn_date'] =
+        defined("self::SECURITY_COVERAGE_ENDING_WARN_DATE_$version_suffix")
+          ? constant("self::SECURITY_COVERAGE_ENDING_WARN_DATE_$version_suffix")
+          : NULL;
+    }
+    elseif ($security_coverage_until_version = $this->getSecurityCoverageUntilVersion()) {
+      $info['security_coverage_end_version'] = $security_coverage_until_version;
+      $info['additional_minors_coverage'] = $this->getAdditionalSecurityCoveredMinors($security_coverage_until_version);
+    }
+    return $info;
+  }
+
+  /**
+   * Gets the release the current minor will receive security coverage until.
+   *
+   * For the sake of example, assume that the currently installed version of
+   * Drupal is 8.7.11 and that static::CORE_MINORS_WITH_SECURITY_COVERAGE is 2.
+   * When Drupal 8.9.0 is released, the supported minor versions will be 8.8
+   * and 8.9. At that point, Drupal 8.7 will no longer have security coverage.
+   * Therefore, this function would return "8.9.0".
+   *
+   * @todo In https://www.drupal.org/node/2998285 determine how we will know
+   *    what the final minor release of a particular major version will be. This
+   *    method should not return a version beyond that minor.
+   *
+   * @return string|null
+   *   The version the existing version will receive security coverage until or
+   *   NULL if this cannot be determined.
+   */
+  private function getSecurityCoverageUntilVersion() {
+    $existing_release_version = ModuleVersion::createFromVersionString($this->existingVersion);
+    if (!empty($existing_release_version->getVersionExtra())) {
+      // Only full releases receive security coverage.
+      return NULL;
+    }
+
+    return $existing_release_version->getMajorVersion() . '.'
+      . ($this->getSemanticMinorVersion($this->existingVersion) + static::CORE_MINORS_WITH_SECURITY_COVERAGE)
+      . '.0';
+  }
+
+  /**
+   * Gets the number of additional minor releases with security coverage.
+   *
+   * This function compares the currently installed (existing) version of
+   * the project with two things:
+   * - The latest available official release of that project.
+   * - The target minor release where security coverage for the current release
+   *   should expire. This target release is determined by
+   *   getSecurityCoverageUntilVersion().
+   *
+   * For the sake of example, assume that the currently installed version of
+   * Drupal is 8.7.11 and that static::CORE_MINORS_WITH_SECURITY_COVERAGE is 2.
+   *
+   * Before the release of Drupal 8.8.0, this function would return 2.
+   *
+   * After the release of Drupal 8.8.0 and before the release of 8.9.0, this
+   * function would return 1 to indicate that the next minor version release
+   * will end security coverage for 8.7.
+   *
+   * When Drupal 8.9.0 is released, this function would return 0 to indicate
+   * that security coverage is over for 8.7.
+   *
+   * If the currently installed version is 9.0.0, and there is no 9.1.0 release
+   * yet, the function would return 2. Once 9.1.0 is out, it would return 1.
+   * When 9.2.0 is released, it would again return 0.
+   *
+   * Note: callers should not test this function's return value with empty()
+   * since 0 is a valid return value that has different meaning than NULL.
+   *
+   * @param string $security_covered_version
+   *   The version until which the existing version receives security coverage.
+   *
+   * @return int|null
+   *   The number of additional minor releases that receive security coverage,
+   *   or NULL if this cannot be determined.
+   *
+   * @see \Drupal\update\ProjectSecurityData\getSecurityCoverageUntilVersion()
+   */
+  private function getAdditionalSecurityCoveredMinors($security_covered_version) {
+    $security_covered_version_major = ModuleVersion::createFromVersionString($security_covered_version)->getMajorVersion();
+    $security_covered_version_minor = $this->getSemanticMinorVersion($security_covered_version);
+    foreach ($this->releases as $release) {
+      $release_version = ModuleVersion::createFromVersionString($release['version']);
+      if ($release_version->getMajorVersion() === $security_covered_version_major && $release['status'] === 'published' && !$release_version->getVersionExtra()) {
+        // The releases are ordered with the most recent releases first.
+        // Therefore, if we have found a published, official release with the
+        // same major version as $security_covered_version, then this release
+        // can be used to determine the latest minor.
+        $latest_minor = $this->getSemanticMinorVersion($release['version']);
+        break;
+      }
+    }
+    // If $latest_minor is set, we know that $security_covered_version_minor and
+    // $latest_minor have the same major version. Therefore, we can subtract to
+    // determine the number of additional minor releases with security coverage.
+    return isset($latest_minor) ? $security_covered_version_minor - $latest_minor : NULL;
+  }
+
+  /**
+   * Gets the minor version for a semantic version string.
+   *
+   * @param string $version
+   *   The semantic version string.
+   *
+   * @return int
+   *   The minor version as an integer.
+   */
+  private function getSemanticMinorVersion($version) {
+    return (int) (explode('.', $version)[1]);
+  }
+
+}

web/core/modules/update/src/ProjectSecurityRequirement.php

@@ -0,0 +1,282 @@
+<?php
+
+namespace Drupal\update;
+
+use Drupal\Core\StringTranslation\StringTranslationTrait;
+use Drupal\Core\Url;
+
+/**
+ * Class for generating a project's security requirement.
+ *
+ * @see update_requirements()
+ *
+ * @internal
+ *   This class implements logic to determine security coverage for Drupal core
+ *   according to Drupal core security policy. It should not be called directly.
+ */
+final class ProjectSecurityRequirement {
+
+  use StringTranslationTrait;
+
+  /**
+   * The project title.
+   *
+   * @var string|null
+   */
+  protected $projectTitle;
+
+  /**
+   * Security coverage information for the project.
+   *
+   * @var array
+   *
+   * @see \Drupal\update\ProjectSecurityData::getCoverageInfo()
+   */
+  private $securityCoverageInfo;
+
+  /**
+   * The next version after the installed version in the format [MAJOR].[MINOR].
+   *
+   * @var string|null
+   */
+  private $nextMajorMinorVersion;
+
+  /**
+   * The existing (currently installed) version in the format [MAJOR].[MINOR].
+   *
+   * @var string|null
+   */
+  private $existingMajorMinorVersion;
+
+  /**
+   * Constructs a ProjectSecurityRequirement object.
+   *
+   * @param string|null $project_title
+   *   The project title.
+   * @param array $security_coverage_info
+   *   Security coverage information as set by
+   *   \Drupal\update\ProjectSecurityData::getCoverageInfo().
+   * @param string|null $existing_major_minor_version
+   *   The existing (currently installed) version in the format [MAJOR].[MINOR].
+   * @param string|null $next_major_minor_version
+   *   The next version after the installed version in the format
+   *   [MAJOR].[MINOR].
+   */
+  private function __construct($project_title = NULL, array $security_coverage_info = [], $existing_major_minor_version = NULL, $next_major_minor_version = NULL) {
+    $this->projectTitle = $project_title;
+    $this->securityCoverageInfo = $security_coverage_info;
+    $this->existingMajorMinorVersion = $existing_major_minor_version;
+    $this->nextMajorMinorVersion = $next_major_minor_version;
+  }
+
+  /**
+   * Creates a ProjectSecurityRequirement object from project data.
+   *
+   * @param array $project_data
+   *   Project data from Drupal\update\UpdateManagerInterface::getProjects().
+   *   The 'security_coverage_info' key should be set by
+   *   calling \Drupal\update\ProjectSecurityData::getCoverageInfo() before
+   *   calling this method. The following keys are used in this method:
+   *   - existing_version (string): The version of the project that is installed
+   *     on the site.
+   *   - project_type (string): The type of project.
+   *   - name (string): The project machine name.
+   *   - title (string): The project title.
+   * @param array $security_coverage_info
+   *   The security coverage information as returned by
+   *   \Drupal\update\ProjectSecurityData::getCoverageInfo().
+   *
+   * @return static
+   *
+   * @see \Drupal\update\UpdateManagerInterface::getProjects()
+   * @see \Drupal\update\ProjectSecurityData::getCoverageInfo()
+   * @see update_process_project_info()
+   */
+  public static function createFromProjectDataAndSecurityCoverageInfo(array $project_data, array $security_coverage_info) {
+    if ($project_data['project_type'] !== 'core' || $project_data['name'] !== 'drupal' || empty($security_coverage_info)) {
+      return new static();
+    }
+    if (isset($project_data['existing_version'])) {
+      list($major, $minor) = explode('.', $project_data['existing_version']);
+      $existing_version = "$major.$minor";
+      $next_version = "$major." . ((int) $minor + 1);
+      return new static($project_data['title'], $security_coverage_info, $existing_version, $next_version);
+    }
+    return new static($project_data['title'], $security_coverage_info);
+  }
+
+  /**
+   * Gets the security coverage requirement, if any.
+   *
+   * @return array
+   *   Requirements array as specified by hook_requirements(), or an empty array
+   *   if no requirements can be determined.
+   */
+  public function getRequirement() {
+    if (isset($this->securityCoverageInfo['security_coverage_end_version'])) {
+      $requirement = $this->getVersionEndRequirement();
+    }
+    elseif (isset($this->securityCoverageInfo['security_coverage_end_date'])) {
+      $requirement = $this->getDateEndRequirement();
+    }
+    else {
+      return [];
+    }
+    $requirement['title'] = $this->t('Drupal core security coverage');
+    return $requirement;
+  }
+
+  /**
+   * Gets the requirements based on security coverage until a specific version.
+   *
+   * @return array
+   *   Requirements array as specified by hook_requirements().
+   */
+  private function getVersionEndRequirement() {
+    $requirement = [];
+    if ($security_coverage_message = $this->getVersionEndCoverageMessage()) {
+      $requirement['description'] = $security_coverage_message;
+      if ($this->securityCoverageInfo['additional_minors_coverage'] > 0) {
+        $requirement['value'] = $this->t(
+          'Covered until @end_version',
+          ['@end_version' => $this->securityCoverageInfo['security_coverage_end_version']]
+        );
+        $requirement['severity'] = $this->securityCoverageInfo['additional_minors_coverage'] > 1 ? REQUIREMENT_INFO : REQUIREMENT_WARNING;
+      }
+      else {
+        $requirement['value'] = $this->t('Coverage has ended');
+        $requirement['severity'] = REQUIREMENT_ERROR;
+      }
+    }
+    return $requirement;
+  }
+
+  /**
+   * Gets the message for additional minor version security coverage.
+   *
+   * @return array[]
+   *   A render array containing security coverage message.
+   *
+   * @see \Drupal\update\ProjectSecurityData::getCoverageInfo()
+   */
+  private function getVersionEndCoverageMessage() {
+    if ($this->securityCoverageInfo['additional_minors_coverage'] > 0) {
+      // If the installed minor version will receive security coverage until
+      // newer minor versions are released, inform the user.
+      if ($this->securityCoverageInfo['additional_minors_coverage'] === 1) {
+        // If the installed minor version will only receive security coverage
+        // for 1 newer minor core version, encourage the site owner to update
+        // soon.
+        $message['coverage_message'] = [
+          '#markup' => $this->t(
+            '<a href=":update_status_report">Update to @next_minor or higher</a> soon to continue receiving security updates.',
+            [
+              ':update_status_report' => Url::fromRoute('update.status')->toString(),
+              '@next_minor' => $this->nextMajorMinorVersion,
+            ]
+          ),
+          '#suffix' => ' ',
+        ];
+      }
+    }
+    else {
+      // Because the current minor version no longer has security coverage,
+      // advise the site owner to update.
+      $message['coverage_message'] = [
+        '#markup' => $this->getVersionNoSecurityCoverageMessage(),
+        '#suffix' => ' ',
+      ];
+    }
+    $message['release_cycle_link'] = [
+      '#markup' => $this->getReleaseCycleLink(),
+    ];
+    return $message;
+  }
+
+  /**
+   * Gets the security coverage requirement based on an end date.
+   *
+   * @return array
+   *   Requirements array as specified by hook_requirements().
+   */
+  private function getDateEndRequirement() {
+    $requirement = [];
+    /** @var \Drupal\Component\Datetime\Time $time */
+    $time = \Drupal::service('datetime.time');
+    /** @var \Drupal\Core\Datetime\DateFormatterInterface $date_formatter */
+    $date_formatter = \Drupal::service('date.formatter');
+    // 'security_coverage_end_date' will either be in format 'Y-m-d' or 'Y-m'.
+    if (substr_count($this->securityCoverageInfo['security_coverage_end_date'], '-') === 2) {
+      $date_format = 'Y-m-d';
+      $full_security_coverage_end_date = $this->securityCoverageInfo['security_coverage_end_date'];
+    }
+    else {
+      $date_format = 'Y-m';
+      // If the date does not include a day, use '15'. When calling
+      // \DateTime::createFromFormat() the current day will be used if one is
+      // not provided. This may cause the month to be wrong at the beginning or
+      // end of the month. '15' will never be displayed because we are using the
+      // 'Y-m' format.
+      $full_security_coverage_end_date = $this->securityCoverageInfo['security_coverage_end_date'] . '-15';
+    }
+
+    $comparable_request_date = $date_formatter->format($time->getRequestTime(), 'custom', $date_format);
+    if ($this->securityCoverageInfo['security_coverage_end_date'] <= $comparable_request_date) {
+      // Security coverage is over.
+      $requirement['value'] = $this->t('Coverage has ended');
+      $requirement['severity'] = REQUIREMENT_ERROR;
+      $requirement['description']['coverage_message'] = [
+        '#markup' => $this->getVersionNoSecurityCoverageMessage(),
+        '#suffix' => ' ',
+      ];
+    }
+    else {
+      $security_coverage_end_timestamp = \DateTime::createFromFormat('Y-m-d', $full_security_coverage_end_date)->getTimestamp();
+      $output_date_format = $date_format === 'Y-m-d' ? 'Y-M-d' : 'Y-M';
+      $formatted_end_date = $date_formatter
+        ->format($security_coverage_end_timestamp, 'custom', $output_date_format);
+      $translation_arguments = ['@date' => $formatted_end_date];
+      $requirement['value'] = $this->t('Covered until @date', $translation_arguments);
+      $requirement['severity'] = REQUIREMENT_INFO;
+      // 'security_coverage_ending_warn_date' will always be in the format
+      // 'Y-m-d'.
+      $request_date = $date_formatter->format($time->getRequestTime(), 'custom', 'Y-m-d');
+      if (!empty($this->securityCoverageInfo['security_coverage_ending_warn_date']) && $this->securityCoverageInfo['security_coverage_ending_warn_date'] <= $request_date) {
+        $requirement['description']['coverage_message'] = [
+          '#markup' => $this->t('Update to a supported minor version soon to continue receiving security updates.'),
+          '#suffix' => ' ',
+        ];
+        $requirement['severity'] = REQUIREMENT_WARNING;
+      }
+    }
+    $requirement['description']['release_cycle_link'] = ['#markup' => $this->getReleaseCycleLink()];
+    return $requirement;
+  }
+
+  /**
+   * Gets the formatted message for a project with no security coverage.
+   *
+   * @return string
+   *   The message for a version with no security coverage.
+   */
+  private function getVersionNoSecurityCoverageMessage() {
+    return $this->t(
+      '<a href=":update_status_report">Update to a supported minor</a> as soon as possible to continue receiving security updates.',
+      [':update_status_report' => Url::fromRoute('update.status')->toString()]
+    );
+  }
+
+  /**
+   * Gets a link the release cycle page on drupal.org.
+   *
+   * @return string
+   *   A link to the release cycle page on drupal.org.
+   */
+  private function getReleaseCycleLink() {
+    return $this->t(
+        'Visit the <a href=":url">release cycle overview</a> for more information on supported releases.',
+        [':url' => 'https://www.drupal.org/core/release-cycle-overview']
+      );
+  }
+
+}

web/core/modules/update/src/Tests/UpdateTestBase.php

@@ -0,0 +1,89 @@
+<?php
+
+namespace Drupal\update\Tests;
+
+@trigger_error(__NAMESPACE__ . '\UpdateTestBase is deprecated in Drupal 8.4.0 and will be removed before Drupal 9.0.0. Instead, use \Drupal\Tests\update\Functional\UpdateTestBase', E_USER_DEPRECATED);
+
+use Drupal\Core\DrupalKernel;
+use Drupal\Core\Link;
+use Drupal\Core\Url;
+use Drupal\simpletest\WebTestBase;
+
+/**
+ * Defines some shared functions used by all update tests.
+ *
+ * The overarching methodology of these tests is we need to compare a given
+ * state of installed modules and themes (e.g., version, project grouping,
+ * timestamps, etc) against a current state of what the release history XML
+ * files we fetch say is available. We have dummy XML files (in the
+ * core/modules/update/tests directory) that describe various scenarios of
+ * what's available for different test projects, and we have dummy .info file
+ * data (specified via hook_system_info_alter() in the update_test helper
+ * module) describing what's currently installed. Each test case defines a set
+ * of projects to install, their current state (via the
+ * 'update_test_system_info' variable) and the desired available update data
+ * (via the 'update_test_xml_map' variable), and then performs a series of
+ * assertions that the report matches our expectations given the specific
+ * initial state and availability scenario.
+ *
+ * @deprecated in drupal:8.?.? and is removed from drupal:9.0.0.
+ *   Use \Drupal\Tests\update\Functional\UpdateTestBase instead.
+ */
+abstract class UpdateTestBase extends WebTestBase {
+
+  protected function setUp() {
+    parent::setUp();
+
+    // Change the root path which Update Manager uses to install and update
+    // projects to be inside the testing site directory. See
+    // \Drupal\update\UpdateRootFactory::get() for equivalent changes to the
+    // test child site.
+    $request = \Drupal::request();
+    $update_root = $this->container->get('update.root') . '/' . DrupalKernel::findSitePath($request);
+    $this->container->set('update.root', $update_root);
+    \Drupal::setContainer($this->container);
+
+    // Create the directories within the root path within which the Update
+    // Manager will install projects.
+    foreach (drupal_get_updaters() as $updater_info) {
+      $updater = $updater_info['class'];
+      $install_directory = $update_root . '/' . $updater::getRootDirectoryRelativePath();
+      if (!is_dir($install_directory)) {
+        mkdir($install_directory);
+      }
+    }
+  }
+
+  /**
+   * Refreshes the update status based on the desired available update scenario.
+   *
+   * @param $xml_map
+   *   Array that maps project names to availability scenarios to fetch. The key
+   *   '#all' is used if a project-specific mapping is not defined.
+   * @param $url
+   *   (optional) A string containing the URL to fetch update data from.
+   *   Defaults to 'update-test'.
+   *
+   * @see \Drupal\update_test\Controller\UpdateTestController::updateTest()
+   */
+  protected function refreshUpdateStatus($xml_map, $url = 'update-test') {
+    // Tell the Update Manager module to fetch from the URL provided by
+    // update_test module.
+    $this->config('update.settings')->set('fetch.url', Url::fromUri('base:' . $url, ['absolute' => TRUE])->toString())->save();
+    // Save the map for UpdateTestController::updateTest() to use.
+    $this->config('update_test.settings')->set('xml_map', $xml_map)->save();
+    // Manually check the update status.
+    $this->drupalGet('admin/reports/updates');
+    $this->clickLink(t('Check manually'));
+  }
+
+  /**
+   * Runs a series of assertions that are applicable to all update statuses.
+   */
+  protected function standardTests() {
+    $this->assertRaw('<h3>' . t('Drupal core') . '</h3>');
+    $this->assertRaw(Link::fromTextAndUrl(t('Drupal'), Url::fromUri('http://example.com/project/drupal'))->toString(), 'Link to the Drupal project appears.');
+    $this->assertNoText(t('No available releases found'));
+  }
+
+}

web/core/modules/update/src/UpdateFetcher.php

@@ -0,0 +1,120 @@
+<?php
+
+namespace Drupal\update;
+
+use Drupal\Core\Config\ConfigFactoryInterface;
+use Drupal\Core\DependencyInjection\DependencySerializationTrait;
+use GuzzleHttp\ClientInterface;
+use GuzzleHttp\Exception\RequestException;
+
+/**
+ * Fetches project information from remote locations.
+ */
+class UpdateFetcher implements UpdateFetcherInterface {
+
+  use DependencySerializationTrait;
+
+  /**
+   * URL to check for updates, if a given project doesn't define its own.
+   */
+  const UPDATE_DEFAULT_URL = 'http://updates.drupal.org/release-history';
+
+  /**
+   * The fetch url configured in the update settings.
+   *
+   * @var string
+   */
+  protected $fetchUrl;
+
+  /**
+   * The update settings
+   *
+   * @var \Drupal\Core\Config\Config
+   */
+  protected $updateSettings;
+
+  /**
+   * The HTTP client to fetch the feed data with.
+   *
+   * @var \GuzzleHttp\ClientInterface
+   */
+  protected $httpClient;
+
+  /**
+   * Constructs a UpdateFetcher.
+   *
+   * @param \Drupal\Core\Config\ConfigFactoryInterface $config_factory
+   *   The config factory.
+   * @param \GuzzleHttp\ClientInterface $http_client
+   *   A Guzzle client object.
+   */
+  public function __construct(ConfigFactoryInterface $config_factory, ClientInterface $http_client) {
+    $this->fetchUrl = $config_factory->get('update.settings')->get('fetch.url');
+    $this->httpClient = $http_client;
+    $this->updateSettings = $config_factory->get('update.settings');
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function fetchProjectData(array $project, $site_key = '') {
+    $url = $this->buildFetchUrl($project, $site_key);
+    $data = '';
+    try {
+      $data = (string) $this->httpClient
+        ->get($url, ['headers' => ['Accept' => 'text/xml']])
+        ->getBody();
+    }
+    catch (RequestException $exception) {
+      watchdog_exception('update', $exception);
+    }
+    return $data;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function buildFetchUrl(array $project, $site_key = '') {
+    $name = $project['name'];
+    $url = $this->getFetchBaseUrl($project);
+    $url .= '/' . $name . '/current';
+
+    // Only append usage information if we have a site key and the project is
+    // enabled. We do not want to record usage statistics for disabled projects.
+    if (!empty($site_key) && (strpos($project['project_type'], 'disabled') === FALSE)) {
+      // Append the site key.
+      $url .= (strpos($url, '?') !== FALSE) ? '&' : '?';
+      $url .= 'site_key=';
+      $url .= rawurlencode($site_key);
+
+      // Append the version.
+      if (!empty($project['info']['version'])) {
+        $url .= '&version=';
+        $url .= rawurlencode($project['info']['version']);
+      }
+
+      // Append the list of modules or themes enabled.
+      $list = array_keys($project['includes']);
+      $url .= '&list=';
+      $url .= rawurlencode(implode(',', $list));
+    }
+    return $url;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getFetchBaseUrl($project) {
+    if (isset($project['info']['project status url'])) {
+      $url = $project['info']['project status url'];
+    }
+    else {
+      $url = $this->fetchUrl;
+      if (empty($url)) {
+        $url = static::UPDATE_DEFAULT_URL;
+      }
+    }
+    return $url;
+  }
+
+}

web/core/modules/update/src/UpdateFetcherInterface.php

@@ -0,0 +1,80 @@
+<?php
+
+namespace Drupal\update;
+
+/**
+ * Fetches project information from remote locations.
+ */
+interface UpdateFetcherInterface {
+
+  /**
+   * Project's status cannot be checked.
+   */
+  const NOT_CHECKED = -1;
+
+  /**
+   * No available update data was found for project.
+   */
+  const UNKNOWN = -2;
+
+  /**
+   * There was a failure fetching available update data for this project.
+   */
+  const NOT_FETCHED = -3;
+
+  /**
+   * We need to (re)fetch available update data for this project.
+   */
+  const FETCH_PENDING = -4;
+
+  /**
+   * Returns the base of the URL to fetch available update data for a project.
+   *
+   * @param array $project
+   *   The array of project information from
+   *   \Drupal\update\UpdateManager::getProjects().
+   *
+   * @return string
+   *   The base of the URL used for fetching available update data. This does
+   *   not include the path elements to specify a particular project, version,
+   *   site_key, etc.
+   */
+  public function getFetchBaseUrl($project);
+
+  /**
+   * Retrieves the project information.
+   *
+   * @param array $project
+   *   The array of project information from
+   *   \Drupal\update\UpdateManager::getProjects().
+   * @param string $site_key
+   *   (optional) The anonymous site key hash. Defaults to an empty string.
+   *
+   * @return string
+   *   The project information fetched as string. Empty string upon failure.
+   */
+  public function fetchProjectData(array $project, $site_key = '');
+
+  /**
+   * Generates the URL to fetch information about project updates.
+   *
+   * This figures out the right URL to use, based on the project's .info.yml
+   * file and the global defaults. Appends optional query arguments when the
+   * site is configured to report usage stats.
+   *
+   * @param array $project
+   *   The array of project information from
+   *   \Drupal\update\UpdateManager::getProjects().
+   * @param string $site_key
+   *   (optional) The anonymous site key hash. Defaults to an empty string.
+   *
+   * @return string
+   *   The URL for fetching information about updates to the specified project.
+   *
+   * @see \Drupal\update\UpdateProcessor::fetchData()
+   * @see \Drupal\update\UpdateProcessor::processFetchTask()
+   * @see \Drupal\update\UpdateManager::getProjects()
+   */
+  public function buildFetchUrl(array $project, $site_key = '');
+
+}

web/core/modules/update/src/UpdateManager.php

@@ -0,0 +1,242 @@
+<?php
+
+namespace Drupal\update;
+
+use Drupal\Core\Config\ConfigFactoryInterface;
+use Drupal\Core\DependencyInjection\DependencySerializationTrait;
+use Drupal\Core\Extension\ModuleExtensionList;
+use Drupal\Core\Extension\ModuleHandlerInterface;
+use Drupal\Core\Extension\ThemeHandlerInterface;
+use Drupal\Core\KeyValueStore\KeyValueFactoryInterface;
+use Drupal\Core\StringTranslation\TranslationInterface;
+use Drupal\Core\StringTranslation\StringTranslationTrait;
+use Drupal\Core\Utility\ProjectInfo;
+
+/**
+ * Default implementation of UpdateManagerInterface.
+ */
+class UpdateManager implements UpdateManagerInterface {
+  use DependencySerializationTrait;
+  use StringTranslationTrait;
+
+  /**
+   * The update settings
+   *
+   * @var \Drupal\Core\Config\Config
+   */
+  protected $updateSettings;
+
+  /**
+   * Module Handler Service.
+   *
+   * @var \Drupal\Core\Extension\ModuleHandlerInterface
+   */
+  protected $moduleHandler;
+
+  /**
+   * Update Processor Service.
+   *
+   * @var \Drupal\update\UpdateProcessorInterface
+   */
+  protected $updateProcessor;
+
+  /**
+   * An array of installed and enabled projects.
+   *
+   * @var array
+   */
+  protected $projects;
+
+  /**
+   * The key/value store.
+   *
+   * @var \Drupal\Core\KeyValueStore\KeyValueStoreExpirableInterface
+   */
+  protected $keyValueStore;
+
+  /**
+   * Update available releases key/value store.
+   *
+   * @var \Drupal\Core\KeyValueStore\KeyValueStoreExpirableInterface
+   */
+  protected $availableReleasesTempStore;
+
+  /**
+   * The theme handler.
+   *
+   * @var \Drupal\Core\Extension\ThemeHandlerInterface
+   */
+  protected $themeHandler;
+
+  /**
+   * The module extension list.
+   *
+   * @var \Drupal\Core\Extension\ModuleExtensionList
+   */
+  protected $moduleExtensionList;
+
+  /**
+   * Constructs a UpdateManager.
+   *
+   * @param \Drupal\Core\Config\ConfigFactoryInterface $config_factory
+   *   The config factory.
+   * @param \Drupal\Core\Extension\ModuleHandlerInterface $module_handler
+   *   The Module Handler service
+   * @param \Drupal\update\UpdateProcessorInterface $update_processor
+   *   The Update Processor service.
+   * @param \Drupal\Core\StringTranslation\TranslationInterface $translation
+   *   The translation service.
+   * @param \Drupal\Core\KeyValueStore\KeyValueFactoryInterface $key_value_expirable_factory
+   *   The expirable key/value factory.
+   * @param \Drupal\Core\Extension\ThemeHandlerInterface $theme_handler
+   *   The theme handler.
+   * @param \Drupal\Core\Extension\ModuleExtensionList|null $extension_list_module
+   *   The module extension list. This is left optional for BC reasons, but the
+   *   optional usage is deprecated and will become required in Drupal 9.0.0.
+   */
+  public function __construct(ConfigFactoryInterface $config_factory, ModuleHandlerInterface $module_handler, UpdateProcessorInterface $update_processor, TranslationInterface $translation, KeyValueFactoryInterface $key_value_expirable_factory, ThemeHandlerInterface $theme_handler, ModuleExtensionList $extension_list_module = NULL) {
+    $this->updateSettings = $config_factory->get('update.settings');
+    $this->moduleHandler = $module_handler;
+    $this->updateProcessor = $update_processor;
+    $this->stringTranslation = $translation;
+    $this->keyValueStore = $key_value_expirable_factory->get('update');
+    $this->themeHandler = $theme_handler;
+    $this->availableReleasesTempStore = $key_value_expirable_factory->get('update_available_releases');
+    $this->projects = [];
+    if ($extension_list_module === NULL) {
+      @trigger_error('Invoking the UpdateManager constructor without the module extension list parameter is deprecated in Drupal 8.8.0 and will no longer be supported in Drupal 9.0.0. The extension list parameter is now required in the ConfigImporter constructor. See https://www.drupal.org/node/2943918', E_USER_DEPRECATED);
+      $extension_list_module = \Drupal::service('extension.list.module');
+    }
+    $this->moduleExtensionList = $extension_list_module;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function refreshUpdateData() {
+
+    // Since we're fetching new available update data, we want to clear
+    // of both the projects we care about, and the current update status of the
+    // site. We do *not* want to clear the cache of available releases just yet,
+    // since that data (even if it's stale) can be useful during
+    // \Drupal\update\UpdateManager::getProjects(); for example, to modules
+    // that implement hook_system_info_alter() such as cvs_deploy.
+    $this->keyValueStore->delete('update_project_projects');
+    $this->keyValueStore->delete('update_project_data');
+
+    $projects = $this->getProjects();
+
+    // Now that we have the list of projects, we should also clear the available
+    // release data, since even if we fail to fetch new data, we need to clear
+    // out the stale data at this point.
+    $this->availableReleasesTempStore->deleteAll();
+
+    foreach ($projects as $project) {
+      $this->updateProcessor->createFetchTask($project);
+    }
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getProjects() {
+    if (empty($this->projects)) {
+      // Retrieve the projects from storage, if present.
+      $this->projects = $this->projectStorage('update_project_projects');
+      if (empty($this->projects)) {
+        // Still empty, so we have to rebuild.
+        $module_data = $this->moduleExtensionList->reset()->getList();
+        $theme_data = $this->themeHandler->rebuildThemeData();
+        $project_info = new ProjectInfo();
+        $project_info->processInfoList($this->projects, $module_data, 'module', TRUE);
+        $project_info->processInfoList($this->projects, $theme_data, 'theme', TRUE);
+        if ($this->updateSettings->get('check.disabled_extensions')) {
+          $project_info->processInfoList($this->projects, $module_data, 'module', FALSE);
+          $project_info->processInfoList($this->projects, $theme_data, 'theme', FALSE);
+        }
+        // Allow other modules to alter projects before fetching and comparing.
+        $this->moduleHandler->alter('update_projects', $this->projects);
+        // Store the site's project data for at most 1 hour.
+        $this->keyValueStore->setWithExpire('update_project_projects', $this->projects, 3600);
+      }
+    }
+    return $this->projects;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function projectStorage($key) {
+    $projects = [];
+
+    // On certain paths, we should clear the data and recompute the projects for
+    // update status of the site to avoid presenting stale information.
+    $route_names = [
+      'update.theme_update',
+      'system.modules_list',
+      'system.theme_install',
+      'update.module_update',
+      'update.module_install',
+      'update.status',
+      'update.report_update',
+      'update.report_install',
+      'update.settings',
+      'system.status',
+      'update.manual_status',
+      'update.confirmation_page',
+      'system.themes_page',
+    ];
+    if (in_array(\Drupal::routeMatch()->getRouteName(), $route_names)) {
+      $this->keyValueStore->delete($key);
+    }
+    else {
+      $projects = $this->keyValueStore->get($key, []);
+    }
+    return $projects;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function fetchDataBatch(&$context) {
+    if (empty($context['sandbox']['max'])) {
+      $context['finished'] = 0;
+      $context['sandbox']['max'] = $this->updateProcessor->numberOfQueueItems();
+      $context['sandbox']['progress'] = 0;
+      $context['message'] = $this->t('Checking available update data ...');
+      $context['results']['updated'] = 0;
+      $context['results']['failures'] = 0;
+      $context['results']['processed'] = 0;
+    }
+
+    // Grab another item from the fetch queue.
+    for ($i = 0; $i < 5; $i++) {
+      if ($item = $this->updateProcessor->claimQueueItem()) {
+        if ($this->updateProcessor->processFetchTask($item->data)) {
+          $context['results']['updated']++;
+          $context['message'] = $this->t('Checked available update data for %title.', ['%title' => $item->data['info']['name']]);
+        }
+        else {
+          $context['message'] = $this->t('Failed to check available update data for %title.', ['%title' => $item->data['info']['name']]);
+          $context['results']['failures']++;
+        }
+        $context['sandbox']['progress']++;
+        $context['results']['processed']++;
+        $context['finished'] = $context['sandbox']['progress'] / $context['sandbox']['max'];
+        $this->updateProcessor->deleteQueueItem($item);
+      }
+      else {
+        // If the queue is currently empty, we're done. It's possible that
+        // another thread might have added new fetch tasks while we were
+        // processing this batch. In that case, the usual 'finished' math could
+        // get confused, since we'd end up processing more tasks that we thought
+        // we had when we started and initialized 'max' with numberOfItems(). By
+        // forcing 'finished' to be exactly 1 here, we ensure that batch
+        // processing is terminated.
+        $context['finished'] = 1;
+        return;
+      }
+    }
+  }
+
+}

web/core/modules/update/src/UpdateManagerInterface.php

@@ -0,0 +1,127 @@
+<?php
+
+namespace Drupal\update;
+
+/**
+ * Manages project update information.
+ */
+interface UpdateManagerInterface {
+
+  /**
+   * Project is missing security update(s).
+   */
+  const NOT_SECURE = 1;
+
+  /**
+   * Current release has been unpublished and is no longer available.
+   */
+  const REVOKED = 2;
+
+  /**
+   * Current release is no longer supported by the project maintainer.
+   */
+  const NOT_SUPPORTED = 3;
+
+  /**
+   * Project has a new release available, but it is not a security release.
+   */
+  const NOT_CURRENT = 4;
+
+  /**
+   * Project is up to date.
+   */
+  const CURRENT = 5;
+
+  /**
+   * Fetches an array of installed and enabled projects.
+   *
+   * This is only responsible for generating an array of projects (taking into
+   * account projects that include more than one module or theme). Other
+   * information like the specific version and install type (official release,
+   * dev snapshot, etc) is handled later in update_process_project_info() since
+   * that logic is only required when preparing the status report, not for
+   * fetching the available release data.
+   *
+   * This array is fairly expensive to construct, since it involves a lot of
+   * disk I/O, so we store the results. However, since this is not the data
+   * about available updates fetched from the network, it is acceptable to
+   * invalidate it somewhat quickly. If we keep this data for very long, site
+   * administrators are more likely to see incorrect results if they upgrade to
+   * a newer version of a module or theme but do not visit certain pages that
+   * automatically clear this data.
+   *
+   * @return array
+   *   An associative array of currently enabled projects keyed by the
+   *   machine-readable project short name. Each project contains:
+   *   - name: The machine-readable project short name.
+   *   - info: An array with values from the main .info.yml file for this
+   *     project.
+   *     - name: The human-readable name of the project.
+   *     - package: The package that the project is grouped under.
+   *     - version: The version of the project.
+   *     - project: The Drupal.org project name.
+   *     - datestamp: The date stamp of the project's main .info.yml file.
+   *     - _info_file_ctime: The maximum file change time for all of the
+   *       .info.yml
+   *       files included in this project.
+   *   - datestamp: The date stamp when the project was released, if known.
+   *   - includes: An associative array containing all projects included with
+   *     this project, keyed by the machine-readable short name with the
+   *     human-readable name as value.
+   *   - project_type: The type of project. Allowed values are 'module' and
+   *     'theme'.
+   *   - project_status: This indicates if the project is enabled and will
+   *     always be TRUE, as the function only returns enabled projects.
+   *
+   * @see update_process_project_info()
+   * @see update_calculate_project_data()
+   * @see \Drupal\update\UpdateManager::projectStorage()
+   */
+  public function getProjects();
+
+  /**
+   * Processes a step in batch for fetching available update data.
+   *
+   * @param array $context
+   *   Reference to an array used for Batch API storage.
+   */
+  public function fetchDataBatch(&$context);
+
+  /**
+   * Clears out all the available update data and initiates re-fetching.
+   */
+  public function refreshUpdateData();
+
+  /**
+   * Retrieves update storage data or empties it.
+   *
+   * Two very expensive arrays computed by this module are the list of all
+   * installed modules and themes (and .info.yml data, project associations,
+   * etc), and the current status of the site relative to the currently
+   * available releases. These two arrays are stored and used whenever possible.
+   * The data is cleared whenever the administrator visits the status report,
+   * available updates report, or the module or theme administration pages,
+   * since we should always recompute the most current values on any of those
+   * pages.
+   *
+   * Note: while both of these arrays are expensive to compute (in terms of disk
+   * I/O and some fairly heavy CPU processing), neither of these is the actual
+   * data about available updates that we have to fetch over the network from
+   * updates.drupal.org. That information is stored in the
+   * 'update_available_releases' collection -- it needs to persist longer than 1
+   * hour and never get invalidated just by visiting a page on the site.
+   *
+   * @param string $key
+   *   The key of data to return. Valid options are 'update_project_data' and
+   *   'update_project_projects'.
+   *
+   * @return array
+   *   The stored value of the $projects array generated by
+   *   update_calculate_project_data() or
+   *   \Drupal\update\UpdateManager::getProjects(), or an empty array when the
+   *   storage is cleared.
+   *   array when the storage is cleared.
+   */
+  public function projectStorage($key);
+
+}

web/core/modules/update/src/UpdateProcessor.php

@@ -0,0 +1,269 @@
+<?php
+
+namespace Drupal\update;
+
+use Drupal\Component\Utility\Crypt;
+use Drupal\Core\Config\ConfigFactoryInterface;
+use Drupal\Core\KeyValueStore\KeyValueFactoryInterface;
+use Drupal\Core\State\StateInterface;
+use Drupal\Core\PrivateKey;
+use Drupal\Core\Queue\QueueFactory;
+
+/**
+ * Process project update information.
+ */
+class UpdateProcessor implements UpdateProcessorInterface {
+
+  /**
+   * The update settings
+   *
+   * @var \Drupal\Core\Config\Config
+   */
+  protected $updateSettings;
+
+  /**
+   * The UpdateFetcher service.
+   *
+   * @var \Drupal\update\UpdateFetcherInterface
+   */
+  protected $updateFetcher;
+
+  /**
+   * The update fetch queue.
+   *
+   * @var \Drupal\Core\Queue\QueueInterface
+   */
+  protected $fetchQueue;
+
+  /**
+   * Update key/value store
+   *
+   * @var \Drupal\Core\KeyValueStore\KeyValueStoreExpirableInterface
+   */
+  protected $tempStore;
+
+  /**
+   * Update Fetch Task Store
+   *
+   * @var \Drupal\Core\KeyValueStore\KeyValueStoreInterface
+   */
+  protected $fetchTaskStore;
+
+  /**
+   * Update available releases store
+   *
+   * @var \Drupal\Core\KeyValueStore\KeyValueStoreExpirableInterface
+   */
+  protected $availableReleasesTempStore;
+
+  /**
+   * Array of release history URLs that we have failed to fetch
+   *
+   * @var array
+   */
+  protected $failed;
+
+  /**
+   * The state service.
+   *
+   * @var \Drupal\Core\State\StateInterface
+   */
+  protected $stateStore;
+
+  /**
+   * The private key.
+   *
+   * @var \Drupal\Core\PrivateKey
+   */
+  protected $privateKey;
+
+  /**
+   * Constructs a UpdateProcessor.
+   *
+   * @param \Drupal\Core\Config\ConfigFactoryInterface $config_factory
+   *   The config factory.
+   * @param \Drupal\Core\Queue\QueueFactory $queue_factory
+   *   The queue factory
+   * @param \Drupal\update\UpdateFetcherInterface $update_fetcher
+   *   The update fetcher service
+   * @param \Drupal\Core\State\StateInterface $state_store
+   *   The state service.
+   * @param \Drupal\Core\PrivateKey $private_key
+   *   The private key factory service.
+   * @param \Drupal\Core\KeyValueStore\KeyValueFactoryInterface $key_value_factory
+   *   The key/value factory.
+   * @param \Drupal\Core\KeyValueStore\KeyValueFactoryInterface $key_value_expirable_factory
+   *   The expirable key/value factory.
+   */
+  public function __construct(ConfigFactoryInterface $config_factory, QueueFactory $queue_factory, UpdateFetcherInterface $update_fetcher, StateInterface $state_store, PrivateKey $private_key, KeyValueFactoryInterface $key_value_factory, KeyValueFactoryInterface $key_value_expirable_factory) {
+    $this->updateFetcher = $update_fetcher;
+    $this->updateSettings = $config_factory->get('update.settings');
+    $this->fetchQueue = $queue_factory->get('update_fetch_tasks');
+    $this->tempStore = $key_value_expirable_factory->get('update');
+    $this->fetchTaskStore = $key_value_factory->get('update_fetch_task');
+    $this->availableReleasesTempStore = $key_value_expirable_factory->get('update_available_releases');
+    $this->stateStore = $state_store;
+    $this->privateKey = $private_key;
+    $this->fetchTasks = [];
+    $this->failed = [];
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function createFetchTask($project) {
+    if (empty($this->fetchTasks)) {
+      $this->fetchTasks = $this->fetchTaskStore->getAll();
+    }
+    if (empty($this->fetchTasks[$project['name']])) {
+      $this->fetchQueue->createItem($project);
+      $this->fetchTaskStore->set($project['name'], $project);
+      $this->fetchTasks[$project['name']] = REQUEST_TIME;
+    }
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function fetchData() {
+    $end = time() + $this->updateSettings->get('fetch.timeout');
+    while (time() < $end && ($item = $this->fetchQueue->claimItem())) {
+      $this->processFetchTask($item->data);
+      $this->fetchQueue->deleteItem($item);
+    }
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function processFetchTask($project) {
+    global $base_url;
+
+    // This can be in the middle of a long-running batch, so REQUEST_TIME won't
+    // necessarily be valid.
+    $request_time_difference = time() - REQUEST_TIME;
+    if (empty($this->failed)) {
+      // If we have valid data about release history XML servers that we have
+      // failed to fetch from on previous attempts, load that.
+      $this->failed = $this->tempStore->get('fetch_failures');
+    }
+
+    $max_fetch_attempts = $this->updateSettings->get('fetch.max_attempts');
+
+    $success = FALSE;
+    $available = [];
+    $site_key = Crypt::hmacBase64($base_url, $this->privateKey->get());
+    $fetch_url_base = $this->updateFetcher->getFetchBaseUrl($project);
+    $project_name = $project['name'];
+
+    if (empty($this->failed[$fetch_url_base]) || $this->failed[$fetch_url_base] < $max_fetch_attempts) {
+      $data = $this->updateFetcher->fetchProjectData($project, $site_key);
+    }
+    if (!empty($data)) {
+      $available = $this->parseXml($data);
+      // @todo: Purge release data we don't need. See
+      //   https://www.drupal.org/node/238950.
+      if (!empty($available)) {
+        // Only if we fetched and parsed something sane do we return success.
+        $success = TRUE;
+      }
+    }
+    else {
+      $available['project_status'] = 'not-fetched';
+      if (empty($this->failed[$fetch_url_base])) {
+        $this->failed[$fetch_url_base] = 1;
+      }
+      else {
+        $this->failed[$fetch_url_base]++;
+      }
+    }
+
+    $frequency = $this->updateSettings->get('check.interval_days');
+    $available['last_fetch'] = REQUEST_TIME + $request_time_difference;
+    $this->availableReleasesTempStore->setWithExpire($project_name, $available, $request_time_difference + (60 * 60 * 24 * $frequency));
+
+    // Stash the $this->failed data back in the DB for the next 5 minutes.
+    $this->tempStore->setWithExpire('fetch_failures', $this->failed, $request_time_difference + (60 * 5));
+
+    // Whether this worked or not, we did just (try to) check for updates.
+    $this->stateStore->set('update.last_check', REQUEST_TIME + $request_time_difference);
+
+    // Now that we processed the fetch task for this project, clear out the
+    // record for this task so we're willing to fetch again.
+    $this->fetchTaskStore->delete($project_name);
+
+    return $success;
+  }
+
+  /**
+   * Parses the XML of the Drupal release history info files.
+   *
+   * @param string $raw_xml
+   *   A raw XML string of available release data for a given project.
+   *
+   * @return array
+   *   Array of parsed data about releases for a given project, or NULL if there
+   *   was an error parsing the string.
+   */
+  protected function parseXml($raw_xml) {
+    try {
+      $xml = new \SimpleXMLElement($raw_xml);
+    }
+    catch (\Exception $e) {
+      // SimpleXMLElement::__construct produces an E_WARNING error message for
+      // each error found in the XML data and throws an exception if errors
+      // were detected. Catch any exception and return failure (NULL).
+      return NULL;
+    }
+    // If there is no valid project data, the XML is invalid, so return failure.
+    if (!isset($xml->short_name)) {
+      return NULL;
+    }
+    $data = [];
+    foreach ($xml as $k => $v) {
+      $data[$k] = (string) $v;
+    }
+    $data['releases'] = [];
+    if (isset($xml->releases)) {
+      foreach ($xml->releases->children() as $release) {
+        $version = (string) $release->version;
+        $data['releases'][$version] = [];
+        foreach ($release->children() as $k => $v) {
+          $data['releases'][$version][$k] = (string) $v;
+        }
+        $data['releases'][$version]['terms'] = [];
+        if ($release->terms) {
+          foreach ($release->terms->children() as $term) {
+            if (!isset($data['releases'][$version]['terms'][(string) $term->name])) {
+              $data['releases'][$version]['terms'][(string) $term->name] = [];
+            }
+            $data['releases'][$version]['terms'][(string) $term->name][] = (string) $term->value;
+          }
+        }
+      }
+    }
+    return $data;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function numberOfQueueItems() {
+    return $this->fetchQueue->numberOfItems();
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function claimQueueItem() {
+    return $this->fetchQueue->claimItem();
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function deleteQueueItem($item) {
+    return $this->fetchQueue->deleteItem($item);
+  }
+
+}

web/core/modules/update/src/UpdateProcessorInterface.php

@@ -0,0 +1,81 @@
+<?php
+
+namespace Drupal\update;
+
+/**
+ * Processor of project update information.
+ */
+interface UpdateProcessorInterface {
+
+  /**
+   * Claims an item in the update fetch queue for processing.
+   *
+   * @return bool|object
+   *   On success we return an item object. If the queue is unable to claim an
+   *   item it returns false.
+   *
+   * @see \Drupal\Core\Queue\QueueInterface::claimItem()
+   */
+  public function claimQueueItem();
+
+  /**
+   * Attempts to drain the queue of tasks for release history data to fetch.
+   */
+  public function fetchData();
+
+  /**
+   * Adds a task to the queue for fetching release history data for a project.
+   *
+   * We only create a new fetch task if there's no task already in the queue for
+   * this particular project (based on 'update_fetch_task' key-value
+   * collection).
+   *
+   * @param array $project
+   *   Associative array of information about a project as created by
+   *   \Drupal\update\UpdateManager::getProjects(), including keys such as
+   *   'name' (short name), and the 'info' array with data from a .info.yml
+   *   file for the project.
+   *
+   * @see \Drupal\update\UpdateManager::getProjects()
+   * @see update_get_available()
+   * @see \Drupal\update\UpdateManager::refreshUpdateData()
+   * @see \Drupal\update\UpdateProcessor::fetchData()
+   * @see \Drupal\update\UpdateProcessor::processFetchTask()
+   */
+  public function createFetchTask($project);
+
+  /**
+   * Processes a task to fetch available update data for a single project.
+   *
+   * Once the release history XML data is downloaded, it is parsed and saved in
+   * an entry just for that project.
+   *
+   * @param array $project
+   *   Associative array of information about the project to fetch data for.
+   *
+   * @return bool
+   *   TRUE if we fetched parsable XML, otherwise FALSE.
+   */
+  public function processFetchTask($project);
+
+  /**
+   * Retrieves the number of items in the update fetch queue.
+   *
+   * @return int
+   *   An integer estimate of the number of items in the queue.
+   *
+   * @see \Drupal\Core\Queue\QueueInterface::numberOfItems()
+   */
+  public function numberOfQueueItems();
+
+  /**
+   * Deletes a finished item from the update fetch queue.
+   *
+   * @param object $item
+   *   The item returned by \Drupal\Core\Queue\QueueInterface::claimItem().
+   *
+   * @see \Drupal\Core\Queue\QueueInterface::deleteItem()
+   */
+  public function deleteQueueItem($item);
+
+}

web/core/modules/update/src/UpdateRootFactory.php

@@ -0,0 +1,72 @@
+<?php
+
+namespace Drupal\update;
+
+use Drupal\Core\DrupalKernelInterface;
+use Symfony\Component\HttpFoundation\RequestStack;
+
+/**
+ * Gets the root path used by the Update Manager to install or update projects.
+ */
+class UpdateRootFactory {
+
+  /**
+   * The Drupal kernel.
+   *
+   * @var \Drupal\Core\DrupalKernelInterface
+   */
+  protected $drupalKernel;
+
+  /**
+   * The request stack.
+   *
+   * @var \Symfony\Component\HttpFoundation\RequestStack
+   */
+  protected $requestStack;
+
+  /**
+   * Constructs an UpdateRootFactory instance.
+   *
+   * @param \Drupal\Core\DrupalKernelInterface $drupal_kernel
+   *   The Drupal kernel.
+   * @param \Symfony\Component\HttpFoundation\RequestStack $request_stack
+   *   The request stack.
+   */
+  public function __construct(DrupalKernelInterface $drupal_kernel, RequestStack $request_stack) {
+    $this->drupalKernel = $drupal_kernel;
+    $this->requestStack = $request_stack;
+  }
+
+  /**
+   * Gets the root path under which projects are installed or updated.
+   *
+   * The Update Manager will ensure that project files can only be copied to
+   * specific subdirectories of this root path.
+   *
+   * @return string
+   */
+  public function get() {
+    // Normally the Update Manager's root path is the same as the app root (the
+    // directory in which the Drupal site is installed).
+    $root_path = $this->drupalKernel->getAppRoot();
+
+    // When running in a test site, change the root path to be the testing site
+    // directory. This ensures that it will always be writable by the webserver
+    // (thereby allowing the actual extraction and installation of projects by
+    // the Update Manager to be tested) and also ensures that new project files
+    // added there won't be visible to the parent site and will be properly
+    // cleaned up once the test finishes running. This is done here (rather
+    // than having the tests enable a module which overrides the update root
+    // factory service) to ensure that the parent site is automatically kept
+    // clean without relying on test authors to take any explicit steps. See
+    // also \Drupal\update\Tests\UpdateTestBase::setUp().
+    if (DRUPAL_TEST_IN_CHILD_SITE) {
+      $kernel = $this->drupalKernel;
+      $request = $this->requestStack->getCurrentRequest();
+      $root_path .= '/' . $kernel::findSitePath($request);
+    }
+
+    return $root_path;
+  }
+
+}

web/core/modules/update/src/UpdateSettingsForm.php

@@ -0,0 +1,148 @@
+<?php
+
+namespace Drupal\update;
+
+use Drupal\Core\DependencyInjection\ContainerInjectionInterface;
+use Drupal\Core\Url;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+use Drupal\Core\Form\ConfigFormBase;
+use Drupal\Core\Form\FormStateInterface;
+
+/**
+ * Configure update settings for this site.
+ *
+ * @internal
+ */
+class UpdateSettingsForm extends ConfigFormBase implements ContainerInjectionInterface {
+
+  /**
+   * The email validator.
+   *
+   * @var \Drupal\Component\Utility\EmailValidatorInterface
+   */
+  protected $emailValidator;
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function create(ContainerInterface $container) {
+    $instance = parent::create($container);
+    $instance->emailValidator = $container->get('email.validator');
+    return $instance;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getFormId() {
+    return 'update_settings';
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function getEditableConfigNames() {
+    return ['update.settings'];
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function buildForm(array $form, FormStateInterface $form_state) {
+    $config = $this->config('update.settings');
+
+    $form['update_check_frequency'] = [
+      '#type' => 'radios',
+      '#title' => t('Check for updates'),
+      '#default_value' => $config->get('check.interval_days'),
+      '#options' => [
+        '1' => t('Daily'),
+        '7' => t('Weekly'),
+      ],
+      '#description' => t('Select how frequently you want to automatically check for new releases of your currently installed modules and themes.'),
+    ];
+
+    $form['update_check_disabled'] = [
+      '#type' => 'checkbox',
+      '#title' => t('Check for updates of uninstalled modules and themes'),
+      '#default_value' => $config->get('check.disabled_extensions'),
+    ];
+
+    $notification_emails = $config->get('notification.emails');
+    $form['update_notify_emails'] = [
+      '#type' => 'textarea',
+      '#title' => t('Email addresses to notify when updates are available'),
+      '#rows' => 4,
+      '#default_value' => implode("\n", $notification_emails),
+      '#description' => t('Whenever your site checks for available updates and finds new releases, it can notify a list of users via email. Put each address on a separate line. If blank, no emails will be sent.'),
+    ];
+
+    $form['update_notification_threshold'] = [
+      '#type' => 'radios',
+      '#title' => t('Email notification threshold'),
+      '#default_value' => $config->get('notification.threshold'),
+      '#options' => [
+        'all' => t('All newer versions'),
+        'security' => t('Only security updates'),
+      ],
+      '#description' => t('You can choose to send email only if a security update is available, or to be notified about all newer versions. If there are updates available of Drupal core or any of your installed modules and themes, your site will always print a message on the <a href=":status_report">status report</a> page, and will also display an error message on administration pages if there is a security update.', [':status_report' => Url::fromRoute('system.status')->toString()]),
+    ];
+
+    return parent::buildForm($form, $form_state);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function validateForm(array &$form, FormStateInterface $form_state) {
+    $form_state->set('notify_emails', []);
+    if (!$form_state->isValueEmpty('update_notify_emails')) {
+      $valid = [];
+      $invalid = [];
+      foreach (explode("\n", trim($form_state->getValue('update_notify_emails'))) as $email) {
+        $email = trim($email);
+        if (!empty($email)) {
+          if ($this->emailValidator->isValid($email)) {
+            $valid[] = $email;
+          }
+          else {
+            $invalid[] = $email;
+          }
+        }
+      }
+      if (empty($invalid)) {
+        $form_state->set('notify_emails', $valid);
+      }
+      elseif (count($invalid) == 1) {
+        $form_state->setErrorByName('update_notify_emails', $this->t('%email is not a valid email address.', ['%email' => reset($invalid)]));
+      }
+      else {
+        $form_state->setErrorByName('update_notify_emails', $this->t('%emails are not valid email addresses.', ['%emails' => implode(', ', $invalid)]));
+      }
+    }
+
+    parent::validateForm($form, $form_state);
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function submitForm(array &$form, FormStateInterface $form_state) {
+    $config = $this->config('update.settings');
+    // See if the update_check_disabled setting is being changed, and if so,
+    // invalidate all update status data.
+    if ($form_state->getValue('update_check_disabled') != $config->get('check.disabled_extensions')) {
+      update_storage_clear();
+    }
+
+    $config
+      ->set('check.disabled_extensions', $form_state->getValue('update_check_disabled'))
+      ->set('check.interval_days', $form_state->getValue('update_check_frequency'))
+      ->set('notification.emails', $form_state->get('notify_emails'))
+      ->set('notification.threshold', $form_state->getValue('update_notification_threshold'))
+      ->save();
+
+    parent::submitForm($form, $form_state);
+  }
+
+}

web/core/modules/update/templates/update-last-check.html.twig

@@ -0,0 +1,23 @@
+{#
+/**
+ * @file
+ * Default theme implementation for the last time update data was checked.
+ *
+ * Available variables:
+ * - last: The timestamp that the site was last checked for updates.
+ * - time: The formatted time since the site last checked for updates.
+ * - link: A link to check for updates manually.
+ *
+ * @see template_preprocess_update_last_check()
+ *
+ * @ingroup themeable
+ */
+#}
+<p>
+  {% if last %}
+    {{ 'Last checked: @time ago'|t({'@time': time}) }}
+  {% else %}
+    {{ 'Last checked: never'|t }}
+  {% endif %}
+  ({{ link }})
+</p>

web/core/modules/update/templates/update-project-status.html.twig

@@ -0,0 +1,106 @@
+{#
+/**
+ * @file
+ * Default theme implementation for the project status report.
+ *
+ * Available variables:
+ * - title: The project title.
+ * - url: The project url.
+ * - status: The project status.
+ *   - label: The project status label.
+ *   - attributes: HTML attributes for the project status.
+ *   - reason: The reason you should update the project.
+ *   - icon: The project status version indicator icon.
+ * - existing_version: The version of the installed project.
+ * - versions: The available versions of the project.
+ * - install_type: The type of project (e.g., dev).
+ * - datestamp: The date/time of a project version's release.
+ * - extras: HTML attributes and additional information about the project.
+ *   - attributes: HTML attributes for the extra item.
+ *   - label: The label for an extra item.
+ *   - data: The data about an extra item.
+ * - includes: The projects within the project.
+ * - disabled: The currently disabled projects in the project.
+ *
+ * @see template_preprocess_update_project_status()
+ *
+ * @ingroup themeable
+ */
+#}
+{%
+  set status_classes = [
+    project.status == constant('Drupal\\update\\UpdateManagerInterface::NOT_SECURE') ? 'project-update__status--security-error',
+    project.status == constant('Drupal\\update\\UpdateManagerInterface::REVOKED') ? 'project-update__status--revoked',
+    project.status == constant('Drupal\\update\\UpdateManagerInterface::NOT_SUPPORTED') ? 'project-update__status--not-supported',
+    project.status == constant('Drupal\\update\\UpdateManagerInterface::NOT_CURRENT') ? 'project-update__status--not-current',
+    project.status == constant('Drupal\\update\\UpdateManagerInterface::CURRENT') ? 'project-update__status--current',
+  ]
+%}
+<div{{ status.attributes.addClass('project-update__status', status_classes) }}>
+  {%- if status.label -%}
+    <span>{{ status.label }}</span>
+  {%- else -%}
+    {{ status.reason }}
+  {%- endif %}
+  <span class="project-update__status-icon">
+    {{ status.icon }}
+  </span>
+</div>
+
+<div class="project-update__title">
+  {%- if url -%}
+    <a href="{{ url }}">{{ title }}</a>
+  {%- else -%}
+    {{ title }}
+  {%- endif %}
+  {{ existing_version }}
+  {% if install_type == 'dev' and datestamp %}
+    <span class="project-update__version-date">({{ datestamp }})</span>
+  {% endif %}
+</div>
+
+{% if versions %}
+  {% for version in versions %}
+    {{ version }}
+  {% endfor %}
+{% endif %}
+
+{%
+  set extra_classes = [
+    project.status == constant('Drupal\\update\\UpdateManagerInterface::NOT_SECURE') ? 'project-not-secure',
+    project.status == constant('Drupal\\update\\UpdateManagerInterface::REVOKED') ? 'project-revoked',
+    project.status == constant('Drupal\\update\\UpdateManagerInterface::NOT_SUPPORTED') ? 'project-not-supported',
+  ]
+%}
+<div class="project-updates__details">
+  {% if extras %}
+    <div class="extra">
+      {% for extra in extras %}
+        <div{{ extra.attributes.addClass(extra_classes) }}>
+          {{ extra.label }}: {{ extra.data }}
+        </div>
+      {% endfor %}
+    </div>
+  {% endif %}
+  {% set includes = includes|join(', ') %}
+  {% if disabled %}
+    {{ 'Includes:'|t }}
+    <ul>
+      <li>
+        {% trans %}
+          Enabled: {{ includes|placeholder }}
+        {% endtrans %}
+      </li>
+      <li>
+        {% set disabled = disabled|join(', ') %}
+        {% trans %}
+          Disabled: {{ disabled|placeholder }}
+        {% endtrans %}
+      </li>
+    </ul>
+  {% else %}
+    {% trans %}
+      Includes: {{ includes|placeholder }}
+    {% endtrans %}
+  {% endif %}
+</div>

web/core/modules/update/templates/update-report.html.twig

@@ -0,0 +1,25 @@
+{#
+/**
+ * @file
+ * Default theme implementation for the project status report.
+ *
+ * Available variables:
+ * - last_checked: Themed last time update data was checked.
+ * - no_updates_message: Message when there are no project updates.
+ * - project_types: A list of project types.
+ *   - label: The project type label.
+ *   - table: The project status table.
+ *
+ * @see template_preprocess_update_report()
+ *
+ * @ingroup themeable
+ */
+#}
+{{ last_checked }}
+
+{% for project_type in project_types %}
+  <h3>{{ project_type.label }}</h3>
+  {{ project_type.table }}
+{% else %}
+  <p>{{ no_updates_message }}</p>
+{% endfor %}

web/core/modules/update/templates/update-version.html.twig

@@ -0,0 +1,53 @@
+{#
+/**
+ * @file
+ * Default theme implementation for the version display of a project.
+ *
+ * Available variables:
+ * - attributes: HTML attributes suitable for a container element.
+ * - title: The title of the project.
+ * - core_compatibility_details: Render array of core compatibility details.
+ * - version:  A list of data about the latest released version, containing:
+ *   - version: The version number.
+ *   - date: The date of the release.
+ *   - download_link: The URL for the downloadable file.
+ *   - release_link: The URL for the release notes.
+ *   - core_compatible: A flag indicating whether the project is compatible
+ *     with the currently installed version of Drupal core. This flag is not
+ *     set for the Drupal core project itself.
+ *   - core_compatibility_message: A message indicating the versions of Drupal
+ *     core with which this project is compatible. This message is also
+ *     contained within the 'core_compatibility_details' variable documented
+ *     above. This message is not set for the Drupal core project itself.
+ *
+ * @see template_preprocess_update_version()
+ *
+ * @ingroup themeable
+ */
+#}
+<div class="{{ attributes.class }} project-update__version"{{ attributes|without('class') }}>
+  <div class="clearfix">
+    <div class="project-update__version-title layout-column layout-column--quarter">{{ title }}</div>
+    <div class="project-update__version-details layout-column layout-column--quarter">
+      <a href="{{ version.release_link }}">{{ version.version }}</a>
+      <span class="project-update__version-date">({{ version.date|date('Y-M-d') }})</span>
+    </div>
+    <div class="layout-column layout-column--half">
+      <ul class="project-update__version-links">
+        {% if version.core_compatible is not defined or version.core_compatible %}
+          <li class="project-update__download-link">
+            <a href="{{ version.download_link }}">{{ 'Download'|t }}</a>
+          </li>
+        {% endif %}
+        <li class="project-update__release-notes-link">
+          <a href="{{ version.release_link }}">{{ 'Release notes'|t }}</a>
+        </li>
+        {% if core_compatibility_details %}
+          <li class="project-update__compatibility-details">
+            {{ core_compatibility_details }}
+          </li>
+        {% endif %}
+      </ul>
+    </div>
+  </div>
+</div>

web/core/modules/update/tests/fixtures/release-history/aaa_update_test.1_0-supported.xml

@@ -0,0 +1,80 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>AAA Update test</title>
+<short_name>aaa_update_test</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.x-1.,8.x-2.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/aaa_update_test</link>
+  <terms>
+   <term><name>Projects</name><value>Modules</value></term>
+  </terms>
+<releases>
+  <release>
+    <name>aaa_update_test 8.x-2.0</name>
+    <version>8.x-2.0</version>
+    <tag>8.x-2.0</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-2-0-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-2.0.tar.gz</download_link>
+    <date>1250422521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-2.0-beta1</name>
+    <version>8.x-2.0-beta1</version>
+    <tag>8.x-2.0-beta1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-2-0-beta1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-2.0-beta1.tar.gz</download_link>
+    <date>1250422521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-2.0-alpha1</name>
+    <version>8.x-2.0-alpha1</version>
+    <tag>8.x-2.0-alpha1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-2-0-alpha1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-2.0-alpha1.tar.gz</download_link>
+    <date>1250422521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.1</name>
+    <version>8.x-1.1</version>
+    <tag>8.x-1.1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.1.tar.gz</download_link>
+    <date>1250404525</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+      <term><name>Release type</name><value>Unsupported</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.0</name>
+    <version>8.x-1.0</version>
+    <tag>8.x-1.0</tag>
+    <status>unpublished</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-0-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.0.tar.gz</download_link>
+    <date>1250404521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+</releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/aaa_update_test.1_0-unsupported.xml

@@ -0,0 +1,86 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+This XML file is the exact same as the file aaa_update_test.1_0-supported.xml
+except 'supported_branches' in this file does not contain the '8.x-1.' branch.
+Therefore, all the releases that start with '8.x-1.' are in an unsupported
+branch.
+-->
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>AAA Update test</title>
+<short_name>aaa_update_test</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.x-2.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/aaa_update_test</link>
+  <terms>
+   <term><name>Projects</name><value>Modules</value></term>
+  </terms>
+<releases>
+  <release>
+    <name>aaa_update_test 8.x-2.0</name>
+    <version>8.x-2.0</version>
+    <tag>8.x-2.0</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-2-0-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-2.0.tar.gz</download_link>
+    <date>1250422521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-2.0-beta1</name>
+    <version>8.x-2.0-beta1</version>
+    <tag>8.x-2.0-beta1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-2-0-beta1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-2.0-beta1.tar.gz</download_link>
+    <date>1250422521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-2.0-alpha1</name>
+    <version>8.x-2.0-alpha1</version>
+    <tag>8.x-2.0-alpha1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-2-0-alpha1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-2.0-alpha1.tar.gz</download_link>
+    <date>1250422521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.1</name>
+    <version>8.x-1.1</version>
+    <tag>8.x-1.1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.1.tar.gz</download_link>
+    <date>1250404525</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+      <term><name>Release type</name><value>Unsupported</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.0</name>
+    <version>8.x-1.0</version>
+    <tag>8.x-1.0</tag>
+    <status>unpublished</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-0-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.0.tar.gz</download_link>
+    <date>1250404521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+</releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/aaa_update_test.1_0.xml

@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>AAA Update test</title>
+<short_name>aaa_update_test</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.x-1.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/aaa_update_test</link>
+  <terms>
+   <term><name>Projects</name><value>Modules</value></term>
+  </terms>
+<releases>
+  <release>
+    <!-- This release is not in a supported branch; therefore it should not be recommended. -->
+    <name>aaa_update_test 8.x-3.0</name>
+    <version>8.x-3.0</version>
+    <tag>DRUPAL-8--3-0</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-3-0-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-3.0.tar.gz</download_link>
+    <date>1250426521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+ <release>
+  <name>aaa_update_test 8.x-1.0</name>
+  <version>8.x-1.0</version>
+  <tag>DRUPAL-8--1-0</tag>
+  <status>published</status>
+  <release_link>http://example.com/aaa_update_test-8-x-1-0-release</release_link>
+  <download_link>http://example.com/aaa_update_test-8.x-1.0.tar.gz</download_link>
+  <date>1250424521</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+  </terms>
+ </release>
+</releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/aaa_update_test.1_1-alpha1.xml

@@ -0,0 +1,54 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+  <title>AAA Update test</title>
+  <short_name>aaa_update_test</short_name>
+  <dc:creator>Drupal</dc:creator>
+  <supported_branches>8.x-1.</supported_branches>
+  <project_status>published</project_status>
+  <link>http://example.com/project/aaa_update_test</link>
+  <terms>
+    <term><name>Projects</name><value>Modules</value></term>
+  </terms>
+  <releases>
+    <release>
+      <!-- This release is not in a supported branch; therefore it should not be recommended. -->
+      <name>aaa_update_test 8.x-3.0</name>
+      <version>8.x-3.0</version>
+      <tag>DRUPAL-8--3-0</tag>
+      <status>published</status>
+      <release_link>http://example.com/aaa_update_test-8-x-3-0-release</release_link>
+      <download_link>http://example.com/aaa_update_test-8.x-3.0.tar.gz</download_link>
+      <date>1250426521</date>
+      <terms>
+        <term><name>Release type</name><value>New features</value></term>
+        <term><name>Release type</name><value>Bug fixes</value></term>
+      </terms>
+    </release>
+    <release>
+      <name>aaa_update_test 8.x-1.1-alpha1</name>
+      <version>8.x-1.1-alpha1</version>
+      <tag>DRUPAL-8--1-1-alpha1</tag>
+      <status>published</status>
+      <release_link>http://example.com/aaa_update_test-8-x-1-1-alpha1-release</release_link>
+      <download_link>http://example.com/aaa_update_test-8.x-1.1-alpha1.tar.gz</download_link>
+      <date>1250414521</date>
+      <terms>
+        <term><name>Release type</name><value>New features</value></term>
+        <term><name>Release type</name><value>Bug fixes</value></term>
+      </terms>
+    </release>
+    <release>
+      <name>aaa_update_test 8.x-1.0</name>
+      <version>8.x-1.0</version>
+      <tag>DRUPAL-8--1-0</tag>
+      <status>published</status>
+      <release_link>http://example.com/aaa_update_test-8-x-1-0-release</release_link>
+      <download_link>http://example.com/aaa_update_test-8.x-1.0.tar.gz</download_link>
+      <date>1073781824</date>
+      <terms>
+        <term><name>Release type</name><value>New features</value></term>
+        <term><name>Release type</name><value>Bug fixes</value></term>
+      </terms>
+    </release>
+  </releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/aaa_update_test.1_1-beta1.xml

@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>AAA Update test</title>
+<short_name>aaa_update_test</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.x-1.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/aaa_update_test</link>
+  <terms>
+   <term><name>Projects</name><value>Modules</value></term>
+  </terms>
+<releases>
+  <release>
+    <!-- This release is not in a supported branch; therefore it should not be recommended. -->
+    <name>aaa_update_test 8.x-3.0</name>
+    <version>8.x-3.0</version>
+    <tag>DRUPAL-8--3-0</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-3-0-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-3.0.tar.gz</download_link>
+    <date>1250426521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.1-beta1</name>
+    <version>8.x-1.1-beta1</version>
+    <tag>DRUPAL-8--1-1-beta1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-1-beta1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.1-beta1.tar.gz</download_link>
+    <date>1250414521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.1-alpha1</name>
+    <version>8.x-1.1-alpha1</version>
+    <tag>DRUPAL-8--1-1-alpha1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-1-alpha1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.1-alpha1.tar.gz</download_link>
+    <date>1250414521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.0</name>
+    <version>8.x-1.0</version>
+    <tag>DRUPAL-8--1-0</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-0-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.0.tar.gz</download_link>
+    <date>1073781824</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+</releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/aaa_update_test.1_1.xml

@@ -0,0 +1,80 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>AAA Update test</title>
+<short_name>aaa_update_test</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.x-1.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/aaa_update_test</link>
+  <terms>
+   <term><name>Projects</name><value>Modules</value></term>
+  </terms>
+<releases>
+  <release>
+    <!-- This release is not in a supported branch; therefore it should not be recommended. -->
+    <name>aaa_update_test 8.x-3.0</name>
+    <version>8.x-3.0</version>
+    <tag>DRUPAL-8--3-0</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-3-0-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-3.0.tar.gz</download_link>
+    <date>1250426521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.1</name>
+    <version>8.x-1.1</version>
+    <tag>DRUPAL-8--1-1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.1.tar.gz</download_link>
+    <date>1250424521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.1-beta1</name>
+    <version>8.x-1.1-beta1</version>
+    <tag>DRUPAL-8--1-1-beta1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-1-beta1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.1-beta1.tar.gz</download_link>
+    <date>1250414521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.1-alpha1</name>
+    <version>8.x-1.1-alpha1</version>
+    <tag>DRUPAL-8--1-1-alpha1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-1-alpha1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.1-alpha1.tar.gz</download_link>
+    <date>1250414521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.0</name>
+    <version>8.x-1.0</version>
+    <tag>DRUPAL-8--1-0</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-0-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.0.tar.gz</download_link>
+    <date>1250404521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+</releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/aaa_update_test.1_2-alpha1.xml

@@ -0,0 +1,93 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>AAA Update test</title>
+<short_name>aaa_update_test</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.x-1.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/aaa_update_test</link>
+  <terms>
+   <term><name>Projects</name><value>Modules</value></term>
+  </terms>
+<releases>
+  <release>
+    <!-- This release is not in a supported branch; therefore it should not be recommended. -->
+    <name>aaa_update_test 8.x-3.0</name>
+    <version>8.x-3.0</version>
+    <tag>DRUPAL-8--3-0</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-3-0-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-3.0.tar.gz</download_link>
+    <date>1250426521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.2-alpha1</name>
+    <version>8.x-1.2-alpha1</version>
+    <tag>DRUPAL-8--1-1-alpha1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-2-alpha1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.2-alpha1.tar.gz</download_link>
+    <date>1250413521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.1</name>
+    <version>8.x-1.1</version>
+    <tag>DRUPAL-8--1-1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.1.tar.gz</download_link>
+    <date>1250424521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.1-beta1</name>
+    <version>8.x-1.1-beta1</version>
+    <tag>DRUPAL-8--1-1-beta1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-1-beta1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.1-beta1.tar.gz</download_link>
+    <date>1250414521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.1-alpha1</name>
+    <version>8.x-1.1-alpha1</version>
+    <tag>DRUPAL-8--1-1-alpha1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-1-alpha1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.1-alpha1.tar.gz</download_link>
+    <date>1250414521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.0</name>
+    <version>8.x-1.0</version>
+    <tag>DRUPAL-8--1-0</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-0-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.0.tar.gz</download_link>
+    <date>1250404521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+</releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/aaa_update_test.1_2-beta1.xml

@@ -0,0 +1,106 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>AAA Update test</title>
+<short_name>aaa_update_test</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.x-1.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/aaa_update_test</link>
+  <terms>
+   <term><name>Projects</name><value>Modules</value></term>
+  </terms>
+<releases>
+  <release>
+    <!-- This release is not in a supported branch; therefore it should not be recommended. -->
+    <name>aaa_update_test 8.x-3.0</name>
+    <version>8.x-3.0</version>
+    <tag>DRUPAL-8--3-0</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-3-0-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-3.0.tar.gz</download_link>
+    <date>1250426521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.2-beta1</name>
+    <version>8.x-1.2-beta1</version>
+    <tag>DRUPAL-8--1-1-beta1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-2-beta1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.2-beta1.tar.gz</download_link>
+    <date>1250412521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.2-alpha1</name>
+    <version>8.x-1.2-alpha1</version>
+    <tag>DRUPAL-8--1-1-alpha1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-2-alpha1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.2-alpha1.tar.gz</download_link>
+    <date>1250413521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.1</name>
+    <version>8.x-1.1</version>
+    <tag>DRUPAL-8--1-1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.1.tar.gz</download_link>
+    <date>1250424521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.1-beta1</name>
+    <version>8.x-1.1-beta1</version>
+    <tag>DRUPAL-8--1-1-beta1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-1-beta1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.1-beta1.tar.gz</download_link>
+    <date>1250414521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.1-alpha1</name>
+    <version>8.x-1.1-alpha1</version>
+    <tag>DRUPAL-8--1-1-alpha1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-1-alpha1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.1-alpha1.tar.gz</download_link>
+    <date>1250414521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.0</name>
+    <version>8.x-1.0</version>
+    <tag>DRUPAL-8--1-0</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-0-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.0.tar.gz</download_link>
+    <date>1250404521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+</releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/aaa_update_test.1_2.xml

@@ -0,0 +1,119 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>AAA Update test</title>
+<short_name>aaa_update_test</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.x-1.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/aaa_update_test</link>
+  <terms>
+   <term><name>Projects</name><value>Modules</value></term>
+  </terms>
+<releases>
+  <release>
+    <!-- This release is not in a supported branch; therefore it should not be recommended. -->
+    <name>aaa_update_test 8.x-3.0</name>
+    <version>8.x-3.0</version>
+    <tag>DRUPAL-8--3-0</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-3-0-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-3.0.tar.gz</download_link>
+    <date>1250426521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.2</name>
+    <version>8.x-1.2</version>
+    <tag>DRUPAL-8--1-1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-2-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.2.tar.gz</download_link>
+    <date>1250421521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.2-beta1</name>
+    <version>8.x-1.2-beta1</version>
+    <tag>DRUPAL-8--1-1-beta1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-2-beta1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.2-beta1.tar.gz</download_link>
+    <date>1250412521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.2-alpha1</name>
+    <version>8.x-1.2-alpha1</version>
+    <tag>DRUPAL-8--1-1-alpha1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-2-alpha1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.2-alpha1.tar.gz</download_link>
+    <date>1250413521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.1</name>
+    <version>8.x-1.1</version>
+    <tag>DRUPAL-8--1-1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.1.tar.gz</download_link>
+    <date>1250424521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.1-beta1</name>
+    <version>8.x-1.1-beta1</version>
+    <tag>DRUPAL-8--1-1-beta1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-1-beta1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.1-beta1.tar.gz</download_link>
+    <date>1250414521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.1-alpha1</name>
+    <version>8.x-1.1-alpha1</version>
+    <tag>DRUPAL-8--1-1-alpha1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-1-alpha1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.1-alpha1.tar.gz</download_link>
+    <date>1250414521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.0</name>
+    <version>8.x-1.0</version>
+    <tag>DRUPAL-8--1-0</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-0-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.0.tar.gz</download_link>
+    <date>1250404521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+</releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/aaa_update_test.2_0-alpha1.xml

@@ -0,0 +1,132 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>AAA Update test</title>
+<short_name>aaa_update_test</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.x-1.,8.x-2.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/aaa_update_test</link>
+  <terms>
+   <term><name>Projects</name><value>Modules</value></term>
+  </terms>
+<releases>
+  <release>
+    <!-- This release is not in a supported branch; therefore it should not be recommended. -->
+    <name>aaa_update_test 8.x-3.0</name>
+    <version>8.x-3.0</version>
+    <tag>DRUPAL-8--3-0</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-3-0-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-3.0.tar.gz</download_link>
+    <date>1250426521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-2.0-alpha1</name>
+    <version>8.x-2.0-alpha1</version>
+    <tag>DRUPAL-8--2-0</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-2-0-alpha1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-2.0-alpha1.tar.gz</download_link>
+    <date>1250422521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.2</name>
+    <version>8.x-1.2</version>
+    <tag>DRUPAL-8--1-1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-2-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.2.tar.gz</download_link>
+    <date>1250421521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.2-beta1</name>
+    <version>8.x-1.2-beta1</version>
+    <tag>DRUPAL-8--1-1-beta1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-2-beta1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.2-beta1.tar.gz</download_link>
+    <date>1250412521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.2-alpha1</name>
+    <version>8.x-1.2-alpha1</version>
+    <tag>DRUPAL-8--1-1-alpha1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-2-alpha1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.2-alpha1.tar.gz</download_link>
+    <date>1250413521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.1</name>
+    <version>8.x-1.1</version>
+    <tag>DRUPAL-8--1-1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.1.tar.gz</download_link>
+    <date>1250424521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.1-beta1</name>
+    <version>8.x-1.1-beta1</version>
+    <tag>DRUPAL-8--1-1-beta1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-1-beta1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.1-beta1.tar.gz</download_link>
+    <date>1250414521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.1-alpha1</name>
+    <version>8.x-1.1-alpha1</version>
+    <tag>DRUPAL-8--1-1-alpha1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-1-alpha1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.1-alpha1.tar.gz</download_link>
+    <date>1250414521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.0</name>
+    <version>8.x-1.0</version>
+    <tag>DRUPAL-8--1-0</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-0-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.0.tar.gz</download_link>
+    <date>1250404521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+</releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/aaa_update_test.2_0-beta1.xml

@@ -0,0 +1,145 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>AAA Update test</title>
+<short_name>aaa_update_test</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.x-1.,8.x-2.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/aaa_update_test</link>
+  <terms>
+   <term><name>Projects</name><value>Modules</value></term>
+  </terms>
+<releases>
+  <release>
+    <!-- This release is not in a supported branch; therefore it should not be recommended. -->
+    <name>aaa_update_test 8.x-3.0</name>
+    <version>8.x-3.0</version>
+    <tag>DRUPAL-8--3-0</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-3-0-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-3.0.tar.gz</download_link>
+    <date>1250426521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-2.0-beta1</name>
+    <version>8.x-2.0-beta1</version>
+    <tag>DRUPAL-8--2-0</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-2-0-beta1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-2.0-beta1.tar.gz</download_link>
+    <date>1250442521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-2.0-alpha1</name>
+    <version>8.x-2.0-alpha1</version>
+    <tag>DRUPAL-8--2-0</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-2-0-alpha1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-2.0-alpha1.tar.gz</download_link>
+    <date>1250422521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.2</name>
+    <version>8.x-1.2</version>
+    <tag>DRUPAL-8--1-1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-2-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.2.tar.gz</download_link>
+    <date>1250421521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.2-beta1</name>
+    <version>8.x-1.2-beta1</version>
+    <tag>DRUPAL-8--1-1-beta1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-2-beta1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.2-beta1.tar.gz</download_link>
+    <date>1250412521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.2-alpha1</name>
+    <version>8.x-1.2-alpha1</version>
+    <tag>DRUPAL-8--1-1-alpha1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-2-alpha1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.2-alpha1.tar.gz</download_link>
+    <date>1250413521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.1</name>
+    <version>8.x-1.1</version>
+    <tag>DRUPAL-8--1-1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.1.tar.gz</download_link>
+    <date>1250424521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.1-beta1</name>
+    <version>8.x-1.1-beta1</version>
+    <tag>DRUPAL-8--1-1-beta1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-1-beta1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.1-beta1.tar.gz</download_link>
+    <date>1250414521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.1-alpha1</name>
+    <version>8.x-1.1-alpha1</version>
+    <tag>DRUPAL-8--1-1-alpha1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-1-alpha1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.1-alpha1.tar.gz</download_link>
+    <date>1250414521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.0</name>
+    <version>8.x-1.0</version>
+    <tag>DRUPAL-8--1-0</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-0-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.0.tar.gz</download_link>
+    <date>1250404521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+</releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/aaa_update_test.2_0.xml

@@ -0,0 +1,158 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>AAA Update test</title>
+<short_name>aaa_update_test</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.x-1.,8.x-2.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/aaa_update_test</link>
+  <terms>
+   <term><name>Projects</name><value>Modules</value></term>
+  </terms>
+<releases>
+  <release>
+    <!-- This release is not in a supported branch; therefore it should not be recommended. -->
+    <name>aaa_update_test 8.x-3.0</name>
+    <version>8.x-3.0</version>
+    <tag>DRUPAL-8--3-0</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-3-0-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-3.0.tar.gz</download_link>
+    <date>1250426521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-2.0</name>
+    <version>8.x-2.0</version>
+    <tag>DRUPAL-8--2-0</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-2-0-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-2.0.tar.gz</download_link>
+    <date>1250422521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-2.0-beta1</name>
+    <version>8.x-2.0-beta1</version>
+    <tag>DRUPAL-8--2-0</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-2-0-beta1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-2.0-beta1.tar.gz</download_link>
+    <date>1250422521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-2.0-alpha1</name>
+    <version>8.x-2.0-alpha1</version>
+    <tag>DRUPAL-8--2-0</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-2-0-alpha1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-2.0-alpha1.tar.gz</download_link>
+    <date>1250422521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.2</name>
+    <version>8.x-1.2</version>
+    <tag>DRUPAL-8--1-1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-2-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.2.tar.gz</download_link>
+    <date>1250421521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.2-beta1</name>
+    <version>8.x-1.2-beta1</version>
+    <tag>DRUPAL-8--1-1-beta1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-2-beta1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.2-beta1.tar.gz</download_link>
+    <date>1250412521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.2-alpha1</name>
+    <version>8.x-1.2-alpha1</version>
+    <tag>DRUPAL-8--1-1-alpha1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-2-alpha1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.2-alpha1.tar.gz</download_link>
+    <date>1250413521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.1</name>
+    <version>8.x-1.1</version>
+    <tag>DRUPAL-8--1-1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.1.tar.gz</download_link>
+    <date>1250424521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.1-beta1</name>
+    <version>8.x-1.1-beta1</version>
+    <tag>DRUPAL-8--1-1-beta1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-1-beta1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.1-beta1.tar.gz</download_link>
+    <date>1250414521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.1-alpha1</name>
+    <version>8.x-1.1-alpha1</version>
+    <tag>DRUPAL-8--1-1-alpha1</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-1-alpha1-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.1-alpha1.tar.gz</download_link>
+    <date>1250414521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+  <release>
+    <name>aaa_update_test 8.x-1.0</name>
+    <version>8.x-1.0</version>
+    <tag>DRUPAL-8--1-0</tag>
+    <status>published</status>
+    <release_link>http://example.com/aaa_update_test-8-x-1-0-release</release_link>
+    <download_link>http://example.com/aaa_update_test-8.x-1.0.tar.gz</download_link>
+    <date>1250404521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+</releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/aaa_update_test.8.x-1.2.xml

@@ -0,0 +1,86 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+ <title>AAA Update test</title>
+ <short_name>aaa_update_test</short_name>
+ <dc:creator>Drupal</dc:creator>
+ <api_version>8.x</api_version>
+ <supported_branches>8.x-1.</supported_branches>
+ <project_status>published</project_status>
+ <link>http://example.com/project/aaa_update_test</link>
+ <terms>
+  <term><name>Projects</name><value>Modules</value></term>
+ </terms>
+ <releases>
+   <release>
+     <name>aaa_update_test 8.x-1.3-beta1</name>
+     <version>8.x-1.3-beta1</version>
+     <tag>DRUPAL-8--1-3-beta1</tag>
+     <core_compatibility>8.0.0 || 8.1.1</core_compatibility>
+     <version_major>1</version_major>
+     <version_patch>3</version_patch>
+     <version_extra>beta1</version_extra>
+     <status>published</status>
+     <release_link>http://example.com/aaa_update_test-8-x-1-3-beta1-release</release_link>
+     <download_link>http://example.com/aaa_update_test-8-x-1-3-beta1.tar.gz</download_link>
+     <date>1250624521</date>
+     <mdhash>b966255555d9c9b86d480ca08cfaa98e</mdhash>
+     <filesize>1073751924</filesize>
+     <terms>
+       <term><name>Release type</name><value>New features</value></term>
+       <term><name>Release type</name><value>Bug fixes</value></term>
+     </terms>
+  </release>
+  <release>
+   <name>aaa_update_test 8.x-1.2</name>
+   <version>8.x-1.2</version>
+   <tag>DRUPAL-8--1-2</tag>
+    <core_compatibility>^8</core_compatibility>
+   <version_major>1</version_major>
+   <version_patch>2</version_patch>
+   <status>published</status>
+   <release_link>http://example.com/aaa_update_test-8-x-1-2-release</release_link>
+   <download_link>http://example.com/aaa_update_test-8-x-1-2.tar.gz</download_link>
+   <date>1250424521</date>
+   <mdhash>b966255555d9c9b86d480ca08cfaa98e</mdhash>
+   <filesize>1073741824</filesize>
+   <terms>
+    <term><name>Release type</name><value>New features</value></term>
+    <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+  </release>
+  <release>
+   <name>aaa_update_test 8.x-1.1</name>
+   <version>8.x-1.1</version>
+   <tag>DRUPAL-8--1-1</tag>
+   <version_major>1</version_major>
+   <version_patch>1</version_patch>
+   <status>published</status>
+   <release_link>http://example.com/aaa_update_test-8-x-1-1-release</release_link>
+   <download_link>http://example.com/aaa_update_test-8-x-1-1.tar.gz</download_link>
+   <date>1250424521</date>
+   <mdhash>b966255555d9c9b86d480ca08cfaa98e</mdhash>
+   <filesize>1073741824</filesize>
+   <terms>
+    <term><name>Release type</name><value>New features</value></term>
+    <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+  </release>
+  <release>
+   <name>aaa_update_test 8.x-1.0</name>
+   <version>8.x-1.0</version>
+   <tag>DRUPAL-8--1-0</tag>
+   <version_major>1</version_major>
+   <version_patch>0</version_patch>
+   <status>published</status>
+   <release_link>http://example.com/aaa_update_test-8-x-1-0-release</release_link>
+   <download_link>http://example.com/aaa_update_test-8-x-1-0.tar.gz</download_link>
+   <date>1250424521</date>
+   <mdhash>b966255555d9c9b86d480ca08cfaa98e</mdhash>
+   <filesize>1073741824</filesize>
+   <terms>
+    <term><name>Release type</name><value>New features</value></term>
+    <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+  </release>
+ </releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/aaa_update_test.core_compatibility.8.x-1.2_8.x-2.2.xml

@@ -0,0 +1,58 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+ <title>AAA Update test</title>
+ <short_name>aaa_update_test</short_name>
+ <dc:creator>Drupal</dc:creator>
+ <supported_branches>8.x-1.,8.x-2.</supported_branches>
+ <project_status>published</project_status>
+ <link>http://example.com/project/aaa_update_test</link>
+ <terms>
+  <term><name>Projects</name><value>Modules</value></term>
+ </terms>
+ <releases>
+  <release>
+   <name>aaa_update_test 8.x-2.2</name>
+   <version>8.x-2.2</version>
+   <tag>8.x-2.2</tag>
+   <core_compatibility>^8.1.1</core_compatibility>
+   <status>published</status>
+   <release_link>http://example.com/aaa_update_test-8-x-2-2-release</release_link>
+   <download_link>http://example.com/aaa_update_test-8-x-2-2.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+    <term><name>Release type</name><value>New features</value></term>
+    <term><name>Release type</name><value>Bug fixes</value></term>
+    <term><name>Release type</name><value>Security update</value></term>
+   </terms>
+  </release>
+  <release>
+   <name>aaa_update_test 8.x-1.2</name>
+   <version>8.x-1.2</version>
+   <tag>8.x-2.2</tag>
+   <core_compatibility>^8.1.0</core_compatibility>
+   <status>published</status>
+   <release_link>http://example.com/aaa_update_test-8-x-1-2-release</release_link>
+   <download_link>http://example.com/aaa_update_test-8-x-1-2.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+    <term><name>Release type</name><value>New features</value></term>
+    <term><name>Release type</name><value>Bug fixes</value></term>
+    <term><name>Release type</name><value>Security update</value></term>
+   </terms>
+  </release>
+  <release>
+   <name>aaa_update_test 8.x-1.0</name>
+   <version>8.x-1.0</version>
+   <tag>8.x-2.2</tag>
+   <status>published</status>
+   <release_link>http://example.com/aaa_update_test-8-x-1-0-release</release_link>
+   <download_link>http://example.com/aaa_update_test-8-x-1-0.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+    <term><name>Release type</name><value>New features</value></term>
+    <term><name>Release type</name><value>Bug fixes</value></term>
+    <term><name>Release type</name><value>Insecure</value></term>
+   </terms>
+  </release>
+ </releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/aaa_update_test.no-releases.xml

@@ -0,0 +1,2 @@
+<?xml version="1.0" encoding="utf-8"?>
+<error>No release history was found for the requested project (aaa_update_test).</error>

web/core/modules/update/tests/fixtures/release-history/aaa_update_test.sec.8.x-1.1_8.x-1.2.xml

@@ -0,0 +1,57 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+ <title>AAA Update test</title>
+ <short_name>aaa_update_test</short_name>
+ <dc:creator>Drupal</dc:creator>
+ <supported_branches>8.x-1.</supported_branches>
+ <project_status>published</project_status>
+ <link>http://example.com/project/aaa_update_test</link>
+ <terms>
+  <term><name>Projects</name><value>Modules</value></term>
+ </terms>
+ <releases>
+  <release>
+   <name>aaa_update_test 8.x-1.2</name>
+   <version>8.x-1.2</version>
+   <tag>DRUPAL-8--1-2</tag>
+   <status>published</status>
+   <release_link>http://example.com/aaa_update_test-8-x-1-2-release</release_link>
+   <download_link>http://example.com/aaa_update_test-8-x-1-2.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+    <term><name>Release type</name><value>New features</value></term>
+    <term><name>Release type</name><value>Bug fixes</value></term>
+    <term><name>Release type</name><value>Security update</value></term>
+   </terms>
+  </release>
+  <release>
+   <name>aaa_update_test 8.x-1.1</name>
+   <version>8.x-1.1</version>
+   <tag>DRUPAL-8--1-1</tag>
+   <status>published</status>
+   <release_link>http://example.com/aaa_update_test-8-x-1-1-release</release_link>
+   <download_link>http://example.com/aaa_update_test-8-x-1-1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+    <term><name>Release type</name><value>New features</value></term>
+    <term><name>Release type</name><value>Bug fixes</value></term>
+    <term><name>Release type</name><value>Security update</value></term>
+    <term><name>Release type</name><value>Insecure</value></term>
+   </terms>
+  </release>
+  <release>
+   <name>aaa_update_test 8.x-1.0</name>
+   <version>8.x-1.0</version>
+   <tag>DRUPAL-8--1-0</tag>
+   <status>published</status>
+   <release_link>http://example.com/aaa_update_test-8-x-1-0-release</release_link>
+   <download_link>http://example.com/aaa_update_test-8-x-1-0.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+    <term><name>Release type</name><value>New features</value></term>
+    <term><name>Release type</name><value>Bug fixes</value></term>
+    <term><name>Release type</name><value>Insecure</value></term>
+   </terms>
+  </release>
+ </releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/aaa_update_test.sec.8.x-1.2.xml

@@ -0,0 +1,56 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+ <title>AAA Update test</title>
+ <short_name>aaa_update_test</short_name>
+ <dc:creator>Drupal</dc:creator>
+ <supported_branches>8.x-1.</supported_branches>
+ <project_status>published</project_status>
+ <link>http://example.com/project/aaa_update_test</link>
+ <terms>
+  <term><name>Projects</name><value>Modules</value></term>
+ </terms>
+ <releases>
+  <release>
+   <name>aaa_update_test 8.x-1.2</name>
+   <version>8.x-1.2</version>
+   <tag>DRUPAL-8--1-2</tag>
+   <status>published</status>
+   <release_link>http://example.com/aaa_update_test-8-x-1-2-release</release_link>
+   <download_link>http://example.com/aaa_update_test-8-x-1-2.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+    <term><name>Release type</name><value>New features</value></term>
+    <term><name>Release type</name><value>Bug fixes</value></term>
+    <term><name>Release type</name><value>Security update</value></term>
+   </terms>
+  </release>
+  <release>
+   <name>aaa_update_test 8.x-1.1</name>
+   <version>8.x-1.1</version>
+   <tag>DRUPAL-8--1-1</tag>
+   <status>published</status>
+   <release_link>http://example.com/aaa_update_test-8-x-1-1-release</release_link>
+   <download_link>http://example.com/aaa_update_test-8-x-1-1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+    <term><name>Release type</name><value>New features</value></term>
+    <term><name>Release type</name><value>Bug fixes</value></term>
+    <term><name>Release type</name><value>Insecure</value></term>
+   </terms>
+  </release>
+  <release>
+   <name>aaa_update_test 8.x-1.0</name>
+   <version>8.x-1.0</version>
+   <tag>DRUPAL-8--1-0</tag>
+   <status>published</status>
+   <release_link>http://example.com/aaa_update_test-8-x-1-0-release</release_link>
+   <download_link>http://example.com/aaa_update_test-8-x-1-0.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+    <term><name>Release type</name><value>New features</value></term>
+    <term><name>Release type</name><value>Bug fixes</value></term>
+    <term><name>Release type</name><value>Insecure</value></term>
+   </terms>
+  </release>
+ </releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/aaa_update_test.sec.8.x-1.2_8.x-2.2.xml

@@ -0,0 +1,132 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+ <title>AAA Update test</title>
+ <short_name>aaa_update_test</short_name>
+ <dc:creator>Drupal</dc:creator>
+ <supported_branches>8.x-1.,8.x-2.</supported_branches>
+ <project_status>published</project_status>
+ <link>http://example.com/project/aaa_update_test</link>
+ <terms>
+  <term><name>Projects</name><value>Modules</value></term>
+ </terms>
+ <releases>
+  <release>
+   <name>aaa_update_test 8.x-3.0-beta2</name>
+   <version>8.x-3.0-beta2</version>
+   <tag>8.x-3.0-beta2</tag>
+   <status>published</status>
+   <release_link>http://example.com/aaa_update_test-8-x-3-0-beta2-release</release_link>
+   <download_link>http://example.com/aaa_update_test-8-x-3-0-beta2.tar.gz</download_link>
+   <date>1533298080</date>
+   <terms>
+    <term><name>Release type</name><value>Bug fixes</value></term>
+    <term><name>Release type</name><value>New features</value></term>
+   </terms>
+   <security>
+    Beta releases are not covered by Drupal security advisories.
+   </security>
+  </release>
+  <release>
+   <name>aaa_update_test 8.x-3.0-beta1</name>
+   <version>8.x-3.0-beta1</version>
+   <tag>8.x-3.0-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/aaa_update_test-8-x-3-0-beta1</release_link>
+   <download_link>http://example.com/aaa_update_test--8-x-3-0-beta1.tar.gz</download_link>
+   <date>1533270485</date>
+   <terms>
+    <term><name>Release type</name><value>Insecure</value></term>
+    <term><name>Release type</name><value>Bug fixes</value></term>
+    <term><name>Release type</name><value>New features</value></term>
+   </terms>
+   <security>
+    Beta releases are not covered by Drupal security advisories.
+   </security>
+  </release>
+  <release>
+   <name>aaa_update_test 8.x-2.2</name>
+   <version>8.x-2.2</version>
+   <tag>DRUPAL-8--2-2</tag>
+   <status>published</status>
+   <release_link>http://example.com/aaa_update_test-8-x-2-2-release</release_link>
+   <download_link>http://example.com/aaa_update_test-8-x-2-2.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+    <term><name>Release type</name><value>New features</value></term>
+    <term><name>Release type</name><value>Bug fixes</value></term>
+    <term><name>Release type</name><value>Security update</value></term>
+   </terms>
+  </release>
+  <release>
+   <name>aaa_update_test 8.x-2.1</name>
+   <version>8.x-2.1</version>
+   <tag>DRUPAL-8--2-1</tag>
+   <status>published</status>
+   <release_link>http://example.com/aaa_update_test-8-x-2-1-release</release_link>
+   <download_link>http://example.com/aaa_update_test-8-x-2-1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+    <term><name>Release type</name><value>New features</value></term>
+    <term><name>Release type</name><value>Bug fixes</value></term>
+    <term><name>Release type</name><value>Security update</value></term>
+    <term><name>Release type</name><value>Insecure</value></term>
+   </terms>
+  </release>
+  <release>
+   <name>aaa_update_test 8.x-2.0</name>
+   <version>8.x-2.0</version>
+   <tag>DRUPAL-8--2-0</tag>
+   <status>published</status>
+   <release_link>http://example.com/aaa_update_test-8-x-2-0-release</release_link>
+   <download_link>http://example.com/aaa_update_test-8-x-2-0.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+    <term><name>Release type</name><value>New features</value></term>
+    <term><name>Release type</name><value>Bug fixes</value></term>
+    <term><name>Release type</name><value>Insecure</value></term>
+   </terms>
+  </release>
+  <release>
+   <name>aaa_update_test 8.x-1.2</name>
+   <version>8.x-1.2</version>
+   <tag>DRUPAL-8--1-2</tag>
+   <status>published</status>
+   <release_link>http://example.com/aaa_update_test-8-x-1-2-release</release_link>
+   <download_link>http://example.com/aaa_update_test-8-x-1-2.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+    <term><name>Release type</name><value>New features</value></term>
+    <term><name>Release type</name><value>Bug fixes</value></term>
+    <term><name>Release type</name><value>Security update</value></term>
+   </terms>
+  </release>
+  <release>
+   <name>aaa_update_test 8.x-1.1</name>
+   <version>8.x-1.1</version>
+   <tag>DRUPAL-8--1-1</tag>
+   <status>published</status>
+   <release_link>http://example.com/aaa_update_test-8-x-1-1-release</release_link>
+   <download_link>http://example.com/aaa_update_test-8-x-1-1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+    <term><name>Release type</name><value>New features</value></term>
+    <term><name>Release type</name><value>Bug fixes</value></term>
+    <term><name>Release type</name><value>Insecure</value></term>
+   </terms>
+  </release>
+  <release>
+   <name>aaa_update_test 8.x-1.0</name>
+   <version>8.x-1.0</version>
+   <tag>DRUPAL-8--1-0</tag>
+   <status>published</status>
+   <release_link>http://example.com/aaa_update_test-8-x-1-0-release</release_link>
+   <download_link>http://example.com/aaa_update_test-8-x-1-0.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+    <term><name>Release type</name><value>New features</value></term>
+    <term><name>Release type</name><value>Bug fixes</value></term>
+    <term><name>Release type</name><value>Insecure</value></term>
+   </terms>
+  </release>
+ </releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/aaa_update_test.sec.8.x-2.2_1.x_secure.xml

@@ -0,0 +1,96 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+ <title>AAA Update test</title>
+ <short_name>aaa_update_test</short_name>
+ <dc:creator>Drupal</dc:creator>
+ <supported_branches>8.x-1.,8.x-2.</supported_branches>
+ <project_status>published</project_status>
+ <link>http://example.com/project/aaa_update_test</link>
+ <terms>
+  <term><name>Projects</name><value>Modules</value></term>
+ </terms>
+ <releases>
+  <release>
+   <name>aaa_update_test 8.x-2.2</name>
+   <version>8.x-2.2</version>
+   <tag>DRUPAL-8--2-2</tag>
+   <status>published</status>
+   <release_link>http://example.com/aaa_update_test-8-x-2-2-release</release_link>
+   <download_link>http://example.com/aaa_update_test-8-x-2-2.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+    <term><name>Release type</name><value>New features</value></term>
+    <term><name>Release type</name><value>Bug fixes</value></term>
+    <term><name>Release type</name><value>Security update</value></term>
+   </terms>
+  </release>
+  <release>
+   <name>aaa_update_test 8.x-2.1</name>
+   <version>8.x-2.1</version>
+   <tag>DRUPAL-8--2-1</tag>
+   <status>published</status>
+   <release_link>http://example.com/aaa_update_test-8-x-2-1-release</release_link>
+   <download_link>http://example.com/aaa_update_test-8-x-2-1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+    <term><name>Release type</name><value>New features</value></term>
+    <term><name>Release type</name><value>Bug fixes</value></term>
+    <term><name>Release type</name><value>Security update</value></term>
+    <term><name>Release type</name><value>Insecure</value></term>
+   </terms>
+  </release>
+  <release>
+   <name>aaa_update_test 8.x-2.0</name>
+   <version>8.x-2.0</version>
+   <tag>DRUPAL-8--2-0</tag>
+   <status>published</status>
+   <release_link>http://example.com/aaa_update_test-8-x-2-0-release</release_link>
+   <download_link>http://example.com/aaa_update_test-8-x-2-0.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+    <term><name>Release type</name><value>New features</value></term>
+    <term><name>Release type</name><value>Bug fixes</value></term>
+    <term><name>Release type</name><value>Insecure</value></term>
+   </terms>
+  </release>
+  <release>
+   <name>aaa_update_test 8.x-1.2</name>
+   <version>8.x-1.2</version>
+   <tag>DRUPAL-8--1-2</tag>
+   <status>published</status>
+   <release_link>http://example.com/aaa_update_test-8-x-1-2-release</release_link>
+   <download_link>http://example.com/aaa_update_test-8-x-1-2.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+    <term><name>Release type</name><value>New features</value></term>
+    <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+  </release>
+  <release>
+   <name>aaa_update_test 8.x-1.1</name>
+   <version>8.x-1.1</version>
+   <tag>DRUPAL-8--1-1</tag>
+   <status>published</status>
+   <release_link>http://example.com/aaa_update_test-8-x-1-1-release</release_link>
+   <download_link>http://example.com/aaa_update_test-8-x-1-1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+    <term><name>Release type</name><value>New features</value></term>
+    <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+  </release>
+  <release>
+   <name>aaa_update_test 8.x-1.0</name>
+   <version>8.x-1.0</version>
+   <tag>DRUPAL-8--1-0</tag>
+   <status>published</status>
+   <release_link>http://example.com/aaa_update_test-8-x-1-0-release</release_link>
+   <download_link>http://example.com/aaa_update_test-8-x-1-0.tar.gz</download_link>
+   <date>1250424521</date>
+  <terms>
+    <term><name>Release type</name><value>New features</value></term>
+    <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+  </release>
+ </releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/bbb_update_test.1_0.xml

@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>BBB Update test</title>
+<short_name>bbb_update_test</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.x-1.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/bbb_update_test</link>
+  <terms>
+   <term><name>Projects</name><value>Modules</value></term>
+  </terms>
+<releases>
+ <release>
+  <name>bbb_update_test 8.x-1.0</name>
+  <version>8.x-1.0</version>
+  <tag>DRUPAL-7--1-0</tag>
+  <status>published</status>
+  <release_link>http://example.com/bbb_update_test-7-x-1-0-release</release_link>
+  <download_link>http://example.com/bbb_update_test-8.x-1.0.tar.gz</download_link>
+  <date>1250424521</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+  </terms>
+ </release>
+</releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/bbb_update_test.1_1.xml

@@ -0,0 +1,48 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+This fixture is used by Drupal\Tests\update\Functional\UpdateManagerUpdateTest.
+
+It contains 2 releases, 8.x-1.0 (which is the currently installed version) and
+8.x-1.1, which is the only available update.
+
+To ensure we've got test coverage for the case where the '<core_compatibility>'
+tag is not defined at all, this fixture does not include that value.
+-->
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>BBB Update test</title>
+<short_name>bbb_update_test</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.x-1.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/bbb_update_test</link>
+  <terms>
+   <term><name>Projects</name><value>Modules</value></term>
+  </terms>
+<releases>
+ <release>
+  <name>bbb_update_test 8.x-1.1</name>
+  <version>8.x-1.1</version>
+  <tag>8.x-1.1</tag>
+  <status>published</status>
+  <release_link>http://example.com/bbb_update_test-8-x-1-1-release</release_link>
+  <download_link>http://example.com/bbb_update_test-8.x-1.1.tar.gz</download_link>
+  <date>1250444521</date>
+  <terms>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+  </terms>
+ </release>
+ <release>
+  <name>bbb_update_test 8.x-1.0</name>
+  <version>8.x-1.0</version>
+  <tag>8.x-1.0</tag>
+  <status>published</status>
+  <release_link>http://example.com/bbb_update_test-8-x-1-0-release</release_link>
+  <download_link>http://example.com/bbb_update_test-8.x-1.0.tar.gz</download_link>
+  <date>1250424521</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+  </terms>
+ </release>
+</releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/bbb_update_test.1_2.xml

@@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+This fixture is used by Drupal\Tests\update\Functional\UpdateManagerUpdateTest.
+
+It contains 3 releases:
+- 8.x-1.0: The currently installed version in the test scenarios.
+- 8.x-1.1: An available update that does not specify '<core_compatibility>'.
+- 8.x-1.2: An available update that uses '<core_compatibility>' to require at
+    least Drupal core version 8.1.0. Since the currently installed Drupal core
+    for the tests is 8.0.0, this release will be flagged as 'Not compatible'.
+-->
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>BBB Update test</title>
+<short_name>bbb_update_test</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.x-1.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/bbb_update_test</link>
+  <terms>
+   <term><name>Projects</name><value>Modules</value></term>
+  </terms>
+<releases>
+ <release>
+  <name>bbb_update_test 8.x-1.2</name>
+  <version>8.x-1.2</version>
+  <tag>8.x-1.2</tag>
+  <core_compatibility>^8.1.0</core_compatibility>
+  <status>published</status>
+  <release_link>http://example.com/bbb_update_test-8-x-1-2-release</release_link>
+  <download_link>http://example.com/bbb_update_test-8.x-1.2.tar.gz</download_link>
+  <date>1250445521</date>
+  <terms>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+  </terms>
+ </release>
+ <release>
+  <name>bbb_update_test 8.x-1.1</name>
+  <version>8.x-1.1</version>
+  <tag>8.x-1.1</tag>
+  <status>published</status>
+  <release_link>http://example.com/bbb_update_test-8-x-1-1-release</release_link>
+  <download_link>http://example.com/bbb_update_test-8.x-1.1.tar.gz</download_link>
+  <date>1250444521</date>
+  <terms>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+  </terms>
+ </release>
+ <release>
+  <name>bbb_update_test 8.x-1.0</name>
+  <version>8.x-1.0</version>
+  <tag>8.x-1.0</tag>
+  <status>published</status>
+  <release_link>http://example.com/bbb_update_test-8-x-1-0-release</release_link>
+  <download_link>http://example.com/bbb_update_test-8.x-1.0.tar.gz</download_link>
+  <date>1250424521</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+  </terms>
+ </release>
+</releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/ccc_update_test.1_0.xml

@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>CCC Update test</title>
+<short_name>ccc_update_test</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.x-1.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/ccc_update_test</link>
+  <terms>
+   <term><name>Projects</name><value>Modules</value></term>
+  </terms>
+<releases>
+ <release>
+  <name>ccc_update_test 8.x-1.0</name>
+  <version>8.x-1.0</version>
+  <tag>DRUPAL-7--1-0</tag>
+  <status>published</status>
+  <release_link>http://example.com/ccc_update_test-7-x-1-0-release</release_link>
+  <download_link>http://example.com/ccc_update_test-8.x-1.0.tar.gz</download_link>
+  <date>1250424521</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+  </terms>
+ </release>
+</releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/drupal.0.0-alpha1.xml

@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>Drupal</title>
+<short_name>drupal</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.0.,8.1.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/drupal</link>
+  <terms>
+   <term><name>Projects</name><value>Drupal project</value></term>
+  </terms>
+<releases>
+  <release>
+    <!-- This release is not in a supported branch; therefore it should not be recommended. -->
+    <name>Drupal 8.2.0</name>
+    <version>8.2.0</version>
+    <tag>DRUPAL-8-2-0</tag>
+    <status>published</status>
+    <release_link>http://example.com/drupal-8-2-0-release</release_link>
+    <download_link>http://example.com/drupal-8-2-0.tar.gz</download_link>
+    <date>1250425521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.0-alpha1</name>
+   <version>8.0.0-alpha1</version>
+   <tag>DRUPAL-8-0-0-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-0-alpha1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-0-alpha1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+</releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/drupal.0.0-beta1.xml

@@ -0,0 +1,54 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>Drupal</title>
+<short_name>drupal</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.0.,8.1.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/drupal</link>
+  <terms>
+   <term><name>Projects</name><value>Drupal project</value></term>
+  </terms>
+<releases>
+  <release>
+    <!-- This release is not in a supported branch; therefore it should not be recommended. -->
+    <name>Drupal 8.2.0</name>
+    <version>8.2.0</version>
+    <tag>DRUPAL-8-2-0</tag>
+    <status>published</status>
+    <release_link>http://example.com/drupal-8-2-0-release</release_link>
+    <download_link>http://example.com/drupal-8-2-0.tar.gz</download_link>
+    <date>1250425521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+ <release>
+   <name>Drupal 8.0.0-beta1</name>
+   <version>8.0.0-beta1</version>
+   <tag>DRUPAL-8-0-0-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-0-beta1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-0-beta1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+  <name>Drupal 8.0.0-alpha1</name>
+  <version>8.0.0-alpha1</version>
+  <tag>DRUPAL-8-0-0-alpha1</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-0-0-alpha1-release</release_link>
+  <download_link>http://example.com/drupal-8-0-0-alpha1.tar.gz</download_link>
+  <date>1250424521</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+  </terms>
+ </release>
+</releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/drupal.0.0.xml

@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>Drupal</title>
+<short_name>drupal</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.0.,8.1.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/drupal</link>
+  <terms>
+   <term><name>Projects</name><value>Drupal project</value></term>
+  </terms>
+<releases>
+ <release>
+  <!-- This release is not in a supported branch; therefore it should not be recommended. -->
+  <name>Drupal 8.2.0</name>
+  <version>8.2.0</version>
+  <tag>DRUPAL-8-2-0</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-2-0-release</release_link>
+  <download_link>http://example.com/drupal-8-2-0.tar.gz</download_link>
+  <date>1250425521</date>
+  <terms>
+    <term><name>Release type</name><value>New features</value></term>
+    <term><name>Release type</name><value>Bug fixes</value></term>
+  </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.0</name>
+   <version>8.0.0</version>
+   <tag>DRUPAL-8-0-0</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-0-release</release_link>
+   <download_link>http://example.com/drupal-8-0-0.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.0-beta1</name>
+   <version>8.0.0-beta1</version>
+   <tag>DRUPAL-8-0-0-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-0-beta1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-0-beta1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+  <name>Drupal 8.0.0-alpha1</name>
+  <version>8.0.0-alpha1</version>
+  <tag>DRUPAL-8-0-0-alpha1</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-0-0-alpha1-release</release_link>
+  <download_link>http://example.com/drupal-8-0-0-alpha1.tar.gz</download_link>
+  <date>1250424521</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+  </terms>
+ </release>
+</releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/drupal.0.1-alpha1.xml

@@ -0,0 +1,80 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>Drupal</title>
+<short_name>drupal</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.0.,8.1.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/drupal</link>
+  <terms>
+   <term><name>Projects</name><value>Drupal project</value></term>
+  </terms>
+<releases>
+  <release>
+    <!-- This release is not in a supported branch; therefore it should not be recommended. -->
+    <name>Drupal 8.2.0</name>
+    <version>8.2.0</version>
+    <tag>DRUPAL-8-2-0</tag>
+    <status>published</status>
+    <release_link>http://example.com/drupal-8-2-0-release</release_link>
+    <download_link>http://example.com/drupal-8-2-0.tar.gz</download_link>
+    <date>1250425521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+ <release>
+   <name>Drupal 8.0.1-alpha1</name>
+   <version>8.0.1-alpha1</version>
+   <tag>DRUPAL-8-0-1-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-1-alpha1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-1-alpha1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.0</name>
+   <version>8.0.0</version>
+   <tag>DRUPAL-8-0-0</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-0-release</release_link>
+   <download_link>http://example.com/drupal-8-0-0.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.0-beta1</name>
+   <version>8.0.0-beta1</version>
+   <tag>DRUPAL-8-0-0-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-0-beta1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-0-beta1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.0-alpha1</name>
+   <version>8.0.0-alpha1</version>
+   <tag>DRUPAL-8-0-0-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-0-alpha1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-0-alpha1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+</releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/drupal.0.1-beta1.xml

@@ -0,0 +1,93 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>Drupal</title>
+<short_name>drupal</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.0.,8.1.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/drupal</link>
+  <terms>
+   <term><name>Projects</name><value>Drupal project</value></term>
+  </terms>
+<releases>
+  <release>
+    <!-- This release is not in a supported branch; therefore it should not be recommended. -->
+    <name>Drupal 8.2.0</name>
+    <version>8.2.0</version>
+    <tag>DRUPAL-8-2-0</tag>
+    <status>published</status>
+    <release_link>http://example.com/drupal-8-2-0-release</release_link>
+    <download_link>http://example.com/drupal-8-2-0.tar.gz</download_link>
+    <date>1250425521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+ <release>
+   <name>Drupal 8.0.1-beta1</name>
+   <version>8.0.1-beta1</version>
+   <tag>DRUPAL-8-0-1-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-1-beta1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-1-beta1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.1-alpha1</name>
+   <version>8.0.1-alpha1</version>
+   <tag>DRUPAL-8-0-1-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-1-alpha1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-1-alpha1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.0</name>
+   <version>8.0.0</version>
+   <tag>DRUPAL-8-0-0</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-0-release</release_link>
+   <download_link>http://example.com/drupal-8-0-0.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.0-beta1</name>
+   <version>8.0.0-beta1</version>
+   <tag>DRUPAL-8-0-0-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-0-beta1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-0-beta1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.0-alpha1</name>
+   <version>8.0.0-alpha1</version>
+   <tag>DRUPAL-8-0-0-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-0-alpha1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-0-alpha1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+</releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/drupal.0.1.xml

@@ -0,0 +1,106 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>Drupal</title>
+<short_name>drupal</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.0.,8.1.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/drupal</link>
+  <terms>
+   <term><name>Projects</name><value>Drupal project</value></term>
+  </terms>
+<releases>
+  <release>
+    <!-- This release is not in a supported branch; therefore it should not be recommended. -->
+    <name>Drupal 8.2.0</name>
+    <version>8.2.0</version>
+    <tag>DRUPAL-8-2-0</tag>
+    <status>published</status>
+    <release_link>http://example.com/drupal-8-2-0-release</release_link>
+    <download_link>http://example.com/drupal-8-2-0.tar.gz</download_link>
+    <date>1250425521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+ <release>
+   <name>Drupal 8.0.1</name>
+   <version>8.0.1</version>
+   <tag>DRUPAL-8-0-1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-1.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.1-beta1</name>
+   <version>8.0.1-beta1</version>
+   <tag>DRUPAL-8-0-1-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-1-beta1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-1-beta1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.1-alpha1</name>
+   <version>8.0.1-alpha1</version>
+   <tag>DRUPAL-8-0-1-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-1-alpha1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-1-alpha1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.0</name>
+   <version>8.0.0</version>
+   <tag>DRUPAL-8-0-0</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-0-release</release_link>
+   <download_link>http://example.com/drupal-8-0-0.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.0-beta1</name>
+   <version>8.0.0-beta1</version>
+   <tag>DRUPAL-8-0-0-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-0-beta1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-0-beta1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.0-alpha1</name>
+   <version>8.0.0-alpha1</version>
+   <tag>DRUPAL-8-0-0-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-0-alpha1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-0-alpha1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+</releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/drupal.1.0-alpha1.xml

@@ -0,0 +1,119 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>Drupal</title>
+<short_name>drupal</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.0.,8.1.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/drupal</link>
+  <terms>
+   <term><name>Projects</name><value>Drupal project</value></term>
+  </terms>
+<releases>
+  <release>
+    <!-- This release is not in a supported branch; therefore it should not be recommended. -->
+    <name>Drupal 8.2.0</name>
+    <version>8.2.0</version>
+    <tag>DRUPAL-8-2-0</tag>
+    <status>published</status>
+    <release_link>http://example.com/drupal-8-2-0-release</release_link>
+    <download_link>http://example.com/drupal-8-2-0.tar.gz</download_link>
+    <date>1250425521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+ <release>
+   <name>Drupal 8.1.0-alpha1</name>
+   <version>8.1.0-alpha1</version>
+   <tag>DRUPAL-8-1-0-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-1-0-alpha1-release</release_link>
+   <download_link>http://example.com/drupal-8-1-0-alpha1.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.1</name>
+   <version>8.0.1</version>
+   <tag>DRUPAL-8-0-1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-1.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.1-beta1</name>
+   <version>8.0.1-beta1</version>
+   <tag>DRUPAL-8-0-1-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-1-beta1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-1-beta1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.1-alpha1</name>
+   <version>8.0.1-alpha1</version>
+   <tag>DRUPAL-8-0-1-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-1-alpha1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-1-alpha1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.0</name>
+   <version>8.0.0</version>
+   <tag>DRUPAL-8-0-0</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-0-release</release_link>
+   <download_link>http://example.com/drupal-8-0-0.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.0-beta1</name>
+   <version>8.0.0-beta1</version>
+   <tag>DRUPAL-8-0-0-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-0-beta1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-0-beta1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.0-alpha1</name>
+   <version>8.0.0-alpha1</version>
+   <tag>DRUPAL-8-0-0-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-0-alpha1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-0-alpha1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+</releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/drupal.1.0-beta1.xml

@@ -0,0 +1,132 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>Drupal</title>
+<short_name>drupal</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.0.,8.1.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/drupal</link>
+  <terms>
+   <term><name>Projects</name><value>Drupal project</value></term>
+  </terms>
+<releases>
+  <release>
+    <!-- This release is not in a supported branch; therefore it should not be recommended. -->
+    <name>Drupal 8.2.0</name>
+    <version>8.2.0</version>
+    <tag>DRUPAL-8-2-0</tag>
+    <status>published</status>
+    <release_link>http://example.com/drupal-8-2-0-release</release_link>
+    <download_link>http://example.com/drupal-8-2-0.tar.gz</download_link>
+    <date>1250425521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+ <release>
+   <name>Drupal 8.1.0-beta1</name>
+   <version>8.1.0-beta1</version>
+   <tag>DRUPAL-8-1-0-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-1-0-beta1-release</release_link>
+   <download_link>http://example.com/drupal-8-1-0-beta1.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.1.0-alpha1</name>
+   <version>8.1.0-alpha1</version>
+   <tag>DRUPAL-8-1-0-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-1-0-alpha1-release</release_link>
+   <download_link>http://example.com/drupal-8-1-0-alpha1.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.1</name>
+   <version>8.0.1</version>
+   <tag>DRUPAL-8-0-1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-1.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.1-beta1</name>
+   <version>8.0.1-beta1</version>
+   <tag>DRUPAL-8-0-1-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-1-beta1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-1-beta1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.1-alpha1</name>
+   <version>8.0.1-alpha1</version>
+   <tag>DRUPAL-8-0-1-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-1-alpha1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-1-alpha1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.0</name>
+   <version>8.0.0</version>
+   <tag>DRUPAL-8-0-0</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-0-release</release_link>
+   <download_link>http://example.com/drupal-8-0-0.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.0-beta1</name>
+   <version>8.0.0-beta1</version>
+   <tag>DRUPAL-8-0-0-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-0-beta1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-0-beta1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.0-alpha1</name>
+   <version>8.0.0-alpha1</version>
+   <tag>DRUPAL-8-0-0-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-0-alpha1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-0-alpha1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+</releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/drupal.1.0-unsupported.xml

@@ -0,0 +1,163 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+This XML file is the exact same as the file drupal.1.xml except
+'supported_branches' in this file does not contain the '8.0.' branch. Therefore,
+all the releases that start with '8.0.' are in an unsupported branch.
+-->
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>Drupal</title>
+<short_name>drupal</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.1.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/drupal</link>
+  <terms>
+   <term><name>Projects</name><value>Drupal project</value></term>
+  </terms>
+<releases>
+ <release>
+   <name>Drupal 8.1.0</name>
+   <version>8.1.0</version>
+   <tag>8.1.0</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-1-0-release</release_link>
+   <download_link>http://example.com/drupal-8-1-0.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.1.0-beta1</name>
+   <version>8.1.0-beta1</version>
+   <tag>8.1.0-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-1-0-beta1-release</release_link>
+   <download_link>http://example.com/drupal-8-1-0-beta1.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.1.0-alpha1</name>
+   <version>8.1.0-alpha1</version>
+   <tag>8.1.0-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-1-0-alpha1-release</release_link>
+   <download_link>http://example.com/drupal-8-1-0-alpha1.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.3</name>
+   <version>8.0.3</version>
+   <tag>8.0.3</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-3-release</release_link>
+   <download_link>http://example.com/drupal-8-0-3.tar.gz</download_link>
+   <date>1250424585</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+     <term><name>Release type</name><value>Unsupported</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.2</name>
+   <version>8.0.2</version>
+   <tag>8.0.2</tag>
+   <status>unpublished</status>
+   <release_link>http://example.com/drupal-8-0-2-release</release_link>
+   <download_link>http://example.com/drupal-8-0-2.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.1</name>
+   <version>8.0.1</version>
+   <tag>8.0.1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-1.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.1-beta1</name>
+   <version>8.0.1-beta1</version>
+   <tag>8.0.1-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-1-beta1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-1-beta1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.1-alpha1</name>
+   <version>8.0.1-alpha1</version>
+   <tag>8.0.1-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-1-alpha1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-1-alpha1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.0</name>
+   <version>8.0.0</version>
+   <tag>8.0.0</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-0-release</release_link>
+   <download_link>http://example.com/drupal-8-0-0.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.0-beta1</name>
+   <version>8.0.0-beta1</version>
+   <tag>8.0.0-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-0-beta1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-0-beta1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.0-alpha1</name>
+   <version>8.0.0-alpha1</version>
+   <tag>8.0.0-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-0-alpha1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-0-alpha1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+</releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/drupal.1.0.xml

@@ -0,0 +1,172 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>Drupal</title>
+<short_name>drupal</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.0.,8.1.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/drupal</link>
+  <terms>
+   <term><name>Projects</name><value>Drupal project</value></term>
+  </terms>
+<releases>
+  <release>
+    <!-- This release is not in a supported branch; therefore it should not be recommended. -->
+    <name>Drupal 8.2.0</name>
+    <version>8.2.0</version>
+    <tag>DRUPAL-8-2-0</tag>
+    <status>published</status>
+    <release_link>http://example.com/drupal-8-2-0-release</release_link>
+    <download_link>http://example.com/drupal-8-2-0.tar.gz</download_link>
+    <date>1250425521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+ <release>
+   <name>Drupal 8.1.0</name>
+   <version>8.1.0</version>
+   <tag>DRUPAL-8-1-0</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-1-0-release</release_link>
+   <download_link>http://example.com/drupal-8-1-0.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.1.0-beta1</name>
+   <version>8.1.0-beta1</version>
+   <tag>DRUPAL-8-1-0-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-1-0-beta1-release</release_link>
+   <download_link>http://example.com/drupal-8-1-0-beta1.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.1.0-alpha1</name>
+   <version>8.1.0-alpha1</version>
+   <tag>DRUPAL-8-0-1-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-1-0-alpha1-release</release_link>
+   <download_link>http://example.com/drupal-8-1-0-alpha1.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.3</name>
+   <version>8.0.3</version>
+   <tag>8.0.3</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-3-release</release_link>
+   <download_link>http://example.com/drupal-8-0-3.tar.gz</download_link>
+   <date>1250424585</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+     <term><name>Release type</name><value>Unsupported</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.2</name>
+   <version>8.0.2</version>
+   <tag>8.0.2</tag>
+   <status>unpublished</status>
+   <release_link>http://example.com/drupal-8-0-2-release</release_link>
+   <download_link>http://example.com/drupal-8-0-2.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.1</name>
+   <version>8.0.1</version>
+   <tag>DRUPAL-8-0-1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-1.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.1-beta1</name>
+   <version>8.0.1-beta1</version>
+   <tag>DRUPAL-8-0-1-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-1-beta1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-1-beta1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.1-alpha1</name>
+   <version>8.0.1-alpha1</version>
+   <tag>DRUPAL-8-0-1-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-1-alpha1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-1-alpha1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.0</name>
+   <version>8.0.0</version>
+   <tag>DRUPAL-8-0-0</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-0-release</release_link>
+   <download_link>http://example.com/drupal-8-0-0.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.0-beta1</name>
+   <version>8.0.0-beta1</version>
+   <tag>DRUPAL-8-0-0-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-0-beta1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-0-beta1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.0-alpha1</name>
+   <version>8.0.0-alpha1</version>
+   <tag>DRUPAL-8-0-0-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-0-alpha1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-0-alpha1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+</releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/drupal.1.1-alpha1-core_compatibility.xml

@@ -0,0 +1,144 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>Drupal</title>
+<short_name>drupal</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.0.,8.1.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/drupal</link>
+  <terms>
+   <term><name>Projects</name><value>Drupal project</value></term>
+  </terms>
+<releases>
+ <release>
+   <name>Drupal 8.1.1-alpha1</name>
+   <version>8.1.1-alpha1</version>
+   <tag>DRUPAL-8-1-1-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-1-1-alpha1-release</release_link>
+   <download_link>http://example.com/drupal-8-1-1-alpha1.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.1.0</name>
+   <version>8.1.0</version>
+   <tag>DRUPAL-8-1-0</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-1-0-release</release_link>
+   <download_link>http://example.com/drupal-8-1-0.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.1.0-beta1</name>
+   <version>8.1.0-beta1</version>
+   <tag>DRUPAL-8-0-1-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-1-0-beta1-release</release_link>
+   <download_link>http://example.com/drupal-8-1-0-beta1.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.1.0-alpha1</name>
+   <version>8.1.0-alpha1</version>
+   <tag>DRUPAL-8-1-0-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-1-0-alpha1-release</release_link>
+   <download_link>http://example.com/drupal-8-1-0-alpha1.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.1</name>
+   <version>8.0.1</version>
+   <tag>DRUPAL-8-0-1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-1.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.1-beta1</name>
+   <version>8.0.1-beta1</version>
+   <tag>DRUPAL-8-0-1-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-1-beta1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-1-beta1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.1-alpha1</name>
+   <version>8.0.1-alpha1</version>
+   <tag>DRUPAL-8-0-1-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-1-alpha1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-1-alpha1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.0</name>
+   <version>8.0.0</version>
+   <tag>DRUPAL-8-0-0</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-0-release</release_link>
+   <download_link>http://example.com/drupal-8-0-0.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.0-beta1</name>
+   <version>8.0.0-beta1</version>
+   <tag>DRUPAL-8-0-0-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-0-beta1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-0-beta1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.0-alpha1</name>
+   <version>8.0.0-alpha1</version>
+   <tag>DRUPAL-8-0-0-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-0-alpha1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-0-alpha1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+</releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/drupal.1.1-alpha1.xml

@@ -0,0 +1,158 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>Drupal</title>
+<short_name>drupal</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.0.,8.1.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/drupal</link>
+  <terms>
+   <term><name>Projects</name><value>Drupal project</value></term>
+  </terms>
+<releases>
+  <release>
+    <!-- This release is not in a supported branch; therefore it should not be recommended. -->
+    <name>Drupal 8.2.0</name>
+    <version>8.2.0</version>
+    <tag>DRUPAL-8-2-0</tag>
+    <status>published</status>
+    <release_link>http://example.com/drupal-8-2-0-release</release_link>
+    <download_link>http://example.com/drupal-8-2-0.tar.gz</download_link>
+    <date>1250425521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+ <release>
+   <name>Drupal 8.1.1-alpha1</name>
+   <version>8.1.1-alpha1</version>
+   <tag>DRUPAL-8-1-1-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-1-1-alpha1-release</release_link>
+   <download_link>http://example.com/drupal-8-1-1-alpha1.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.1.0</name>
+   <version>8.1.0</version>
+   <tag>DRUPAL-8-1-0</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-1-0-release</release_link>
+   <download_link>http://example.com/drupal-8-1-0.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.1.0-beta1</name>
+   <version>8.1.0-beta1</version>
+   <tag>DRUPAL-8-0-1-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-1-0-beta1-release</release_link>
+   <download_link>http://example.com/drupal-8-1-0-beta1.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.1.0-alpha1</name>
+   <version>8.1.0-alpha1</version>
+   <tag>DRUPAL-8-1-0-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-1-0-alpha1-release</release_link>
+   <download_link>http://example.com/drupal-8-1-0-alpha1.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.1</name>
+   <version>8.0.1</version>
+   <tag>DRUPAL-8-0-1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-1.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.1-beta1</name>
+   <version>8.0.1-beta1</version>
+   <tag>DRUPAL-8-0-1-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-1-beta1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-1-beta1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.1-alpha1</name>
+   <version>8.0.1-alpha1</version>
+   <tag>DRUPAL-8-0-1-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-1-alpha1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-1-alpha1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.0</name>
+   <version>8.0.0</version>
+   <tag>DRUPAL-8-0-0</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-0-release</release_link>
+   <download_link>http://example.com/drupal-8-0-0.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.0-beta1</name>
+   <version>8.0.0-beta1</version>
+   <tag>DRUPAL-8-0-0-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-0-beta1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-0-beta1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.0-alpha1</name>
+   <version>8.0.0-alpha1</version>
+   <tag>DRUPAL-8-0-0-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-0-alpha1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-0-alpha1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+</releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/drupal.1.1-beta1.xml

@@ -0,0 +1,171 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>Drupal</title>
+<short_name>drupal</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.0.,8.1.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/drupal</link>
+  <terms>
+   <term><name>Projects</name><value>Drupal project</value></term>
+  </terms>
+<releases>
+  <release>
+    <!-- This release is not in a supported branch; therefore it should not be recommended. -->
+    <name>Drupal 8.2.0</name>
+    <version>8.2.0</version>
+    <tag>DRUPAL-8-2-0</tag>
+    <status>published</status>
+    <release_link>http://example.com/drupal-8-2-0-release</release_link>
+    <download_link>http://example.com/drupal-8-2-0.tar.gz</download_link>
+    <date>1250425521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+ <release>
+   <name>Drupal 8.1.1-beta1</name>
+   <version>8.1.1-beta1</version>
+   <tag>DRUPAL-8-1-1-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-1-1-beta1-release</release_link>
+   <download_link>http://example.com/drupal-8-1-1-beta1.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.1.1-alpha1</name>
+   <version>8.1.1-alpha1</version>
+   <tag>DRUPAL-8-1-1-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-1-1-alpha1-release</release_link>
+   <download_link>http://example.com/drupal-8-1-1-alpha1.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.1.0</name>
+   <version>8.1.0</version>
+   <tag>DRUPAL-8-1-0</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-1-0-release</release_link>
+   <download_link>http://example.com/drupal-8-1-0.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.1.0-beta1</name>
+   <version>8.1.0-beta1</version>
+   <tag>DRUPAL-8-0-1-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-1-0-beta1-release</release_link>
+   <download_link>http://example.com/drupal-8-1-0-beta1.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.1.0-alpha1</name>
+   <version>8.1.0-alpha1</version>
+   <tag>DRUPAL-8-1-0-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-1-0-alpha1-release</release_link>
+   <download_link>http://example.com/drupal-8-1-0-alpha1.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.1</name>
+   <version>8.0.1</version>
+   <tag>DRUPAL-8-0-1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-1.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.1-beta1</name>
+   <version>8.0.1-beta1</version>
+   <tag>DRUPAL-8-0-1-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-1-beta1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-1-beta1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.1-alpha1</name>
+   <version>8.0.1-alpha1</version>
+   <tag>DRUPAL-8-0-1-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-1-alpha1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-1-alpha1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.0</name>
+   <version>8.0.0</version>
+   <tag>DRUPAL-8-0-0</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-0-release</release_link>
+   <download_link>http://example.com/drupal-8-0-0.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.0-beta1</name>
+   <version>8.0.0-beta1</version>
+   <tag>DRUPAL-8-0-0-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-0-beta1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-0-beta1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.0-alpha1</name>
+   <version>8.0.0-alpha1</version>
+   <tag>DRUPAL-8-0-0-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-0-alpha1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-0-alpha1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+</releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/drupal.1.1-core_compatibility.xml

@@ -0,0 +1,170 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>Drupal</title>
+<short_name>drupal</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.0.,8.1.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/drupal</link>
+  <terms>
+   <term><name>Projects</name><value>Drupal project</value></term>
+  </terms>
+<releases>
+ <release>
+   <name>Drupal 8.1.1</name>
+   <version>8.1.1</version>
+   <tag>DRUPAL-8-1-1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-1-1-release</release_link>
+   <download_link>http://example.com/drupal-8-1-1.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.1.1-beta1</name>
+   <version>8.1.1-beta1</version>
+   <tag>DRUPAL-8-1-1-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-1-1-beta1-release</release_link>
+   <download_link>http://example.com/drupal-8-1-1-beta1.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.1.1-alpha1</name>
+   <version>8.1.1-alpha1</version>
+   <tag>DRUPAL-8-1-1-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-1-1-alpha1-release</release_link>
+   <download_link>http://example.com/drupal-8-1-1-alpha1.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.1.0</name>
+   <version>8.1.0</version>
+   <tag>DRUPAL-8-1-0</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-1-0-release</release_link>
+   <download_link>http://example.com/drupal-8-1-0.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.1.0-beta1</name>
+   <version>8.1.0-beta1</version>
+   <tag>DRUPAL-8-0-1-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-1-0-beta1-release</release_link>
+   <download_link>http://example.com/drupal-8-1-0-beta1.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.1.0-alpha1</name>
+   <version>8.1.0-alpha1</version>
+   <tag>DRUPAL-8-1-0-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-1-0-alpha1-release</release_link>
+   <download_link>http://example.com/drupal-8-1-0-alpha1.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.1</name>
+   <version>8.0.1</version>
+   <tag>DRUPAL-8-0-1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-1.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.1-beta1</name>
+   <version>8.0.1-beta1</version>
+   <tag>DRUPAL-8-0-1-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-1-beta1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-1-beta1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.1-alpha1</name>
+   <version>8.0.1-alpha1</version>
+   <tag>DRUPAL-8-0-1-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-1-alpha1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-1-alpha1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.0</name>
+   <version>8.0.0</version>
+   <tag>DRUPAL-8-0-0</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-0-release</release_link>
+   <download_link>http://example.com/drupal-8-0-0.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.0-beta1</name>
+   <version>8.0.0-beta1</version>
+   <tag>DRUPAL-8-0-0-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-0-beta1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-0-beta1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.0-alpha1</name>
+   <version>8.0.0-alpha1</version>
+   <tag>DRUPAL-8-0-0-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-0-alpha1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-0-alpha1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+</releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/drupal.1.1.xml

@@ -0,0 +1,184 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>Drupal</title>
+<short_name>drupal</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.0.,8.1.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/drupal</link>
+  <terms>
+   <term><name>Projects</name><value>Drupal project</value></term>
+  </terms>
+<releases>
+  <release>
+    <!-- This release is not in a supported branch; therefore it should not be recommended. -->
+    <name>Drupal 8.2.0</name>
+    <version>8.2.0</version>
+    <tag>DRUPAL-8-2-0</tag>
+    <status>published</status>
+    <release_link>http://example.com/drupal-8-2-0-release</release_link>
+    <download_link>http://example.com/drupal-8-2-0.tar.gz</download_link>
+    <date>1250425521</date>
+    <terms>
+      <term><name>Release type</name><value>New features</value></term>
+      <term><name>Release type</name><value>Bug fixes</value></term>
+    </terms>
+  </release>
+ <release>
+   <name>Drupal 8.1.1</name>
+   <version>8.1.1</version>
+   <tag>DRUPAL-8-1-1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-1-1-release</release_link>
+   <download_link>http://example.com/drupal-8-1-1.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.1.1-beta1</name>
+   <version>8.1.1-beta1</version>
+   <tag>DRUPAL-8-1-1-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-1-1-beta1-release</release_link>
+   <download_link>http://example.com/drupal-8-1-1-beta1.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.1.1-alpha1</name>
+   <version>8.1.1-alpha1</version>
+   <tag>DRUPAL-8-1-1-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-1-1-alpha1-release</release_link>
+   <download_link>http://example.com/drupal-8-1-1-alpha1.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.1.0</name>
+   <version>8.1.0</version>
+   <tag>DRUPAL-8-1-0</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-1-0-release</release_link>
+   <download_link>http://example.com/drupal-8-1-0.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.1.0-beta1</name>
+   <version>8.1.0-beta1</version>
+   <tag>DRUPAL-8-0-1-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-1-0-beta1-release</release_link>
+   <download_link>http://example.com/drupal-8-1-0-beta1.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.1.0-alpha1</name>
+   <version>8.1.0-alpha1</version>
+   <tag>DRUPAL-8-1-0-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-1-0-alpha1-release</release_link>
+   <download_link>http://example.com/drupal-8-1-0-alpha1.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.1</name>
+   <version>8.0.1</version>
+   <tag>DRUPAL-8-0-1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-1.tar.gz</download_link>
+   <date>1250424581</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.1-beta1</name>
+   <version>8.0.1-beta1</version>
+   <tag>DRUPAL-8-0-1-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-1-beta1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-1-beta1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.1-alpha1</name>
+   <version>8.0.1-alpha1</version>
+   <tag>DRUPAL-8-0-1-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-1-alpha1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-1-alpha1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.0</name>
+   <version>8.0.0</version>
+   <tag>DRUPAL-8-0-0</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-0-release</release_link>
+   <download_link>http://example.com/drupal-8-0-0.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.0-beta1</name>
+   <version>8.0.0-beta1</version>
+   <tag>DRUPAL-8-0-0-beta1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-0-beta1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-0-beta1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+ <release>
+   <name>Drupal 8.0.0-alpha1</name>
+   <version>8.0.0-alpha1</version>
+   <tag>DRUPAL-8-0-0-alpha1</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-8-0-0-alpha1-release</release_link>
+   <download_link>http://example.com/drupal-8-0-0-alpha1.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+</releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/drupal.9.xml

@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>Drupal</title>
+<short_name>drupal</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>9.0.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/drupal</link>
+  <terms>
+   <term><name>Projects</name><value>Drupal project</value></term>
+  </terms>
+<releases>
+ <release>
+   <name>Drupal 9.0.0</name>
+   <version>9.0.0</version>
+   <tag>DRUPAL-9-0-0</tag>
+   <status>published</status>
+   <release_link>http://example.com/drupal-9-0-0-release</release_link>
+   <download_link>http://example.com/drupal-9-0-0.tar.gz</download_link>
+   <date>1250424521</date>
+   <terms>
+     <term><name>Release type</name><value>New features</value></term>
+     <term><name>Release type</name><value>Bug fixes</value></term>
+   </terms>
+ </release>
+</releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/drupal.dev.xml

@@ -0,0 +1,39 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>Drupal</title>
+<short_name>drupal</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.0.,8.1.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/drupal</link>
+  <terms>
+   <term><name>Projects</name><value>Drupal project</value></term>
+  </terms>
+<releases>
+ <release>
+  <name>Drupal 8.0.0</name>
+  <version>8.0.0</version>
+  <tag>DRUPAL-8-0-0</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-0-0-release</release_link>
+  <download_link>http://example.com/drupal-8-0-0.tar.gz</download_link>
+  <date>1250424521</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+  </terms>
+ </release>
+ <release>
+  <name>Drupal 8.0.x-dev</name>
+  <version>8.0.x-dev</version>
+  <tag>DRUPAL-8-0</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-0-x-dev-release</release_link>
+  <download_link>http://example.com/drupal-8.0.x-dev.tar.gz</download_link>
+  <date>1250424581</date>
+  <terms>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+  </terms>
+ </release>
+</releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/drupal.sec.0.1_0.2.xml

@@ -0,0 +1,57 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>Drupal</title>
+<short_name>drupal</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.0.,8.1.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/drupal</link>
+  <terms>
+   <term><name>Projects</name><value>Drupal project</value></term>
+  </terms>
+<releases>
+ <release>
+  <name>Drupal 8.0.2</name>
+  <version>8.0.2</version>
+  <tag>DRUPAL-8-0-2</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-0-2-release</release_link>
+  <download_link>http://example.com/drupal-8-0-2.tar.gz</download_link>
+  <date>1250424641</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>Security update</value></term>
+  </terms>
+ </release>
+ <release>
+  <name>Drupal 8.0.1</name>
+  <version>8.0.1</version>
+  <tag>DRUPAL-8-0-1</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-0-1-release</release_link>
+  <download_link>http://example.com/drupal-8-0-1.tar.gz</download_link>
+  <date>1250424581</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>Security update</value></term>
+   <term><name>Release type</name><value>Insecure</value></term>
+  </terms>
+ </release>
+ <release>
+  <name>Drupal 8.0.0</name>
+  <version>8.0.0</version>
+  <tag>DRUPAL-8-0-0</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-0-0-release</release_link>
+  <download_link>http://example.com/drupal-8-0-0.tar.gz</download_link>
+  <date>1250424521</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>Insecure</value></term>
+  </terms>
+ </release>
+</releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/drupal.sec.0.2-rc2-b.xml

@@ -0,0 +1,194 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>Drupal</title>
+<short_name>drupal</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.0.,8.1.,8.2.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/drupal</link>
+  <terms>
+   <term><name>Projects</name><value>Drupal project</value></term>
+  </terms>
+<releases>
+ <release>
+  <name>drupal 8.2.0-rc2</name>
+  <version>8.2.0-rc2</version>
+  <tag>8.2.0-rc2</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-2-0-rc2-release</release_link>
+  <download_link>http://example.com/drupal-8-2-0-rc2.tar.gz</download_link>
+  <date>1533298080</date>
+  <terms>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>New features</value></term>
+  </terms>
+  <security>
+   RC releases are not covered by Drupal security advisories.
+  </security>
+ </release>
+ <release>
+  <name>drupal 8.2.0-rc1</name>
+  <version>8.2.0-rc1</version>
+  <tag>8.2.0-rc1</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-2-0-rc1-release</release_link>
+  <download_link>http://example.com/drupal-8-2-0-rc1.tar.gz</download_link>
+  <date>1533270485</date>
+  <terms>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>New features</value></term>
+  </terms>
+  <security>
+   RC releases are not covered by Drupal security advisories.
+  </security>
+ </release>
+ <release>
+  <name>drupal 8.2.0-beta2</name>
+  <version>8.2.0-beta2</version>
+  <tag>8.2.0-beta2</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-2-0-beta2-release</release_link>
+  <download_link>http://example.com/drupal-8-2-0-beta2.tar.gz</download_link>
+  <date>1533298080</date>
+  <terms>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>New features</value></term>
+  </terms>
+  <security>
+   Beta releases are not covered by Drupal security advisories.
+  </security>
+ </release>
+ <release>
+  <name>drupal 8.2.0-beta1</name>
+  <version>8.2.0-beta1</version>
+  <tag>8.2.0-beta1</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-2-0-beta1-release</release_link>
+  <download_link>http://example.com/drupal-8-2-0-beta1.tar.gz</download_link>
+  <date>1533270485</date>
+  <terms>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>New features</value></term>
+  </terms>
+  <security>
+   Beta releases are not covered by Drupal security advisories.
+  </security>
+ </release>
+ <release>
+  <name>drupal 8.2.0-alpha2</name>
+  <version>8.2.0-alpha2</version>
+  <tag>8.2.0-alpha2</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-2-0-alpha2-release</release_link>
+  <download_link>http://example.com/drupal-8-2-0-alpha2.tar.gz</download_link>
+  <date>1533298080</date>
+  <terms>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>New features</value></term>
+  </terms>
+  <security>
+   Alpha releases are not covered by Drupal security advisories.
+  </security>
+ </release>
+ <release>
+  <name>drupal 8.2.0-alpha1</name>
+  <version>8.2.0-alpha1</version>
+  <tag>8.2.0-alpha1</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8.2.0-alpha1</release_link>
+  <download_link>http://example.com/drupal-8-2-0-alpha1.tar.gz</download_link>
+  <date>1533270485</date>
+  <terms>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>New features</value></term>
+  </terms>
+  <security>
+   Alpha releases are not covered by Drupal security advisories.
+  </security>
+ </release>
+ <release>
+  <name>Drupal 8.1.2</name>
+  <version>8.1.2</version>
+  <tag>DRUPAL-8-1-2</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-1-2-release</release_link>
+  <download_link>http://example.com/drupal-8-1-2.tar.gz</download_link>
+  <date>1250424526</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>Security update</value></term>
+  </terms>
+ </release>
+ <release>
+  <name>Drupal 8.1.1</name>
+  <version>8.1.1</version>
+  <tag>DRUPAL-8-1-1</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-1-1-release</release_link>
+  <download_link>http://example.com/drupal-8-1-1.tar.gz</download_link>
+  <date>1250424525</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>Insecure</value></term>
+  </terms>
+ </release>
+ <release>
+  <name>Drupal 8.1.0</name>
+  <version>8.1.0</version>
+  <tag>DRUPAL-8-1-0</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-1-0-release</release_link>
+  <download_link>http://example.com/drupal-8-1-0.tar.gz</download_link>
+  <date>1250424524</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>Insecure</value></term>
+  </terms>
+ </release>
+ <release>
+  <name>Drupal 8.0.2</name>
+  <version>8.0.2</version>
+  <tag>DRUPAL-8-0-2</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-0-2-release</release_link>
+  <download_link>http://example.com/drupal-8-0-2.tar.gz</download_link>
+  <date>1250424523</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>Security update</value></term>
+  </terms>
+ </release>
+ <release>
+  <name>Drupal 8.0.1</name>
+  <version>8.0.1</version>
+  <tag>DRUPAL-8-0-1</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-0-1-release</release_link>
+  <download_link>http://example.com/drupal-8-0-1.tar.gz</download_link>
+  <date>1250424522</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>Insecure</value></term>
+  </terms>
+ </release>
+ <release>
+  <name>Drupal 8.0.0</name>
+  <version>8.0.0</version>
+  <tag>DRUPAL-8-0-0</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-0-0-release</release_link>
+  <download_link>http://example.com/drupal-8-0-0.tar.gz</download_link>
+  <date>1250424521</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>Insecure</value></term>
+  </terms>
+ </release>
+</releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/drupal.sec.0.2-rc2.xml

@@ -0,0 +1,200 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>Drupal</title>
+<short_name>drupal</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.0.,8.1.,8.2.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/drupal</link>
+  <terms>
+   <term><name>Projects</name><value>Drupal project</value></term>
+  </terms>
+<releases>
+ <release>
+  <name>drupal 8.2.0-rc2</name>
+  <version>8.2.0-rc2</version>
+  <tag>8.2.0-rc2</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-2-0-rc2-release</release_link>
+  <download_link>http://example.com/drupal-8-2-0-rc2.tar.gz</download_link>
+  <date>1533298080</date>
+  <terms>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Security update</value></term>
+  </terms>
+  <security>
+   RC releases are not covered by Drupal security advisories.
+  </security>
+ </release>
+ <release>
+  <name>drupal 8.2.0-rc1</name>
+  <version>8.2.0-rc1</version>
+  <tag>8.2.0-rc1</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-2-0-rc1-release</release_link>
+  <download_link>http://example.com/drupal-8-2-0-rc1.tar.gz</download_link>
+  <date>1533270485</date>
+  <terms>
+   <term><name>Release type</name><value>Insecure</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>New features</value></term>
+  </terms>
+  <security>
+   RC releases are not covered by Drupal security advisories.
+  </security>
+ </release>
+ <release>
+  <name>drupal 8.2.0-beta2</name>
+  <version>8.2.0-beta2</version>
+  <tag>8.2.0-beta2</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-2-0-beta2-release</release_link>
+  <download_link>http://example.com/drupal-8-2-0-beta2.tar.gz</download_link>
+  <date>1533298080</date>
+  <terms>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Insecure</value></term>
+  </terms>
+  <security>
+   Beta releases are not covered by Drupal security advisories.
+  </security>
+ </release>
+ <release>
+  <name>drupal 8.2.0-beta1</name>
+  <version>8.2.0-beta1</version>
+  <tag>8.2.0-beta1</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-2-0-beta1-release</release_link>
+  <download_link>http://example.com/drupal-8-2-0-beta1.tar.gz</download_link>
+  <date>1533270485</date>
+  <terms>
+   <term><name>Release type</name><value>Insecure</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>New features</value></term>
+  </terms>
+  <security>
+   Beta releases are not covered by Drupal security advisories.
+  </security>
+ </release>
+ <release>
+  <name>drupal 8.2.0-alpha2</name>
+  <version>8.2.0-alpha2</version>
+  <tag>8.2.0-alpha2</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-2-0-alpha2-release</release_link>
+  <download_link>http://example.com/drupal-8-2-0-alpha2.tar.gz</download_link>
+  <date>1533298080</date>
+  <terms>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Insecure</value></term>
+  </terms>
+  <security>
+   Alpha releases are not covered by Drupal security advisories.
+  </security>
+ </release>
+ <release>
+  <name>drupal 8.2.0-alpha1</name>
+  <version>8.2.0-alpha1</version>
+  <tag>8.2.0-alpha1</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8.2.0-alpha1</release_link>
+  <download_link>http://example.com/drupal-8-2-0-alpha1.tar.gz</download_link>
+  <date>1533270485</date>
+  <terms>
+   <term><name>Release type</name><value>Insecure</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>New features</value></term>
+  </terms>
+  <security>
+   Alpha releases are not covered by Drupal security advisories.
+  </security>
+ </release>
+ <release>
+  <name>Drupal 8.1.2</name>
+  <version>8.1.2</version>
+  <tag>DRUPAL-8-1-2</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-1-2-release</release_link>
+  <download_link>http://example.com/drupal-8-1-2.tar.gz</download_link>
+  <date>1250424641</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>Security update</value></term>
+  </terms>
+ </release>
+ <release>
+  <name>Drupal 8.1.1</name>
+  <version>8.1.1</version>
+  <tag>DRUPAL-8-1-1</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-1-1-release</release_link>
+  <download_link>http://example.com/drupal-8-1-1.tar.gz</download_link>
+  <date>1250424581</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>Insecure</value></term>
+  </terms>
+ </release>
+ <release>
+  <name>Drupal 8.1.0</name>
+  <version>8.1.0</version>
+  <tag>DRUPAL-8-1-0</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-1-0-release</release_link>
+  <download_link>http://example.com/drupal-8-1-0.tar.gz</download_link>
+  <date>1250424521</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>Insecure</value></term>
+  </terms>
+ </release>
+ <release>
+  <name>Drupal 8.0.2</name>
+  <version>8.0.2</version>
+  <tag>DRUPAL-8-0-2</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-0-2-release</release_link>
+  <download_link>http://example.com/drupal-8-0-2.tar.gz</download_link>
+  <date>1250424641</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>Security update</value></term>
+  </terms>
+ </release>
+ <release>
+  <name>Drupal 8.0.1</name>
+  <version>8.0.1</version>
+  <tag>DRUPAL-8-0-1</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-0-1-release</release_link>
+  <download_link>http://example.com/drupal-8-0-1.tar.gz</download_link>
+  <date>1250424581</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>Insecure</value></term>
+  </terms>
+ </release>
+ <release>
+  <name>Drupal 8.0.0</name>
+  <version>8.0.0</version>
+  <tag>DRUPAL-8-0-0</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-0-0-release</release_link>
+  <download_link>http://example.com/drupal-8-0-0.tar.gz</download_link>
+  <date>1250424521</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>Insecure</value></term>
+  </terms>
+ </release>
+</releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/drupal.sec.0.2.xml

@@ -0,0 +1,56 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>Drupal</title>
+<short_name>drupal</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.0.,8.1.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/drupal</link>
+  <terms>
+   <term><name>Projects</name><value>Drupal project</value></term>
+  </terms>
+<releases>
+ <release>
+  <name>Drupal 8.0.2</name>
+  <version>8.0.2</version>
+  <tag>DRUPAL-8-0-2</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-0-2-release</release_link>
+  <download_link>http://example.com/drupal-8-0-2.tar.gz</download_link>
+  <date>1250424641</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>Security update</value></term>
+  </terms>
+ </release>
+ <release>
+  <name>Drupal 8.0.1</name>
+  <version>8.0.1</version>
+  <tag>DRUPAL-8-0-1</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-0-1-release</release_link>
+  <download_link>http://example.com/drupal-8-0-1.tar.gz</download_link>
+  <date>1250424581</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>Insecure</value></term>
+  </terms>
+ </release>
+ <release>
+  <name>Drupal 8.0.0</name>
+  <version>8.0.0</version>
+  <tag>DRUPAL-8-0-0</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-0-0-release</release_link>
+  <download_link>http://example.com/drupal-8-0-0.tar.gz</download_link>
+  <date>1250424521</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>Insecure</value></term>
+  </terms>
+ </release>
+</releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/drupal.sec.1.2.xml

@@ -0,0 +1,95 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>Drupal</title>
+<short_name>drupal</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.0.,8.1.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/drupal</link>
+  <terms>
+   <term><name>Projects</name><value>Drupal project</value></term>
+  </terms>
+<releases>
+ <release>
+  <name>Drupal 8.1.2</name>
+  <version>8.1.2</version>
+  <tag>DRUPAL-8-1-2</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-1-2-release</release_link>
+  <download_link>http://example.com/drupal-8-1-2.tar.gz</download_link>
+  <date>1250424641</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>Security update</value></term>
+  </terms>
+ </release>
+ <release>
+  <name>Drupal 8.1.1</name>
+  <version>8.1.1</version>
+  <tag>DRUPAL-8-1-1</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-1-1-release</release_link>
+  <download_link>http://example.com/drupal-8-1-1.tar.gz</download_link>
+  <date>1250424581</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>Insecure</value></term>
+  </terms>
+ </release>
+ <release>
+  <name>Drupal 8.1.0</name>
+  <version>8.1.0</version>
+  <tag>DRUPAL-8-1-0</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-1-0-release</release_link>
+  <download_link>http://example.com/drupal-8-1-0.tar.gz</download_link>
+  <date>1250424521</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>Insecure</value></term>
+  </terms>
+ </release>
+ <release>
+  <name>Drupal 8.0.2</name>
+  <version>8.0.2</version>
+  <tag>DRUPAL-8-0-2</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-0-2-release</release_link>
+  <download_link>http://example.com/drupal-8-0-2.tar.gz</download_link>
+  <date>1250424641</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+  </terms>
+ </release>
+ <release>
+  <name>Drupal 8.0.1</name>
+  <version>8.0.1</version>
+  <tag>DRUPAL-8-0-1</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-0-1-release</release_link>
+  <download_link>http://example.com/drupal-8-0-1.tar.gz</download_link>
+  <date>1250424581</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+  </terms>
+ </release>
+ <release>
+  <name>Drupal 8.0.0</name>
+  <version>8.0.0</version>
+  <tag>DRUPAL-8-0-0</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-0-0-release</release_link>
+  <download_link>http://example.com/drupal-8-0-0.tar.gz</download_link>
+  <date>1250424521</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+  </terms>
+ </release>
+</releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/drupal.sec.1.2_insecure-unsupported.xml

@@ -0,0 +1,103 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+This XML file is the exact same as the file drupal.sec.1.2_insecure.xml except
+'supported_branches' in this file does not contain the '8.0.' branch. Therefore,
+all the releases that start with '8.0.' are in an unsupported branch.
+-->
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>Drupal</title>
+<short_name>drupal</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.1.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/drupal</link>
+  <terms>
+   <term><name>Projects</name><value>Drupal project</value></term>
+  </terms>
+<releases>
+ <release>
+  <name>Drupal 8.1.2</name>
+  <version>8.1.2</version>
+  <tag>8.1.2</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-1-2-release</release_link>
+  <download_link>http://example.com/drupal-8-1-2.tar.gz</download_link>
+  <date>1250424641</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>Security update</value></term>
+  </terms>
+ </release>
+ <release>
+  <name>Drupal 8.1.1</name>
+  <version>8.1.1</version>
+  <tag>8.1.1</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-1-1-release</release_link>
+  <download_link>http://example.com/drupal-8-1-1.tar.gz</download_link>
+  <date>1250424581</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>Insecure</value></term>
+  </terms>
+ </release>
+ <release>
+  <name>Drupal 8.1.0</name>
+  <version>8.1.0</version>
+  <tag>8.1.0</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-1-0-release</release_link>
+  <download_link>http://example.com/drupal-8-1-0.tar.gz</download_link>
+  <date>1250424521</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>Insecure</value></term>
+  </terms>
+ </release>
+ <release>
+  <name>Drupal 8.0.2</name>
+  <version>8.0.2</version>
+  <tag>8.0.2</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-0-2-release</release_link>
+  <download_link>http://example.com/drupal-8-0-2.tar.gz</download_link>
+  <date>1250424641</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>Insecure</value></term>
+  </terms>
+ </release>
+ <release>
+  <name>Drupal 8.0.1</name>
+  <version>8.0.1</version>
+  <tag>8.0.1</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-0-1-release</release_link>
+  <download_link>http://example.com/drupal-8-0-1.tar.gz</download_link>
+  <date>1250424581</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>Insecure</value></term>
+  </terms>
+ </release>
+ <release>
+  <name>Drupal 8.0.0</name>
+  <version>8.0.0</version>
+  <tag>8.0.0</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-0-0-release</release_link>
+  <download_link>http://example.com/drupal-8-0-0.tar.gz</download_link>
+  <date>1250424521</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>Insecure</value></term>
+  </terms>
+ </release>
+</releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/drupal.sec.1.2_insecure.xml

@@ -0,0 +1,98 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>Drupal</title>
+<short_name>drupal</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.0.,8.1.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/drupal</link>
+  <terms>
+   <term><name>Projects</name><value>Drupal project</value></term>
+  </terms>
+<releases>
+ <release>
+  <name>Drupal 8.1.2</name>
+  <version>8.1.2</version>
+  <tag>DRUPAL-8-1-2</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-1-2-release</release_link>
+  <download_link>http://example.com/drupal-8-1-2.tar.gz</download_link>
+  <date>1250424641</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>Security update</value></term>
+  </terms>
+ </release>
+ <release>
+  <name>Drupal 8.1.1</name>
+  <version>8.1.1</version>
+  <tag>DRUPAL-8-1-1</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-1-1-release</release_link>
+  <download_link>http://example.com/drupal-8-1-1.tar.gz</download_link>
+  <date>1250424581</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>Insecure</value></term>
+  </terms>
+ </release>
+ <release>
+  <name>Drupal 8.1.0</name>
+  <version>8.1.0</version>
+  <tag>DRUPAL-8-1-0</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-1-0-release</release_link>
+  <download_link>http://example.com/drupal-8-1-0.tar.gz</download_link>
+  <date>1250424521</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>Insecure</value></term>
+  </terms>
+ </release>
+ <release>
+  <name>Drupal 8.0.2</name>
+  <version>8.0.2</version>
+  <tag>DRUPAL-8-0-2</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-0-2-release</release_link>
+  <download_link>http://example.com/drupal-8-0-2.tar.gz</download_link>
+  <date>1250424641</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>Insecure</value></term>
+  </terms>
+ </release>
+ <release>
+  <name>Drupal 8.0.1</name>
+  <version>8.0.1</version>
+  <tag>DRUPAL-8-0-1</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-0-1-release</release_link>
+  <download_link>http://example.com/drupal-8-0-1.tar.gz</download_link>
+  <date>1250424581</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>Insecure</value></term>
+  </terms>
+ </release>
+ <release>
+  <name>Drupal 8.0.0</name>
+  <version>8.0.0</version>
+  <tag>DRUPAL-8-0-0</tag>
+  <status>published</status>
+  <release_link>http://example.com/drupal-8-0-0-release</release_link>
+  <download_link>http://example.com/drupal-8-0-0.tar.gz</download_link>
+  <date>1250424521</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>Insecure</value></term>
+  </terms>
+ </release>
+</releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/drupal.sec.2.0.xml

@@ -0,0 +1,88 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+    <title>Drupal</title>
+    <short_name>drupal</short_name>
+    <dc:creator>Drupal</dc:creator>
+    <api_version>8.x</api_version>
+    <recommended_major>8</recommended_major>
+    <supported_majors>8</supported_majors>
+    <default_major>8</default_major>
+    <project_status>published</project_status>
+    <link>http://example.com/project/drupal</link>
+    <terms><term><name>Projects</name><value>Drupal project</value></term></terms>
+    <releases>
+        <release>
+            <name>Drupal 8.2.0</name>
+            <version>8.2.0</version>
+            <tag>DRUPAL-8-2-0</tag>
+            <status>published</status>
+            <release_link>http://example.com/drupal-8-2-0-release</release_link>
+            <download_link>http://example.com/drupal-8-2-0.tar.gz</download_link>
+            <date>1250424641</date>
+            <terms>
+                <term>
+                    <name>Release type</name>
+                    <value>New features</value>
+                </term>
+                <term>
+                    <name>Release type</name>
+                    <value>Bug fixes</value>
+                </term>
+            </terms>
+        </release>
+        <release>
+            <name>drupal 8.2.0-beta2</name>
+            <version>8.2.0-beta2</version>
+            <tag>8.2.0-beta2</tag>
+            <status>published</status>
+            <release_link>http://example.com/drupal-8-2-0-beta2-release</release_link>
+            <download_link>http://example.com/drupal-8-2-0-beta2.tar.gz</download_link>
+            <date>1533298080</date>
+            <terms>
+                <term><name>Release type</name><value>Bug fixes</value></term>
+                <term><name>Release type</name><value>New features</value></term>
+            </terms>
+            <security>
+                Beta releases are not covered by Drupal security advisories.
+            </security>
+        </release>
+        <release>
+            <name>Drupal 8.1.0</name>
+            <version>8.1.0</version>
+            <tag>DRUPAL-8-1-0</tag>
+            <status>published</status>
+            <release_link>http://example.com/drupal-8-1-0-release</release_link>
+            <download_link>http://example.com/drupal-8-1-0.tar.gz</download_link>
+            <date>1250424521</date>
+            <terms>
+                <term>
+                    <name>Release type</name>
+                    <value>New features</value>
+                </term>
+                <term>
+                    <name>Release type</name>
+                    <value>Bug fixes</value>
+                </term>
+            </terms>
+        </release>
+        <release>
+            <name>Drupal 8.0.0</name>
+            <version>8.0.0</version>
+            <tag>DRUPAL-8-0-0</tag>
+            <status>published</status>
+            <release_link>http://example.com/drupal-8-0-0-release</release_link>
+            <download_link>http://example.com/drupal-8-0-0.tar.gz</download_link>
+            <date>1250424521</date>
+            <terms>
+                <term>
+                    <name>Release type</name>
+                    <value>New features</value>
+                </term>
+                <term>
+                    <name>Release type</name>
+                    <value>Bug fixes</value>
+                </term>
+            </terms>
+        </release>
+    </releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/drupal.sec.2.0_3.0-rc1.xml

@@ -0,0 +1,104 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+    <title>Drupal</title>
+    <short_name>drupal</short_name>
+    <dc:creator>Drupal</dc:creator>
+    <api_version>8.x</api_version>
+    <recommended_major>8</recommended_major>
+    <supported_majors>8</supported_majors>
+    <default_major>8</default_major>
+    <project_status>published</project_status>
+    <link>http://example.com/project/drupal</link>
+    <terms><term><name>Projects</name><value>Drupal project</value></term></terms>
+    <releases>
+        <release>
+            <name>drupal 8.3.0-rc1</name>
+            <version>8.3.0-rc1</version>
+            <tag>8.3.0-rc1</tag>
+            <status>published</status>
+            <release_link>http://example.com/drupal-8-3-0-rc1-release</release_link>
+            <download_link>http://example.com/drupal-8-3-0-rc1.tar.gz</download_link>
+            <date>1533270485</date>
+            <terms>
+                <term><name>Release type</name><value>Bug fixes</value></term>
+                <term><name>Release type</name><value>New features</value></term>
+            </terms>
+            <security>
+                RC releases are not covered by Drupal security advisories.
+            </security>
+        </release>
+        <release>
+            <name>Drupal 8.2.0</name>
+            <version>8.2.0</version>
+            <tag>DRUPAL-8-2-0</tag>
+            <status>published</status>
+            <release_link>http://example.com/drupal-8-2-0-release</release_link>
+            <download_link>http://example.com/drupal-8-2-0.tar.gz</download_link>
+            <date>1250424641</date>
+            <terms>
+                <term>
+                    <name>Release type</name>
+                    <value>New features</value>
+                </term>
+                <term>
+                    <name>Release type</name>
+                    <value>Bug fixes</value>
+                </term>
+            </terms>
+        </release>
+        <release>
+            <name>drupal 8.2.0-beta2</name>
+            <version>8.2.0-beta2</version>
+            <tag>8.2.0-beta2</tag>
+            <status>published</status>
+            <release_link>http://example.com/drupal-8-2-0-beta2-release</release_link>
+            <download_link>http://example.com/drupal-8-2-0-beta2.tar.gz</download_link>
+            <date>1533298080</date>
+            <terms>
+                <term><name>Release type</name><value>Bug fixes</value></term>
+                <term><name>Release type</name><value>New features</value></term>
+            </terms>
+            <security>
+                Beta releases are not covered by Drupal security advisories.
+            </security>
+        </release>
+        <release>
+            <name>Drupal 8.1.0</name>
+            <version>8.1.0</version>
+            <tag>DRUPAL-8-1-0</tag>
+            <status>published</status>
+            <release_link>http://example.com/drupal-8-1-0-release</release_link>
+            <download_link>http://example.com/drupal-8-1-0.tar.gz</download_link>
+            <date>1250424521</date>
+            <terms>
+                <term>
+                    <name>Release type</name>
+                    <value>New features</value>
+                </term>
+                <term>
+                    <name>Release type</name>
+                    <value>Bug fixes</value>
+                </term>
+            </terms>
+        </release>
+        <release>
+            <name>Drupal 8.0.0</name>
+            <version>8.0.0</version>
+            <tag>DRUPAL-8-0-0</tag>
+            <status>published</status>
+            <release_link>http://example.com/drupal-8-0-0-release</release_link>
+            <download_link>http://example.com/drupal-8-0-0.tar.gz</download_link>
+            <date>1250424521</date>
+            <terms>
+                <term>
+                    <name>Release type</name>
+                    <value>New features</value>
+                </term>
+                <term>
+                    <name>Release type</name>
+                    <value>Bug fixes</value>
+                </term>
+            </terms>
+        </release>
+    </releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/drupal.sec.2.0_9.0.0.xml

@@ -0,0 +1,126 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+    <title>Drupal</title>
+    <short_name>drupal</short_name>
+    <dc:creator>Drupal</dc:creator>
+    <api_version>8.x</api_version>
+    <recommended_major>8</recommended_major>
+    <supported_majors>8</supported_majors>
+    <default_major>8</default_major>
+    <project_status>published</project_status>
+    <link>http://example.com/project/drupal</link>
+    <terms><term><name>Projects</name><value>Drupal project</value></term></terms>
+    <releases>
+        <release>
+            <name>Drupal 9.0.0</name>
+            <version>9.0.0</version>
+            <tag>DRUPAL-9-0-0</tag>
+            <status>published</status>
+            <release_link>http://example.com/drupal-9-0-0-release</release_link>
+            <download_link>http://example.com/drupal-9-0-0.tar.gz</download_link>
+            <date>1250424641</date>
+            <terms>
+                <term>
+                    <name>Release type</name>
+                    <value>New features</value>
+                </term>
+                <term>
+                    <name>Release type</name>
+                    <value>Bug fixes</value>
+                </term>
+            </terms>
+        </release>
+        <release>
+            <name>Drupal 8.3.0</name>
+            <version>8.3.0</version>
+            <tag>DRUPAL-8-3-0</tag>
+            <status>published</status>
+            <release_link>http://example.com/drupal-8-3-0-release</release_link>
+            <download_link>http://example.com/drupal-8-3-0.tar.gz</download_link>
+            <date>1250424641</date>
+            <terms>
+                <term>
+                    <name>Release type</name>
+                    <value>New features</value>
+                </term>
+                <term>
+                    <name>Release type</name>
+                    <value>Bug fixes</value>
+                </term>
+            </terms>
+        </release>
+        <release>
+            <name>Drupal 8.2.0</name>
+            <version>8.2.0</version>
+            <tag>DRUPAL-8-2-0</tag>
+            <status>published</status>
+            <release_link>http://example.com/drupal-8-2-0-release</release_link>
+            <download_link>http://example.com/drupal-8-2-0.tar.gz</download_link>
+            <date>1250424641</date>
+            <terms>
+                <term>
+                    <name>Release type</name>
+                    <value>New features</value>
+                </term>
+                <term>
+                    <name>Release type</name>
+                    <value>Bug fixes</value>
+                </term>
+            </terms>
+        </release>
+        <release>
+            <name>drupal 8.2.0-beta2</name>
+            <version>8.2.0-beta2</version>
+            <tag>8.2.0-beta2</tag>
+            <status>published</status>
+            <release_link>http://example.com/drupal-8-2-0-beta2-release</release_link>
+            <download_link>http://example.com/drupal-8-2-0-beta2.tar.gz</download_link>
+            <date>1533298080</date>
+            <terms>
+                <term><name>Release type</name><value>Bug fixes</value></term>
+                <term><name>Release type</name><value>New features</value></term>
+            </terms>
+            <security>
+                Beta releases are not covered by Drupal security advisories.
+            </security>
+        </release>
+        <release>
+            <name>Drupal 8.1.0</name>
+            <version>8.1.0</version>
+            <tag>DRUPAL-8-1-0</tag>
+            <status>published</status>
+            <release_link>http://example.com/drupal-8-1-0-release</release_link>
+            <download_link>http://example.com/drupal-8-1-0.tar.gz</download_link>
+            <date>1250424521</date>
+            <terms>
+                <term>
+                    <name>Release type</name>
+                    <value>New features</value>
+                </term>
+                <term>
+                    <name>Release type</name>
+                    <value>Bug fixes</value>
+                </term>
+            </terms>
+        </release>
+        <release>
+            <name>Drupal 8.0.0</name>
+            <version>8.0.0</version>
+            <tag>DRUPAL-8-0-0</tag>
+            <status>published</status>
+            <release_link>http://example.com/drupal-8-0-0-release</release_link>
+            <download_link>http://example.com/drupal-8-0-0.tar.gz</download_link>
+            <date>1250424521</date>
+            <terms>
+                <term>
+                    <name>Release type</name>
+                    <value>New features</value>
+                </term>
+                <term>
+                    <name>Release type</name>
+                    <value>Bug fixes</value>
+                </term>
+            </terms>
+        </release>
+    </releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/drupal.sec.9.0.xml

@@ -0,0 +1,107 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+    <title>Drupal</title>
+    <short_name>drupal</short_name>
+    <dc:creator>Drupal</dc:creator>
+    <api_version>8.x</api_version>
+    <recommended_major>8</recommended_major>
+    <supported_majors>8,9</supported_majors>
+    <default_major>8</default_major>
+    <project_status>published</project_status>
+    <link>http://example.com/project/drupal</link>
+    <terms><term><name>Projects</name><value>Drupal project</value></term></terms>
+    <releases>
+        <release>
+            <name>Drupal 8.9.0</name>
+            <version>8.9.0</version>
+            <tag>DRUPAL-8-9-0</tag>
+            <status>published</status>
+            <release_link>http://example.com/drupal-8-9-0-release</release_link>
+            <download_link>http://example.com/drupal-8-9-0.tar.gz</download_link>
+            <date>1250424641</date>
+            <terms>
+                <term>
+                    <name>Release type</name>
+                    <value>New features</value>
+                </term>
+                <term>
+                    <name>Release type</name>
+                    <value>Bug fixes</value>
+                </term>
+            </terms>
+        </release>
+        <release>
+            <name>drupal 8.9.0-beta2</name>
+            <version>8.9.0-beta2</version>
+            <tag>8.9.0-beta2</tag>
+            <status>published</status>
+            <release_link>http://example.com/drupal-8-9-0-beta2-release</release_link>
+            <download_link>http://example.com/drupal-8-9-0-beta2.tar.gz</download_link>
+            <date>1533298080</date>
+            <terms>
+                <term><name>Release type</name><value>Bug fixes</value></term>
+                <term><name>Release type</name><value>New features</value></term>
+            </terms>
+            <security>
+                Beta releases are not covered by Drupal security advisories.
+            </security>
+        </release>
+        <release>
+          <name>Drupal 8.8.0</name>
+          <version>8.8.0</version>
+          <tag>DRUPAL-8-8-0</tag>
+          <status>published</status>
+          <release_link>http://example.com/drupal-8-8-0-release</release_link>
+          <download_link>http://example.com/drupal-8-8-0.tar.gz</download_link>
+          <date>1250424641</date>
+          <terms>
+            <term>
+              <name>Release type</name>
+              <value>New features</value>
+            </term>
+            <term>
+              <name>Release type</name>
+              <value>Bug fixes</value>
+            </term>
+          </terms>
+        </release>
+        <release>
+            <name>Drupal 8.1.0</name>
+            <version>8.1.0</version>
+            <tag>DRUPAL-8-1-0</tag>
+            <status>published</status>
+            <release_link>http://example.com/drupal-8-1-0-release</release_link>
+            <download_link>http://example.com/drupal-8-1-0.tar.gz</download_link>
+            <date>1250424521</date>
+            <terms>
+                <term>
+                    <name>Release type</name>
+                    <value>New features</value>
+                </term>
+                <term>
+                    <name>Release type</name>
+                    <value>Bug fixes</value>
+                </term>
+            </terms>
+        </release>
+        <release>
+            <name>Drupal 8.0.0</name>
+            <version>8.0.0</version>
+            <tag>DRUPAL-8-0-0</tag>
+            <status>published</status>
+            <release_link>http://example.com/drupal-8-0-0-release</release_link>
+            <download_link>http://example.com/drupal-8-0-0.tar.gz</download_link>
+            <date>1250424521</date>
+            <terms>
+                <term>
+                    <name>Release type</name>
+                    <value>New features</value>
+                </term>
+                <term>
+                    <name>Release type</name>
+                    <value>Bug fixes</value>
+                </term>
+            </terms>
+        </release>
+    </releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/drupal.sec.9.9.0.xml

@@ -0,0 +1,107 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+    <title>Drupal</title>
+    <short_name>drupal</short_name>
+    <dc:creator>Drupal</dc:creator>
+    <api_version>9.x</api_version>
+    <recommended_major>8</recommended_major>
+    <supported_majors>8,9</supported_majors>
+    <default_major>9</default_major>
+    <project_status>published</project_status>
+    <link>http://example.com/project/drupal</link>
+    <terms><term><name>Projects</name><value>Drupal project</value></term></terms>
+    <releases>
+        <release>
+            <name>Drupal 9.9.0</name>
+            <version>9.9.0</version>
+            <tag>DRUPAL-9-9-0</tag>
+            <status>published</status>
+            <release_link>http://example.com/drupal-9-9-0-release</release_link>
+            <download_link>http://example.com/drupal-9-9-0.tar.gz</download_link>
+            <date>1250424641</date>
+            <terms>
+                <term>
+                    <name>Release type</name>
+                    <value>New features</value>
+                </term>
+                <term>
+                    <name>Release type</name>
+                    <value>Bug fixes</value>
+                </term>
+            </terms>
+        </release>
+        <release>
+            <name>drupal 9.9.0-beta2</name>
+            <version>9.9.0-beta2</version>
+            <tag>9.9.0-beta2</tag>
+            <status>published</status>
+            <release_link>http://example.com/drupal-9-9-0-beta2-release</release_link>
+            <download_link>http://example.com/drupal-9-9-0-beta2.tar.gz</download_link>
+            <date>1533298080</date>
+            <terms>
+                <term><name>Release type</name><value>Bug fixes</value></term>
+                <term><name>Release type</name><value>New features</value></term>
+            </terms>
+            <security>
+                Beta releases are not covered by Drupal security advisories.
+            </security>
+        </release>
+        <release>
+          <name>Drupal 9.8.0</name>
+          <version>9.8.0</version>
+          <tag>DRUPAL-9-8-0</tag>
+          <status>published</status>
+          <release_link>http://example.com/drupal-9-8-0-release</release_link>
+          <download_link>http://example.com/drupal-9-8-0.tar.gz</download_link>
+          <date>1250424641</date>
+          <terms>
+            <term>
+              <name>Release type</name>
+              <value>New features</value>
+            </term>
+            <term>
+              <name>Release type</name>
+              <value>Bug fixes</value>
+            </term>
+          </terms>
+        </release>
+        <release>
+            <name>Drupal 9.1.0</name>
+            <version>9.1.0</version>
+            <tag>DRUPAL-9-1-0</tag>
+            <status>published</status>
+            <release_link>http://example.com/drupal-9-1-0-release</release_link>
+            <download_link>http://example.com/drupal-9-1-0.tar.gz</download_link>
+            <date>1250424521</date>
+            <terms>
+                <term>
+                    <name>Release type</name>
+                    <value>New features</value>
+                </term>
+                <term>
+                    <name>Release type</name>
+                    <value>Bug fixes</value>
+                </term>
+            </terms>
+        </release>
+        <release>
+            <name>Drupal 9.0.0</name>
+            <version>9.0.0</version>
+            <tag>DRUPAL-9-0-0</tag>
+            <status>published</status>
+            <release_link>http://example.com/drupal-9-0-0-release</release_link>
+            <download_link>http://example.com/drupal-9-0-0.tar.gz</download_link>
+            <date>1250424521</date>
+            <terms>
+                <term>
+                    <name>Release type</name>
+                    <value>New features</value>
+                </term>
+                <term>
+                    <name>Release type</name>
+                    <value>Bug fixes</value>
+                </term>
+            </terms>
+        </release>
+    </releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/update_test_basetheme.1_1-sec.xml

@@ -0,0 +1,42 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>Update test base theme</title>
+<short_name>update_test_basetheme</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.x-1.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/update_test_basetheme</link>
+  <terms>
+   <term><name>Projects</name><value>Themes</value></term>
+  </terms>
+<releases>
+ <release>
+  <name>update_test_basetheme 8.x-1.1</name>
+  <version>8.x-1.1</version>
+  <tag>DRUPAL-7--1-1</tag>
+  <status>published</status>
+  <release_link>http://example.com/update_test_basetheme-7-x-1-1-release</release_link>
+  <download_link>http://example.com/update_test_basetheme-8.x-1.1.tar.gz</download_link>
+  <date>1250624521</date>
+  <terms>
+   <term><name>Release type</name><value>Security update</value></term>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+  </terms>
+ </release>
+ <release>
+  <name>update_test_basetheme 8.x-1.0</name>
+  <version>8.x-1.0</version>
+  <tag>DRUPAL-7--1-0</tag>
+  <status>published</status>
+  <release_link>http://example.com/update_test_basetheme-7-x-1-0-release</release_link>
+  <download_link>http://example.com/update_test_basetheme-8.x-1.0.tar.gz</download_link>
+  <date>1250524521</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+   <term><name>Release type</name><value>Insecure</value></term>
+  </terms>
+ </release>
+</releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/update_test_new_module.1_1.xml

@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>Update test new module</title>
+<short_name>update_test_new_module</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.x-1.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/update_test_new_module</link>
+  <terms>
+   <term><name>Projects</name><value>Modules</value></term>
+  </terms>
+<releases>
+ <release>
+  <name>update_test_new_module 8.x-1.1</name>
+  <version>8.x-1.1</version>
+  <tag>DRUPAL-8--1-1</tag>
+  <status>published</status>
+  <release_link>http://example.com/update_test_new_module-8-x-1-1-release</release_link>
+  <download_link>core/modules/update/tests/update_test_new_module/8.x-1.1/update_test_new_module.tar.gz</download_link>
+  <date>1300424521</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+  </terms>
+ </release>
+</releases>
+</project>

web/core/modules/update/tests/fixtures/release-history/update_test_subtheme.1_0.xml

@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<project xmlns:dc="http://purl.org/dc/elements/1.1/">
+<title>Update test subtheme</title>
+<short_name>update_test_subtheme</short_name>
+<dc:creator>Drupal</dc:creator>
+<supported_branches>8.x-1.</supported_branches>
+<project_status>published</project_status>
+<link>http://example.com/project/update_test_subtheme</link>
+  <terms>
+   <term><name>Projects</name><value>Themes</value></term>
+  </terms>
+<releases>
+ <release>
+  <name>update_test_subtheme 8.x-1.0</name>
+  <version>8.x-1.0</version>
+  <tag>DRUPAL-7--1-0</tag>
+  <status>published</status>
+  <release_link>http://example.com/update_test_subtheme-7-x-1-0-release</release_link>
+  <download_link>http://example.com/update_test_subtheme-8.x-1.0.tar.gz</download_link>
+  <date>1250524521</date>
+  <terms>
+   <term><name>Release type</name><value>New features</value></term>
+   <term><name>Release type</name><value>Bug fixes</value></term>
+  </terms>
+ </release>
+</releases>
+</project>

web/core/modules/update/tests/modules/aaa_update_test/aaa_update_test.info.yml

@@ -0,0 +1,5 @@
+name: 'AAA Update test'
+type: module
+description: 'Support module for update module testing.'
+package: Testing
+core: 8.x

web/core/modules/update/tests/modules/bbb_update_test/bbb_update_test.info.yml

@@ -0,0 +1,5 @@
+name: 'BBB Update test'
+type: module
+description: 'Support module for update module testing.'
+package: Testing
+core: 8.x

web/core/modules/update/tests/modules/ccc_update_test/ccc_update_test.info.yml

@@ -0,0 +1,5 @@
+name: 'CCC Update test'
+type: module
+description: 'Support module for update module testing.'
+package: Testing
+core: 8.x

web/core/modules/update/tests/modules/update_test/config/install/update_test.settings.yml

@@ -0,0 +1,3 @@
+system_info: []
+update_status: []
+xml_map: []

web/core/modules/update/tests/modules/update_test/config/schema/update_test.schema.yml

@@ -0,0 +1,31 @@
+# Schema for the configuration files of the Update Test module.
+
+update_test.settings:
+  type: config_object
+  label: 'Update test settings'
+  mapping:
+    system_info:
+      type: sequence
+      label: 'System info'
+      sequence:
+        type: sequence
+        label: 'Items'
+        sequence:
+          type: string
+          label: 'Item'
+    update_status:
+      type: sequence
+      label: 'Update status'
+      sequence:
+        type: mapping
+        label: 'Module'
+        mapping:
+          status:
+            type: integer
+            label: 'Value'
+    xml_map:
+      type: sequence
+      label: 'XML map'
+      sequence:
+        type: string
+        label: 'Value'

web/core/modules/update/tests/modules/update_test/src/Controller/UpdateTestController.php

@@ -0,0 +1,75 @@
+<?php
+
+namespace Drupal\update_test\Controller;
+
+use Drupal\Core\Controller\ControllerBase;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpFoundation\BinaryFileResponse;
+
+/**
+ * Provides different routes of the update_test module.
+ */
+class UpdateTestController extends ControllerBase {
+
+  /**
+   * Displays an Error 503 (Service unavailable) page.
+   *
+   * @return \Symfony\Component\HttpFoundation\Response
+   *   Returns the response with a special header.
+   */
+  public function updateError() {
+    $response = new Response();
+    $response->setStatusCode(503);
+    $response->headers->set('Status', '503 Service unavailable');
+
+    return $response;
+  }
+
+  /**
+   * Page callback: Prints mock XML for the Update Manager module.
+   *
+   * The specific XML file to print depends on two things: the project we're
+   * trying to fetch data for, and the desired "availability scenario" for that
+   * project which we're trying to test. Before attempting to fetch this data (by
+   * checking for updates on the available updates report), callers need to define
+   * the 'update_test_xml_map' variable as an array, keyed by project name,
+   * indicating which availability scenario to use for that project.
+   *
+   * @param string $project_name
+   *   The project short name the update manager is trying to fetch data for (the
+   *   fetch URLs are of the form: [base_url]/[project_name]/[core_version]).
+   * @param string $version
+   *   The version of Drupal core.
+   *
+   * @return \Symfony\Component\HttpFoundation\BinaryFileResponse|Response
+   *   A BinaryFileResponse object containing the content of the XML release file
+   *   for the specified project if one is available; a Response object with no
+   *   content otherwise.
+   */
+  public function updateTest($project_name, $version) {
+    $xml_map = $this->config('update_test.settings')->get('xml_map');
+    if (isset($xml_map[$project_name])) {
+      $availability_scenario = $xml_map[$project_name];
+    }
+    elseif (isset($xml_map['#all'])) {
+      $availability_scenario = $xml_map['#all'];
+    }
+    else {
+      // The test didn't specify (for example, the webroot has other modules and
+      // themes installed but they're disabled by the version of the site
+      // running the test. So, we default to a file we know won't exist, so at
+      // least we'll get an empty xml response instead of a bunch of Drupal page
+      // output.
+      $availability_scenario = '#broken#';
+    }
+
+    $file = __DIR__ . "/../../../../fixtures/release-history/$project_name.$availability_scenario.xml";
+    $headers = ['Content-Type' => 'text/xml; charset=utf-8'];
+    if (!is_file($file)) {
+      // Return an empty response.
+      return new Response('', 200, $headers);
+    }
+    return new BinaryFileResponse($file, 200, $headers);
+  }
+
+}

web/core/modules/update/tests/modules/update_test/src/Datetime/TestTime.php

@@ -0,0 +1,22 @@
+<?php
+
+namespace Drupal\update_test\Datetime;
+
+use Drupal\Component\Datetime\Time;
+
+/**
+ * Test service for altering the request time.
+ */
+class TestTime extends Time {
+
+  /**
+   * {@inheritdoc}
+   */
+  public function getRequestTime() {
+    if ($mock_date = \Drupal::state()->get('update_test.mock_date', NULL)) {
+      return \DateTime::createFromFormat('Y-m-d', $mock_date)->getTimestamp();
+    }
+    return parent::getRequestTime();
+  }
+
+}

web/core/modules/update/tests/modules/update_test/src/Plugin/Archiver/UpdateTestArchiver.php

@@ -0,0 +1,46 @@
+<?php
+
+namespace Drupal\update_test\Plugin\Archiver;
+
+use Drupal\Core\Archiver\ArchiverInterface;
+
+/**
+ * Defines a test archiver implementation.
+ *
+ * @Archiver(
+ *   id = "update_test_archiver",
+ *   title = @Translation("Update Test Archiver"),
+ *   extensions = {"update-test-extension"}
+ * )
+ */
+class UpdateTestArchiver implements ArchiverInterface {
+
+  /**
+   * {@inheritdoc}
+   */
+  public function add($file_path) {
+    return $this;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function remove($path) {
+    return $this;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function extract($path, array $files = []) {
+    return $this;
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public function listContents() {
+    return [];
+  }
+
+}

web/core/modules/update/tests/modules/update_test/src/TestFileTransferWithSettingsForm.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace Drupal\update_test;
+
+use Drupal\Core\FileTransfer\Local;
+
+/**
+ * Provides an object to test the settings form functionality.
+ *
+ * This class extends \Drupal\Core\FileTransfer\Local to make module install
+ * testing via \Drupal\Core\FileTransfer\Form\FileTransferAuthorizeForm and
+ * authorize.php possible.
+ *
+ * @see \Drupal\update\Tests\FileTransferAuthorizeFormTest
+ */
+class TestFileTransferWithSettingsForm extends Local {
+
+  /**
+   * Returns a Drupal\update_test\TestFileTransferWithSettingsForm object.
+   *
+   * @return static
+   *   A new Drupal\update_test\TestFileTransferWithSettingsForm object.
+   */
+  public static function factory($jail, $settings) {
+    return new static($jail, \Drupal::service('file_system'));
+  }
+
+  /**
+   * Returns a settings form with a text field to input a username.
+   */
+  public function getSettingsForm() {
+    $form = [];
+    $form['update_test_username'] = [
+      '#type' => 'textfield',
+      '#title' => t('Update Test Username'),
+    ];
+    return $form;
+  }
+
+}

web/core/modules/update/tests/modules/update_test/update_test.info.yml

@@ -0,0 +1,5 @@
+name: 'Update test'
+type: module
+description: 'Support module for update module testing.'
+package: Testing
+core: 8.x

web/core/modules/update/tests/modules/update_test/update_test.module

@@ -0,0 +1,72 @@
+<?php
+
+/**
+ * @file
+ * Module for testing Update Manager functionality.
+ */
+
+use Drupal\Core\Extension\Extension;
+
+/**
+ * Implements hook_system_info_alter().
+ *
+ * Checks the 'update_test.settings:system_info' configuration and sees if we
+ * need to alter the system info for the given $file based on the setting. The
+ * setting is expected to be a nested associative array. If the key '#all' is
+ * defined, its subarray will include .info.yml keys and values for all modules
+ * and themes on the system. Otherwise, the settings array is keyed by the
+ * module or theme short name ($file->name) and the subarrays contain settings
+ * just for that module or theme.
+ */
+function update_test_system_info_alter(&$info, Extension $file) {
+  $setting = \Drupal::config('update_test.settings')->get('system_info');
+  foreach (['#all', $file->getName()] as $id) {
+    if (!empty($setting[$id])) {
+      foreach ($setting[$id] as $key => $value) {
+        $info[$key] = $value;
+      }
+    }
+  }
+}
+
+/**
+ * Implements hook_update_status_alter().
+ *
+ * Checks the 'update_test.settings:update_status' configuration and sees if we
+ * need to alter the update status for the given project based on the setting.
+ * The setting is expected to be a nested associative array. If the key '#all'
+ * is defined, its subarray will include .info.yml keys and values for all modules
+ * and themes on the system. Otherwise, the settings array is keyed by the
+ * module or theme short name and the subarrays contain settings just for that
+ * module or theme.
+ */
+function update_test_update_status_alter(&$projects) {
+  $setting = \Drupal::config('update_test.settings')->get('update_status');
+  if (!empty($setting)) {
+    foreach ($projects as $project_name => &$project) {
+      foreach (['#all', $project_name] as $id) {
+        if (!empty($setting[$id])) {
+          foreach ($setting[$id] as $key => $value) {
+            $project[$key] = $value;
+          }
+        }
+      }
+    }
+  }
+}
+
+/**
+ * Implements hook_filetransfer_info().
+ */
+function update_test_filetransfer_info() {
+  // Define a test file transfer method, to ensure that there will always be at
+  // least one method available in the user interface (regardless of the
+  // environment in which the update manager tests are run).
+  return [
+    'system_test' => [
+      'title' => t('Update Test FileTransfer'),
+      'class' => 'Drupal\update_test\TestFileTransferWithSettingsForm',
+      'weight' => -20,
+    ],
+  ];
+}

web/core/modules/update/tests/modules/update_test/update_test.routing.yml

@@ -0,0 +1,16 @@
+update_test.503:
+  path: '/503-error'
+  defaults:
+    _controller: '\Drupal\update_test\Controller\UpdateTestController::updateError'
+  requirements:
+    _access: 'TRUE'
+
+update_test.update_test:
+  path: '/update-test/{project_name}/{version}'
+  defaults:
+    _title: 'Update test'
+    _controller: '\Drupal\update_test\Controller\UpdateTestController::updateTest'
+    version: NULL
+    project_name: NULL
+  requirements:
+    _access: 'TRUE'

web/core/modules/update/tests/modules/update_test/update_test.services.yml

@@ -0,0 +1,4 @@
+services:
+  datetime.time:
+    class: Drupal\update_test\Datetime\TestTime
+    arguments: ['@request_stack']

web/core/modules/update/tests/src/Functional/FileTransferAuthorizeFormTest.php

@@ -0,0 +1,85 @@
+<?php
+
+namespace Drupal\Tests\update\Functional;
+
+/**
+ * Tests the Update Manager module upload via authorize.php functionality.
+ *
+ * @group update
+ */
+class FileTransferAuthorizeFormTest extends UpdateTestBase {
+
+  /**
+   * Modules to enable.
+   *
+   * @var array
+   */
+  public static $modules = ['update', 'update_test'];
+
+  /**
+   * {@inheritdoc}
+   */
+  protected $defaultTheme = 'stark';
+
+  protected function setUp() {
+    parent::setUp();
+    $admin_user = $this->drupalCreateUser(['administer modules', 'administer software updates', 'administer site configuration']);
+    $this->drupalLogin($admin_user);
+
+    // Create a local cache so the module is not downloaded from drupal.org.
+    $cache_directory = _update_manager_cache_directory(TRUE);
+    foreach (['.tar.gz', '.zip'] as $extension) {
+      $filename = 'update_test_new_module' . $extension;
+      copy(
+        __DIR__ . '/../../update_test_new_module/8.x-1.0/' . $filename,
+        $cache_directory . '/' . $filename
+      );
+    }
+  }
+
+  /**
+   * Tests the Update Manager module upload via authorize.php functionality.
+   *
+   * @dataProvider archiveFileUrlProvider
+   */
+  public function testViaAuthorize($url) {
+    // Ensure the that we can select which file transfer backend to use.
+    \Drupal::state()->set('test_uploaders_via_prompt', TRUE);
+
+    // Ensure the module does not already exist.
+    $this->drupalGet('admin/modules');
+    $this->assertNoText('Update test new module');
+
+    $edit = [
+      'project_url' => $url,
+    ];
+    $this->drupalPostForm('admin/modules/install', $edit, t('Install'));
+    $edit = [
+      'connection_settings[authorize_filetransfer_default]' => 'system_test',
+      'connection_settings[system_test][update_test_username]' => $this->randomMachineName(),
+    ];
+    $this->drupalPostForm(NULL, $edit, t('Continue'));
+    $this->assertText(t('Installation was completed successfully.'));
+
+    // Ensure the module is available to install.
+    $this->drupalGet('admin/modules');
+    $this->assertText('Update test new module');
+  }
+
+  /**
+   * Data provider method for testViaAuthorize().
+   *
+   * Each of these release URLs has been cached in the setUp() method.
+   */
+  public function archiveFileUrlProvider() {
+    return [
+      'tar.gz' => [
+        'url' => 'https://ftp.drupal.org/files/projects/update_test_new_module.tar.gz',
+      ],
+      'zip' => [
+        'url' => 'https://ftp.drupal.org/files/projects/update_test_new_module.zip',
+      ],
+    ];
+  }
+
+}

web/core/modules/update/tests/src/Functional/UpdateContribTest.php

@@ -0,0 +1,884 @@
+<?php
+
+namespace Drupal\Tests\update\Functional;
+
+use Drupal\Core\Link;
+use Drupal\Core\Url;
+use Drupal\Core\Utility\ProjectInfo;
+use Drupal\update\UpdateManagerInterface;
+
+/**
+ * Tests how the Update Manager module handles contributed modules and themes in
+ * a series of functional tests using mock XML data.
+ *
+ * @group update
+ */
+class UpdateContribTest extends UpdateTestBase {
+
+  /**
+   * {@inheritdoc}
+   */
+  protected $updateTableLocator = 'table.update:nth-of-type(2)';
+
+  /**
+   * {@inheritdoc}
+   */
+  protected $updateProject = 'aaa_update_test';
+
+  /**
+   * Modules to enable.
+   *
+   * @var array
+   */
+  public static $modules = [
+    'update_test',
+    'update',
+    'aaa_update_test',
+    'bbb_update_test',
+    'ccc_update_test',
+  ];
+
+  /**
+   * {@inheritdoc}
+   */
+  protected $defaultTheme = 'stark';
+
+  protected function setUp() {
+    parent::setUp();
+    $admin_user = $this->drupalCreateUser(['administer site configuration']);
+    $this->drupalLogin($admin_user);
+  }
+
+  /**
+   * Tests when there is no available release data for a contrib module.
+   */
+  public function testNoReleasesAvailable() {
+    $system_info = [
+      '#all' => [
+        'version' => '8.0.0',
+      ],
+      'aaa_update_test' => [
+        'project' => 'aaa_update_test',
+        'version' => '8.x-1.0',
+        'hidden' => FALSE,
+      ],
+    ];
+    $this->config('update_test.settings')->set('system_info', $system_info)->save();
+    $this->refreshUpdateStatus(['drupal' => '0.0', 'aaa_update_test' => 'no-releases']);
+    $this->drupalGet('admin/reports/updates');
+    // Cannot use $this->standardTests() because we need to check for the
+    // 'No available releases found' string.
+    $this->assertRaw('<h3>' . t('Drupal core') . '</h3>');
+    $this->assertRaw(Link::fromTextAndUrl(t('Drupal'), Url::fromUri('http://example.com/project/drupal'))->toString());
+    $this->assertText(t('Up to date'));
+    $this->assertRaw('<h3>' . t('Modules') . '</h3>');
+    $this->assertNoText(t('Update available'));
+    $this->assertText(t('No available releases found'));
+    $this->assertNoRaw(Link::fromTextAndUrl(t('AAA Update test'), Url::fromUri('http://example.com/project/aaa_update_test'))->toString());
+
+    $available = update_get_available();
+    $this->assertFalse(isset($available['aaa_update_test']['fetch_status']), 'Results are cached even if no releases are available.');
+  }
+
+  /**
+   * Tests the basic functionality of a contrib module on the status report.
+   */
+  public function testUpdateContribBasic() {
+    $project_link = Link::fromTextAndUrl(t('AAA Update test'), Url::fromUri('http://example.com/project/aaa_update_test'))->toString();
+    $system_info = [
+      '#all' => [
+        'version' => '8.0.0',
+      ],
+      'aaa_update_test' => [
+        'project' => 'aaa_update_test',
+        'version' => '8.x-1.0',
+        'hidden' => FALSE,
+      ],
+    ];
+    $this->config('update_test.settings')->set('system_info', $system_info)->save();
+    $this->refreshUpdateStatus(
+      [
+        'drupal' => '0.0',
+        'aaa_update_test' => '1_0',
+      ]
+    );
+    $this->standardTests();
+    $this->assertText(t('Up to date'));
+    $this->assertRaw('<h3>' . t('Modules') . '</h3>');
+    $this->assertNoText(t('Update available'));
+    $this->assertRaw($project_link, 'Link to aaa_update_test project appears.');
+
+    // Since aaa_update_test is installed the fact it is hidden and in the
+    // Testing package means it should not appear.
+    $system_info['aaa_update_test']['hidden'] = TRUE;
+    $this->config('update_test.settings')->set('system_info', $system_info)->save();
+    $this->refreshUpdateStatus(
+      [
+        'drupal' => '0.0',
+        'aaa_update_test' => '1_0',
+      ]
+    );
+    $this->assertNoRaw($project_link, 'Link to aaa_update_test project does not appear.');
+
+    // A hidden and installed project not in the Testing package should appear.
+    $system_info['aaa_update_test']['package'] = 'aaa_update_test';
+    $this->config('update_test.settings')->set('system_info', $system_info)->save();
+    $this->refreshUpdateStatus(
+      [
+        'drupal' => '0.0',
+        'aaa_update_test' => '1_0',
+      ]
+    );
+    $this->assertRaw($project_link, 'Link to aaa_update_test project appears.');
+  }
+
+  /**
+   * Tests that contrib projects are ordered by project name.
+   *
+   * If a project contains multiple modules, we want to make sure that the
+   * available updates report is sorted by the parent project names, not by the
+   * names of the modules included in each project. In this test case, we have
+   * two contrib projects, "BBB Update test" and "CCC Update test". However, we
+   * have a module called "aaa_update_test" that's part of the "CCC Update test"
+   * project. We need to make sure that we see the "BBB" project before the
+   * "CCC" project, even though "CCC" includes a module that's processed first
+   * if you sort alphabetically by module name (which is the order we see things
+   * inside \Drupal\Core\Extension\ExtensionList::getList() for example).
+   */
+  public function testUpdateContribOrder() {
+    // We want core to be version 8.0.0.
+    $system_info = [
+      '#all' => [
+        'version' => '8.0.0',
+      ],
+      // All the rest should be visible as contrib modules at version 8.x-1.0.
+
+      // aaa_update_test needs to be part of the "CCC Update test" project,
+      // which would throw off the report if we weren't properly sorting by
+      // the project names.
+      'aaa_update_test' => [
+        'project' => 'ccc_update_test',
+        'version' => '8.x-1.0',
+        'hidden' => FALSE,
+      ],
+
+      // This should be its own project, and listed first on the report.
+      'bbb_update_test' => [
+        'project' => 'bbb_update_test',
+        'version' => '8.x-1.0',
+        'hidden' => FALSE,
+      ],
+
+      // This will contain both aaa_update_test and ccc_update_test, and
+      // should come after the bbb_update_test project.
+      'ccc_update_test' => [
+        'project' => 'ccc_update_test',
+        'version' => '8.x-1.0',
+        'hidden' => FALSE,
+      ],
+    ];
+    $this->config('update_test.settings')->set('system_info', $system_info)->save();
+    $this->refreshUpdateStatus(['drupal' => '0.0', '#all' => '1_0']);
+    $this->standardTests();
+    // We're expecting the report to say all projects are up to date.
+    $this->assertText(t('Up to date'));
+    $this->assertNoText(t('Update available'));
+    // We want to see all 3 module names listed, since they'll show up either
+    // as project names or as modules under the "Includes" listing.
+    $this->assertText(t('AAA Update test'));
+    $this->assertText(t('BBB Update test'));
+    $this->assertText(t('CCC Update test'));
+    // We want aaa_update_test included in the ccc_update_test project, not as
+    // its own project on the report.
+    $this->assertNoRaw(Link::fromTextAndUrl(t('AAA Update test'), Url::fromUri('http://example.com/project/aaa_update_test'))->toString(), 'Link to aaa_update_test project does not appear.');
+    // The other two should be listed as projects.
+    $this->assertRaw(Link::fromTextAndUrl(t('BBB Update test'), Url::fromUri('http://example.com/project/bbb_update_test'))->toString(), 'Link to bbb_update_test project appears.');
+    $this->assertRaw(Link::fromTextAndUrl(t('CCC Update test'), Url::fromUri('http://example.com/project/ccc_update_test'))->toString(), 'Link to bbb_update_test project appears.');
+
+    // We want to make sure we see the BBB project before the CCC project.
+    // Instead of just searching for 'BBB Update test' or something, we want
+    // to use the full markup that starts the project entry itself, so that
+    // we're really testing that the project listings are in the right order.
+    $bbb_project_link = '<div class="project-update__title"><a href="http://example.com/project/bbb_update_test">BBB Update test</a>';
+    $ccc_project_link = '<div class="project-update__title"><a href="http://example.com/project/ccc_update_test">CCC Update test</a>';
+    $this->assertTrue(strpos($this->getSession()->getPage()->getContent(), $bbb_project_link) < strpos($this->getSession()->getPage()->getContent(), $ccc_project_link), "'BBB Update test' project is listed before the 'CCC Update test' project");
+  }
+
+  /**
+   * Tests that subthemes are notified about security updates for base themes.
+   */
+  public function testUpdateBaseThemeSecurityUpdate() {
+    // @todo https://www.drupal.org/node/2338175 base themes have to be
+    //  installed.
+    // Only install the subtheme, not the base theme.
+    \Drupal::service('theme_installer')->install(['update_test_subtheme']);
+
+    // Define the initial state for core and the subtheme.
+    $system_info = [
+      // We want core to be version 8.0.0.
+      '#all' => [
+        'version' => '8.0.0',
+      ],
+      // Show the update_test_basetheme
+      'update_test_basetheme' => [
+        'project' => 'update_test_basetheme',
+        'version' => '8.x-1.0',
+        'hidden' => FALSE,
+      ],
+      // Show the update_test_subtheme
+      'update_test_subtheme' => [
+        'project' => 'update_test_subtheme',
+        'version' => '8.x-1.0',
+        'hidden' => FALSE,
+      ],
+    ];
+    $this->config('update_test.settings')->set('system_info', $system_info)->save();
+    $xml_mapping = [
+      'drupal' => '0.0',
+      'update_test_subtheme' => '1_0',
+      'update_test_basetheme' => '1_1-sec',
+    ];
+    $this->refreshUpdateStatus($xml_mapping);
+    $this->assertText(t('Security update required!'));
+    $this->assertRaw(Link::fromTextAndUrl(t('Update test base theme'), Url::fromUri('http://example.com/project/update_test_basetheme'))->toString(), 'Link to the Update test base theme project appears.');
+  }
+
+  /**
+   * Tests the Update Manager module when one normal update is available.
+   */
+  public function testNormalUpdateAvailable() {
+    $assert_session = $this->assertSession();
+    // Ensure that the update check requires a token.
+    $this->drupalGet('admin/reports/updates/check');
+    $assert_session->statusCodeEquals(403);
+
+    $system_info = [
+      'aaa_update_test' => [
+        'project' => 'aaa_update_test',
+        'version' => '8.x-1.0',
+        'hidden' => FALSE,
+      ],
+    ];
+    $this->config('update_test.settings')->set('system_info', $system_info)->save();
+
+    foreach (['1.1', '1.2', '2.0'] as $version) {
+      foreach (['-beta1', '-alpha1', ''] as $extra_version) {
+        $full_version = "8.x-$version$extra_version";
+        $this->refreshUpdateStatus([
+          'drupal' => '0.0',
+          'aaa_update_test' => str_replace('.', '_', $version) . $extra_version,
+        ]);
+        $this->standardTests();
+        $this->drupalGet('admin/reports/updates');
+        $this->clickLink('Check manually');
+        $this->checkForMetaRefresh();
+        $assert_session->pageTextNotContains('Security update required!');
+        // The XML test fixtures for this method all contain the '8.x-3.0'
+        // release but because '8.x-3.0' is not in a supported branch it will
+        // not be in the available updates.
+        $this->assertNoRaw('8.x-3.0');
+        // Set a CSS selector in order for assertions to target the 'Modules'
+        // table and not Drupal core updates.
+        $this->updateTableLocator = 'table.update:nth-of-type(2)';
+        switch ($version) {
+          case '1.1':
+            // Both stable and unstable releases are available.
+            // A stable release is the latest.
+            if ($extra_version == '') {
+              $assert_session->elementTextNotContains('css', $this->updateTableLocator, 'Up to date');
+              $assert_session->elementTextContains('css', $this->updateTableLocator, 'Update available');
+              $this->assertVersionUpdateLinks('Recommended version', $full_version);
+              $assert_session->elementTextNotContains('css', $this->updateTableLocator, 'Latest version:');
+              $assert_session->elementContains('css', $this->updateTableLocator, 'warning.svg');
+            }
+            // Only unstable releases are available.
+            // An unstable release is the latest.
+            else {
+              $assert_session->elementTextContains('css', $this->updateTableLocator, 'Up to date');
+              $assert_session->elementTextNotContains('css', $this->updateTableLocator, 'Update available');
+              $assert_session->elementTextNotContains('css', $this->updateTableLocator, 'Recommended version:');
+              $this->assertVersionUpdateLinks('Latest version', $full_version);
+              $assert_session->elementContains('css', $this->updateTableLocator, 'check.svg');
+            }
+            break;
+
+          case '1.2':
+            // Both stable and unstable releases are available.
+            // A stable release is the latest.
+            if ($extra_version == '') {
+              $assert_session->elementTextNotContains('css', $this->updateTableLocator, 'Up to date');
+              $assert_session->elementTextContains('css', $this->updateTableLocator, 'Update available');
+              $this->assertVersionUpdateLinks('Recommended version:', $full_version);
+              $assert_session->elementTextNotContains('css', $this->updateTableLocator, 'Latest version:');
+              $assert_session->elementContains('css', $this->updateTableLocator, 'warning.svg');
+            }
+            // Both stable and unstable releases are available.
+            // An unstable release is the latest.
+            else {
+              $assert_session->elementTextNotContains('css', $this->updateTableLocator, 'Up to date');
+              $assert_session->elementTextContains('css', $this->updateTableLocator, 'Update available');
+              $this->assertVersionUpdateLinks('Recommended version:', '8.x-1.1');
+              $this->assertVersionUpdateLinks('Latest version:', $full_version);
+              $assert_session->elementTextContains('css', $this->updateTableLocator, 'Latest version:');
+              $assert_session->elementContains('css', $this->updateTableLocator, 'warning.svg');
+            }
+            break;
+
+          case '2.0':
+            // When next major release (either stable or unstable) is available
+            // and the current major is still supported, the next major will be
+            // listed as "Also available".
+            $assert_session->elementTextNotContains('css', $this->updateTableLocator, 'Up to date');
+            $assert_session->elementTextContains('css', $this->updateTableLocator, 'Update available');
+            $this->assertVersionUpdateLinks('Recommended version', '8.x-1.2');
+            $this->assertVersionUpdateLinks('Also available', $full_version);
+            $assert_session->elementTextNotContains('css', $this->updateTableLocator, 'Latest version:');
+            $assert_session->elementContains('css', $this->updateTableLocator, 'warning.svg');
+        }
+      }
+    }
+  }
+
+  /**
+   * Tests that disabled themes are only shown when desired.
+   *
+   * @todo https://www.drupal.org/node/2338175 extensions can not be hidden and
+   *   base themes have to be installed.
+   */
+  public function testUpdateShowDisabledThemes() {
+    $update_settings = $this->config('update.settings');
+    // Make sure all the update_test_* themes are disabled.
+    $extension_config = $this->config('core.extension');
+    foreach ($extension_config->get('theme') as $theme => $weight) {
+      if (preg_match('/^update_test_/', $theme)) {
+        $extension_config->clear("theme.$theme");
+      }
+    }
+    $extension_config->save();
+
+    // Define the initial state for core and the test contrib themes.
+    $system_info = [
+      // We want core to be version 8.0.0.
+      '#all' => [
+        'version' => '8.0.0',
+      ],
+      // The update_test_basetheme should be visible and up to date.
+      'update_test_basetheme' => [
+        'project' => 'update_test_basetheme',
+        'version' => '8.x-1.1',
+        'hidden' => FALSE,
+      ],
+      // The update_test_subtheme should be visible and up to date.
+      'update_test_subtheme' => [
+        'project' => 'update_test_subtheme',
+        'version' => '8.x-1.0',
+        'hidden' => FALSE,
+      ],
+    ];
+    // When there are contributed modules in the site's file system, the
+    // total number of attempts made in the test may exceed the default value
+    // of update_max_fetch_attempts. Therefore this variable is set very high
+    // to avoid test failures in those cases.
+    $update_settings->set('fetch.max_attempts', 99999)->save();
+    $this->config('update_test.settings')->set('system_info', $system_info)->save();
+    $xml_mapping = [
+      'drupal' => '0.0',
+      'update_test_subtheme' => '1_0',
+      'update_test_basetheme' => '1_1-sec',
+    ];
+    $base_theme_project_link = Link::fromTextAndUrl(t('Update test base theme'), Url::fromUri('http://example.com/project/update_test_basetheme'))->toString();
+    $sub_theme_project_link = Link::fromTextAndUrl(t('Update test subtheme'), Url::fromUri('http://example.com/project/update_test_subtheme'))->toString();
+    foreach ([TRUE, FALSE] as $check_disabled) {
+      $update_settings->set('check.disabled_extensions', $check_disabled)->save();
+      $this->refreshUpdateStatus($xml_mapping);
+      // In neither case should we see the "Themes" heading for installed
+      // themes.
+      $this->assertNoText(t('Themes'));
+      if ($check_disabled) {
+        $this->assertText(t('Uninstalled themes'));
+        $this->assertRaw($base_theme_project_link, 'Link to the Update test base theme project appears.');
+        $this->assertRaw($sub_theme_project_link, 'Link to the Update test subtheme project appears.');
+      }
+      else {
+        $this->assertNoText(t('Uninstalled themes'));
+        $this->assertNoRaw($base_theme_project_link, 'Link to the Update test base theme project does not appear.');
+        $this->assertNoRaw($sub_theme_project_link, 'Link to the Update test subtheme project does not appear.');
+      }
+    }
+  }
+
+  /**
+   * Tests updates with a hidden base theme.
+   */
+  public function testUpdateHiddenBaseTheme() {
+    module_load_include('compare.inc', 'update');
+
+    // Install the subtheme.
+    \Drupal::service('theme_installer')->install(['update_test_subtheme']);
+
+    // Add a project and initial state for base theme and subtheme.
+    $system_info = [
+      // Hide the update_test_basetheme.
+      'update_test_basetheme' => [
+        'project' => 'update_test_basetheme',
+        'hidden' => TRUE,
+      ],
+      // Show the update_test_subtheme.
+      'update_test_subtheme' => [
+        'project' => 'update_test_subtheme',
+        'hidden' => FALSE,
+      ],
+    ];
+    $this->config('update_test.settings')->set('system_info', $system_info)->save();
+    $projects = \Drupal::service('update.manager')->getProjects();
+    $theme_data = \Drupal::service('theme_handler')->rebuildThemeData();
+    $project_info = new ProjectInfo();
+    $project_info->processInfoList($projects, $theme_data, 'theme', TRUE);
+
+    $this->assertTrue(!empty($projects['update_test_basetheme']), 'Valid base theme (update_test_basetheme) was found.');
+  }
+
+  /**
+   * Makes sure that if we fetch from a broken URL, sane things happen.
+   */
+  public function testUpdateBrokenFetchURL() {
+    $system_info = [
+      '#all' => [
+        'version' => '8.0.0',
+      ],
+      'aaa_update_test' => [
+        'project' => 'aaa_update_test',
+        'version' => '8.x-1.0',
+        'hidden' => FALSE,
+      ],
+      'bbb_update_test' => [
+        'project' => 'bbb_update_test',
+        'version' => '8.x-1.0',
+        'hidden' => FALSE,
+      ],
+      'ccc_update_test' => [
+        'project' => 'ccc_update_test',
+        'version' => '8.x-1.0',
+        'hidden' => FALSE,
+      ],
+    ];
+    $this->config('update_test.settings')->set('system_info', $system_info)->save();
+
+    // Ensure that the update information is correct before testing.
+    $this->drupalGet('admin/reports/updates');
+
+    $xml_mapping = [
+      'drupal' => '0.0',
+      'aaa_update_test' => '1_0',
+      'bbb_update_test' => 'does-not-exist',
+      'ccc_update_test' => '1_0',
+    ];
+    $this->refreshUpdateStatus($xml_mapping);
+
+    $this->assertText(t('Up to date'));
+    // We're expecting the report to say most projects are up to date, so we
+    // hope that 'Up to date' is not unique.
+    $this->assertNoUniqueText(t('Up to date'));
+    // It should say we failed to get data, not that we're missing an update.
+    $this->assertNoText(t('Update available'));
+
+    // We need to check that this string is found as part of a project row, not
+    // just in the "Failed to get available update data" message at the top of
+    // the page.
+    $this->assertRaw('<div class="project-update__status">' . t('Failed to get available update data'));
+
+    // We should see the output messages from fetching manually.
+    $this->assertUniqueText(t('Checked available update data for 3 projects.'));
+    $this->assertUniqueText(t('Failed to get available update data for one project.'));
+
+    // The other two should be listed as projects.
+    $this->assertRaw(Link::fromTextAndUrl(t('AAA Update test'), Url::fromUri('http://example.com/project/aaa_update_test'))->toString(), 'Link to aaa_update_test project appears.');
+    $this->assertNoRaw(Link::fromTextAndUrl(t('BBB Update test'), Url::fromUri('http://example.com/project/bbb_update_test'))->toString(), 'Link to bbb_update_test project does not appear.');
+    $this->assertRaw(Link::fromTextAndUrl(t('CCC Update test'), Url::fromUri('http://example.com/project/ccc_update_test'))->toString(), 'Link to bbb_update_test project appears.');
+  }
+
+  /**
+   * Checks that hook_update_status_alter() works to change a status.
+   *
+   * We provide the same external data as if aaa_update_test 8.x-1.0 were
+   * installed and that was the latest release. Then we use
+   * hook_update_status_alter() to try to mark this as missing a security
+   * update, then assert if we see the appropriate warnings on the right pages.
+   */
+  public function testHookUpdateStatusAlter() {
+    $update_test_config = $this->config('update_test.settings');
+    $update_admin_user = $this->drupalCreateUser(['administer site configuration', 'administer software updates']);
+    $this->drupalLogin($update_admin_user);
+
+    $system_info = [
+      '#all' => [
+        'version' => '8.0.0',
+      ],
+      'aaa_update_test' => [
+        'project' => 'aaa_update_test',
+        'version' => '8.x-1.0',
+        'hidden' => FALSE,
+      ],
+    ];
+    $update_test_config->set('system_info', $system_info)->save();
+    $update_status = [
+      'aaa_update_test' => [
+        'status' => UpdateManagerInterface::NOT_SECURE,
+      ],
+    ];
+    $update_test_config->set('update_status', $update_status)->save();
+    $this->refreshUpdateStatus(
+      [
+        'drupal' => '0.0',
+        'aaa_update_test' => '1_0',
+      ]
+    );
+    $this->drupalGet('admin/reports/updates');
+    $this->assertRaw('<h3>' . t('Modules') . '</h3>');
+    $this->assertText(t('Security update required!'));
+    $this->assertRaw(Link::fromTextAndUrl(t('AAA Update test'), Url::fromUri('http://example.com/project/aaa_update_test'))->toString(), 'Link to aaa_update_test project appears.');
+
+    // Visit the reports page again without the altering and make sure the
+    // status is back to normal.
+    $update_test_config->set('update_status', [])->save();
+    $this->drupalGet('admin/reports/updates');
+    $this->assertRaw('<h3>' . t('Modules') . '</h3>');
+    $this->assertNoText(t('Security update required!'));
+    $this->assertRaw(Link::fromTextAndUrl(t('AAA Update test'), Url::fromUri('http://example.com/project/aaa_update_test'))->toString(), 'Link to aaa_update_test project appears.');
+
+    // Turn the altering back on and visit the Update manager UI.
+    $update_test_config->set('update_status', $update_status)->save();
+    $this->drupalGet('admin/modules/update');
+    $this->assertText(t('Security update'));
+
+    // Turn the altering back off and visit the Update manager UI.
+    $update_test_config->set('update_status', [])->save();
+    $this->drupalGet('admin/modules/update');
+    $this->assertNoText(t('Security update'));
+  }
+
+  /**
+   * Tests that core compatibility messages are displayed.
+   */
+  public function testCoreCompatibilityMessage() {
+    $system_info = [
+      '#all' => [
+        'version' => '8.0.0',
+      ],
+      'aaa_update_test' => [
+        'project' => 'aaa_update_test',
+        'version' => '8.x-1.0',
+        'hidden' => FALSE,
+      ],
+    ];
+    $this->config('update_test.settings')->set('system_info', $system_info)->save();
+
+    // Confirm that messages are displayed for recommended and latest updates.
+    // @todo In https://www.drupal.org/project/drupal/issues/3112962:
+    //   Change the calls to 'refreshUpdateStatus()' to use:
+    //   - '1.1' instead of '1.1-core_compatibility'.
+    //   - '1.1-alpha1' instead of '1.1-alpha1-core_compatibility'.
+    //   Delete the files:
+    //   - core/modules/update/tests/modules/update_test/drupal.1.1-alpha1-core_compatibility.xml
+    //   - core/modules/update/tests/modules/update_test/drupal.1.1-core_compatibility.xml
+    $this->refreshUpdateStatus(['drupal' => '1.1-core_compatibility', 'aaa_update_test' => '8.x-1.2']);
+    $this->assertCoreCompatibilityMessage('8.x-1.2', '8.0.0 to 8.1.1', 'Recommended version:');
+    $this->assertCoreCompatibilityMessage('8.x-1.3-beta1', '8.0.0, 8.1.1', 'Latest version:');
+
+    // Change the available core releases and confirm that the messages change.
+    $this->refreshUpdateStatus(['drupal' => '1.1-alpha1-core_compatibility', 'aaa_update_test' => '8.x-1.2']);
+    $this->assertCoreCompatibilityMessage('8.x-1.2', '8.0.0 to 8.1.0', 'Recommended version:');
+    $this->assertCoreCompatibilityMessage('8.x-1.3-beta1', '8.0.0', 'Latest version:');
+
+    // Confirm that messages are displayed for security and 'Also available'
+    // updates.
+    $this->refreshUpdateStatus(['drupal' => '1.1-core_compatibility', 'aaa_update_test' => 'core_compatibility.8.x-1.2_8.x-2.2']);
+    $this->assertCoreCompatibilityMessage('8.x-1.2', '8.1.0 to 8.1.1', 'Security update:', FALSE);
+    $this->assertCoreCompatibilityMessage('8.x-2.2', '8.1.1', 'Also available:', FALSE);
+  }
+
+  /**
+   * Tests update status of security releases.
+   *
+   * @param string $module_version
+   *   The module version the site is using.
+   * @param string[] $expected_security_releases
+   *   The security releases, if any, that the status report should recommend.
+   * @param string $expected_update_message_type
+   *   The type of update message expected.
+   * @param string $fixture
+   *   The fixture file to use.
+   *
+   * @dataProvider securityUpdateAvailabilityProvider
+   */
+  public function testSecurityUpdateAvailability($module_version, array $expected_security_releases, $expected_update_message_type, $fixture) {
+    $system_info = [
+      '#all' => [
+        'version' => '8.0.0',
+      ],
+      'aaa_update_test' => [
+        'project' => 'aaa_update_test',
+        'version' => $module_version,
+        'hidden' => FALSE,
+      ],
+    ];
+    $this->config('update_test.settings')->set('system_info', $system_info)->save();
+    $this->refreshUpdateStatus(['drupal' => '0.0', 'aaa_update_test' => $fixture]);
+    $this->assertSecurityUpdates('aaa_update_test', $expected_security_releases, $expected_update_message_type, 'table.update:nth-of-type(2)');
+  }
+
+  /**
+   * Data provider method for testSecurityUpdateAvailability().
+   *
+   * These test cases rely on the following fixtures containing the following
+   * releases:
+   * - aaa_update_test.sec.8.x-1.2.xml
+   *   - 8.x-1.2 Security update
+   *   - 8.x-1.1 Insecure
+   *   - 8.x-1.0 Insecure
+   * - aaa_update_test.sec.8.x-1.1_8.x-1.2.xml
+   *   - 8.x-1.2 Security update
+   *   - 8.x-1.1 Security update, Insecure
+   *   - 8.x-1.0 Insecure
+   * - aaa_update_test.sec.8.x-1.2_8.x-2.2.xml
+   *   - 8.x-3.0-beta2
+   *   - 8.x-3.0-beta1 Insecure
+   *   - 8.x-2.2 Security update
+   *   - 8.x-2.1 Security update, Insecure
+   *   - 8.x-2.0 Insecure
+   *   - 8.x-1.2 Security update
+   *   - 8.x-1.1 Insecure
+   *   - 8.x-1.0 Insecure
+   * - aaa_update_test.sec.8.x-2.2_1.x_secure.xml
+   *   - 8.x-2.2 Security update
+   *   - 8.x-2.1 Security update, Insecure
+   *   - 8.x-2.0 Insecure
+   *   - 8.x-1.2
+   *   - 8.x-1.1
+   *   - 8.x-1.0
+   */
+  public function securityUpdateAvailabilityProvider() {
+    return [
+      // Security releases available for module major release 1.
+      // No releases for next major.
+      '8.x-1.0, 8.x-1.2' => [
+        'module_patch_version' => '8.x-1.0',
+        'expected_security_releases' => ['8.x-1.2'],
+        'expected_update_message_type' => static::SECURITY_UPDATE_REQUIRED,
+        'fixture' => 'sec.8.x-1.2',
+      ],
+      // Two security releases available for module major release 1.
+      // 8.x-1.1 security release marked as insecure.
+      // No releases for next major.
+      '8.x-1.0, 8.x-1.1 8.x-1.2' => [
+        'module_patch_version' => '8.x-1.0',
+        'expected_security_releases' => ['8.x-1.2'],
+        'expected_update_message_type' => static::SECURITY_UPDATE_REQUIRED,
+        'fixture' => 'sec.8.x-1.1_8.x-1.2',
+      ],
+      // Security release available for module major release 2.
+      // No releases for next major.
+      '8.x-2.0, 8.x-2.2' => [
+        'module_patch_version' => '8.x-2.0',
+        'expected_security_releases' => ['8.x-2.2'],
+        'expected_update_message_type' => static::SECURITY_UPDATE_REQUIRED,
+        'fixture' => 'sec.8.x-2.2_1.x_secure',
+      ],
+      '8.x-2.2, 8.x-1.2 8.x-2.2' => [
+        'module_patch_version' => '8.x-2.2',
+        'expected_security_releases' => [],
+        'expected_update_message_type' => static::UPDATE_NONE,
+        'fixture' => 'sec.8.x-1.2_8.x-2.2',
+      ],
+      // Security release available for module major release 1.
+      // Security release also available for next major.
+      '8.x-1.0, 8.x-1.2 8.x-2.2' => [
+        'module_patch_version' => '8.x-1.0',
+        'expected_security_releases' => ['8.x-1.2'],
+        'expected_update_message_type' => static::SECURITY_UPDATE_REQUIRED,
+        'fixture' => 'sec.8.x-1.2_8.x-2.2',
+      ],
+      // No security release available for module major release 1 but 1.x
+      // releases are not marked as insecure.
+      // Security release available for next major.
+      '8.x-1.0, 8.x-2.2, not insecure' => [
+        'module_patch_version' => '8.x-1.0',
+        'expected_security_releases' => [],
+        'expected_update_message_type' => static::UPDATE_AVAILABLE,
+        'fixture' => 'sec.8.x-2.2_1.x_secure',
+      ],
+      // On latest security release for module major release 1.
+      // Security release also available for next major.
+      '8.x-1.2, 8.x-1.2 8.x-2.2' => [
+        'module_patch_version' => '8.x-1.2',
+        'expected_security_release' => [],
+        'expected_update_message_type' => static::UPDATE_NONE,
+        'fixture' => 'sec.8.x-1.2_8.x-2.2',
+      ],
+      '8.x-2.0, 8.x-1.2 8.x-2.2' => [
+        'module_patch_version' => '8.x-2.0',
+        'expected_security_releases' => ['8.x-2.2'],
+        'expected_update_message_type' => static::SECURITY_UPDATE_REQUIRED,
+        'fixture' => 'sec.8.x-1.2_8.x-2.2',
+      ],
+      // @todo In https://www.drupal.org/node/2865920 add test cases:
+      //   - 8.x-3.0-beta1 using fixture 'sec.8.x-1.2_8.x-2.2' to ensure that
+      //     8.x-2.2 is the  only security update.
+    ];
+  }
+
+  /**
+   * Tests messages when a project release is unpublished.
+   *
+   * This test confirms that revoked messages are displayed regardless of
+   * whether the installed version is in a supported branch or not. This test
+   * relies on 2 test XML fixtures that are identical except for the
+   * 'supported_branches' value:
+   * - aaa_update_test.1_0-supported.xml
+   *    'supported_branches' is '8.x-1.,8.x-2.'.
+   * - aaa_update_test.1_0-unsupported.xml
+   *    'supported_branches' is '8.x-2.'.
+   * They both have an '8.x-1.0' release that is unpublished and an '8.x-2.0'
+   * release that is published and is the expected update.
+   */
+  public function testRevokedRelease() {
+    $system_info = [
+      'aaa_update_test' => [
+        'project' => 'aaa_update_test',
+        'version' => '8.x-1.0',
+        'hidden' => FALSE,
+      ],
+    ];
+    $this->config('update_test.settings')->set('system_info', $system_info)->save();
+    $this->refreshUpdateStatus([
+      'drupal' => '0.0',
+      $this->updateProject => '1_0-supported',
+    ]);
+    // @todo Change the version label to 'Recommended version:' in
+    // https://www.drupal.org/node/3114408.
+    $this->confirmRevokedStatus('8.x-1.0', '8.x-2.0', 'Also available:');
+
+    $this->refreshUpdateStatus([
+      'drupal' => '0.0',
+      $this->updateProject => '1_0-unsupported',
+    ]);
+    $this->confirmRevokedStatus('8.x-1.0', '8.x-2.0', 'Recommended version:');
+  }
+
+  /**
+   * Tests messages when a project release is marked unsupported.
+   *
+   * This test confirms unsupported messages are displayed regardless of whether
+   * the installed version is in a supported branch or not. This test relies on
+   * 2 test XML fixtures that are identical except for the 'supported_branches'
+   * value:
+   * - aaa_update_test.1_0-supported.xml
+   *    'supported_branches' is '8.x-1.,8.x-2.'.
+   * - aaa_update_test.1_0-unsupported.xml
+   *    'supported_branches' is '8.x-2.'.
+   * They both have an '8.x-1.1' release that has the 'Release type' value of
+   * 'unsupported' and an '8.x-2.0' release that has the 'Release type' value of
+   * 'supported' and is the expected update.
+   */
+  public function testUnsupportedRelease() {
+    $system_info = [
+      'aaa_update_test' => [
+        'project' => 'aaa_update_test',
+        'version' => '8.x-1.1',
+        'hidden' => FALSE,
+      ],
+    ];
+    $this->config('update_test.settings')->set('system_info', $system_info)->save();
+    $this->refreshUpdateStatus([
+      'drupal' => '0.0',
+      $this->updateProject => '1_0-supported',
+    ]);
+    // @todo Change the version label to 'Recommended version:' in
+    // https://www.drupal.org/node/3114408.
+    $this->confirmUnsupportedStatus('8.x-1.1', '8.x-2.0', 'Also available:');
+
+    $this->refreshUpdateStatus([
+      'drupal' => '0.0',
+      $this->updateProject => '1_0-unsupported',
+    ]);
+    $this->confirmUnsupportedStatus('8.x-1.1', '8.x-2.0', 'Recommended version:');
+  }
+
+  /**
+   * Tests messages for invalid, empty and missing version strings.
+   */
+  public function testNonStandardVersionStrings() {
+    $version_infos = [
+      'invalid' => [
+        'version' => 'llama',
+        'expected' => 'Invalid version: llama',
+      ],
+      'empty' => [
+        'version' => '',
+        'expected' => 'Empty version',
+      ],
+      'null' => [
+        'expected' => 'Invalid version: Unknown',
+      ],
+    ];
+    foreach ($version_infos as $version_info) {
+      $system_info = [
+        'aaa_update_test' => [
+          'project' => 'aaa_update_test',
+          'hidden' => FALSE,
+        ],
+      ];
+      if (isset($version_info['version'])) {
+        $system_info['aaa_update_test']['version'] = $version_info['version'];
+      }
+      $this->config('update_test.settings')->set('system_info', $system_info)->save();
+      $this->refreshUpdateStatus([
+        'drupal' => '0.0',
+        $this->updateProject => '1_0-supported',
+      ]);
+      $this->standardTests();
+      $this->assertSession()->elementTextContains('css', $this->updateTableLocator, $version_info['expected']);
+    }
+  }
+
+  /**
+   * Asserts that a core compatibility message is correct for an update.
+   *
+   * @param string $version
+   *   The version of the update.
+   * @param string $expected_range
+   *   The expected core compatibility range.
+   * @param string $expected_release_title
+   *   The expected release title.
+   * @param bool $is_compatible
+   *   If the update is compatible with the installed version of Drupal.
+   */
+  protected function assertCoreCompatibilityMessage($version, $expected_range, $expected_release_title, $is_compatible = TRUE) {
+    $update_element = $this->findUpdateElementByLabel($expected_release_title);
+    $this->assertTrue($update_element->hasLink($version));
+    $compatibility_details = $update_element->find('css', '.project-update__compatibility-details details');
+    $this->assertStringContainsString("Requires Drupal core: $expected_range", $compatibility_details->getText());
+    $details_summary_element = $compatibility_details->find('css', 'summary');
+    if ($is_compatible) {
+      $download_version = str_replace('.', '-', $version);
+      // If an update is compatible with the installed version of Drupal core,
+      // it should have a download link and the details element should be closed
+      // by default.
+      $this->assertFalse($compatibility_details->hasAttribute('open'));
+      $this->assertSame('Compatible', $details_summary_element->getText());
+      $this->assertEquals(
+        $update_element->findLink('Download')->getAttribute('href'),
+        "http://example.com/{$this->updateProject}-$download_version.tar.gz"
+      );
+    }
+    else {
+      // If an update is not compatible with the installed version of Drupal
+      // core, it should not have a download link and the details element should
+      // be open by default.
+      $this->assertTrue($compatibility_details->hasAttribute('open'));
+      $this->assertSame('Not compatible', $details_summary_element->getText());
+      $this->assertFalse($update_element->hasLink('Download'));
+    }
+  }
+
+}

web/core/modules/update/tests/src/Functional/UpdateCoreTest.php

@@ -0,0 +1,890 @@
+<?php
+
+namespace Drupal\Tests\update\Functional;
+
+use Drupal\Core\Link;
+use Drupal\Core\Url;
+use Drupal\Tests\Traits\Core\CronRunTrait;
+
+/**
+ * Tests the Update Manager module through a series of functional tests using
+ * mock XML data.
+ *
+ * @group update
+ */
+class UpdateCoreTest extends UpdateTestBase {
+
+  use CronRunTrait;
+
+  /**
+   * Modules to enable.
+   *
+   * @var array
+   */
+  public static $modules = ['update_test', 'update', 'language', 'block'];
+
+  /**
+   * {@inheritdoc}
+   */
+  protected $defaultTheme = 'stark';
+
+  /**
+   * {@inheritdoc}
+   */
+  protected $updateTableLocator = 'table.update';
+
+  /**
+   * {@inheritdoc}
+   */
+  protected $updateProject = 'drupal';
+
+  protected function setUp() {
+    parent::setUp();
+    $admin_user = $this->drupalCreateUser(['administer site configuration', 'administer modules', 'administer themes']);
+    $this->drupalLogin($admin_user);
+    $this->drupalPlaceBlock('local_actions_block');
+  }
+
+  /**
+   * Sets the version to x.x.x when no project-specific mapping is defined.
+   *
+   * @param string $version
+   *   The version.
+   */
+  protected function setSystemInfo($version) {
+    $setting = [
+      '#all' => [
+        'version' => $version,
+      ],
+    ];
+    $this->config('update_test.settings')->set('system_info', $setting)->save();
+  }
+
+  /**
+   * Tests the Update Manager module when no updates are available.
+   *
+   * The XML fixture file 'drupal.1.0.xml' which is one of the XML files this
+   * test uses also contains 2 extra releases that are newer than '8.0.1'. These
+   * releases will not show as available updates because of the following
+   * reasons:
+   * - '8.0.2' is an unpublished release.
+   * - '8.0.3' is marked as 'Release type' 'Unsupported'.
+   */
+  public function testNoUpdatesAvailable() {
+    foreach ([0, 1] as $minor_version) {
+      foreach ([0, 1] as $patch_version) {
+        foreach (['-alpha1', '-beta1', ''] as $extra_version) {
+          $this->setSystemInfo("8.$minor_version.$patch_version" . $extra_version);
+          $this->refreshUpdateStatus(['drupal' => "$minor_version.$patch_version" . $extra_version]);
+          $this->standardTests();
+          // The XML test fixtures for this method all contain the '8.2.0'
+          // release but because '8.2.0' is not in a supported branch it will
+          // not be in the available updates.
+          $this->assertNoRaw('8.2.0');
+          $this->assertText(t('Up to date'));
+          $this->assertNoText(t('Update available'));
+          $this->assertNoText(t('Security update required!'));
+          $this->assertRaw('check.svg', 'Check icon was found.');
+        }
+      }
+    }
+  }
+
+  /**
+   * Tests the Update Manager module when one normal update is available.
+   */
+  public function testNormalUpdateAvailable() {
+    $this->setSystemInfo('8.0.0');
+
+    // Ensure that the update check requires a token.
+    $this->drupalGet('admin/reports/updates/check');
+    $this->assertSession()->statusCodeEquals(403);
+
+    foreach ([0, 1] as $minor_version) {
+      foreach (['-alpha1', '-beta1', ''] as $extra_version) {
+        $full_version = "8.$minor_version.1$extra_version";
+        $this->refreshUpdateStatus(['drupal' => "$minor_version.1" . $extra_version]);
+        $this->standardTests();
+        $this->drupalGet('admin/reports/updates');
+        $this->clickLink(t('Check manually'));
+        $this->checkForMetaRefresh();
+        $this->assertNoText(t('Security update required!'));
+        // The XML test fixtures for this method all contain the '8.2.0' release
+        // but because '8.2.0' is not in a supported branch it will not be in
+        // the available updates.
+        $this->assertNoRaw('8.2.0');
+        switch ($minor_version) {
+          case 0:
+            // Both stable and unstable releases are available.
+            // A stable release is the latest.
+            if ($extra_version == '') {
+              $this->assertNoText(t('Up to date'));
+              $this->assertText(t('Update available'));
+              $this->assertVersionUpdateLinks('Recommended version:', $full_version);
+              $this->assertNoText(t('Latest version:'));
+              $this->assertRaw('warning.svg', 'Warning icon was found.');
+            }
+            // Only unstable releases are available.
+            // An unstable release is the latest.
+            else {
+              $this->assertText(t('Up to date'));
+              $this->assertNoText(t('Update available'));
+              $this->assertNoText(t('Recommended version:'));
+              $this->assertVersionUpdateLinks('Latest version:', $full_version);
+              $this->assertRaw('check.svg', 'Check icon was found.');
+            }
+            break;
+
+          case 1:
+            // Both stable and unstable releases are available.
+            // A stable release is the latest.
+            if ($extra_version == '') {
+              $this->assertNoText(t('Up to date'));
+              $this->assertText(t('Update available'));
+              $this->assertVersionUpdateLinks('Recommended version:', $full_version);
+              $this->assertNoText(t('Latest version:'));
+              $this->assertRaw('warning.svg', 'Warning icon was found.');
+            }
+            // Both stable and unstable releases are available.
+            // An unstable release is the latest.
+            else {
+              $this->assertNoText(t('Up to date'));
+              $this->assertText(t('Update available'));
+              $this->assertVersionUpdateLinks('Recommended version:', '8.1.0');
+              $this->assertVersionUpdateLinks('Latest version:', $full_version);
+              $this->assertRaw('warning.svg', 'Warning icon was found.');
+            }
+            break;
+        }
+      }
+    }
+  }
+
+  /**
+   * Tests the Update Manager module when a major update is available.
+   */
+  public function testMajorUpdateAvailable() {
+    foreach ([0, 1] as $minor_version) {
+      foreach ([0, 1] as $patch_version) {
+        foreach (['-alpha1', '-beta1', ''] as $extra_version) {
+          $this->setSystemInfo("8.$minor_version.$patch_version" . $extra_version);
+          $this->refreshUpdateStatus(['drupal' => '9']);
+          $this->standardTests();
+          $this->drupalGet('admin/reports/updates');
+          $this->clickLink(t('Check manually'));
+          $this->checkForMetaRefresh();
+          $this->assertNoText(t('Security update required!'));
+          $this->assertRaw(Link::fromTextAndUrl('9.0.0', Url::fromUri("http://example.com/drupal-9-0-0-release"))->toString(), 'Link to release appears.');
+          $this->assertRaw(Link::fromTextAndUrl(t('Download'), Url::fromUri("http://example.com/drupal-9-0-0.tar.gz"))->toString(), 'Link to download appears.');
+          $this->assertRaw(Link::fromTextAndUrl(t('Release notes'), Url::fromUri("http://example.com/drupal-9-0-0-release"))->toString(), 'Link to release notes appears.');
+          $this->assertNoText(t('Up to date'));
+          $this->assertText(t('Not supported!'));
+          $this->assertText(t('Recommended version:'));
+          $this->assertNoText(t('Latest version:'));
+          $this->assertRaw('error.svg', 'Error icon was found.');
+        }
+      }
+    }
+  }
+
+  /**
+   * Tests the Update Manager module when a security update is available.
+   *
+   * @param string $site_patch_version
+   *   The patch version to set the site to for testing.
+   * @param string[] $expected_security_releases
+   *   The security releases, if any, that the status report should recommend.
+   * @param string $expected_update_message_type
+   *   The type of update message expected.
+   * @param string $fixture
+   *   The test fixture that contains the test XML.
+   *
+   * @dataProvider securityUpdateAvailabilityProvider
+   */
+  public function testSecurityUpdateAvailability($site_patch_version, array $expected_security_releases, $expected_update_message_type, $fixture) {
+    $this->setSystemInfo("8.$site_patch_version");
+    $this->refreshUpdateStatus(['drupal' => $fixture]);
+    $this->assertSecurityUpdates('drupal-8', $expected_security_releases, $expected_update_message_type, 'table.update');
+  }
+
+  /**
+   * Data provider method for testSecurityUpdateAvailability().
+   *
+   * These test cases rely on the following fixtures containing the following
+   * releases:
+   * - drupal.sec.0.1_0.2.xml
+   *   - 8.0.2 Security update
+   *   - 8.0.1 Security update, Insecure
+   *   - 8.0.0 Insecure
+   * - drupal.sec.0.2.xml
+   *   - 8.0.2 Security update
+   *   - 8.0.1 Insecure
+   *   - 8.0.0 Insecure
+   * - drupal.sec.0.2-rc2.xml
+   *   - 8.2.0-rc2 Security update
+   *   - 8.2.0-rc1 Insecure
+   *   - 8.2.0-beta2 Insecure
+   *   - 8.2.0-beta1 Insecure
+   *   - 8.2.0-alpha2 Insecure
+   *   - 8.2.0-alpha1 Insecure
+   *   - 8.1.2 Security update
+   *   - 8.1.1 Insecure
+   *   - 8.1.0 Insecure
+   *   - 8.0.2 Security update
+   *   - 8.0.1 Insecure
+   *   - 8.0.0 Insecure
+   * - drupal.sec.1.2.xml
+   *   - 8.1.2 Security update
+   *   - 8.1.1 Insecure
+   *   - 8.1.0 Insecure
+   *   - 8.0.2
+   *   - 8.0.1
+   *   - 8.0.0
+   * - drupal.sec.1.2_insecure.xml
+   *   - 8.1.2 Security update
+   *   - 8.1.1 Insecure
+   *   - 8.1.0 Insecure
+   *   - 8.0.2 Insecure
+   *   - 8.0.1 Insecure
+   *   - 8.0.0 Insecure
+   * - drupal.sec.1.2_insecure-unsupported
+   *   This file has the exact releases as drupal.sec.1.2_insecure.xml. It has a
+   *   different value for 'supported_branches' that does not contain '8.0.'.
+   *   It is used to ensure that the "Security update required!" is displayed
+   *   even if the currently installed version is in an unsupported branch.
+   * - drupal.sec.0.2-rc2-b.xml
+   *   - 8.2.0-rc2
+   *   - 8.2.0-rc1
+   *   - 8.2.0-beta2
+   *   - 8.2.0-beta1
+   *   - 8.2.0-alpha2
+   *   - 8.2.0-alpha1
+   *   - 8.1.2 Security update
+   *   - 8.1.1 Insecure
+   *   - 8.1.0 Insecure
+   *   - 8.0.2 Security update
+   *   - 8.0.1 Insecure
+   *   - 8.0.0 Insecure
+   */
+  public function securityUpdateAvailabilityProvider() {
+    $test_cases = [
+      // Security release available for site minor release 0.
+      // No releases for next minor.
+      '0.0, 0.2' => [
+        'site_patch_version' => '0.0',
+        'expected_security_releases' => ['0.2'],
+        'expected_update_message_type' => static::SECURITY_UPDATE_REQUIRED,
+        'fixture' => 'sec.0.2',
+      ],
+      // Site on latest security release available for site minor release 0.
+      // Minor release 1 also has a security release, and the current release
+      // is marked as insecure.
+      '0.2, 0.2' => [
+        'site_patch_version' => '0.2',
+        'expected_security_release' => ['1.2', '2.0-rc2'],
+        'expected_update_message_type' => static::UPDATE_AVAILABLE,
+        'fixture' => 'sec.0.2-rc2',
+      ],
+      // Two security releases available for site minor release 0.
+      // 0.1 security release marked as insecure.
+      // No releases for next minor.
+      '0.0, 0.1 0.2' => [
+        'site_patch_version' => '0.0',
+        'expected_security_releases' => ['0.2'],
+        'expected_update_message_type' => static::SECURITY_UPDATE_REQUIRED,
+        'fixture' => 'sec.0.1_0.2',
+      ],
+      // Security release available for site minor release 1.
+      // No releases for next minor.
+      '1.0, 1.2' => [
+        'site_patch_version' => '1.0',
+        'expected_security_releases' => ['1.2'],
+        'expected_update_message_type' => static::SECURITY_UPDATE_REQUIRED,
+        'fixture' => 'sec.1.2',
+      ],
+      // Security release available for site minor release 0.
+      // Security release also available for next minor.
+      '0.0, 0.2 1.2' => [
+        'site_patch_version' => '0.0',
+        'expected_security_releases' => ['0.2', '1.2', '2.0-rc2'],
+        'expected_update_message_type' => static::SECURITY_UPDATE_REQUIRED,
+        'fixture' => 'sec.0.2-rc2',
+      ],
+      // No newer security release for site minor 1.
+      // Previous minor has security release.
+      '1.2, 0.2 1.2' => [
+        'site_patch_version' => '1.2',
+        'expected_security_releases' => [],
+        'expected_update_message_type' => static::UPDATE_NONE,
+        'fixture' => 'sec.0.2-rc2',
+      ],
+      // No security release available for site minor release 0.
+      // Security release available for next minor.
+      '0.0, 1.2, insecure' => [
+        'site_patch_version' => '0.0',
+        'expected_security_releases' => ['1.2'],
+        'expected_update_message_type' => static::SECURITY_UPDATE_REQUIRED,
+        'fixture' => 'sec.1.2_insecure',
+      ],
+      // No security release available for site minor release 0.
+      // Site minor is not a supported branch.
+      // Security release available for next minor.
+      '0.0, 1.2, insecure-unsupported' => [
+        'site_patch_version' => '0.0',
+        'expected_security_releases' => ['1.2'],
+        'expected_update_message_type' => static::SECURITY_UPDATE_REQUIRED,
+        'fixture' => 'sec.1.2_insecure-unsupported',
+      ],
+      // All releases for minor 0 are secure.
+      // Security release available for next minor.
+      '0.0, 1.2, secure' => [
+        'site_patch_version' => '0.0',
+        'expected_security_release' => ['1.2'],
+        'expected_update_message_type' => static::UPDATE_AVAILABLE,
+        'fixture' => 'sec.1.2',
+      ],
+      '0.2, 1.2, secure' => [
+        'site_patch_version' => '0.2',
+        'expected_security_release' => ['1.2'],
+        'expected_update_message_type' => static::UPDATE_AVAILABLE,
+        'fixture' => 'sec.1.2',
+      ],
+      // Site on 2.0-rc2 which is a security release.
+      '2.0-rc2, 0.2 1.2' => [
+        'site_patch_version' => '2.0-rc2',
+        'expected_security_releases' => [],
+        'expected_update_message_type' => static::UPDATE_NONE,
+        'fixture' => 'sec.0.2-rc2',
+      ],
+      // Ensure that 8.0.2 security release is not shown because it is earlier
+      // version than 1.0.
+      '1.0, 0.2 1.2' => [
+        'site_patch_version' => '1.0',
+        'expected_security_releases' => ['1.2', '2.0-rc2'],
+        'expected_update_message_type' => static::SECURITY_UPDATE_REQUIRED,
+        'fixture' => 'sec.0.2-rc2',
+      ],
+    ];
+    $pre_releases = [
+      '2.0-alpha1',
+      '2.0-alpha2',
+      '2.0-beta1',
+      '2.0-beta2',
+      '2.0-rc1',
+      '2.0-rc2',
+    ];
+
+    foreach ($pre_releases as $pre_release) {
+      // If the site is on an alpha/beta/RC of an upcoming minor and none of the
+      // alpha/beta/RC versions are marked insecure, no security update should
+      // be required.
+      $test_cases["Pre-release:$pre_release, no security update"] = [
+        'site_patch_version' => $pre_release,
+        'expected_security_releases' => [],
+        'expected_update_message_type' => $pre_release === '2.0-rc2' ? static::UPDATE_NONE : static::UPDATE_AVAILABLE,
+        'fixture' => 'sec.0.2-rc2-b',
+      ];
+      // If the site is on an alpha/beta/RC of an upcoming minor and there is
+      // an RC version with a security update, it should be recommended.
+      $test_cases["Pre-release:$pre_release, security update"] = [
+        'site_patch_version' => $pre_release,
+        'expected_security_releases' => $pre_release === '2.0-rc2' ? [] : ['2.0-rc2'],
+        'expected_update_message_type' => $pre_release === '2.0-rc2' ? static::UPDATE_NONE : static::SECURITY_UPDATE_REQUIRED,
+        'fixture' => 'sec.0.2-rc2',
+      ];
+    }
+    return $test_cases;
+  }
+
+  /**
+   * Tests the security coverage messages for Drupal core versions.
+   *
+   * @param string $installed_version
+   *   The installed Drupal version to test.
+   * @param string $fixture
+   *   The test fixture that contains the test XML.
+   * @param string $requirements_section_heading
+   *   The requirements section heading.
+   * @param string $message
+   *   The expected coverage message.
+   * @param string $mock_date
+   *   The mock date to use if needed in the format CCYY-MM-DD. If an empty
+   *   string is provided, no mock date will be used.
+   *
+   * @dataProvider securityCoverageMessageProvider
+   */
+  public function testSecurityCoverageMessage($installed_version, $fixture, $requirements_section_heading, $message, $mock_date) {
+    \Drupal::state()->set('update_test.mock_date', $mock_date);
+    $this->setSystemInfo($installed_version);
+    $this->refreshUpdateStatus(['drupal' => $fixture]);
+    $this->drupalGet('admin/reports/status');
+
+    if (empty($requirements_section_heading)) {
+      $this->assertSession()->pageTextNotContains('Drupal core security coverage');
+      return;
+    }
+
+    $all_requirements_details = $this->getSession()->getPage()->findAll(
+      'css',
+      'details.system-status-report__entry:contains("Drupal core security coverage")'
+    );
+    // Ensure we only have 1 security message section.
+    $this->assertCount(1, $all_requirements_details);
+    $requirements_details = $all_requirements_details[0];
+    // Ensure that messages are under the correct heading which could be
+    // 'Checked', 'Warnings found', or 'Errors found'.
+    $requirements_section_element = $requirements_details->getParent();
+    $this->assertCount(1, $requirements_section_element->findAll('css', "h3:contains('$requirements_section_heading')"));
+    $actual_message = $requirements_details->find('css', 'div.system-status-report__entry__value')->getText();
+    $this->assertNotEmpty($actual_message);
+    $this->assertEquals($message, $actual_message);
+  }
+
+  /**
+   * Dataprovider for testSecurityCoverageMessage().
+   *
+   * These test cases rely on the following fixtures containing the following
+   * releases:
+   * - drupal.sec.2.0_3.0-rc1.xml
+   *   - 8.2.0
+   *   - 8.3.0-rc1
+   * - drupal.sec.2.0.xml
+   *   - 8.2.0
+   * - drupal.sec.2.0_9.0.0.xml
+   *   - 8.2.0
+   *   - 9.0.0
+   * - drupal.sec.9.0.xml
+   *   - 8.9.0
+   * - drupal.sec.9.9.0.xml
+   *   - 9.9.0
+   */
+  public function securityCoverageMessageProvider() {
+    $release_coverage_message = 'Visit the release cycle overview for more information on supported releases.';
+    $coverage_ended_message = 'Coverage has ended';
+    $update_asap_message = 'Update to a supported minor as soon as possible to continue receiving security updates.';
+    $update_soon_message = 'Update to a supported minor version soon to continue receiving security updates.';
+    $test_cases = [
+      '8.0.0, unsupported' => [
+        'installed_version' => '8.0.0',
+        'fixture' => 'sec.2.0_3.0-rc1',
+        'requirements_section_heading' => 'Errors found',
+        'message' => "$coverage_ended_message $update_asap_message $release_coverage_message",
+        'mock_date' => '',
+      ],
+      '8.1.0, supported with 3rc' => [
+        'installed_version' => '8.1.0',
+        'fixture' => 'sec.2.0_3.0-rc1',
+        'requirements_section_heading' => 'Warnings found',
+        'message' => "Covered until 8.3.0 Update to 8.2 or higher soon to continue receiving security updates. $release_coverage_message",
+        'mock_date' => '',
+      ],
+      '8.1.0, supported' => [
+        'installed_version' => '8.1.0',
+        'fixture' => 'sec.2.0',
+        'requirements_section_heading' => 'Warnings found',
+        'message' => "Covered until 8.3.0 Update to 8.2 or higher soon to continue receiving security updates. $release_coverage_message",
+        'mock_date' => '',
+      ],
+      '8.2.0, supported with 3rc' => [
+        'installed_version' => '8.2.0',
+        'fixture' => 'sec.2.0_3.0-rc1',
+        'requirements_section_heading' => 'Checked',
+        'message' => "Covered until 8.4.0 $release_coverage_message",
+        'mock_date' => '',
+      ],
+      '8.2.0, supported' => [
+        'installed_version' => '8.2.0',
+        'fixture' => 'sec.2.0',
+        'requirements_section_heading' => 'Checked',
+        'message' => "Covered until 8.4.0 $release_coverage_message",
+        'mock_date' => '',
+      ],
+      // Ensure we don't show messages for pre-release or dev versions.
+      '8.2.0-beta2, no message' => [
+        'installed_version' => '8.2.0-beta2',
+        'fixture' => 'sec.2.0_3.0-rc1',
+        'requirements_section_heading' => '',
+        'message' => '',
+        'mock_date' => '',
+      ],
+      '8.1.0-dev, no message' => [
+        'installed_version' => '8.1.0-dev',
+        'fixture' => 'sec.2.0_3.0-rc1',
+        'requirements_section_heading' => '',
+        'message' => '',
+        'mock_date' => '',
+      ],
+      // Ensures the message is correct if the next major version has been
+      // released and the additional minors indicated by
+      // CORE_MINORS_WITH_SECURITY_COVERAGE minors have been released.
+      '8.0.0, 9 unsupported' => [
+        'installed_version' => '8.0.0',
+        'fixture' => 'sec.2.0_9.0.0',
+        'requirements_section_heading' => 'Errors found',
+        'message' => "$coverage_ended_message $update_asap_message $release_coverage_message",
+        'mock_date' => '',
+      ],
+      // Ensures the message is correct if the next major version has been
+      // released and the additional minors indicated by
+      // CORE_MINORS_WITH_SECURITY_COVERAGE minors have not been released.
+      '8.2.0, 9 warning' => [
+        'installed_version' => '8.2.0',
+        'fixture' => 'sec.2.0_9.0.0',
+        'requirements_section_heading' => 'Warnings found',
+        'message' => "Covered until 8.4.0 Update to 8.3 or higher soon to continue receiving security updates. $release_coverage_message",
+        'mock_date' => '',
+      ],
+    ];
+
+    // Drupal 8.8.x test cases.
+    $test_cases += [
+      // Ensure that a message is displayed during 8.8's active support.
+      '8.8.0, supported' => [
+        'installed_version' => '8.8.0',
+        'fixture' => 'sec.9.0',
+        'requirements_section_heading' => 'Checked',
+        'message' => "Covered until 2020-Dec-02 $release_coverage_message",
+        'mock_date' => '2020-06-01',
+      ],
+      // Ensure a warning is displayed if less than six months remain until the
+      // end of 8.8's security coverage.
+      '8.8.0, supported, 6 months warn' => [
+        'installed_version' => '8.8.0',
+        'fixture' => 'sec.9.0',
+        'requirements_section_heading' => 'Warnings found',
+        'message' => "Covered until 2020-Dec-02 $update_soon_message $release_coverage_message",
+        'mock_date' => '2020-06-02',
+      ],
+    ];
+    // Ensure that the message does not change, including on the last day of
+    // security coverage.
+    $test_cases['8.8.0, supported, last day warn'] = $test_cases['8.8.0, supported, 6 months warn'];
+    $test_cases['8.8.0, supported, last day warn']['mock_date'] = '2020-12-01';
+
+    // Ensure that if the 8.8 support window is finished a message is
+    // displayed.
+    $test_cases['8.8.0, support over'] = [
+      'installed_version' => '8.8.0',
+      'fixture' => 'sec.9.0',
+      'requirements_section_heading' => 'Errors found',
+      'message' => "$coverage_ended_message $update_asap_message $release_coverage_message",
+      'mock_date' => '2020-12-02',
+    ];
+
+    // Drupal 8.9 LTS test cases.
+    $test_cases['8.9.0, lts supported'] = [
+      'installed_version' => '8.9.0',
+      'fixture' => 'sec.9.0',
+      'requirements_section_heading' => 'Checked',
+      'message' => "Covered until 2021-Nov $release_coverage_message",
+      'mock_date' => '2021-01-01',
+    ];
+    // Ensure that the message does not change, including on the last day of
+    // security coverage.
+    $test_cases['8.9.0, lts supported, last day'] = $test_cases['8.9.0, lts supported'];
+    $test_cases['8.9.0, lts supported, last day']['mock_date'] = '2021-10-31';
+
+    // Ensure that if LTS support window is finished a message is displayed.
+    $test_cases['8.9.0, lts support over'] = [
+      'installed_version' => '8.9.0',
+      'fixture' => 'sec.9.0',
+      'requirements_section_heading' => 'Errors found',
+      'message' => "$coverage_ended_message $update_asap_message $release_coverage_message",
+      'mock_date' => '2021-11-01',
+    ];
+
+    // Drupal 9 test cases.
+    $test_cases += [
+      // Ensure the end dates for 8.8 and 8.9 only apply to major version 8.
+      '9.9.0' => [
+        'installed_version' => '9.9.0',
+        'fixture' => 'sec.9.9.0',
+        'requirements_section_heading' => 'Checked',
+        'message' => "Covered until 9.11.0 $release_coverage_message",
+        'mock_date' => '',
+      ],
+      '9.8.0' => [
+        'installed_version' => '9.8.0',
+        'fixture' => 'sec.9.9.0',
+        'requirements_section_heading' => 'Warnings found',
+        'message' => "Covered until 9.10.0 Update to 9.9 or higher soon to continue receiving security updates. $release_coverage_message",
+        'mock_date' => '',
+      ],
+    ];
+    return $test_cases;
+
+  }
+
+  /**
+   * Ensures proper results where there are date mismatches among modules.
+   */
+  public function testDatestampMismatch() {
+    $system_info = [
+      '#all' => [
+        // We need to think we're running a -dev snapshot to see dates.
+        'version' => '8.1.0-dev',
+        'datestamp' => time(),
+      ],
+      'block' => [
+        // This is 2001-09-09 01:46:40 GMT, so test for "2001-Sep-".
+        'datestamp' => '1000000000',
+      ],
+    ];
+    $this->config('update_test.settings')->set('system_info', $system_info)->save();
+    $this->refreshUpdateStatus(['drupal' => 'dev']);
+    $this->assertNoText(t('2001-Sep-'));
+    $this->assertText(t('Up to date'));
+    $this->assertNoText(t('Update available'));
+    $this->assertNoText(t('Security update required!'));
+  }
+
+  /**
+   * Checks that running cron updates the list of available updates.
+   */
+  public function testModulePageRunCron() {
+    $this->setSystemInfo('8.0.0');
+    $this->config('update.settings')
+      ->set('fetch.url', Url::fromRoute('update_test.update_test')->setAbsolute()->toString())
+      ->save();
+    $this->config('update_test.settings')
+      ->set('xml_map', ['drupal' => '0.0'])
+      ->save();
+
+    $this->cronRun();
+    $this->drupalGet('admin/modules');
+    $this->assertNoText(t('No update information available.'));
+  }
+
+  /**
+   * Checks that clearing the disk cache works.
+   */
+  public function testClearDiskCache() {
+    $directories = [
+      _update_manager_cache_directory(FALSE),
+      _update_manager_extract_directory(FALSE),
+    ];
+    // Check that update directories does not exists.
+    foreach ($directories as $directory) {
+      $this->assertDirectoryNotExists($directory);
+    }
+
+    // Method must not fail if update directories do not exists.
+    update_clear_update_disk_cache();
+  }
+
+  /**
+   * Checks the messages at admin/modules when the site is up to date.
+   */
+  public function testModulePageUpToDate() {
+    $this->setSystemInfo('8.0.0');
+    // Instead of using refreshUpdateStatus(), set these manually.
+    $this->config('update.settings')
+      ->set('fetch.url', Url::fromRoute('update_test.update_test')->setAbsolute()->toString())
+      ->save();
+    $this->config('update_test.settings')
+      ->set('xml_map', ['drupal' => '0.0'])
+      ->save();
+
+    $this->drupalGet('admin/reports/updates');
+    $this->clickLink(t('Check manually'));
+    $this->checkForMetaRefresh();
+    $this->assertText(t('Checked available update data for one project.'));
+    $this->drupalGet('admin/modules');
+    $this->assertNoText(t('There are updates available for your version of Drupal.'));
+    $this->assertNoText(t('There is a security update available for your version of Drupal.'));
+  }
+
+  /**
+   * Checks the messages at admin/modules when an update is missing.
+   */
+  public function testModulePageRegularUpdate() {
+    $this->setSystemInfo('8.0.0');
+    // Instead of using refreshUpdateStatus(), set these manually.
+    $this->config('update.settings')
+      ->set('fetch.url', Url::fromRoute('update_test.update_test')->setAbsolute()->toString())
+      ->save();
+    $this->config('update_test.settings')
+      ->set('xml_map', ['drupal' => '0.1'])
+      ->save();
+
+    $this->drupalGet('admin/reports/updates');
+    $this->clickLink(t('Check manually'));
+    $this->checkForMetaRefresh();
+    $this->assertText(t('Checked available update data for one project.'));
+    $this->drupalGet('admin/modules');
+    $this->assertText(t('There are updates available for your version of Drupal.'));
+    $this->assertNoText(t('There is a security update available for your version of Drupal.'));
+  }
+
+  /**
+   * Checks the messages at admin/modules when a security update is missing.
+   */
+  public function testModulePageSecurityUpdate() {
+    $this->setSystemInfo('8.0.0');
+    // Instead of using refreshUpdateStatus(), set these manually.
+    $this->config('update.settings')
+      ->set('fetch.url', Url::fromRoute('update_test.update_test')->setAbsolute()->toString())
+      ->save();
+    $this->config('update_test.settings')
+      ->set('xml_map', ['drupal' => 'sec.0.2'])
+      ->save();
+
+    $this->drupalGet('admin/reports/updates');
+    $this->clickLink(t('Check manually'));
+    $this->checkForMetaRefresh();
+    $this->assertText(t('Checked available update data for one project.'));
+    $this->drupalGet('admin/modules');
+    $this->assertNoText(t('There are updates available for your version of Drupal.'));
+    $this->assertText(t('There is a security update available for your version of Drupal.'));
+
+    // Make sure admin/appearance warns you you're missing a security update.
+    $this->drupalGet('admin/appearance');
+    $this->assertNoText(t('There are updates available for your version of Drupal.'));
+    $this->assertText(t('There is a security update available for your version of Drupal.'));
+
+    // Make sure duplicate messages don't appear on Update status pages.
+    $this->drupalGet('admin/reports/status');
+    // We're expecting "There is a security update..." inside the status report
+    // itself, but the message from
+    // \Drupal\Core\Messenger\MessengerInterface::addStatus() appears as an li
+    // so we can prefix with that and search for the raw HTML.
+    $this->assertNoRaw('<li>' . t('There is a security update available for your version of Drupal.'));
+
+    $this->drupalGet('admin/reports/updates');
+    $this->assertNoText(t('There is a security update available for your version of Drupal.'));
+
+    $this->drupalGet('admin/reports/updates/settings');
+    $this->assertNoText(t('There is a security update available for your version of Drupal.'));
+  }
+
+  /**
+   * Tests the Update Manager module when the update server returns 503 errors.
+   */
+  public function testServiceUnavailable() {
+    $this->refreshUpdateStatus([], '503-error');
+    // Ensure that no "Warning: SimpleXMLElement..." parse errors are found.
+    $this->assertNoText('SimpleXMLElement');
+    $this->assertUniqueText(t('Failed to get available update data for one project.'));
+  }
+
+  /**
+   * Tests that exactly one fetch task per project is created and not more.
+   */
+  public function testFetchTasks() {
+    $projecta = [
+      'name' => 'aaa_update_test',
+    ];
+    $projectb = [
+      'name' => 'bbb_update_test',
+    ];
+    $queue = \Drupal::queue('update_fetch_tasks');
+    $this->assertEqual($queue->numberOfItems(), 0, 'Queue is empty');
+    update_create_fetch_task($projecta);
+    $this->assertEqual($queue->numberOfItems(), 1, 'Queue contains one item');
+    update_create_fetch_task($projectb);
+    $this->assertEqual($queue->numberOfItems(), 2, 'Queue contains two items');
+    // Try to add project a again.
+    update_create_fetch_task($projecta);
+    $this->assertEqual($queue->numberOfItems(), 2, 'Queue still contains two items');
+
+    // Clear storage and try again.
+    update_storage_clear();
+    update_create_fetch_task($projecta);
+    $this->assertEqual($queue->numberOfItems(), 2, 'Queue contains two items');
+  }
+
+  /**
+   * Checks language module in core package at admin/reports/updates.
+   */
+  public function testLanguageModuleUpdate() {
+    $this->setSystemInfo('8.0.0');
+    // Instead of using refreshUpdateStatus(), set these manually.
+    $this->config('update.settings')
+      ->set('fetch.url', Url::fromRoute('update_test.update_test')->setAbsolute()->toString())
+      ->save();
+    $this->config('update_test.settings')
+      ->set('xml_map', ['drupal' => '0.1'])
+      ->save();
+
+    $this->drupalGet('admin/reports/updates');
+    $this->assertText(t('Language'));
+  }
+
+  /**
+   * Ensures that the local actions appear.
+   */
+  public function testLocalActions() {
+    $admin_user = $this->drupalCreateUser(['administer site configuration', 'administer modules', 'administer software updates', 'administer themes']);
+    $this->drupalLogin($admin_user);
+
+    $this->drupalGet('admin/modules');
+    $this->clickLink(t('Install new module'));
+    $this->assertUrl('admin/modules/install');
+
+    $this->drupalGet('admin/appearance');
+    $this->clickLink(t('Install new theme'));
+    $this->assertUrl('admin/theme/install');
+
+    $this->drupalGet('admin/reports/updates');
+    $this->clickLink(t('Install new module or theme'));
+    $this->assertUrl('admin/reports/updates/install');
+  }
+
+  /**
+   * Tests messages when a project release is unpublished.
+   *
+   * This test confirms that revoked messages are displayed regardless of
+   * whether the installed version is in a supported branch or not. This test
+   * relies on 2 test XML fixtures that are identical except for the
+   * 'supported_branches' value:
+   * - drupal.1.0.xml
+   *    'supported_branches' is '8.0.,8.1.'.
+   * - drupal.1.0-unsupported.xml
+   *    'supported_branches' is '8.1.'.
+   * They both have an '8.0.2' release that is unpublished and an '8.1.0'
+   * release that is published and is the expected update.
+   */
+  public function testRevokedRelease() {
+    foreach (['1.0', '1.0-unsupported'] as $fixture) {
+      $this->setSystemInfo('8.0.2');
+      $this->refreshUpdateStatus([$this->updateProject => $fixture]);
+      $this->standardTests();
+      $this->confirmRevokedStatus('8.0.2', '8.1.0', 'Recommended version:');
+    }
+  }
+
+  /**
+   * Tests messages when a project release is marked unsupported.
+   *
+   * This test confirms unsupported messages are displayed regardless of whether
+   * the installed version is in a supported branch or not. This test relies on
+   * 2 test XML fixtures that are identical except for the 'supported_branches'
+   * value:
+   * - drupal.1.0.xml
+   *    'supported_branches' is '8.0.,8.1.'.
+   * - drupal.1.0-unsupported.xml
+   *    'supported_branches' is '8.1.'.
+   * They both have an '8.0.3' release that has the 'Release type' value of
+   * 'unsupported' and an '8.1.0' release that has the 'Release type' value of
+   * 'supported' and is the expected update.
+   */
+  public function testUnsupportedRelease() {
+    foreach (['1.0', '1.0-unsupported'] as $fixture) {
+      $this->setSystemInfo('8.0.3');
+      $this->refreshUpdateStatus([$this->updateProject => $fixture]);
+      $this->standardTests();
+      $this->confirmUnsupportedStatus('8.0.3', '8.1.0', 'Recommended version:');
+    }
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function assertVersionUpdateLinks($label, $version, $download_version = NULL) {
+    // Test XML files for Drupal core use '-' in the version number for the
+    // download link.
+    $download_version = str_replace('.', '-', $version);
+    parent::assertVersionUpdateLinks($label, $version, $download_version);
+  }
+
+}

web/core/modules/update/tests/src/Functional/UpdateManagerUpdateTest.php

@@ -0,0 +1,236 @@
+<?php
+
+namespace Drupal\Tests\update\Functional;
+
+/**
+ * Tests the Update Manager module's 'Update' form and functionality.
+ *
+ * @todo In https://www.drupal.org/project/drupal/issues/3117229 expand this.
+ *
+ * @group update
+ */
+class UpdateManagerUpdateTest extends UpdateTestBase {
+
+  /**
+   * Modules to enable.
+   *
+   * @var array
+   */
+  protected static $modules = [
+    'update',
+    'update_test',
+    'aaa_update_test',
+    'bbb_update_test',
+  ];
+
+  /**
+   * {@inheritdoc}
+   */
+  protected $defaultTheme = 'stark';
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function setUp() {
+    parent::setUp();
+    $admin_user = $this->drupalCreateUser([
+      'administer software updates',
+      'administer site configuration',
+    ]);
+    $this->drupalLogin($admin_user);
+
+    // The installed state of the system is the same for all test cases. What
+    // varies for each test scenario is which release history fixture we fetch,
+    // which in turn changes the expected state of the UpdateManagerUpdateForm.
+    $system_info = [
+      '#all' => [
+        'version' => '8.0.0',
+      ],
+      'aaa_update_test' => [
+        'project' => 'aaa_update_test',
+        'version' => '8.x-1.0',
+        'hidden' => FALSE,
+      ],
+      'bbb_update_test' => [
+        'project' => 'bbb_update_test',
+        'version' => '8.x-1.0',
+        'hidden' => FALSE,
+      ],
+    ];
+    $this->config('update_test.settings')->set('system_info', $system_info)->save();
+  }
+
+  /**
+   * Provides data for test scenarios involving incompatible updates.
+   *
+   * These test cases rely on the following fixtures containing the following
+   * releases:
+   * - aaa_update_test.8.x-1.2.xml
+   *   - 8.x-1.2 Compatible with 8.0.0 core.
+   * - aaa_update_test.core_compatibility.8.x-1.2_8.x-2.2.xml
+   *   - 8.x-1.2 Requires 8.1.0 and above.
+   * - bbb_update_test.1_0.xml
+   *   - 8.x-1.0 is the only available release.
+   * - bbb_update_test.1_1.xml
+   *   - 8.x-1.1 is available and compatible with everything (does not define
+   *     <core_compatibility> at all).
+   * - bbb_update_test.1_2.xml
+   *   - 8.x-1.1 is available and compatible with everything (does not define
+   *     <core_compatibility> at all).
+   *   - 8.x-1.2 is available and requires Drupal 8.1.0 and above.
+   *
+   * @todo In https://www.drupal.org/project/drupal/issues/3112962:
+   *   Change the 'core_fixture' values here to use:
+   *   - '1.1' instead of '1.1-core_compatibility'.
+   *   - '1.1-alpha1' instead of '1.1-alpha1-core_compatibility'.
+   *   Delete the files:
+   *   - core/modules/update/tests/modules/update_test/drupal.1.1-alpha1-core_compatibility.xml
+   *   - core/modules/update/tests/modules/update_test/drupal.1.1-core_compatibility.xml
+   *
+   * @return array[]
+   *   Test data.
+   */
+  public function incompatibleUpdatesTableProvider() {
+    return [
+      'only one compatible' => [
+        'core_fixture' => '1.1-core_compatibility',
+        // aaa_update_test.8.x-1.2.xml has core compatibility set and will test
+        // the case where $recommended_release['core_compatible'] === TRUE in
+        // \Drupal\update\Form\UpdateManagerUpdate.
+        'a_fixture' => '8.x-1.2',
+        // Use a fixture with only a 8.x-1.0 release so BBB is up to date.
+        'b_fixture' => '1_0',
+        'compatible' => [
+          'AAA' => '8.x-1.2',
+        ],
+        'incompatible' => [],
+      ],
+      'only one incompatible' => [
+        'core_fixture' => '1.1-core_compatibility',
+        'a_fixture' => 'core_compatibility.8.x-1.2_8.x-2.2',
+        // Use a fixture with only a 8.x-1.0 release so BBB is up to date.
+        'b_fixture' => '1_0',
+        'compatible' => [],
+        'incompatible' => [
+          'AAA' => [
+            'recommended' => '8.x-1.2',
+            'range' => '8.1.0 to 8.1.1',
+          ],
+        ],
+      ],
+      'two compatible, no incompatible' => [
+        'core_fixture' => '1.1-core_compatibility',
+        'a_fixture' => '8.x-1.2',
+        // bbb_update_test.1_1.xml does not have core compatibility set and will
+        // test the case where $recommended_release['core_compatible'] === NULL
+        // in \Drupal\update\Form\UpdateManagerUpdate.
+        'b_fixture' => '1_1',
+        'compatible' => [
+          'AAA' => '8.x-1.2',
+          'BBB' => '8.x-1.1',
+        ],
+        'incompatible' => [],
+      ],
+      'two incompatible, no compatible' => [
+        'core_fixture' => '1.1-core_compatibility',
+        'a_fixture' => 'core_compatibility.8.x-1.2_8.x-2.2',
+        // bbb_update_test.1_2.xml has core compatibility set and will test the
+        // case where $recommended_release['core_compatible'] === FALSE in
+        // \Drupal\update\Form\UpdateManagerUpdate.
+        'b_fixture' => '1_2',
+        'compatible' => [],
+        'incompatible' => [
+          'AAA' => [
+            'recommended' => '8.x-1.2',
+            'range' => '8.1.0 to 8.1.1',
+          ],
+          'BBB' => [
+            'recommended' => '8.x-1.2',
+            'range' => '8.1.0 to 8.1.1',
+          ],
+        ],
+      ],
+      'one compatible, one incompatible' => [
+        'core_fixture' => '1.1-core_compatibility',
+        'a_fixture' => 'core_compatibility.8.x-1.2_8.x-2.2',
+        'b_fixture' => '1_1',
+        'compatible' => [
+          'BBB' => '8.x-1.1',
+        ],
+        'incompatible' => [
+          'AAA' => [
+            'recommended' => '8.x-1.2',
+            'range' => '8.1.0 to 8.1.1',
+          ],
+        ],
+      ],
+    ];
+  }
+
+  /**
+   * Tests the Update form for a single test scenario of incompatible updates.
+   *
+   * @dataProvider incompatibleUpdatesTableProvider
+   *
+   * @param string $core_fixture
+   *   The fixture file to use for Drupal core.
+   * @param string $a_fixture
+   *   The fixture file to use for the aaa_update_test module.
+   * @param string $b_fixture
+   *   The fixture file to use for the bbb_update_test module.
+   * @param string[] $compatible
+   *   Compatible recommended updates (if any). Keys are module identifier
+   *   ('AAA' or 'BBB') and values are the expected recommended release.
+   * @param string[][] $incompatible
+   *   Incompatible recommended updates (if any). Keys are module identifier
+   *   ('AAA' or 'BBB') and values are subarrays with the following keys:
+   *   - 'recommended': The recommended version.
+   *   - 'range': The versions of Drupal core required for that version.
+   */
+  public function testIncompatibleUpdatesTable($core_fixture, $a_fixture, $b_fixture, array $compatible, array $incompatible) {
+
+    $assert_session = $this->assertSession();
+    $compatible_table_locator = '[data-drupal-selector="edit-projects"]';
+    $incompatible_table_locator = '[data-drupal-selector="edit-not-compatible"]';
+
+    $this->refreshUpdateStatus(['drupal' => $core_fixture, 'aaa_update_test' => $a_fixture, 'bbb_update_test' => $b_fixture]);
+    $this->drupalGet('admin/reports/updates/update');
+
+    if ($compatible) {
+      // Verify the number of rows in the table.
+      $assert_session->elementsCount('css', "$compatible_table_locator tbody tr", count($compatible));
+      // We never want to see a compatibility range in the compatible table.
+      $assert_session->elementTextNotContains('css', $compatible_table_locator, 'Requires Drupal core');
+      foreach ($compatible as $module => $version) {
+        $compatible_row = "$compatible_table_locator tbody tr:contains('$module Update test')";
+        // First <td> is the checkbox, so start with td #2.
+        $assert_session->elementTextContains('css', "$compatible_row td:nth-of-type(2)", "$module Update test");
+        // Both contrib modules use 8.x-1.0 as the currently installed version.
+        $assert_session->elementTextContains('css', "$compatible_row td:nth-of-type(3)", '8.x-1.0');
+        $assert_session->elementTextContains('css', "$compatible_row td:nth-of-type(4)", $version);
+      }
+    }
+    else {
+      // Verify there is no compatible updates table.
+      $assert_session->elementNotExists('css', $compatible_table_locator);
+    }
+
+    if ($incompatible) {
+      // Verify the number of rows in the table.
+      $assert_session->elementsCount('css', "$incompatible_table_locator tbody tr", count($incompatible));
+      foreach ($incompatible as $module => $data) {
+        $incompatible_row = "$incompatible_table_locator tbody tr:contains('$module Update test')";
+        $assert_session->elementTextContains('css', "$incompatible_row td:nth-of-type(1)", "$module Update test");
+        // Both contrib modules use 8.x-1.0 as the currently installed version.
+        $assert_session->elementTextContains('css', "$incompatible_row td:nth-of-type(2)", '8.x-1.0');
+        $assert_session->elementTextContains('css', "$incompatible_row td:nth-of-type(3)", $data['recommended']);
+        $assert_session->elementTextContains('css', "$incompatible_row td:nth-of-type(3)", 'Requires Drupal core: ' . $data['range']);
+      }
+    }
+    else {
+      // Verify there is no incompatible updates table.
+      $assert_session->elementNotExists('css', $incompatible_table_locator);
+    }
+  }
+
+}