News Roundup

LocalGov Drupal received Digital Public Good recognition on 8 September 2026 and announced it on 9 October. The assessment examined open licensing, ownership, documentation, privacy and safeguards against harmful content. The designation gives public-sector organisations an independently reviewed reference when evaluating shared open-source website software.

DruBOM beta2 adds dependency mapping to help Drupal teams trace packages in a software inventory. Creator Paolo Mainardi also describes a broader rewrite with optional vulnerability checks, VEX decisions and SPDX exports. The module remains in beta, and its security findings still require review by site teams.

Two Drupal contributors will speak at Digital Leaders' AI Week 2026. Zoocha founder Will Huggins will discuss organisational AI governance and ISO/IEC 42001, while Drupal UX research lead Emma Horrell will examine how provenance information can help people assess AI-generated answers. Their talks take place online on 16 and 15 October respectively.

Drupal CMS 2.2.4 changes default dependencies and adds compatibility checks for free third-party site templates. It also hides custom module and recipe names in telemetry. The release improves experimental site archiving, including Composer data validation and handling of assets and patches.

Digital accessibility has risen to sixth place on NASCIO’s 2026 State CIO priority list. A survey of 36 state accessibility officers reports major gaps in document remediation, staffing and funding despite progress on statewide policies. Iowa’s Drupal publishing guidance illustrates how accessibility checks can become part of everyday content work.

Drupal CRM 1.0.0-beta14 was released on 11 October with five changes to contact methods, media references and demo content. The beta adds required-field options and addresses contact-method records missing their parent contact. Maintainer Steve Ayers is targeting a first release candidate in late 2026 or early 2027.

Paragraphs Bundles 2.0.1 fixes save failures in older column sections and restores carousel styling compatibility. Separately, Drupal core has documented query-object serialisation deprecations for 11.5 ahead of their removal in Drupal 12. Upgrading sites should test existing content, while developers should review code that stores database query objects.

The Drupal Security Team has scheduled a critical core security release for 14 October, between 16:00 and 21:00 UTC. The affected versions include supported Drupal 10 and 11 branches and Drupal 12.0.0-beta1; Drupal Steward provides only partial protection. Site teams should install their latest supported bug-fix release before the window and prepare to deploy the security updates promptly.

Linux Foundation Europe published its 2026 State of Open Source in Europe study on 7 October. The survey finds widespread interest in digital sovereignty alongside gaps in governance and significant private-fork maintenance costs. For Drupal organisations, the findings raise questions about managing dependencies and sustaining the projects they rely on.

Jeremy Andrews of Tag1 Consulting describes a workflow for staging AI-generated code review comments before publication. GitHub pending reviews and GitLab draft notes let developers inspect and edit the findings under their own accounts. The guide includes a GitLab example applicable to DrupalCode merge requests.

Drupal 11.4.9 is available as a production-ready maintenance release. It addresses navigation layout movement, supports multiple editor toolbar buttons through recipes, and updates the bundled CKEditor build. The changes benefit administrators using the navigation sidebar and developers configuring editing tools.

The European Union's Cyber Resilience Act has introduced security reporting duties for manufacturers of covered digital products. Drupal has received public investment in package signing, security audits and developer infrastructure, while compliance guidance helps suppliers assess their responsibilities. Organisations distributing Drupal-based software must determine whether their products fall within the law and what evidence they need to maintain.

FINOS announced that OSERA is operational with support from six Premier members. The alliance reports an initial set of 58 Spring-related libraries and a ratified standard for accepting security fixes. Its model offers a way for organisations to share maintenance costs while keeping patch source code public.

Drupal requests can span frontend services, application code and an external cache. OpenTelemetry traces show timed operations, while Valkey metrics describe cache-server conditions. Drupal teams can compare both signals to investigate latency without assuming that a slow operation identifies its root cause.

Drupal communities have five events listed for October 12–18, 2026. The programme includes a Lake Constance meetup, online discussions on AI and women in Drupal, incident response training and the Pacific Northwest Drupal Summit. Participants can choose between local gatherings, remote sessions and a two-day conference in Vancouver.

Symfony has outlined a compiled event dispatcher planned for version 8.2. Its published benchmark shows reduced dispatcher creation time, while runtime changes to listeners on the shared service become deprecated. Drupal developers can review the new listener and interface rules as they prepare for future Symfony dependency updates.

Cloudflare Purge 3.1.4 adds Drupal 12 compatibility while keeping support for Drupal 10 and 11. The release fixes error handling for failed Cloudflare API requests under Guzzle 8, where an API failure could otherwise trigger an undefined-method fatal error. No database update is required, but maintainers should rebuild Drupal caches after updating.

GovCMS has extended its existing Drupal Services Panel to 30 September 2027 while the replacement procurement moves forward. The new Drupal and Digital Experience Platform services tender closed on 7 October and is expected to support government entities across three service categories. The planned replacement arrangement has an initial three-year term with extension options of up to three additional years.

The Drupal Security Team published 26 contributed-project advisories on 7 October 2026, covering 25 projects. Block AJAX carries the batch's only highly critical rating, while seven notices are critical and two projects are now unsupported. Several remedies also require manual configuration changes, database updates, cache clears or submodule removal after updating.

Paragraphs Bundles 2.0 and Views Slideshow VVJS 2.0.1 introduce upgrade paths that need preparation. Paragraphs Bundles 2.0 is a one-way migration with CSS and ID changes, while VVJS 2.0.1 converts saved 1.x Views to the new schema and requires VVJ Core to be updated first. Both newer branches require Drupal 11.3 or Drupal 12 and PHP 8.3 or later.

The Drupal Security Team has welcomed Pierre Rudloff, Joseph Zhao, Bram Driesen and Swan Kalata as full members after provisional service. Their public contribution records show experience across vulnerability reporting, security fixes, advisory coordination, Drupal core and community work. The 8 October announcement was published after the membership changes had already taken effect.

Solo 1.0.36 fixes a fatal regression introduced in 1.0.35 for Drupal 10 and Drupal 11.0–11.2. The release replaces 38 direct service lookups with class resolution, restores compatibility with older library-discovery APIs and adds Drupal 10 CI coverage. Subthemes generated from 1.0.35 still need a manual change in their .theme file.

CVE-2026-59944 affects Composer package binary handling and is rated Medium with a CVSS 3.1 score of 6.1. A malicious or compromised dependency can abuse a symlinked binary path to make Composer alter permissions on a file outside the package directory. Drupal teams should update Composer to 2.10.3 or 2.2.30 or later and check the Composer executable used across development, CI and deployment environments.

DrupalFit and Pantheon have published guides covering two different operational concerns for web teams. DrupalFit focuses on security risks affecting Drupal websites, while Pantheon examines preview, revalidation, releases, observability and recovery in decoupled Next.js and CMS deployments. Pantheon's guide is not Drupal-specific, but its operating-model guidance is relevant to teams using Drupal as a decoupled content backend.

Gemini Provider 1.1.0 adds image embeddings to Drupal AI, allowing modules to work with vectors generated from images or combined image-and-text inputs. The release also updates default Gemini models, enables streamed CKEditor responses and improves handling of image and audio files. Existing installations should review their selected models, and sites using gemini-embedding-2 without an explicit chunk size should reindex AI Search.

Drupal Patch Check is a Composer plugin for auditing patched Drupal sites before and during upgrades. It can identify patches that still apply, fixes already present upstream, conflicts and cases that cannot yet be judged, while rerolling some broken patches and pinning remote merge-request patches locally. The analysis uses a Très Bien Tech remote service, with --dry-run available to show the exact request before it is sent.

Three Drupal.org case studies show Drupal 11 supporting very different operational models. Bayer's proof of concept combines Drupal with OpenFisca for regulatory assessment, MTH Electric Trains connects structured product data with commerce and preorders, and DiSign uses Drupal to manage information across browser-based displays. The cases are useful for their architectural patterns, although the published material provides limited independent evidence of production-scale outcomes.

Drupal AI 1.6.x-dev introduces support for decision models that return structured results rather than open-ended text. Jev provides an early example through Choice, Score and Noul question types, while a TypeSafe provider already connects that model family to Drupal AI. The work remains in a development branch, with Drupal AI 1.5.0 still the current stable release.

Mautic 7.2.1, the Absolunto Edition, fixes campaign scheduling, form embedding, plugin compatibility and several deployment problems. The release also corrects dynamic-content tokens, theme installation, reports, imports and separate web-root setups. A later fix for a DomCrawler production dependency was merged for 7.2.2 and is not part of the 7.2.1 package.

AI Neuron connects Drupal AI with the Neuron PHP framework in both directions. Drupal-configured providers, models and keys become available to Neuron, while Neuron agents, tools and workflows can be implemented as Drupal plugins with durable state and on-site logging. Tool API integration and Drupal AI agent bridging are still planned, and the project currently has no supported stable release.

The Drupal Association has launched a pilot that brings advocacy work into Drupal's contribution-credit system. Eligible work includes articles, talks, videos, translations, podcasts, tutorials and thoughtful amplification, with quarterly-theme contributions earning double credit. The programme also sets limits on self-promotion and asks contributors to support claims with verifiable evidence.

Federal Reserve Vice Chair for Supervision Michelle Bowman said cyber resilience depends on asset inventories, access controls, patching, training and active oversight from boards and senior management. Her remarks were not about Drupal, but they sharpen a governance question for organisations running many public websites across separate teams and platforms. Shared Drupal architectures can reduce fragmented maintenance when organisations deliberately centralise code, deployment and security responsibilities.

Drupal AI Context, also known as Context Control Center, has reached RC1 after five beta releases. The release covers 62 credited issues across administration, context selection, upgrade stability, Drupal 10 compatibility and QA, while integrations continue across AI CKEditor, AI Translate and AI Validations. The team is targeting 1.0 in about a month, subject to release-candidate testing.

Drupal 11.5 deprecates the .module file extension as core continues moving hooks and procedural logic into classes and services. Most hooks can use object-oriented implementations with PHP attributes, while special cases and public procedural APIs need more careful migration. Existing .module files continue to load until Drupal 13, giving maintainers time to convert code and preserve backwards compatibility where needed.

Mark Conroy tested Compound Field by modelling media-and-text and quotation structures inside a Drupal content type. Nested compounds brought the experiment closer to a Paragraphs-style workflow, but the Alpha 1 interface did not provide the compact component chooser he wanted. Compound Field has since reached Alpha 2, while its documentation continues to position the module around repeated structured records stored with the host entity rather than a full Paragraphs-style component system.

Field Validation 3.0.0, Akismet Anti-Spam 1.1.0 and Drupal CMS Helper 2.2.2 each introduce a practical decision for maintainers. The releases cover a cache-sensitive upgrade path, a one-way module migration and opt-in anonymous usage tracking. Sites should review the relevant upgrade and migration guidance before treating them as routine package updates.

Drupal Code Builder 4.6.11 adds PHPUnit attributes to generated test classes as Drupal prepares for PHPUnit 12. The release also fixes failures involving missing injected services, hyphenated Drush commands, plugin definition classes and quoted numeric values. Joachim Noreiko described the update as a bug-fix release made while larger work on plugin configuration and generated naming continues.

Drupal communities have several meetups scheduled between October 5 and 11, 2026. Events this week include an informal gathering in Edinburgh, an Eastern Time Zone meetup and an online Drupal User Group Ruhr session. Programmes range from community conversations and lightning talks to sessions on Kern UX, Playwright and VersaTiles.

Michael Lenahan created a temporary jobs board for DrupalCon Rotterdam after finding work through a personal connection at DrupalCon Vienna. Eight employer listings appeared on both a digital spreadsheet and a physical board, and job seekers could get recommendations from other attendees. Lenahan hopes others will repeat the experiment at future Drupal events, particularly local DrupalCamps.

Advanced Comment Threads reached 1.0.0-beta2 on 2 October 2026, one day after its first beta. The two beta releases refine shared refresh caching, progressive loading, teaser presentation, accessibility and in-page discussion expansion. The module currently supports Drupal 11.4, while Drupal 12 compatibility is not yet declared.

OpenKnowledgebase has entered beta as a self-hosted knowledge platform built on Drupal 11, Nuxt 4 and OpenSearch. It combines collaborative Markdown editing, review workflows, grounded AI chat, hybrid search and MCP access for agents. Beta2, published after the first beta, adds fixes around evaluation setup, unpublished-page access and release testing.

Drupal Live Update provides a common event layer for modules that need to update browser content without full page reloads. The base project uses Drupal-controlled polling while keeping authorization and channel access inside Drupal, with other transports possible through companion integrations. The Drupal 11 and 12 project has reached alpha5 and is not currently covered by Drupal's security advisory policy.

Local Drupal Association Japan held its founding assembly on 26 September 2026 and applied to Tokyo for NPO establishment certification two days later. The voluntary association begins activities in October through working groups covering Drupal projects, communications, events and external relations. Legal incorporation will follow only after Tokyo certification and a separate registration process.

Drupal 12.0.0-beta1 was released on 30 September 2026 for compatibility and upgrade testing. The beta requires PHP 8.5, raises database minimums, upgrades several dependencies and removes multiple modules and themes from core. Site teams should update through a current Drupal 11 release, review removed extensions and test their upgrade path before Drupal 12 reaches stable.

Bento Showcase 1.0.0 is now available as the first stable release of the Drupal Views formatter for mixed-size bento layouts. The module combines Views ordering with adaptive and fixed layouts, tile-specific image styles, category tabs, accessibility support, and extension points for themes and modules. The stable release supports Drupal 11.2 or later and is covered by Drupal's security advisory policy.

Drupack packages a local Drupal CMS environment into a single executable, while ECA Tool bridges ECA and Tool API in both directions. Live Update's first alpha adds channel-based browser updates with built-in polling and block integration. All three remain early-stage projects, making their architectures more relevant for evaluation than as production defaults.

Canvas Accessibility Checker 1.0.6 was released on 24 September 2026, while Entity Connections reached 1.0.0 the same day after its first beta a day earlier. One provides accessibility feedback inside Drupal Canvas, while the other visualises entity-reference relationships across a Drupal site. The tools give accessibility, site-building and migration teams additional ways to inspect problems that can be difficult to see through configuration screens alone.