#669626 by dww: Reduce RAM bloat: split update status logic into a per-project helper and only save available release info we care about.

1 files changed, 342 insertions, 331 deletions

diff --git a/modules/update/update.compare.inc b/modules/update/update.compare.inc
index 98338a864..18c6c7dc6 100644
--- a/modules/update/update.compare.inc
+++ b/modules/update/update.compare.inc
@@ -278,15 +278,63 @@ function update_process_project_info(&$projects) {
 }
 
 /**
- * Given the installed projects and the available release data retrieved from
- * remote servers, calculate the current status.
+ * Calculate the current update status of all projects on the site.
  *
- * This function is the heart of the update status feature. It iterates over
- * every currently installed project. For each one, it first checks if the
- * project has been flagged with a special status like "unsupported" or
- * "insecure", or if the project node itself has been unpublished. In any of
- * those cases, the project is marked with an error and the next project is
- * considered.
+ * The results of this function are expensive to compute, especially on sites
+ * with lots of modules or themes, since it involves a lot of comparisons and
+ * other operations. Therefore, we cache the results into the {cache_update}
+ * table using the 'update_project_data' cache ID. However, since this is not
+ * the data about available updates fetched from the network, it is ok to
+ * invalidate it somewhat quickly. If we keep this data for very long, site
+ * administrators are more likely to see incorrect results if they upgrade to
+ * a newer version of a module or theme but do not visit certain pages that
+ * automatically clear this cache.
+ *
+ * @param array $available
+ *   Data about available project releases.
+ *
+ * @see update_get_available()
+ * @see update_get_projects()
+ * @see update_process_project_info()
+ * @see update_project_cache()
+ */
+function update_calculate_project_data($available) {
+  // Retrieve the projects from cache, if present.
+  $projects = update_project_cache('update_project_data');
+  // If $projects is empty, then the cache must be rebuilt.
+  // Otherwise, return the cached data and skip the rest of the function.
+  if (!empty($projects)) {
+    return $projects;
+  }
+  $projects = update_get_projects();
+  update_process_project_info($projects);
+  foreach ($projects as $project => $project_info) {
+    if (isset($available[$project])) {
+      update_calculate_project_update_status($project, $projects[$project], $available[$project]);
+    }
+    else {
+      $projects[$project]['status'] = UPDATE_UNKNOWN;
+      $projects[$project]['reason'] = t('No available releases found');
+    }
+  }
+  // Give other modules a chance to alter the status (for example, to allow a
+  // contrib module to provide fine-grained settings to ignore specific
+  // projects or releases).
+  drupal_alter('update_status', $projects);
+
+  // Cache the site's update status for at most 1 hour.
+  _update_cache_set('update_project_data', $projects, REQUEST_TIME + 3600);
+  return $projects;
+}
+
+/**
+ * Calculate the current update status of a specific project.
+ *
+ * This function is the heart of the update status feature. For each project
+ * it is invoked with, it first checks if the project has been flagged with a
+ * special status like "unsupported" or "insecure", or if the project node
+ * itself has been unpublished. In any of those cases, the project is marked
+ * with an error and the next project is considered.
  *
  * If the project itself is valid, the function decides what major release
  * series to consider. The project defines what the currently supported major
@@ -337,363 +385,326 @@ function update_process_project_info(&$projects) {
  * version (e.g. 5.x-1.5-beta1, 5.x-1.5-beta2, and 5.x-1.5). Development
  * snapshots for a given major version are always listed last.
  *
- * The results of this function are expensive to compute, especially on sites
- * with lots of modules or themes, since it involves a lot of comparisons and
- * other operations. Therefore, we cache the results into the {cache_update}
- * table using the 'update_project_data' cache ID. However, since this is not
- * the data about available updates fetched from the network, it is ok to
- * invalidate it somewhat quickly. If we keep this data for very long, site
- * administrators are more likely to see incorrect results if they upgrade to
- * a newer version of a module or theme but do not visit certain pages that
- * automatically clear this cache.
- *
- * @param $available
- *  Array of data about available project releases.
- *
- * @see update_get_available()
- * @see update_get_projects()
- * @see update_process_project_info()
- * @see update_project_cache()
  */
-function update_calculate_project_data($available) {
-  // Retrieve the projects from cache, if present.
-  $projects = update_project_cache('update_project_data');
-  // If $projects is empty, then the cache must be rebuilt.
-  // Otherwise, return the cached data and skip the rest of the function.
-  if (!empty($projects)) {
-    return $projects;
+function update_calculate_project_update_status($project, &$project_data, $available) {
+  foreach (array('title', 'link') as $attribute) {
+    if (!isset($project_data[$attribute]) && isset($available[$attribute])) {
+      $project_data[$attribute] = $available[$attribute];
+    }
   }
-  $projects = update_get_projects();
-  update_process_project_info($projects);
-  foreach ($projects as $project => $project_info) {
-    if (isset($available[$project])) {
 
-      // If the project status is marked as something bad, there's nothing
-      // else to consider.
-      if (isset($available[$project]['project_status'])) {
-        switch ($available[$project]['project_status']) {
-          case 'insecure':
-            $projects[$project]['status'] = UPDATE_NOT_SECURE;
-            if (empty($projects[$project]['extra'])) {
-              $projects[$project]['extra'] = array();
-            }
-            $projects[$project]['extra'][] = array(
-              'class' => array('project-not-secure'),
-              'label' => t('Project not secure'),
-              'data' => t('This project has been labeled insecure by the Drupal security team, and is no longer available for download. Immediately disabling everything included by this project is strongly recommended!'),
-            );
-            break;
-          case 'unpublished':
-          case 'revoked':
-            $projects[$project]['status'] = UPDATE_REVOKED;
-            if (empty($projects[$project]['extra'])) {
-              $projects[$project]['extra'] = array();
-            }
-            $projects[$project]['extra'][] = array(
-              'class' => array('project-revoked'),
-              'label' => t('Project revoked'),
-              'data' => t('This project has been revoked, and is no longer available for download. Disabling everything included by this project is strongly recommended!'),
-            );
-            break;
-          case 'unsupported':
-            $projects[$project]['status'] = UPDATE_NOT_SUPPORTED;
-            if (empty($projects[$project]['extra'])) {
-              $projects[$project]['extra'] = array();
-            }
-            $projects[$project]['extra'][] = array(
-              'class' => array('project-not-supported'),
-              'label' => t('Project not supported'),
-              'data' => t('This project is no longer supported, and is no longer available for download. Disabling everything included by this project is strongly recommended!'),
-            );
-            break;
-          case 'not-fetched':
-            $projects[$project]['status'] = UPDATE_NOT_FETCHED;
-            $projects[$project]['reason'] = t('Failed to get available update data.');
-            break;
-
-          default:
-            // Assume anything else (e.g. 'published') is valid and we should
-            // perform the rest of the logic in this function.
-            break;
+  // If the project status is marked as something bad, there's nothing else
+  // to consider.
+  if (isset($available['project_status'])) {
+    switch ($available['project_status']) {
+      case 'insecure':
+        $project_data['status'] = UPDATE_NOT_SECURE;
+        if (empty($project_data['extra'])) {
+          $project_data['extra'] = array();
         }
-      }
+        $project_data['extra'][] = array(
+          'class' => array('project-not-secure'),
+          'label' => t('Project not secure'),
+          'data' => t('This project has been labeled insecure by the Drupal security team, and is no longer available for download. Immediately disabling everything included by this project is strongly recommended!'),
+        );
+        break;
+      case 'unpublished':
+      case 'revoked':
+        $project_data['status'] = UPDATE_REVOKED;
+        if (empty($project_data['extra'])) {
+          $project_data['extra'] = array();
+        }
+        $project_data['extra'][] = array(
+          'class' => array('project-revoked'),
+          'label' => t('Project revoked'),
+          'data' => t('This project has been revoked, and is no longer available for download. Disabling everything included by this project is strongly recommended!'),
+        );
+        break;
+      case 'unsupported':
+        $project_data['status'] = UPDATE_NOT_SUPPORTED;
+        if (empty($project_data['extra'])) {
+          $project_data['extra'] = array();
+        }
+        $project_data['extra'][] = array(
+          'class' => array('project-not-supported'),
+          'label' => t('Project not supported'),
+          'data' => t('This project is no longer supported, and is no longer available for download. Disabling everything included by this project is strongly recommended!'),
+        );
+        break;
+      case 'not-fetched':
+        $project_data['status'] = UPDATE_NOT_FETCHED;
+        $project_data['reason'] = t('Failed to get available update data.');
+        break;
+
+      default:
+        // Assume anything else (e.g. 'published') is valid and we should
+        // perform the rest of the logic in this function.
+        break;
+    }
+  }
 
-      if (!empty($projects[$project]['status'])) {
-        // We already know the status for this project, so there's nothing
-        // else to compute. Just record everything else we fetched from the
-        // XML file into our projects array and move to the next project.
-        $projects[$project] += $available[$project];
-        continue;
-      }
+  if (!empty($project_data['status'])) {
+    // We already know the status for this project, so there's nothing else to
+    // compute. Record the project status into $project_data and we're done.
+    $project_data['project_status'] = $available['project_status'];
+    return;
+  }
 
-      // Figure out the target major version.
-      $existing_major = $project_info['existing_major'];
-      $supported_majors = array();
-      if (isset($available[$project]['supported_majors'])) {
-        $supported_majors = explode(',', $available[$project]['supported_majors']);
-      }
-      elseif (isset($available[$project]['default_major'])) {
-        // Older release history XML file without supported or recommended.
-        $supported_majors[] = $available[$project]['default_major'];
-      }
+  // Figure out the target major version.
+  $existing_major = $project_data['existing_major'];
+  $supported_majors = array();
+  if (isset($available['supported_majors'])) {
+    $supported_majors = explode(',', $available['supported_majors']);
+  }
+  elseif (isset($available['default_major'])) {
+    // Older release history XML file without supported or recommended.
+    $supported_majors[] = $available['default_major'];
+  }
 
-      if (in_array($existing_major, $supported_majors)) {
-        // Still supported, stay at the current major version.
-        $target_major = $existing_major;
-      }
-      elseif (isset($available[$project]['recommended_major'])) {
-        // Since 'recommended_major' is defined, we know this is the new XML
-        // format. Therefore, we know the current release is unsupported since
-        // its major version was not in the 'supported_majors' list. We should
-        // find the best release from the recommended major version.
-        $target_major = $available[$project]['recommended_major'];
-        $projects[$project]['status'] = UPDATE_NOT_SUPPORTED;
-      }
-      elseif (isset($available[$project]['default_major'])) {
-        // Older release history XML file without recommended, so recommend
-        // the currently defined "default_major" version.
-        $target_major = $available[$project]['default_major'];
-      }
-      else {
-        // Malformed XML file? Stick with the current version.
-        $target_major = $existing_major;
-      }
+  if (in_array($existing_major, $supported_majors)) {
+    // Still supported, stay at the current major version.
+    $target_major = $existing_major;
+  }
+  elseif (isset($available['recommended_major'])) {
+    // Since 'recommended_major' is defined, we know this is the new XML
+    // format. Therefore, we know the current release is unsupported since
+    // its major version was not in the 'supported_majors' list. We should
+    // find the best release from the recommended major version.
+    $target_major = $available['recommended_major'];
+    $project_data['status'] = UPDATE_NOT_SUPPORTED;
+  }
+  elseif (isset($available['default_major'])) {
+    // Older release history XML file without recommended, so recommend
+    // the currently defined "default_major" version.
+    $target_major = $available['default_major'];
+  }
+  else {
+    // Malformed XML file? Stick with the current version.
+    $target_major = $existing_major;
+  }
 
-      // Make sure we never tell the admin to downgrade. If we recommended an
-      // earlier version than the one they're running, they'd face an
-      // impossible data migration problem, since Drupal never supports a DB
-      // downgrade path. In the unfortunate case that what they're running is
-      // unsupported, and there's nothing newer for them to upgrade to, we
-      // can't print out a "Recommended version", but just have to tell them
-      // what they have is unsupported and let them figure it out.
-      $target_major = max($existing_major, $target_major);
-
-      $version_patch_changed = '';
-      $patch = '';
-
-      // If the project is marked as UPDATE_FETCH_PENDING, it means that the
-      // data we currently have (if any) is stale, and we've got a task queued
-      // up to (re)fetch the data. In that case, we mark it as such, merge in
-      // whatever data we have (e.g. project title and link), and move on.
-      if (!empty($available[$project]['fetch_status']) && $available[$project]['fetch_status'] == UPDATE_FETCH_PENDING) {
-        $projects[$project]['status'] = UPDATE_FETCH_PENDING;
-        $projects[$project]['reason'] = t('No available update data');
-        $projects[$project] += $available[$project];
-        continue;
-      }
+  // Make sure we never tell the admin to downgrade. If we recommended an
+  // earlier version than the one they're running, they'd face an
+  // impossible data migration problem, since Drupal never supports a DB
+  // downgrade path. In the unfortunate case that what they're running is
+  // unsupported, and there's nothing newer for them to upgrade to, we
+  // can't print out a "Recommended version", but just have to tell them
+  // what they have is unsupported and let them figure it out.
+  $target_major = max($existing_major, $target_major);
+
+  $release_patch_changed = '';
+  $patch = '';
+
+  // If the project is marked as UPDATE_FETCH_PENDING, it means that the
+  // data we currently have (if any) is stale, and we've got a task queued
+  // up to (re)fetch the data. In that case, we mark it as such, merge in
+  // whatever data we have (e.g. project title and link), and move on.
+  if (!empty($available['fetch_status']) && $available['fetch_status'] == UPDATE_FETCH_PENDING) {
+    $project_data['status'] = UPDATE_FETCH_PENDING;
+    $project_data['reason'] = t('No available update data');
+    $project_data['fetch_status'] = $available['fetch_status'];
+    return;
+  }
 
-      // Defend ourselves from XML history files that contain no releases.
-      if (empty($available[$project]['releases'])) {
-        $projects[$project]['status'] = UPDATE_UNKNOWN;
-        $projects[$project]['reason'] = t('No available releases found');
-        continue;
+  // Defend ourselves from XML history files that contain no releases.
+  if (empty($available['releases'])) {
+    $project_data['status'] = UPDATE_UNKNOWN;
+    $project_data['reason'] = t('No available releases found');
+    return;
+  }
+  foreach ($available['releases'] as $version => $release) {
+    // First, if this is the existing release, check a few conditions.
+    if ($project_data['existing_version'] === $version) {
+      if (isset($release['terms']['Release type']) &&
+          in_array('Insecure', $release['terms']['Release type'])) {
+        $project_data['status'] = UPDATE_NOT_SECURE;
       }
-      foreach ($available[$project]['releases'] as $version => $release) {
-        // First, if this is the existing release, check a few conditions.
-        if ($projects[$project]['existing_version'] === $version) {
-          if (isset($release['terms']['Release type']) &&
-              in_array('Insecure', $release['terms']['Release type'])) {
-            $projects[$project]['status'] = UPDATE_NOT_SECURE;
-          }
-          elseif ($release['status'] == 'unpublished') {
-            $projects[$project]['status'] = UPDATE_REVOKED;
-            if (empty($projects[$project]['extra'])) {
-              $projects[$project]['extra'] = array();
-            }
-            $projects[$project]['extra'][] = array(
-              'class' => array('release-revoked'),
-              'label' => t('Release revoked'),
-              'data' => t('Your currently installed release has been revoked, and is no longer available for download. Disabling everything included in this release or upgrading is strongly recommended!'),
-            );
-          }
-          elseif (isset($release['terms']['Release type']) &&
-                  in_array('Unsupported', $release['terms']['Release type'])) {
-            $projects[$project]['status'] = UPDATE_NOT_SUPPORTED;
-            if (empty($projects[$project]['extra'])) {
-              $projects[$project]['extra'] = array();
-            }
-            $projects[$project]['extra'][] = array(
-              'class' => array('release-not-supported'),
-              'label' => t('Release not supported'),
-              'data' => t('Your currently installed release is now unsupported, and is no longer available for download. Disabling everything included in this release or upgrading is strongly recommended!'),
-            );
-          }
+      elseif ($release['status'] == 'unpublished') {
+        $project_data['status'] = UPDATE_REVOKED;
+        if (empty($project_data['extra'])) {
+          $project_data['extra'] = array();
         }
-
-        // Otherwise, ignore unpublished, insecure, or unsupported releases.
-        if ($release['status'] == 'unpublished' ||
-            (isset($release['terms']['Release type']) &&
-              (in_array('Insecure', $release['terms']['Release type']) ||
-                in_array('Unsupported', $release['terms']['Release type'])))) {
-          continue;
-        }
-
-        // See if this is a higher major version than our target and yet still
-        // supported. If so, record it as an "Also available" release.
-        if ($release['version_major'] > $target_major) {
-          if (in_array($release['version_major'], $supported_majors)) {
-            if (!isset($available[$project]['also'])) {
-              $available[$project]['also'] = array();
-            }
-            if (!isset($available[$project]['also'][$release['version_major']])) {
-              $available[$project]['also'][$release['version_major']] = $version;
-            }
-          }
-          // Otherwise, this release can't matter to us, since it's neither
-          // from the release series we're currently using nor the recommended
-          // release. We don't even care about security updates for this
-          // branch, since if a project maintainer puts out a security release
-          // at a higher major version and not at the lower major version,
-          // they must remove the lower version from the supported major
-          // versions at the same time, in which case we won't hit this code.
-          continue;
+        $project_data['extra'][] = array(
+          'class' => array('release-revoked'),
+          'label' => t('Release revoked'),
+          'data' => t('Your currently installed release has been revoked, and is no longer available for download. Disabling everything included in this release or upgrading is strongly recommended!'),
+        );
+      }
+      elseif (isset($release['terms']['Release type']) &&
+              in_array('Unsupported', $release['terms']['Release type'])) {
+        $project_data['status'] = UPDATE_NOT_SUPPORTED;
+        if (empty($project_data['extra'])) {
+          $project_data['extra'] = array();
         }
+        $project_data['extra'][] = array(
+          'class' => array('release-not-supported'),
+          'label' => t('Release not supported'),
+          'data' => t('Your currently installed release is now unsupported, and is no longer available for download. Disabling everything included in this release or upgrading is strongly recommended!'),
+        );
+      }
+    }
 
-        // Look for the 'latest version' if we haven't found it yet. Latest is
-        // defined as the most recent version for the target major version.
-        if (!isset($available[$project]['latest_version'])
-            && $release['version_major'] == $target_major) {
-          $available[$project]['latest_version'] = $version;
-        }
+    // Otherwise, ignore unpublished, insecure, or unsupported releases.
+    if ($release['status'] == 'unpublished' ||
+        (isset($release['terms']['Release type']) &&
+         (in_array('Insecure', $release['terms']['Release type']) ||
+          in_array('Unsupported', $release['terms']['Release type'])))) {
+      continue;
+    }
 
-        // Look for the development snapshot release for this branch.
-        if (!isset($available[$project]['dev_version'])
-            && $release['version_major'] == $target_major
-            && isset($release['version_extra'])
-            && $release['version_extra'] == 'dev') {
-          $available[$project]['dev_version'] = $version;
+    // See if this is a higher major version than our target and yet still
+    // supported. If so, record it as an "Also available" release.
+    if ($release['version_major'] > $target_major) {
+      if (in_array($release['version_major'], $supported_majors)) {
+        if (!isset($project_data['also'])) {
+          $project_data['also'] = array();
         }
-
-        // Look for the 'recommended' version if we haven't found it yet (see
-        // phpdoc at the top of this function for the definition).
-        if (!isset($available[$project]['recommended'])
-            && $release['version_major'] == $target_major
-            && isset($release['version_patch'])) {
-          if ($patch != $release['version_patch']) {
-            $patch = $release['version_patch'];
-            $version_patch_changed = $release['version'];
-          }
-          if (empty($release['version_extra']) && $patch == $release['version_patch']) {
-            $available[$project]['recommended'] = $version_patch_changed;
-          }
+        if (!isset($project_data['also'][$release['version_major']])) {
+          $project_data['also'][$release['version_major']] = $version;
+          $project_data['releases'][$version] = $release;
         }
+      }
+      // Otherwise, this release can't matter to us, since it's neither
+      // from the release series we're currently using nor the recommended
+      // release. We don't even care about security updates for this
+      // branch, since if a project maintainer puts out a security release
+      // at a higher major version and not at the lower major version,
+      // they must remove the lower version from the supported major
+      // versions at the same time, in which case we won't hit this code.
+      continue;
+    }
 
-        // Stop searching once we hit the currently installed version.
-        if ($projects[$project]['existing_version'] === $version) {
-          break;
-        }
+    // Look for the 'latest version' if we haven't found it yet. Latest is
+    // defined as the most recent version for the target major version.
+    if (!isset($project_data['latest_version'])
+        && $release['version_major'] == $target_major) {
+      $project_data['latest_version'] = $version;
+      $project_data['releases'][$version] = $release;
+    }
 
-        // If we're running a dev snapshot and have a timestamp, stop
-        // searching for security updates once we hit an official release
-        // older than what we've got. Allow 100 seconds of leeway to handle
-        // differences between the datestamp in the .info file and the
-        // timestamp of the tarball itself (which are usually off by 1 or 2
-        // seconds) so that we don't flag that as a new release.
-        if ($projects[$project]['install_type'] == 'dev') {
-          if (empty($projects[$project]['datestamp'])) {
-            // We don't have current timestamp info, so we can't know.
-            continue;
-          }
-          elseif (isset($release['date']) && ($projects[$project]['datestamp'] + 100 > $release['date'])) {
-            // We're newer than this, so we can skip it.
-            continue;
-          }
-        }
+    // Look for the development snapshot release for this branch.
+    if (!isset($project_data['dev_version'])
+        && $release['version_major'] == $target_major
+        && isset($release['version_extra'])
+        && $release['version_extra'] == 'dev') {
+      $project_data['dev_version'] = $version;
+      $project_data['releases'][$version] = $release;
+    }
 
-        // See if this release is a security update.
-        if (isset($release['terms']['Release type'])
-            && in_array('Security update', $release['terms']['Release type'])) {
-          $projects[$project]['security updates'][] = $release;
-        }
+    // Look for the 'recommended' version if we haven't found it yet (see
+    // phpdoc at the top of this function for the definition).
+    if (!isset($project_data['recommended'])
+        && $release['version_major'] == $target_major
+        && isset($release['version_patch'])) {
+      if ($patch != $release['version_patch']) {
+        $patch = $release['version_patch'];
+        $release_patch_changed = $release;
       }
-
-      // If we were unable to find a recommended version, then make the latest
-      // version the recommended version if possible.
-      if (!isset($available[$project]['recommended']) && isset($available[$project]['latest_version'])) {
-        $available[$project]['recommended'] = $available[$project]['latest_version'];
+      if (empty($release['version_extra']) && $patch == $release['version_patch']) {
+        $project_data['recommended'] = $release_patch_changed['version'];
+        $project_data['releases'][$release_patch_changed['version']] = $release_patch_changed;
       }
+    }
 
-      // Stash the info about available releases into our $projects array.
-      $projects[$project] += $available[$project];
-
-      //
-      // Check to see if we need an update or not.
-      //
-
-      if (!empty($projects[$project]['security updates'])) {
-        // If we found security updates, that always trumps any other status.
-        $projects[$project]['status'] = UPDATE_NOT_SECURE;
-      }
+    // Stop searching once we hit the currently installed version.
+    if ($project_data['existing_version'] === $version) {
+      break;
+    }
 
-      if (isset($projects[$project]['status'])) {
-        // If we already know the status, we're done.
+    // If we're running a dev snapshot and have a timestamp, stop
+    // searching for security updates once we hit an official release
+    // older than what we've got. Allow 100 seconds of leeway to handle
+    // differences between the datestamp in the .info file and the
+    // timestamp of the tarball itself (which are usually off by 1 or 2
+    // seconds) so that we don't flag that as a new release.
+    if ($project_data['install_type'] == 'dev') {
+      if (empty($project_data['datestamp'])) {
+        // We don't have current timestamp info, so we can't know.
         continue;
       }
-
-      // If we don't know what to recommend, there's nothing we can report.
-      // Bail out early.
-      if (!isset($projects[$project]['recommended'])) {
-        $projects[$project]['status'] = UPDATE_UNKNOWN;
-        $projects[$project]['reason'] = t('No available releases found');
+      elseif (isset($release['date']) && ($project_data['datestamp'] + 100 > $release['date'])) {
+        // We're newer than this, so we can skip it.
         continue;
       }
+    }
 
-      // If we're running a dev snapshot, compare the date of the dev snapshot
-      // with the latest official version, and record the absolute latest in
-      // 'latest_dev' so we can correctly decide if there's a newer release
-      // than our current snapshot.
-      if ($projects[$project]['install_type'] == 'dev') {
-        if (isset($available[$project]['dev_version']) && $available[$project]['releases'][$available[$project]['dev_version']]['date'] > $available[$project]['releases'][$available[$project]['latest_version']]['date']) {
-          $projects[$project]['latest_dev'] = $available[$project]['dev_version'];
-        }
-        else {
-          $projects[$project]['latest_dev'] = $available[$project]['latest_version'];
-        }
-      }
+    // See if this release is a security update.
+    if (isset($release['terms']['Release type'])
+        && in_array('Security update', $release['terms']['Release type'])) {
+      $project_data['security updates'][] = $release;
+    }
+  }
 
-      // Figure out the status, based on what we've seen and the install type.
-      switch ($projects[$project]['install_type']) {
-        case 'official':
-          if ($projects[$project]['existing_version'] === $projects[$project]['recommended'] || $projects[$project]['existing_version'] === $projects[$project]['latest_version']) {
-            $projects[$project]['status'] = UPDATE_CURRENT;
-          }
-          else {
-            $projects[$project]['status'] = UPDATE_NOT_CURRENT;
-          }
-          break;
-
-        case 'dev':
-          $latest = $available[$project]['releases'][$projects[$project]['latest_dev']];
-          if (empty($projects[$project]['datestamp'])) {
-            $projects[$project]['status'] = UPDATE_NOT_CHECKED;
-            $projects[$project]['reason'] = t('Unknown release date');
-          }
-          elseif (($projects[$project]['datestamp'] + 100 > $latest['date'])) {
-            $projects[$project]['status'] = UPDATE_CURRENT;
-          }
-          else {
-            $projects[$project]['status'] = UPDATE_NOT_CURRENT;
-          }
-          break;
-
-        default:
-          $projects[$project]['status'] = UPDATE_UNKNOWN;
-          $projects[$project]['reason'] = t('Invalid info');
-      }
+  // If we were unable to find a recommended version, then make the latest
+  // version the recommended version if possible.
+  if (!isset($project_data['recommended']) && isset($project_data['latest_version'])) {
+    $project_data['recommended'] = $project_data['latest_version'];
+  }
+
+  //
+  // Check to see if we need an update or not.
+  //
+
+  if (!empty($project_data['security updates'])) {
+    // If we found security updates, that always trumps any other status.
+    $project_data['status'] = UPDATE_NOT_SECURE;
+  }
+
+  if (isset($project_data['status'])) {
+    // If we already know the status, we're done.
+    return;
+  }
+
+  // If we don't know what to recommend, there's nothing we can report.
+  // Bail out early.
+  if (!isset($project_data['recommended'])) {
+    $project_data['status'] = UPDATE_UNKNOWN;
+    $project_data['reason'] = t('No available releases found');
+    return;
+  }
+
+  // If we're running a dev snapshot, compare the date of the dev snapshot
+  // with the latest official version, and record the absolute latest in
+  // 'latest_dev' so we can correctly decide if there's a newer release
+  // than our current snapshot.
+  if ($project_data['install_type'] == 'dev') {
+    if (isset($project_data['dev_version']) && $available['releases'][$project_data['dev_version']]['date'] > $available['releases'][$project_data['latest_version']]['date']) {
+      $project_data['latest_dev'] = $project_data['dev_version'];
     }
     else {
-      $projects[$project]['status'] = UPDATE_UNKNOWN;
-      $projects[$project]['reason'] = t('No available releases found');
+      $project_data['latest_dev'] = $project_data['latest_version'];
     }
   }
-  // Give other modules a chance to alter the status (for example, to allow a
-  // contrib module to provide fine-grained settings to ignore specific
-  // projects or releases).
-  drupal_alter('update_status', $projects);
 
-  // Cache the site's update status for at most 1 hour.
-  _update_cache_set('update_project_data', $projects, REQUEST_TIME + 3600);
-  return $projects;
+  // Figure out the status, based on what we've seen and the install type.
+  switch ($project_data['install_type']) {
+    case 'official':
+      if ($project_data['existing_version'] === $project_data['recommended'] || $project_data['existing_version'] === $project_data['latest_version']) {
+        $project_data['status'] = UPDATE_CURRENT;
+      }
+      else {
+        $project_data['status'] = UPDATE_NOT_CURRENT;
+      }
+      break;
+
+    case 'dev':
+      $latest = $available['releases'][$project_data['latest_dev']];
+      if (empty($project_data['datestamp'])) {
+        $project_data['status'] = UPDATE_NOT_CHECKED;
+        $project_data['reason'] = t('Unknown release date');
+      }
+      elseif (($project_data['datestamp'] + 100 > $latest['date'])) {
+        $project_data['status'] = UPDATE_CURRENT;
+      }
+      else {
+        $project_data['status'] = UPDATE_NOT_CURRENT;
+      }
+      break;
+
+    default:
+      $project_data['status'] = UPDATE_UNKNOWN;
+      $project_data['reason'] = t('Invalid info');
+  }
 }
 
 /**