A more specific state variable should be used for storing the last run time

Can you test on the 3.x version

I haven't actually tested because it would take quite some time, but unless you know (or suspect; I'd be happy to put in some more legwork in that case) this was actually changed between 2.x and 3.x, I'm fairly sure from inspecting the code it has not changed and the same is true for 3.x. See https://git.drupalcode.org/project/security_review/-/blob/3.0.x/src/Secu.... The state service passed into that service is just the plain state service from core.

In fact, let me just switch to 3.0. It's not mission critical, so maybe more relevant to do my work on that.

You'll probably have to uninstall and reinstall at 3.x

Did a lot of refactoring in 3.x and didn't really have time for an upgrade path.

I did just that on my dev environment. I'll be curious to see what happens on the test environment, where it will be a straight "update" in the sense that it will just do a config import of the changed config.

As long as the old config is gone.

On 2.0.x the config was broken up into like a dozen files. I've consolidated that.

I checked on 3.0, but this has not changed.

One remaining decision I see is what to do with the old value if we provide an update hook to set the new variable. Are we going to assume it is nit used by anything else and delete it, or err on the safe side and leave it be, in case some other code is inadvertently making use of the same value?

Changed suggested new name because the uid and group are specifically about the user with which drush runs on the server.

BTW, I now get why this is the way it is. It has everything to do with #2902571: `last_run` should be a part of state, not config → , where 'config' was simply replaced by 'state'. Except, 'config' was the module's own config item, while 'state' is the generic state key value store.

Made a nitpicky change

Automatically closed - issue fixed for 2 weeks with no activity.