Problem/Motivation
in #2990511-39: Add comprehensive test coverage for update status for security releases cases were found where in Update reports, if security release is needed for current minor and is also available for minor the previous minor security update is listed also.
An example:
The current core version is 8.1.0 which insecure
- 8.1.2 is a security update, not insecure
- 8.0.2 is a security update, not insecure
- 8.0.2, in addition to 8.1.2, is shown as security update even though it would be downgrade
This seems separate issue than #2865920: When a site is multiple security releases behind for a given project, they are all listed in a paralyzing wall of terror
Proposed resolution
Downgrades should never be shown as a Security update.
The current fix for #2804155: If the next minor version of core has a security release, status still says "Security update required!" even if the site is on an equivalent, secure release already does not fix this issue.
Remaining tasks
Figure out the fix
patch
review
User interface changes
None
API changes
None
Data model changes
None