TYPO3 Core

Same thing happens when the extension is manually extracted into typo3conf/ext. Clearing all caches (in the install tool) does not help.

i see no security related problem there.

Most likely a dependency is not fulfilled, e.g. the max TYPO3 version allowed is lower that the current version or the PHP version allowed is lower than the current.

Please have a look at #53576.

IMHO we should still show the update icon, but make it grey and let it show the dependencies that are required for an update on hover.

I would not show an action icon for an action that is not available, on an older installation you'd then get icons everywhere with which you can't do anything. Normally the missing dependency for the update of an extension will be the TYPO3 version (especially in case you use git master ;)) - but an available TYPO3 update should not be communicated via the extensions.

I don't think it is good to remove the info about available extension updates alltogether. The problem is that some people (me included) look for available updates in the extension manager, and if there is no indication of an available update, they tend to think that no update is available.

I think that showing the icons, but grayed out would be a good solution, since it a) shows that updates are available, and b) bugs the user to update their TYPO3. Additionally, a title tag (or some other, more obvious ui-element) with more detailed info about the missing dependencies would be nice. This helps the integrator to make an informed decision (instead to making the decision for him, as it is now).