Drush or Drupal console command to list modules with security updates? Is there a command for Drupal 8.x that shows available updates?

I added forms_steps 1.1 that has an SA and a security update required in the Web UI, which is saying to update to 1.2



I tried drush pm:security but it reports that there is no outstanding security.

root@d568732a8640:/app# drush pm:security
 [success] There are no outstanding security updates for Drupal projects.


I might have overestimated the capability of this command so I'm looking for alternatives to get both update and security update in the console. My goal with this is to add a schedule job in our CI that will report on those.
drush pm:security should be fine in listing Drupal modules with security updates.

There was a bug from the drupal-composer/drupal-security-advisories project that resulted in not listing the forms_steps module and some other modules.  It was promptly fixed and now it works!