How can I list only modules which need an update?
Drush puts that [ok] information out on stderr. So you can actually just dump that by using:

drush ups 2&gt;/dev/null


which for me gave:

 $ drush ups 2&gt;/dev/null
 Name    Installed Version  Proposed version  Message
 Drupal  8.2.5              8.2.6             Update available