News

Faster vulnerability discovery exposes a slower constraint: the human review needed to turn reports into secure releases. ...more

An April 2027 target may apply to one organisation and mislead another. Planning begins by identifying the governing rule, covered service, and content in scope. ...more

Changes to how Drupal handles dynamic page updates could force contributed-module maintainers to support different behaviour in Drupal 11 and Drupal 12. ...more

Automated testing now covers confidential merge requests for contributed-project security fixes, where testing was previously unavailable. ...more

Static delivery can remove the need for a public Drupal application, but it often removes live filtering with it. Taxonomy Facets addresses that trade-off by turning filter states into pre-generated pages. ...more

Working code does not necessarily leave developers with an understanding of how it was designed. Decodie records the explanations that can disappear when an agent conversation ends. ...more

Government open source strategies are easy to announce. The harder test is whether institutions have the skills, stewardship, and infrastructure needed for reuse. ...more

Accurate service data does not always produce a clear public schedule. A council project shows how Drupal can reconcile that difference without changing the external waste system. ...more

Drupal maintainers now have a clearer signal about migration order, but not the size or completion schedule of the new cohort. ...more

Atelier narrows Drupal’s everyday interface while keeping structured content and self-hosted ownership within reach. ...more

This week’s community calendar connects two questions facing digital teams: how technology can reduce cognitive barriers and how developers can move AI agents beyond prompt-based experiments. ...more

Drupal’s AI work now turns on whether assisted changes can remain permission-aware, repeatable, and independently reviewable. ...more

The savings case begins with reusable work, not with the number of CMS platforms an organisation retires. ...more

Farriss says reserves are covering a gap in Drupal’s wider stewardship work, prompting proposals to expose programme costs and connect enterprise use with ongoing support. ...more

Community participation moves beyond story leads as The DropTimes prepares an Editorial Working Group for Drupal contributors. ...more

One release keeps product changes inside the cart. The other addresses payment-reference handling for Drupal Commerce stores serving the Portuguese market. ...more

A single advisory window can demand upgrades, removals, and tighter environment controls. The correct response depends on support status and exposure conditions, not the severity label alone. ...more

Drupal AI activity now spans releases, events, workstreams, and training sessions. The new briefing brings those updates into one recurring publication. ...more

Drupal already has many of the controls that autonomous tools require. Turning that foundation into a low-friction path for agents remains the harder test. ...more

A public upload field can turn a trusted domain into infrastructure for content its administrators never approved. ...more

For organisations relying on open-source software, the missing question is who will still be maintaining it when a vulnerability or upgrade arrives. ...more

Accessibility gaps often enter social posts at the final publishing step. A five-point checklist turns that moment into a practical review. ...more

The practical question is not whether PHP disappears, but how agencies combine mature CMS estates with newer JavaScript work. ...more

The risk is not Drupal’s flexibility alone. It is flexibility without a clear owner for upgrades, extensions, and exceptions. ...more

The session lets Drupal users put Webform questions to a long-time maintainer and hear how AI coding agents are changing his day-to-day work. ...more

Drupal practitioners have until 28 August to turn recent implementation lessons into a conference proposal. The call accepts talks, workshops, panels, and possible shorter formats. ...more

Existing Drupal AI project lists can become incomplete or outdated. An automated pipeline now provides a sortable and filterable view of modules and recipes that directly depend on the AI module. ...more

Skynet’s All in One Accessibility module adds visitor-facing display and reading controls to Drupal sites. Drupal.org lists a current stable release, but broader accessibility and compliance claims remain statements from the vendor. ...more

The support cutoff adds monitoring and alerting to the migration risks facing teams that still operate Drupal 7 or Drupal 9. ...more

Drupal is not named in the HTML First paper, but the argument lands close to home. It gives Drupal teams a useful test for deciding when server rendering, Twig, components, and JavaScript should each carry the frontend load. ...more

A capable model becomes a fragile dependency when access, pricing, or policy changes. Drupal teams need routing and fallback plans that keep governance inside the site rather than inside one provider. ...more

Beacon packages familiar PHP building blocks into a single Composer starter. For Drupal developers, it offers a compact way to examine server-rendered application patterns outside a CMS. ...more

The week moves from reusable component practice to community planning and edge security, then closes with a Pune programme on passkeys and production AI agents. ...more

Panel access simplifies procurement but does not authorise a deployment. Agencies still need to review the assessment scope, findings, and residual risk against their intended use. ...more

Southwark reports substantial time savings, although results vary with document complexity. The practical test is whether councils can move long reports into an editable workflow without surrendering editorial review. ...more

DrupalCamp Colorado combines paid training with two free conference days, giving attendees separate routes into product, AI, technical, and community sessions. ...more

The London session gives Drupal practitioners an opportunity to hear about a university AI concierge and raise questions directly with its presenter. ...more

The vulnerabilities depend on different permissions and configurations, but supported sites should still install the appropriate security release. Maintainers of contributed modules that handle HTMX attributes or implement custom stream wrappers should review the accompanying hardening. ...more

For regulated Drupal projects, choosing a cloud region settles only the easiest part of the sovereignty question. Access, key custody, operations, recovery, and exit planning determine whether the hosting claim holds. ...more

The interim mandate places the Association’s funding model and operational stability at the centre of its next leadership phase. ...more

The published programme gives attendees an early planning view of the themes that will carry from summits into sessions and contribution rooms. ...more

Social embeds depend on platform APIs that can change without warning. Juicer Social Feed gives Drupal site builders a block-based path while Juicer handles feed aggregation outside the site. ...more

The sessions place Drupal AI in front of service desks, editorial teams, and sensitive campaign moderation instead of leaving the discussion at roadmap level. ...more

The beta turns quiz design into a routing problem rather than a fixed sequence of questions. Site builders can now think about what happens after each answer, not only which questions appear next. ...more

The latest Drupal 11.4 patch closes a routing regression that had remained visible after the previous bugfix release. The update also gives site teams a concise set of core fixes to review as the 11.4 branch settles after its initial release. ...more

The discussion turns a technical dependency into a governance question: how Drupal can share infrastructure risk without weakening the Association that keeps Drupal.org running. ...more

Open source adoption is only part of the sovereignty question. The harder issue is whether the institutions that depend on shared software also help maintain it. ...more

Drupal site security rarely stops at core and module updates. Canonical’s survey shows why package provenance, Linux maintenance, and patch ownership remain part of delivery risk. ...more

Drupal core now has a CLI path that modules can target, but most production workflows still belong to Drush. ...more

AI can make code appear faster, but it cannot make a contributor understand what the code does. For Drupal developers, the harder question is whether AI-assisted work can be reviewed, maintained, and trusted. ...more