False warnings about security updates

As the module maintainer in question, this was certainly an unpleasant surprise.

Even linking to some docs would be an improvement, it wasn’t clear to me that these checkboxes would have any impact beyond the Drupal.org project page.

Thanks for sharing a screen dump @star-szr. I agree, adding a sentence and a link to the doc page would be great, something like this:

Note: Disabling "Supported" → can result in security warning emails being sent out, and a "Not Supported!" message under /admin/reports/updates.

I couldn't find the right documentation page, so the link should be updated to point at the actual page, where this setting is documented.

There was some discussion of this when Semantic Versioning for contributed projects was introduced. That allowed more options for maintainers to support or not. I didn’t find any issues offhand though.

https://www.drupal.org/node/1015226 → could be a place to document, or link to from documentation.

I think we should get rid of the “Recommended” label to simplify the form 📌 Remove “recommended” status for releases? Active

The wording for a message here does not need to be overly-specific or discouraging. We do want maintainers to be able to keep a manageable workload, un-supporting a release series is fine. The emphasis should be on encouraging some overlap in what is supported, to give users time to migrate.

Thanks for a great response @drumm, good points.

Adding a sentence or two about the ramifications of removing the check of "Supported" from a version number on the Release naming conventions → page and linking to it from the module "Release" page is a great idea.

@star-szr. Do you feel like putting this into writing, and adding it to that page?

I understand that the wording shouldn't dissuade module maintainers from removing the "Supported" check, but make it clear that it might have consequences, such as email alerts being sent to users. And these users may get weekly or daily emails about this, until they update. So minor bugfix releases, and similar probably does not warrant making a previous version not "Supported".

And thanks for creating 📌 Remove “recommended” status for releases? Active , I was a bit apprehensive at first, since I do like the different colors (see for example Webform) indicating which is the recommended version. But as you write, if Composer's rules are what counts, maybe it should be removed.

I’ve added a draft to #686918: Add help text to project release admin page to warn about marking branches unsupported and the impact on update status → for adding help text, please help review and improve it.

It looks like the conclusion of this issue was to add help text and documentation, so I think the other issue will cover making this improvement.

Thanks @drumm. I know the other issue is older, but wouldn't it be better to continue in this issue and mark the other as duplicate, since this issue includes valuable information such as:

• A recent incident
• Feedback from a maintainer
• Feedback from a regular user
• Documentation