This works and fix the bug with ampersands... but what about the scary message “Extension XXX Potentially Serious Problem. More Information.”? Seriously we want that everytime that there is a Joomla 4 update and a system plugin has no update informations, the user will be warned about potentially breaking the Joomla site or update?
Keep in mind that there are many extensions developers that provide plugins bundled as part of a main component which is the one subject of the updater.

Can we please branch this question out to its own issue? This PR here fixes an valid issue to be merged after tests. The question mentiond by you is also the case for 3.10 so i would propose this to be moved to its own issue. I'm happy to explain the reasons and discuss alternative solutions when we have better proposals. Thanks @joeforjoomla

@joeforjoomla I can address your issue to the extent it touches the scope of my PR. When you install a package type extensions all of its extensions (e.g. component, plugins, modules, ...) are "assigned" to the package ID in the #__extensions table, see the package_id column. According to my tests with JCE and my own software these sub-extensions do not appear in the pre-update check. So, by fixing the problem this PR addresses any canonical 3PD Joomla extension installation should appear correctly in the pre-update checks.

Thankyou @nikosdion - sorry must have mucked this one up in the conflicts from 3.10

@wilsonge It's OK. My original report was two pronged, one question being about sub-extensions (I had the same concern as @joeforjoomla). The other one was about the actual checks which originally were brushed off as a problem with the extension XML update file, then there was an oblique reference to a possible issue with the URL. It ended up not being fixed, I guess? At least now I could test with JCE, not just my stuff, to make sure that the problem is definitely not between this chair and keyboard ;)

I will probably come back with more small bugs. I am in the process of converting Admin Tools to core MVC and figuring out the transition from FOF-based to core MVC-based extensions. I end up hitting all the weird things in extensions installation and updates nobody could have reasonably tested during the alpha and beta.

I currently have an issue with an extension version X listing update site A and extension version Y listing site B resulting in both sites being kept. I will be diving into that in a week or so.

@nikosdion there is still a javascript error after this fix (see image)

It seems that there are no elements having id 'plg_xxx' so the remove function fails, i guess that line should be removed.