Drush pm:security does not find SA for Drupal 9.0.0

[spleshka]

Describe the bug
Command drush pm:security does not find security releases for Drupal 9 core.

To Reproduce

1. Install Drupal 9.0.0 (which has security issues and has to be upgraded to 9.0.1)
2. Install latest Drush 10.3
3. Run drush pm:security - it will not find any security issues.

Expected behavior
drush pm:security should find security update for Drupal core which is 9.0.1 as of today.

Actual behavior
We get [success] There are no outstanding security updates for Drupal projects.

Workaround
Unknown

System Configuration

Q	A
Drush version?	10.3
Drupal version?	9.0.0
PHP version	7.4.5
OS	Linux

Additional information
We've done a quick research and look like https://github.com/drupal-composer/drupal-security-advisories does not include Drupal 9 yet, which causes this issue.

[weitzman]

Good find. Out of curiosity, does drush pm:security-php report it? I think they monitor core but not contrib.

[spleshka]

Yep, it does report the issue:

drush pm:security-php

 [warning] One or more of your dependencies has an outstanding security update.
 [notice] Run composer why drupal/core to learn what module requires the package.
drupal/core:
  version: 9.0.0
  advisories:
    -
      title: 'Drupal core - Critical - Cross Site Request Forgery - SA-CORE-2020-004'
      link: 'https://www.drupal.org/sa-core-2020-004'
      cve: ''
    -
      title: 'Drupal core - Critical - Arbitrary PHP code execution - SA-CORE-2020-005'
      link: 'https://www.drupal.org/sa-core-2020-005'
      cve: ''
    -
      title: 'Drupal core - Less critical - Access bypass - SA-CORE-2020-006'
      link: 'https://www.drupal.org/sa-core-2020-006'
      cve: ''

[weitzman]

Hopefully will be fixed by drupal-composer/drupal-security-advisories#22

[weitzman]

Yes, that fixed it.

[spleshka]

Brilliant, thank you @weitzman!