Consider flipping the default for update.settings:check.disabled_extensions

+1 for this. Dependabot and similar tools already flag uninstalled modules because they only look at composer.json.

Also, this would help if there was ever another SA-CONTRIB-2016-039 → .

The UI for when you turn this on isn't terrible. 😅 The uninstalled stuff appears in a whole separate table at the bottom of the report. So hopefully won't be too much confusing noise in the regular case.

In general, +1 to the change.

UpdateManagerUpdateTest is failing now, since it's assuming the old default.

However, that test is completely removed @ 📌 Remove UI and routes for the ability to update modules and themes via update.module and authorize.php Active .

Should we bother fixing the test here and needing to re-roll one of these MRs whenever the other lands, or should we postpone this on committing #3502973 first?

+1 for defaulting this true. Think we can postpone as this is a "nice to have" update but don't think breaking anything immediately. Will prioritize the blocker though in my next round of reviews.

Blocker is in. Just need trivial rebase and those should be green pipelines

Rebased. Pipeline is green.

Well, that was easy!

Do we need a CR for this (for example for distribution developers), since we are changing the behavior for new sites?

Added a CR:

https://www.drupal.org/node/3512744 →

Committed/pushed to 11.x, thanks!

catch → closed merge request !11401

Thanks for adding the CR and committing this. Hopefully this helps more than it confuses. 🤞