Hide centrally managed modules/themes from the update manager

On Monday, there is a planned intervention to update two of the centrally managed modules. One of them implements new functionality to hide all centrally managed modules and themes from the update manager of each individual site. In other words, site administrators will be able to see only the manually installed (local) modules in the module update page [1]. The following are the reasons for this change:

  • An unnecessary warning (see the picture below) will be removed. The failure was caused because the update manager was unsuccessfully searching online for new releases of custom internal modules.

  • The notifications for available updates of centrally managed modules will be disabled (see the picture below). As a result, site administrators will be prevented from installing a local version in order to update. This is not recommended because those modules are maintained and carefully updated by the Drupal infrastructure team. In addition, site administrators will only receive those notification when there is an actual update for a module that they are responsible to maintain and they should take them seriously into account.

  • The available updates report [2] will be shorter and list only modules which the site administrator is responsible to maintain. It will be more clear and easier to spot an important update.

Eventually, there is a plan in the near future to enable by default the security update email notifications for all sites. This is a proactive measure since It has been noticed that some sites have enabled local outdated and often vulnerable modules. In case you are interested in enabling them yourself you can go to Administration->Reports->Available updates->SETTINGS like it is illustrated in the following figure (maybe preferably after Monday):



[1] https://example.com/admin/modules/update

[2] https://example.com/admin/reports/updates

You are here