Leverage update.xml to discover core security updates

Cool, with this improvement I get to go directly from 8.7.4 to 8.7.8:
http://autoupdate.lndo.site/automatic_updates/in-place-update/drupal/cor...

I do get these warnings, the update succeeds nevertheless. Perhaps I get them because I use Composer, and not the tarball?:

Warning message

Your site does not pass some readiness checks for automatic updates. Depending on the nature of the failures, it might effect the eligibility for automatic updates.
The project "Automatic Updates" can not be updated because its version is either undefined or a dev release.
The hash for INSTALL.txt does not match its original. Updates that include that file will fail and require manual intervention.
The hash for README.txt does not match its original. Updates that include that file will fail and require manual intervention.
The hash for autoload.php does not match its original. Updates that include that file will fail and require manual intervention.
The hash for composer.json does not match its original. Updates that include that file will fail and require manual intervention.
The hash for composer.lock does not match its original. Updates that include that file will fail and require manual intervention.
The hash for example.gitignore does not match its original. Updates that include that file will fail and require manual intervention.
The hash for modules/README.txt does not match its original. Updates that include that file will fail and require manual intervention.
The hash for profiles/README.txt does not match its original. Updates that include that file will fail and require manual intervention.
The hash for sites/README.txt does not match its original. Updates that include that file will fail and require manual intervention.
The hash for themes/README.txt does not match its original. Updates that include that file will fail and require manual intervention.

After updating, initially this text is shown:

No update for Drupal is available for version 8.7.4.

After I run drush cr, I get the correct text:

No update for Drupal is available for version 8.7.8.

So perhaps the cache can be rebuilt by the module, after the update process is completed?

Also, great to see that changed files are now getting logged, thanks! However, since there are so many insertions now, would it be possible to list the files in a single log insertion, or would that become too large?

----------------------
Putting my process for creating a fresh Lando environment here, to document it for myself, but also if others are interested, It takes me around two minutes:

# get older version 8.7.4 of Drupal core to test updating directly to 8.7.8 (8.7.5 is a security update)
git clone git@github.com:drupal-composer/drupal-project autoupdate
cd autoupdate/
sed -i 's|\^8.7.0|8.7.4|g' composer.json

# create fresh Lando instance
lando init --recipe drupal8 --webroot web --name autoupdate
lando start

# get Drupal core files and install
composer update --with-dependencies --no-dev -v
drush site-install --db-url=mysql://drupal8:drupal8@database/drupal8 --account-pass=content -y

# get modules and enable
composer require --update-no-dev drupal/admin_toolbar drupal/automatic_updates:1.x-dev
drush en admin_toolbar admin_toolbar_tools automatic_updates -y

# test the patch in "Leverage update.xml to discover core security updates"
cd web/modules/contrib/automatic_updates/
wget https://www.drupal.org/files/issues/2019-10-11/3087463.patch
patch -p1 < 3087463.patch
cd -

# rebuild cache and get login link
drush cr
drush uli -l http://autoupdate.lndo.site

# shut down and destroy Lando instance when done, and remove the directory
lando stop
lando destroy
chmod 775 web/sites/default
cd ..
 rm autoupdate -rf

I also now can't reproduce the version string thing @heddn. After updating it works perfectly, and shows the correct text:

No update for Drupal is available for version 8.7.8.