The Maintainers Behind Drupal’s Company Contribution Rankings

People listed in Drupal core’s maintainer roster account for 66.9% of 10,933 recorded core contribution credit units in an audit by The DropTimes. The ten most-credited people hold 43.9% of the total, and all ten appear in core’s maintainer roster. Credit measures recorded recognition, not money, hours or the difficulty of the work.

Company rankings therefore need to be read alongside the people behind them. Six of the ten leading organisations by fractional core credit obtain at least 97.8% of their counted units from one person, or almost entirely from one or two people. A core-only comparison also leaves participation in strategic initiatives outside the picture. These distinctions matter as the Drupal Association changes how it rewards core contribution and recognises sponsorship of maintenance roles.

The audit covers 2,515 closed, non-security core issues carrying granted credit, involving 1,568 people and 461 organisations, whose last status change falls between 1 October 2025 and 30 September 2026 UTC. Its data were captured on 14 October 2026, with six newsroom hand-checks against Drupal.org’s own pages completed on 3 November 2026. The results describe that captured record, rather than a live ranking or a measurement of work performed within those dates.

The fractional core-credit rankings illustrate the difference between organisational totals and the people behind them. PreviousNext leads with 996.5 units, followed by Third and Grove (693.3), Full Fat Things (644.5), Mobomo (629.5) and Acquia (488.3). Those five account for 31.6% of all recorded core units under the audit’s fractional method, which keeps unattributed credits in the denominator. Acquia’s credits are spread among 46 people; some other high-ranking organisations rely overwhelmingly on one person. These rankings represent credited recognition, not equivalent quantities of labour or company investment.

The people named in the maintainer roster include contributors with responsibilities for particular subsystems and topics, alongside core leadership roles. Members of the Core Leadership team alone hold 38.1% of recorded core credit. The concentration identifies recognised participation by people holding those roles; it does not establish how much their employers spent supporting them.

One Core Leadership team member’s change in organisational attribution illustrates how an individual contributor can affect company rankings. After the contributor changed attribution from Third and Grove to Tag1 Consulting in June 2026, roughly 340 units in the June–September period were attributed to Tag1 rather than Third and Grove. Such movements cannot, by themselves, establish changes in maintenance investment or a transfer of previously awarded credits.

Later in October, the Association increased the weight assigned to core contributions. Its 21 October announcement confirmed that a core issue now carries 15 weighted credits, previously ten, while a core security advisory carries 150, previously 50. Strategic initiative issues remain worth ten weighted credits.

The Association linked the higher core weighting to the need to support the foundation on which Drupal CMS, Canvas and Drupal AI depend. It also expanded monthly sponsorship recognition to active Security Team members, subsystem maintainers and topic maintainers. That mechanism recognises support for roles whose responsibilities do not always produce individual issue credits.

Those changes affect the incentives surrounding the audit, rather than altering its counting unit. The audit counts granted contributor recognition before marketplace weighting. Its snapshot cannot establish whether the subsequent changes have attracted additional sponsors or filled unassigned responsibilities.

Project scope changes the interpretation of company participation too. Across core, Drupal CMS, Canvas and Drupal AI, 59.5% of organisation-attributed fractional credit went to core. About 40% went to the three initiatives. For example, only 16.7% of Acquia’s attributed units across these four projects concerned core, while 72.9% went to Canvas. A company’s position in core alone consequently describes only part of its recorded Drupal participation.

Maintainer affiliations provide a separate view of organisational involvement. The employer information comes from maintainers’ self-reported Drupal.org profiles checked on 14 October 2026. It identifies current affiliations, rather than establishing which employer supported every contribution during the preceding year. An entry with maintainers from more than one organisation can also appear in more than one organisation’s coverage.

Organisation attribution leaves another substantial part of the record unexplained. Credit carrying no organisation rose from 20.1% in October 2023–September 2024 to 29.1% in October 2025–September 2026. The number of organisations credited on core fell from 516 to 461 across the same comparison. Neither finding identifies whether unattributed contributors were paid or who supported their participation.

The historical comparison has a further qualification. When an issue changes status again, its status date can move into a later reporting window, and older issues have had longer to do so. The audit identifies this depletion of older counts, but does not measure its effect on attribution shares. The results therefore do not support a general claim that concentration is getting worse.

End-user customers are also sparsely represented in core’s attribution record. Government, commercial and non-profit end users are named on 1.4% of core credit units under the audit’s classification of the leading customer profiles. Employer and customer recognition are treated separately. This measures visible customer attribution, without establishing how much customers finance upstream work through contracts or other arrangements.

The maintainer roster supplies a separate observation about responsibilities awaiting an assigned maintainer. At the checked commit, 16 of 100 subsystem and topic entries have no maintainer. These entries describe responsibilities, rather than measured full-time jobs or a count of areas receiving no maintenance work.

The October 2025 recruitment call originally identified areas seeking maintainers. Ban and Settings Tray have since been removed from the Drupal 12 development releases ahead of the scheduled stable 12.0.0 release, leaving 26 of those original areas in the Drupal 12 core codebase. Of those remaining areas, 11 now have named maintainers and 15 are still unassigned. The audit establishes no company-specific funding cause for the unassigned entries.

Certification is evolving alongside these contribution incentives. In remarks published on 28 October 2026, Association interim CEO Tiffany Farriss outlined a broader Drupal Certified framework recognising makers, patrons and advocates. She also proposed a maintainers fund through which organisations without development capacity could support maintenance. These are stated plans, rather than evidence that a replacement certification programme or fund is already operating.

Tiffany described shared practices including contributing fixes upstream, responding to the Security Team, tending relevant issue queues and keeping sites current. Those proposed expectations extend the discussion beyond a company’s position in a contribution table. The audit, however, cannot establish whether such arrangements will change participation or maintenance capacity.

The method behind the findings is important to their interpretation. The audit used a single-threaded, keyset-paginated capture of Drupal.org’s contribution records and checked field meanings against the contribution_records module source. A credit unit represents one contributor with granted credit on one counted record. Where organisation shares use fractional allocation, the unit is divided equally among attributed organisations; units without an organisation remain in the denominator.

Closed issues are not synonymous with committed fixes. The counted statuses include fixed issues alongside duplicates, issues closed as outdated and other closed outcomes that the API does not distinguish. Open issues are excluded, and security recognition is treated separately. The source-status date can also move after capture, so a later inspection need not return an identical total.

The audit reports that a second SQL-only implementation matched all 106 checked figures. Both implementations belong to the same AI-assisted workflow, so their agreement checks arithmetic and consistency rather than providing external assurance. Comparisons with Drupal.org’s organisation counters and the newsroom’s dated hand-checks provide additional checks, subject to differences in reporting windows and subsequent record changes.

The findings make the people behind organisational recognition visible. They also show why core credit, initiative participation, current maintainer responsibilities and customer attribution need to be examined on their own terms. October’s changes create new incentives for supporting core and maintenance roles; evidence of the resulting sponsorship and participation will be needed to assess their effect.

These findings draw on The DropTimes’ Drupal Contribution Audit, using data captured on 14 October 2026 and newsroom hand-checks completed on 3 November 2026. The main analysis covers closed, non-security core issues whose last status change falls between 1 October 2025 and 30 September 2026 UTC. Credit measures recorded recognition, not hours, spending or task difficulty.

Drupal.org’s official organisation count treats each qualifying issue once per organisation. For fractional company comparisons, each contributor credit unit is divided equally among its attributed organisations; units naming no organisation remain in the denominator for shares of all credit. Employer and customer attribution are distinguished, while current employer listings do not establish who supported earlier work.

Closed issues include outcomes other than committed fixes, and later status changes can move records between reporting windows. The figures therefore describe a dated snapshot and exclude open issues and work unrecorded in the issue queues. A separate SQL-only implementation matched all 106 checked figures within the same AI-assisted workflow, providing an arithmetic and consistency check rather than external assurance.