[Drush 8] (8.5.0) Upgrading drupal core from 7.72 => 7.102 fails

[heddn]

Describe the bug
A clear and concise description of what the bug is.

To Reproduce
What did you do?

This is a really old and out of date site that is hosted on Pantheon. I attempted to test the new 8.5.0 release of Drush to update things.

I downloaded the site's code and copy of the db from pantheon. Then launched ddev. Initially I did a drush up and that updated everything but drupal core. Since I wanted to test updating drupal core too, I removed .drush-lock-update. Then I attempted drush up drupal and that failed. I switched back to drush 8.4.12, and the core upgrade started working again.

Expected behavior
What did you expect would happen?

Drupal core would update.

Actual behavior
What happened instead?

$ ./drush up drupal
Update information last refreshed: Wed, 11/27/2024 - 16:06
 Name    Installed Version  Proposed version  Message                   
 Drupal  7.72               7.102             SECURITY UPDATE available 


Code updates will be made to drupal core.
WARNING:  Updating core will discard any modifications made to Drupal core files, most noteworthy among these are .htaccess and robots.txt.  If you have made any modifications to these files, please back them up before updating so that you can re-create your modifications in the updated version of the file.
Note: Updating core can potentially break your site. It is NOT recommended to update production sites without prior testing.

Do you really want to continue? (y/n): y
TYPO3\PharStreamWrapper\Exception: Unexpected file extension in "phar:///var/www/html/drush/commands/pm/version_control" in      [error]
/var/www/html/misc/typo3/drupal-security/PharExtensionInterceptor.php:38
Stack trace:
#0 /var/www/html/misc/typo3/phar-stream-wrapper/src/Behavior.php(72):
Drupal\Core\Security\PharExtensionInterceptor->assert('phar:///var/www...', 'url_stat')
#1 /var/www/html/misc/typo3/phar-stream-wrapper/src/Manager.php(115):
TYPO3\PharStreamWrapper\Behavior->assert('phar:///var/www...', 'url_stat')

Workaround
Is there another way to do the desired action?

System Configuration

Q	A
Drush version?	8.5.0
Drupal version?	7.72
PHP version	7.3
OS?	Linux

Additional information
Add any other context about the problem here.

[greg-1-anderson]

Looks like overzealous security in the box phar generator; investigating.

[greg-1-anderson]

I was able to reproduce the phar install on Pantheon. When trying to do the same thing (update drupal core after removing the lock file) on a source install, I would get the error Unable to load class \Drush\VersionControl\Backup when updating Drupal Core, whereas updating contrib modules work. I haven't tested drush pm-update drupal in a non-Pantheon environment. If it works there, then I might discount this as an edge case that doesn't need to be fixed. If it also fails in the general case, then I'll likely remove support for the phar build in Drush 8.