News Roundup

Nathan Wallace discusses how reduced federal capacity is changing the questions Drupal4Gov receives from government web teams. He addresses GovCon sponsorship pressure, volunteer ownership, underrepresented groups, content governance, and delivery planning for a federal design system. The conversation offers his view of leadership and Drupal delivery under public-sector constraints.

Four Drupal events are listed to begin or take place between 10 and 17 August 2026. The schedule includes Drupal GovCon 2026, a DrupalEasy module-development course, Drupal Cafe Lutsk #32, and the Drupal User Group Ruhr meeting. The events offer a mix of conference sessions, professional training, and community discussion for Drupal participants.

Display Builder 1.0.0-beta6 was released on 6 August 2026 with new UX, preview, and Drupal 11.4 compatibility work. The release follows Beta 5’s shift to revision-backed history and incorporates the interface refresh demonstrated at UI Suite Monthly #37. Translation and accessibility work remain as the project moves toward a release candidate.

Drupal’s Security Team disclosed a moderately critical cross-site scripting vulnerability in UI Patterns 2.x on 8 July 2026. UI Patterns 2.0.17 fixed the affected code, and 2.0.18 followed with changes that rely on Twig auto-escaping at render time. Sites running versions earlier than 2.0.17 in the 2.x branch should update to a fixed release.

Dries Buytaert has recapped a Drupal AI Learners Club session on three tools that began as personal experiments. He demonstrated Drupal Digests, AI-generated Rector rules, and an API Catalog that exposes his site's search service to agents. The post presents publication, community use, and contribution as signals that an experiment may eventually develop into a Drupal community project.

Bloomidea has released Commerce MRW, a contributed module for Drupal Commerce stores using the MRW carrier. It handles shipment transmission, labels, cancellations, return pickups, and tracking through MRW's SAGEC services. For merchants in Spain, Portugal, Andorra, and Gibraltar, it can reduce the need to transfer order data between Drupal and a separate carrier portal.

The Drupal Security Team published two Moderately Critical contributed-module security advisories on 5 August 2026 for Entity Browser and Edit in-place field. Entity Browser has a stored cross-site scripting flaw in tab titles, while Edit in-place field can let users with a specific permission modify fields without normal entity access checks. Maintainers using affected releases should update to Entity Browser 8.x-2.16 and Edit in-place field 2.1.1.

Drupal core maintainers released Drupal 11.4.5 and Drupal 10.6.15 on 6 August 2026. Drupal 11.4.5 fixes the AJAX error that could prevent administrators from creating a new content-based View and includes a wider set of core bug fixes. Drupal 11.4.x has security coverage until June 2027, while Drupal 10.6.x remains under security support until December 2026.

Joshua Mitchell has detailed PDFa11y, a Drupal module that reviews uploaded PDFs for selected accessibility issues. The module examines document metadata and structure, records passed, failed, or skipped results, and can be configured to warn editors or block uploads when checks fail. Drupal teams can use it as an early publishing control, but the project does not present automated scanning as a comprehensive accessibility assessment.

Rod Martin surveys Drupal’s unsettled site-building landscape across Layout Builder, Paragraphs, Canvas, UI Patterns, and Display Builder. He recommends keeping content structured, using Single-Directory Components for frontend work, and choosing one primary builder for each project. The approach aims to preserve portability while Drupal’s builder roles and integration paths continue to evolve.

Drupal developer Marcus Johansson has shared an AI-produced setup tutorial for the AI Translate module. The workflow researches the module, drafts a storyboard for human approval, and records browser actions with generated narration and captions. Jim Birch later adapted the approach into two macOS skills for broader software demonstrations.

LocalGov Drupal is offering ten sponsored places for the inaugural Government Summit at DrupalCon Europe in Rotterdam. The event on 28 September 2026 will combine panels and presentations with lightning talks and facilitated workshops. Council digital teams unable to fund attendance can apply until 21 August 2026.

Adopting an open-source dependency does not end technical due diligence. Hosted access, licensing, maintainer capacity, successor projects, and regulation can change during its operational life. Drupal teams can prepare through accurate inventories, sustainable maintenance practices, and practical continuity planning.

DXP Scorecard has introduced The Decider, a free tool that shortlists content platforms after seven questions. It weighs use case, team, budget, reach, regulatory needs, and AI priorities against an 187-criterion framework. Drupal is among the 38 active candidates, giving prospective adopters another starting point for platform research.

The European Commission published its EU Open Source Strategy on 3 June 2026 as part of its technology sovereignty package. It proposes procurement reform, support for maintainers and foundations, security measures, skills programmes and funding for essential open-source components. For Drupal organisations, the strategy could influence how public software is selected, maintained, shared and transferred between suppliers.

Pumex Infotech has published a setup guide for using DrupalBridge to send Drupal Webform submissions to HubSpot. The process combines manual module installation with OAuth authorisation, licence activation, handler configuration, and field mapping. For Drupal teams, the guide clarifies the integration steps but not the connector’s maintenance and recovery model.

Webform 6.3.0 became the module’s first stable release compatible with Drupal 11 on 7 July 2026. It requires Drupal 10.3 or Drupal 11 and records 292 resolved issues from 229 contributors, while maintainers flag caching, asset-loading, and submodule concerns. Drupal site teams now have a stable upgrade path but should test affected configurations before production deployment.

Bluefly.io will host John Money, director of product marketing for platform and Drupal at Acquia, for an online town hall at 18:00 UTC on 7 August 2026. The event notice says John will demonstrate Acquia Source and agentic AI before a live question-and-answer session. Drupal practitioners can watch the vendor-led walkthrough and ask how the platform’s AI agents are intended to work.

Audited statements show the Drupal Association ended 2025 with a $224,072 decline in total net assets after restating the 2024 decline to $922,731. Management says unrestricted reserves fell to about $960,000, equal to 2.3 months of operating expenses, while donated and exchanged services accounted for more than $1 million of 2025 support and revenue. For the Drupal community, the figures sharpen questions about how Drupal.org will be funded and how the board will receive reconciled financial reports.

Pantheon has started provisioning new Drupal and WordPress sites on a filesystem backed by Cloud Storage FUSE. New-site adoption is scheduled to reach 100% by 17 August 2026, followed by plan-based migrations for existing sites from September through November. Drupal teams can use the Filesystem Generation field in Site details to check whether a site has moved to the new system.

Decoupled Days 2026 will bring open-source web practitioners to Montréal on 6 and 7 August 2026. Four featured speakers will examine content modelling, configurable applications, neurodivergent working experiences, and development processes for artificial intelligence tools. Their sessions offer Drupal and broader decoupled-web teams practical perspectives on governance, application structure, workplace agency, and software delivery.

Drupal hosting providers are presenting sovereignty through managed regional platforms, customer-controlled cloud accounts, certified commercial services, government-managed platforms, and self-hosted infrastructure. These models distribute control over data, infrastructure, operations, supply chains, and migration in different ways. Drupal buyers need to test each control separately rather than treating a hosting region as proof of sovereignty.

BOA 5.88.811 refined the Drupal 7-to-Backdrop conversion workflow introduced in version 5.88.8. The system prepares a separate site copy, reports module compatibility, and lets operators transfer the production domain after reviewing the result. Drupal 7 operators still need to test the converted application and resolve unsupported modules, themes, layouts, and custom components before cutover.

Vardot has updated its guide to building or buying donation platforms, drawing on its work with UNHCR. The company says the Drupal system supports more than 35 markets and lets campaign teams publish pages in about 15 minutes through reusable layouts and configurable payment options. The example shows Drupal teams how local control can operate within a shared governance and reporting structure.

Drupal AI 1.5.0-alpha2 adds processor selection to the DeepChat chatbot block. The block can send chat input through a registered processor instead of calling the AI Assistant API directly. The change gives Drupal site builders a common interface for testing different chatbot processing strategies.

Universal AI Provider beta 2 adds content-governance tools for Drupal 11.1 and Drupal 12. The release introduces provenance records, reader-facing and machine-readable disclosures, configurable guardrails, and scheduled content reviews. Drupal teams can use the tools to support transparency workflows, but the module does not determine whether a site complies with Article 50 of the EU AI Act.

Drupal events scheduled from 3 to 9 August 2026 include two online sessions and four in-person gatherings in Tokyo, Montréal, Oxford, and London, Ontario. The programme covers HTMX in Drupal core, Code of Conduct incident response, decoupled web development, local community discussion, and an artificial intelligence concierge built with Drupal. The week gives Drupal contributors several routes to follow technical initiatives, exchange implementation experience, and strengthen community practice.

Drupal AI Videos published a demonstration of a self-hosted observability stack created with the One Line Installer. The setup sends OpenTelemetry data through Alloy to Tempo, Mimir, and Loki, while Grafana displays requests, costs, and agent-session traces. The example gives Drupal teams a reference for testing local monitoring of AI calls and nested agent activity.

Marcin Grabias has described using Claude Code to merge two similar answer plugins in Drupal LMS. He says the tool updated the implementation, migration hook, fixtures, and tests while he reviewed and corrected the changes. The account presents repetitive consistency work as a suitable use for coding agents when maintainers retain technical judgment.

Jaymie Strecker has published a tutorial on inserting reusable boilerplate text into Drupal’s CKEditor. The setup stores shared passages in taxonomy terms and makes them available through an Entity Embed toolbar button. It gives editors a way to combine centrally managed wording with content written for individual nodes.

Click Here Labs released Entity Reference Field Override for Drupal. The module stores selected list or boolean overrides on the parent entity and can extend the same workflow to paragraph types through an optional submodule. Drupal teams can vary presentation per placement without changing reusable content or modifying templates.

The Drupal Security Team published three contributed-project advisories on 29 July 2026. Token Content Access received a fix for a timing-based access bypass, while Disable Login Page and Powerful Surveys were marked unsupported with unresolved security issues. Sites should update Token Content Access to version 3.1.2 and remove the other two projects because no supported releases remain.

Context Control Center 1.0.0-beta3 was released on 18 July 2026. It adds optional document and webpage imports, per-agent context limits, redesigned administration pages and supported selection events. Drupal teams gain a broader path for testing governed AI context, but the beta still requires non-production evaluation and careful upgrades.

Daniel Cothran will demonstrate the ePub Generator module during a Bluefly Town Hall on 31 July 2026. The module creates EPUB files from Drupal content and Book outlines, while the session will also cover lesser-known Charts features. The discussion gives Drupal site builders a practical look at publishing long-form content for offline reading and working with data visualisation tools.

Oxford and UC Berkeley have published Drupal 7 transition arrangements that separate extended security coverage from platform operation and migration work. Oxford retains update implementation and support for customised modules and integrations, while Berkeley requires campus website teams to review content and complete migration cleanup. The examples give Drupal organisations a practical way to test whether every responsibility outside a support contract’s coverage has an owner and budget.

NVIDIA has announced the Open Secure AI Alliance with partners from cybersecurity, cloud computing, enterprise software, open source, and AI research. The group says it will develop and share tools for agent identity, isolation, model storage, vulnerability scanning, logging, and evaluation, while NVIDIA has released its NOOA research framework. No Drupal project is named among the inaugural partners, but the controls are relevant to teams deploying agents through the Drupal AI ecosystem.

SparkFabrik has published an analysis of Drupal CMS Product Strategy 2.0, focusing on artificial intelligence, site-building tools, and mid-market adoption. The agency presents AI as infrastructure operating through Drupal permissions and editorial workflows, while describing Recipes, Site Templates, Canvas, and integrated hosting as ways to simplify delivery. Drupal teams may find the governance framing useful, but SparkFabrik does not publish a methodology for its implementation-time or total-cost estimates.

Christian López Espínola has clarified that Drupal component authors can define image fields for Canvas without making their Single-Directory Components depend on the module. A standard image schema gives Canvas enough information to display its image widget in the editor. The approach allows the same component to work on Drupal sites that do not use Canvas.

Drupaljam has joined DrupalCon Rotterdam 2026 as an official Event Partner. The partnership includes the Drupaljam House, Dutch involvement in the International Splash Awards, and a partner summit hosted by Stichting Drupal Nederland. The arrangement gives Dutch and other European Drupal groups a shared meeting point during the conference.

DrupalCamp Frankfurt will return from 27 to 29 November 2026 at the SAALBAU Titus-Forum in Frankfurt am Main. Most talks will be in English, with German sessions also welcome, and Sunday will be set aside for contribution work and workshops. The three-day format gives Drupal community members time for technical learning and collaborative project work.

The Drupal Association has detailed the Drupal AI Security Initiative, a six-month grant-funded programme working alongside the volunteer Security Team. The Association says the fractional team contributed to more than ten published advisories and CVEs, filed more than 30 issues, and resolved ten security issues during its first six weeks. The next phase will explore intake checks and reporting standards intended to help human reviewers handle more AI-assisted submissions.

U.S. and European accessibility rules set different dates and cover different entities, products, and services. Drupal core includes accessibility review and testing, but themes, modules, custom code, content, documents, and third-party services shape the conformance of a finished site. Drupal teams need jurisdiction-specific planning and knowledgeable human evaluation alongside automated tools.

Michael Kinnunen and Steve Wirt discuss how higher education jobs led them to Drupal and why its community kept them involved. They compare open-source contribution with mentoring in FIRST Robotics, where competing teams share knowledge, parts, and repairs. Their examples show how both communities support participation across technical and non-technical roles.

Drupal contributors have returned the Drupal 12 HTMX 4 upgrade patch to review while awaiting the library’s final 4.0 release. The patch covers changed attributes, headers, events, PHP APIs, and status-based response handling in HTMX 4. Module maintainers supporting Drupal 11 and Drupal 12 will need version-aware compatibility handling.

Drupal.org has moved all security issues from its legacy security site to GitLab. The new workflow adds automated testing for security merge requests, advisory automation, labels, comments, and threaded reviews. Maintainers and Security Team members can now handle confidential reports and fixes within Drupal.org’s GitLab environment.