Feed aggregator

Eight Posts on the Fun Part. One on the Bill. Photo by Kamil Foatov on Unsplash Jürgen Haas Wed 23 Sep 2026 - 15:00

In Post 8 I described my monthly billing run. One client never gets an invoice: the Drupal community, which has had almost all of my working time since July 2025. This post is that invoice. The eight posts before it showed the fun part: the Modeler API, the Workflow Modeler, test and replay, the ECA Guide, orchestration. This one shows the ledger underneath: 87 actively maintained drupal.org projects, the Gin admin theme, the Admin theme subsystem in core, 293 public projects on the LakeDrops GitLab, a calendar of weekly and monthly community meetings, two DrupalCons a year. Innovation gets applause; maintenance gets a green badge. Every funding conversation so far was about a feature. Nobody has offered to sponsor a security release. Since July 2025 the revenue has been zero, paid for by earlier years. Dries' cost-allocation posts explain why. The menu at the end has prices: sponsor maintenance through Open Collective, a service agreement, hiring for ECA work, funding the next innovation. Total: roughly €10,000 a month.

Two shifts are converging in how Drupal pages get built. The first has already arrived: Drupal Canvas, Drupal's new visual page builder, gives editors a modern, component-based way to compose pages. The second is happening across the broader industry: AI that generates pages from natural-language prompts.

The Enterprise AI Summit takes place in one week, on 28 September aboard the SS Rotterdam, and the countdown is a good moment to properly introduce a session that's been on the agenda for a while: sovereign AI with Julien Blanchez.

Digital sovereignty has moved from a policy discussion into a boardroom question. Regulators, procurement teams and public sector organisations are asking the same thing in different ways: can we use world-class AI technology while keeping control over where our data lives, who can access it, and under what conditions?

With over a decade at Google working on data protection, security and digital sovereignty for large, highly regulated organisations, Julien will walk us through what's driving rising sovereignty expectations and how to keep access to leading AI technology on your own terms.

He joins a day full of similar questions answered with real numbers. The European Personnel Selection Office deployed a RAG-powered instant answer engine inside Drupal in under eight weeks, running in all 24 EU official languages, with 90% fewer repeat support questions and zero hallucinations on manual review. The American Diabetes Association will share what happened when editorial teams got real AI tools in their hands, including the honest lessons that came with it. And Moritz Arendt takes on a question that sits right next to Julien's: can AI strengthen digital communities, or does it risk hollowing them out?

With just days left, there’s still time to check the full agenda and save your seat. Tickets and details are available on the Enterprise AI Summit page.

Choosing a CMS for a multilingual product catalogue is a content-operations decision, not a plugin shootout.

Drupal vs WordPress enterprise teams must compare field-level translation, moderation, entity APIs, and AI-ready outputs before assistants read conflicting specs. Maciej Lukianski explains when WordPress still wins, when Drupal fits connected complexity, and how to pilot migration without guessing.

The 2025 recruitment drive added maintainers across a dozen vacancy areas, but Drupal core’s current roster shows how later departures and module changes have altered that picture.

Your Drupal government website needs to meet WCAG 2.1 Level AA by April 26, 2027. Here's what's in scope, how Drupal helps, and how to plan your government site's remediation.

Drupack: Drupal infrastructure in a single binary

A few years ago I said Drupal needed infrastructure innovation, and I finally took the time to do something about it. While I really like DDEV, I'm really not a fan of having to use Docker for everything so I'm trying to do something about it. 

theodore September 22, 2026

The database under a hosted Drupal or Backdrop estate has to change generations one day, and that is the day most operators find out what their migration tooling was hiding. On a BOA box the move across Percona generations is a rehearsed road: a readiness check names the one account which would block the whole box, the single-account mover carries an account to the newer server with passwords, PHP versions and search indexes intact and the old box relaying traffic until DNS moves, and the whole-server mover refuses to cross a version at all, on purpose, because it replicates rather than dumps. Every transfer and every cutover is a dry run first, every dry run is spent on use, and the watchdog which rescues stuck databases stands down for exactly the minutes it would otherwise rescue you from your own migration.

European Digital Identity Wallets are moving from technical framework and pilot programmes towards services that people will be able to use across the European Union. The European Commission says Member States must make wallets available to citizens, residents, and businesses by the end of 2026. For Drupal teams, that makes digital identity less a future policy topic and more an application-architecture question.

The wallet model changes what an online service can ask a user to prove. Instead of treating identity as one complete profile, users can present particular identity data or attestations and disclose only the information required for a transaction. Commission figures say more than 550 companies and public authorities across 26 Member States, Norway, Iceland, and Ukraine are participating in large-scale pilots covering government services, banking, education, health, transport, telecommunications, and other uses.

The relevant role for a Drupal application is the relying party. Under the European framework, organisations that use wallets for digital services must register their intended use and indicate the data they plan to request. That puts the request itself inside a defined trust and registration model rather than leaving every application to decide independently what identity information it wants to collect.

Read more

Every update on a multilingual Drupal site must reach each market language - not just the source page.

Drupal multilingual websites can use AI-assisted translation drafts inside Content Translation workflows so editors review and publish without copying text between tools. Maciej Lukianski explains shared fields, editorial ownership, document links, and keeping localized pages consistent for people and AI search.

This is the first post in a three-part series about the impact of the AWS Open Source Credits program on the Drupal community. Part one covers our testing infrastructure. Part two will cover the community programs we host beyond code. Part three will cover what the AI era is doing to open source infrastructure, and what we're building next.

Drupal is one of the open web's longest-running content management projects, in continuous development since 2001, and a recognized Digital Public Good. It runs a large share of the public web: government portals, universities, hospitals, cultural institutions, and international organizations, including the European Commission and agencies across the UN system. The Drupal Association is the small non-profit that keeps the project's home online. We build the tools that enable our community to build Drupal.

Since 2025, the AWS Open Source Credits program has supported the infrastructure behind that work. This series is our thank you, and impact report about what that support has made possible.

The scale

Drupal's collaboration happens on git.drupalcode.org, our self-hosted GitLab instance and one of the largest in open source. It hosts 42,382 contributed projects: 39,003 modules, 2,400 themes, and 979 distributions, alongside Drupal core itself.

The Drupal community opens more than 5,300 merge requests every month, about 65,000 a year, from 8,000 unique contributors annually. Drupal core alone has 15,256 issue forks.

Read more

Your marketing team already knows who the VIPs are. They maintain the segment in Mautic, they send it a campaign every month, they add and remove people as orders and behaviour change. Then somebody asks for a VIP banner on the website, and the website turns out to know nothing about any of it. So "VIP" gets built a second time, as a Drupal role or a checkbox on the user: two definitions of the same audience, maintained by two teams, drifting apart from the first week.

The second problem arrives with the first. Personalisation on Drupal usually means varying the page per visitor, and a page that varies per visitor is a page nobody else can be served, so the banner meant to lift conversion ends up slowing the site down for everyone.

We build and run Mautic-driven marketing for our e-commerce clients, so we kept meeting both problems on the same projects. Mautic Audiences is our answer, now on drupal.org as free software (GPL-2.0-or-later) for Drupal 10.3 and 11, covered by Drupal's security advisory policy. It reads the segments and tags you already maintain in Mautic and turns them into native Drupal primitives: block visibility, Twig, tokens, JavaScript, Views, Search API and, since 1.1, a field.

What editors can build without a developer

Place any block, scroll to Visibility, pick Mautic segment, type vip. Save. That is the whole configuration, and it covers most of what people actually ask for:

Read more

Date: 2026-September-21Security risk: Critical 16 ∕ 25 AC:Basic/A:User/CI:All/II:All/E:Theoretical/TD:UncommonDescription: 

There will be a security release for a widely used contributed module on September 23, 2026 between 17:00 and 21:00 UTC.

We are announcing this release in advance because the affected contributed module is used on a significant portion of Drupal sites, and the upcoming release will include a significant number of advisories. The advisory with the highest risk score for the release is currently rated as critical.

Drupal core is not affected.

Advisories may be published in batches (a few at a time)

The current rate of advisories may require changes to our practices going forward:

• The security team may publish advisories individually, at different times inside the window.
• We will try to publish batches grouped by module.
• We will announce in Slack when all planned releases for the day are complete.
• We will release mailing list emails about the security updates together at the end of the window, to reduce the risk of site owners updating multiple times while advisories are still being published.

These changes are intended to make the process easier for the team and to make communication from the team easier to follow.

No special release procedures

The planned update does not require special release procedures.

Read more

Big Blue Door’s Rotterdam responses point to a question already being tested in councils and healthcare: how far can shared Drupal platforms be reused across organisations with different services, editorial practices, and governance requirements?

Snapshots have been a beloved feature of DDEV for years, but in v1.25.4 there is so much more.

Read on (or watch, or both) to see:

• Basic use of snapshots
• Use of a seed snapshot to automatically provide content to a project on first start
• Committing a seed snapshot into a Git repository
• Starting/restarting with a seed snapshot
• Embedding a snapshot (usually for huge databases) into a custom database image

Table of Contents Screencast showing new and old features of snapshots Snapshots are easy!

A DDEV snapshot is a physical, "hot" backup of your database — mariadb-backup/xtrabackup for MariaDB and MySQL, or pg_basebackup for Postgres — not a text-based mysqldump. Because it copies the database's on-disk files instead of dumping SQL statements, it's much faster to create and restore, especially on large databases. All the basics about snapshots are in the docs.

Normally snapshots live in .ddev/db_snapshots/, and the filename encodes the database type and version, for example mariadb_11.8. That's why a snapshot only restores against a matching engine and version — restoring a mariadb_11.8 snapshot into a mariadb_10.11 project will fail.

Snapshots are compressed with zstd by default. --uncompressed skips the decompression step on restore, trading a much larger file on disk for a faster restore. Postgres doesn't support uncompressed snapshots.

Read more

Adobe does not publish AEM pricing. Here is what it actually costs — licence, implementation, the specialist team you must keep — and how to tell when the renewal is funding software nobody uses.

We measured server response time on all 424 Drupal sites in the US federal and state .gov registry. Pantheon vs Acquia, CDN tails, and 12 sites on unsupported Drupal.

BOA now runs Textpattern and Grav 2 sites inside the Ægir control panel, next to Drupal and Backdrop: install, backup, restore, clone, an upgrade done on a copy while the original keeps serving, then rename and cutover, on platforms which build themselves from the newest official release. It is a promise kept, the Continuity which our thirty years story named and our website has repeated since: Drupal CMS on Ægir, done; Backdrop first-class, done; and now Textpattern, our pick before the Drupal era, whose return that story did promise, together with Grav, which has run our own website for a decade and runs our docs from Git. All of it lives in a Drupal 7 panel, on a Drush 8 which works on every PHP between 5.6 and 8.5 and talks to bee, to the Drush inside every modern Drupal codebase, and now to Grav's own CLI and Textpattern's own installer. Fourteen Drupal core lines and fifteen distributions sit next to them. And before somebody asks: no plans for WordPress ;-)

Reposted from Acquia with permission from Acquia. Authored by Martin Anderson-Clutz (mandclu)

Drupal Canvas AI shifts content platforms from reading to writing, using governed context layers to help enterprise AI agents automate safely.

What changes when an agent stops reading your content and starts writing it?

For the last two years, the conversation about AI and content has mostly been about reading. Retrieval, summarization, a chatbot that answers a question from your knowledge base. That problem is largely solved, and it is solved almost everywhere. Any serious platform can find a relevant paragraph and hand it back.

The shift that actually changes the job of a content platform is quieter. Agents have moved from "answer my question" to "do the work." They are no longer only reading your content. They are starting to write it, assembling pages and populating components and publishing the result. The category we have called content management for twenty years was built for the first job. It was never asked to do the second.

Where the Real Cost Lands

At this point a fair objection turns up: is this not exactly why we keep a human in the loop? It is. Any content platform worth running in an enterprise keeps a person between the agent and the published page. A system that lets an agent push unreviewed work straight to production is not showing you the risk of agentic content. It is showing you that it was never built for the enterprise to begin with.

So the risk worth talking about is not the rogue page. Review catches that. The risk is waste.

Read more

Diagnostic tools can add work while they investigate what a website is doing. Native Observability 2.0.0 now measures that added cost on the Drupal site where it runs instead of asking administrators to rely on a general estimate.