News Roundup

Replatform Radar has published guidance on maintaining reference integrity when moving Drupal content to a headless platform. The post covers taxonomy, media metadata, embedded media, entity references, URLs, and nested content relationships that cannot simply retain their Drupal identifiers. It recommends mapping those dependencies explicitly and migrating referenced content before the records that depend on it.

PreviousNext, Annex, Morpht, and Salsa Digital shared a Drupal booth at the Government Innovation Showcase New South Wales on 29 July 2026. The partners presented Drupal CMS alongside artificial intelligence, security, and content-governance topics. PreviousNext described the joint stand as an unusual arrangement among Drupal Certified Partners.

The DropTimes will host its August 2026 Open Townhall on 19 August at 15:30 UTC, or 21:00 IST. Tarun Udayaraj, head of community relations at The DropTimes, will host the online discussion on ongoing work, editorial priorities, and community participation. The meeting gives Drupal contributors and community members a forum to raise questions, suggest stories, and provide feedback on future coverage.

Drupal Training has published a curriculum covering Drupal 11 development and preparation for Drupal 12. Topics include Single-Directory Components, Recipes, Navigation, Workspaces, access control, Symfony 8, and development tooling. Drupal 12 is currently scheduled for the week of 7 December 2026 and will require PHP 8.5.

Voting in the Drupal Association's 2026 At-Large Board election closes on 14 August at 23:59 UTC. Eight candidates are seeking one community-elected seat, and the new board member is scheduled to be announced on 26 August 2026. The election fills one of the At-Large positions intended to provide community representation on the Drupal Association Board.

PreviousNext has signed A Manifesto for an Open Future, a declaration from Drupal business leaders focused on open source, sovereignty, artificial intelligence, security, and contribution. Co-founder Owen Lansbury says the agency's support reflects existing practices, including budgeting for Drupal contribution and sharing knowledge across company boundaries. The post connects those practices with the manifesto's call for sustained investment in Drupal and the wider open-source ecosystem.

Jacob Rockowitz has outlined a cost-aware approach to choosing AI models for Drupal development. He recommends starting suitable tasks with lower-cost models and moving to stronger options when the work requires them. For the Drupal community, he raises a wider question about keeping AI-assisted contribution accessible to developers with different tooling budgets.

Phil Norton has opened a series on migrating Central Bedfordshire Council content from Jadu into LocalGov Drupal. The first instalment extends Migrate Plus with custom plugins for delayed requests, caching, pagination, and API-key handling before applying them to a news migration. It shows how Drupal’s migration framework can be adapted to source-system constraints without replacing its existing migration architecture.

Tiffany Farriss sets out a procurement-based approach to open-source sustainability following her participation in UN Open Source Week 2026. She argues for shared standards covering upstream contribution, maintainer funding, and vendor participation, alongside governance that adapts as projects change. For Drupal, the discussion comes as the Drupal Association examines how to fund the infrastructure and stewardship the project depends on.

Organisers will hold Drupal Cafe Lutsk #32 on 13 August 2026 at 19:00 EEST in Lutsk, Ukraine. Maksym Podubinskyi of SoftServe will discuss business analysis, while DevBranch Drupal developer Taras Kravchuk will cover PHP's request lifecycle and how data flows between requests. Organisers say a third, unnamed speaker will appear only at the venue, while the two announced talks will be available online.

JSON:API Views maintainer Stuart Clark has released version 8.x-1.2, his first release on the module's 1.x line. The update fixes route-building performance, cache handling, preview URL parameters, numeric bundle routing, and OpenAPI resource discovery. For decoupled Drupal projects, the changes reduce routing and caching problems while preserving the ability to reuse existing Views logic.

W3C published an updated ARIA in HTML Recommendation on 11 August 2026. It consolidates conformance changes made since the previous Recommendation, including revised rules for summary and label elements and support for selected content in customisable selects. For Drupal developers, the Recommendation provides an updated reference for generated markup, while any Drupal-specific change would require separate project work.

The Drupal Security Team published five Moderately Critical contributed-project advisories on 12 August 2026. Four concern access bypass and one concerns server-side request forgery, with security releases available for Commerce PayPal, Diff, Entity Share Websub, External Authentication, and Quick Tabs. Earlier advisories reveal recurring validation concerns around payments, identity matching, and outbound requests, while each current vulnerability still requires its own exposure and configuration review.

Eight additional Drupal GovCon 2026 speakers who responded to The Drop Times discuss sessions on bot protection, screen-reader accessibility, AI decision-making, search, structured migration, and agent orchestration. Their comments span sessions across the conference programme rather than a single day. Together, they offer public-sector Drupal teams practical context on resilience, reviewability, content structure, and human accountability.

Helppy Hour Drupal Brasil #6 will hold a hands-on Drupal CMS session on 12 August 2026 with Leonardo Silva as the speaker. The live demonstration will set up Drupal CMS with DDEV and build a custom Recipe step by step before moving to an interactive Q&A. The session gives developers, site builders, and architects a practical look at using Recipes for repeatable Drupal installation and configuration.

FlowDrop 2.2.0, released on 9 August 2026, reworks the confirmation policy model introduced in 2.1.0 earlier that same day. Administrators can set the approval policy independently of processor side-effect declarations, while the release also adds atomic consent handling, secret redaction, expiry rules, ownership changes, and a dedicated permission. The update gives Drupal teams more control over when automated and agent-driven workflows must pause for human approval.

UI Suite DSFR 1.15.0 was released on 11 August 2026 for Drupal 10.3.4 and later 10.x releases, and Drupal 11. The theme updates compatibility to DSFR 1.15.1, adds a ProConnect variant, and includes changes to links, headers, grids, modal markup, footer headings, and theme settings. For Drupal teams working on French state sites, the release keeps the theme aligned with changes in the government design system.

Senior Drupal architect Talish Khan has published a four-question framework for choosing among Drupal page-building approaches. It distinguishes Layout Builder, Paragraphs, custom templates, and blocks by editorial workflow, layout variation, flexibility costs, and team scale. Drupal teams can use the framework to decide when editors need page composition and when structured content entry is the better fit.

Drupal GovCon 2026 moves into its main conference sessions on 12 August 2026 at the University of Maryland, College Park. Speakers who sent written responses to The Drop Times discussed AI governance, migrations, performance, code quality, project management, federal budgets, cost and scope control. Their sessions connect technical choices with the accessibility, security, governance, affordability and communication requirements that shape public-sector Drupal work.

Nominations for the 2026 Women in Drupal Award close on 14 August. This year’s programme replaces the previous Define, Build, and Scale categories with one award recognising overall contribution and impact across the Drupal ecosystem. The winner notification is scheduled for 28 August, with the award ceremony taking place at DrupalCon Rotterdam on 29 September.

Drupito founder Ashraf Abed described a hosting and marketplace platform for reusable Drupal sites on Talking Drupal. The model combines lower-cost hosting, exportable site packages, recurring payments for maintainers and sellers, and blue-green update workflows, while migration and automated testing remain unfinished. For the Drupal community, the approach is aimed at making smaller sites economically viable while preserving a path to move sites elsewhere.

Acquia has documented site-wide CAPTCHA protection for the experimental Drupal Canvas Forms feature in Source CMS. Administrators can choose one of four providers, test submissions in Monitor mode, and then switch to Enforce mode to reject failed checks or missing tokens. The CAPTCHA layer runs alongside Canvas Forms’ honeypot, signed challenge-token, and rate-limit protections.

Bill Ogilvie and Mike Gifford argue that governments should judge digital investment by the capacity it leaves behind. Their GovInsider column links open source, shared standards, accessibility, reuse, and operational stewardship to a concept they call technical equity. For Drupal organisations serving the public sector, the piece offers procurement and governance questions rather than Drupal-specific implementation guidance.

PreviousNext has published a review of contributions it connects to features in Drupal 11.4 and the wider Drupal 11.x series. Michael Strelan points to earlier work on Hux, Bundle Class Attributes, and the Dex proposal alongside changes to hooks, bundle classes, and Drupal’s command-line tooling. The examples show Drupal contributors how proofs of concept can feed into community development across several release cycles.

Drupal contributed projects provide both direct-database and WordPress XML routes for moving content into Drupal. Their documented differences include entity coverage, customisation options, release maturity, and security advisory status. Drupal teams need to match those constraints to source-site complexity before choosing a production migration path.

Annotations is developing a Drupal-managed layer for attaching human-written knowledge to site structures such as content types, entities and fields. The same annotations can be governed through Drupal, shown as contextual guidance, turned into documentation, or supplied selectively to AI tools according to roles and permissions. Maintainer Nik LePage says the idea grew from difficulties documenting complex forms, while architectural work, testing and module organisation remain before a supported stable release.

Kaylie Tiessen of the Canadian Shield Institute said Ottawa’s approved cloud services catalogue gives large US providers far more service options than Canadian suppliers. A Shared Services Canada evaluation separately found Microsoft Azure was the government’s most-used cloud provider between fiscal years 2019–2020 and 2022–2023 and documented vendor lock-in concerns among departments. For Drupal and other open-source teams serving the public sector, the debate connects cloud procurement with portability, supplier choice, and long-term technical control.

Nathan Wallace discusses how reduced federal capacity is changing the questions Drupal4Gov receives from government web teams. He addresses GovCon sponsorship pressure, volunteer ownership, underrepresented groups, content governance, and delivery planning for a federal design system. The conversation offers his view of leadership and Drupal delivery under public-sector constraints.

The Drupal Association published a guest post from 1xINTERNET on 29 July 2026 describing the agency’s approach to Drupal contribution. 1xINTERNET says it sponsors more than 500 contribution hours each month, supports more than 85 Drupal projects, and contributes through Drupal AI, events, governance, and other community work. The post presents contribution as part of the agency’s normal business and client-delivery model rather than a separate activity.

Four Drupal events are listed to begin or take place between 10 and 17 August 2026. The schedule includes Drupal GovCon 2026, a DrupalEasy module-development course, Drupal Cafe Lutsk #32, and the Drupal User Group Ruhr meeting. The events offer a mix of conference sessions, professional training, and community discussion for Drupal participants.

Vardot has published a guide on writing Drupal support RFPs for nonprofits. The guide says organisations should define ticket volume, support hours, response expectations, resolution targets, hosting details, and team structure before inviting proposals. It also recommends a website audit before takeover and closer review of bidders’ nonprofit and Drupal experience.

Display Builder 1.0.0-beta6 was released on 6 August 2026 with new UX, preview, and Drupal 11.4 compatibility work. The release follows Beta 5’s shift to revision-backed history and incorporates the interface refresh demonstrated at UI Suite Monthly #37. Translation and accessibility work remain as the project moves toward a release candidate.

Drupal’s Security Team disclosed a moderately critical cross-site scripting vulnerability in UI Patterns 2.x on 8 July 2026. UI Patterns 2.0.17 fixed the affected code, and 2.0.18 followed with changes that rely on Twig auto-escaping at render time. Sites running versions earlier than 2.0.17 in the 2.x branch should update to a fixed release.

Dries Buytaert has recapped a Drupal AI Learners Club session on three tools that began as personal experiments. He demonstrated Drupal Digests, AI-generated Rector rules, and an API Catalog that exposes his site's search service to agents. The post presents publication, community use, and contribution as signals that an experiment may eventually develop into a Drupal community project.

Bloomidea has released Commerce MRW, a contributed module for Drupal Commerce stores using the MRW carrier. It handles shipment transmission, labels, cancellations, return pickups, and tracking through MRW's SAGEC services. For merchants in Spain, Portugal, Andorra, and Gibraltar, it can reduce the need to transfer order data between Drupal and a separate carrier portal.

The Drupal Security Team published two Moderately Critical contributed-module security advisories on 5 August 2026 for Entity Browser and Edit in-place field. Entity Browser has a stored cross-site scripting flaw in tab titles, while Edit in-place field can let users with a specific permission modify fields without normal entity access checks. Maintainers using affected releases should update to Entity Browser 8.x-2.16 and Edit in-place field 2.1.1.

Drupal core maintainers released Drupal 11.4.5 and Drupal 10.6.15 on 6 August 2026. Drupal 11.4.5 fixes the AJAX error that could prevent administrators from creating a new content-based View and includes a wider set of core bug fixes. Drupal 11.4.x has security coverage until June 2027, while Drupal 10.6.x remains under security support until December 2026.

Joshua Mitchell has detailed PDFa11y, a Drupal module that reviews uploaded PDFs for selected accessibility issues. The module examines document metadata and structure, records passed, failed, or skipped results, and can be configured to warn editors or block uploads when checks fail. Drupal teams can use it as an early publishing control, but the project does not present automated scanning as a comprehensive accessibility assessment.

Rod Martin surveys Drupal’s unsettled site-building landscape across Layout Builder, Paragraphs, Canvas, UI Patterns, and Display Builder. He recommends keeping content structured, using Single-Directory Components for frontend work, and choosing one primary builder for each project. The approach aims to preserve portability while Drupal’s builder roles and integration paths continue to evolve.

Drupal developer Marcus Johansson has shared an AI-produced setup tutorial for the AI Translate module. The workflow researches the module, drafts a storyboard for human approval, and records browser actions with generated narration and captions. Jim Birch later adapted the approach into two macOS skills for broader software demonstrations.

LocalGov Drupal is offering ten sponsored places for the inaugural Government Summit at DrupalCon Europe in Rotterdam. The event on 28 September 2026 will combine panels and presentations with lightning talks and facilitated workshops. Council digital teams unable to fund attendance can apply until 21 August 2026.

Adopting an open-source dependency does not end technical due diligence. Hosted access, licensing, maintainer capacity, successor projects, and regulation can change during its operational life. Drupal teams can prepare through accurate inventories, sustainable maintenance practices, and practical continuity planning.

DXP Scorecard has introduced The Decider, a free tool that shortlists content platforms after seven questions. It weighs use case, team, budget, reach, regulatory needs, and AI priorities against an 187-criterion framework. Drupal is among the 38 active candidates, giving prospective adopters another starting point for platform research.

The European Commission published its EU Open Source Strategy on 3 June 2026 as part of its technology sovereignty package. It proposes procurement reform, support for maintainers and foundations, security measures, skills programmes and funding for essential open-source components. For Drupal organisations, the strategy could influence how public software is selected, maintained, shared and transferred between suppliers.

Pumex Infotech has published a setup guide for using DrupalBridge to send Drupal Webform submissions to HubSpot. The process combines manual module installation with OAuth authorisation, licence activation, handler configuration, and field mapping. For Drupal teams, the guide clarifies the integration steps but not the connector’s maintenance and recovery model.

Webform 6.3.0 became the module’s first stable release compatible with Drupal 11 on 7 July 2026. It requires Drupal 10.3 or Drupal 11 and records 292 resolved issues from 229 contributors, while maintainers flag caching, asset-loading, and submodule concerns. Drupal site teams now have a stable upgrade path but should test affected configurations before production deployment.