Feed aggregator

La Ley Europea de Accesibilidad entró en vigor en junio de 2025, elevando el cumplimiento de las WCAG AA de una buena práctica a un requisito legal para la mayoría de los proyectos web en la UE. Entre los criterios que cubre esa norma, el 3.1.2 es uno de los que más se incumplen en los flujos de trabajo editoriales: exige que cualquier cambio de idioma en una página se identifique en el marcado. El contenido que mezcla idiomas es casi universal, ya que cualquier sitio que escriba en español tomará prestados términos ingleses, y cualquier sitio que escriba en inglés hará lo mismo en la otra dirección. Esa mezcla de idiomas incumple el criterio sin que nadie lo advierta, y la mayoría de los sitios no tienen ningún mecanismo para solucionarlo. Drupal 10 y versiones posteriores incluyen una solución nativa en el Core que no requiere módulos adicionales, y la diferencia entre los sitios que cumplen y los que no casi siempre es solo una cuestión de concienciación.

La brecha de accesibilidad: las palabras extranjeras

La accesibilidad ahora tiene peso en dos frentes a la vez. Mejora el SEO y es un requisito legal. Desde que la Ley Europea de Accesibilidad entró en vigor en junio de 2025, cumplir el nivel AA de las WCAG dejó de ser una buena práctica para convertirse en una obligación legal para cualquier sitio web.

Uno de los errores más frecuentes al redactar contenido se da justo en esta intersección: usar una palabra o expresión...

The European Accessibility Act came into force in June 2025, raising WCAG AA compliance from a best practice to a legal requirement for most web projects in the EU. Among the criteria that standard covers, WCAG 3.1.2 is one of the most consistently missed in editorial workflows: it requires that any change of language within a page be identified in the markup. Content that mixes languages is nearly universal, since any site writing in Spanish will borrow English terms, and any site writing in English does the same in the other direction. That language-mixing fails this criterion silently, and most sites have no mechanism in place to fix it. Drupal 10 and later ship with a native solution in Core that requires no extra modules, and the gap between sites that comply and sites that fail is almost always just a matter of awareness.

The accessibility gap: foreign words

Accessibility now carries weight on two fronts at once. It improves SEO, and it is a legal requirement. Since the European Accessibility Act came into force in June 2025, meeting WCAG level AA stopped being a good practice and became a legal must for any web project.

One of the most frequent mistakes when authoring content sits right at this intersection: using a word or expression from another language without identifying or marking it semantically. The most common case is writing in your main language and reaching for loanwords. A text in Spanish borrows…

Druxt's Drupal module carries a list of twelve JSON:API resources it answers for. It's been the same twelve since 2021, hardcoded in a PHP array, and changing it has meant carrying a patch.

1.3.0, tagged today, makes that list yours. The twelve stay exactly as they are, so nothing a site exposes changes when it updates. What is new is being able to choose, and the first thing I would choose is the one my frontend has always had to guess at: the toolbar an administrator configured for a text format.

A CORS default ships in the same release. If you keep a proxy rule in front of your frontend so that authenticated calls succeed, this is the release where you delete it.

Continue reading →

Beta 5 release of Drupal AI Context Beta 5 of Drupal AI Context , also known as Context Control Center (CCC), is now available. This is expected to be the final beta release, and an RC 1 release should be available soon. CCC helps Drupal sites provide governed, reusable context for AI workflows and agents, from brand voice and editorial standards to organisational knowledge and governance rules. This gives AI systems access to more structured and relevant information while allowing teams to manage that information centrally. Following the beta 4 release , beta 5 has been shaped by extensive community testing and an expanded scope. The community testing revealed refinements for a more intuitive user experience, and several features earmarked for 1.1 have been brought forward into 1.0.

Somewhere in your organization, someone put AI-generated content on your website this week. Nothing marks those pages as AI-generated, and no record exists of which tool produced them, from what prompt, or who checked the result before it went live. Closing that gap is what AI content governance is about.

As I've been experimenting with different AI models, I've observed varying behaviors. For example, I like the price point and the reasonable output from GPT-6 Luna. On Reddit, many people recommend running it at max, so I tried it. I assumed Luna Max would yield better results. Instead, it would take an unreasonable amount of time to respond, with not much better code. Because I am using AI as a coding assistant, speed matters. Luna Max may be better suited for autonomous coding agents.

I'm starting to feel like I have to track different models and modes, as if I were on a dating app looking for someone I'd be compatible with. Yes, I am humanizing AI, even though it is just an advanced pattern-recognition machine. Still, I recently discovered that AI can get stubborn and enter "Brat mode."

Brat mode

On one of the many AI-related podcasts I was listening to, someone shared a tip: if your AI gets stubborn and frustrating, clear the context and start a new session. Their theory was that the AI gets locked in a negative feedback loop and, instead of trying to please you, it leans into frustrating you. I am calling this "Brat mode."

I ran into "Brat mode" while trying to fix a simple report with duplicate records that needed a minor query tweak and some display adjustments. My prompt was matter-of-fact, but the AI would still make one change and then revert another. I caught myself asking the AI, "Why did you revert our recent changes? Please restore them," and the AI failed to explain or fix the problem. It felt like I was dealing with a stubborn child who was enjoying my frustration. Yep, I got frustrated. Fortunately, I knew better than to play this game, so I had the AI create a slightly better prompt, started a new session using the improved prompt, and the AI fixed the issue immediately.

Read more

simplytest.me had been sitting in the back of my mind for a long time. I knew it was unstable, and that release information kept falling out of date. It was a constant battle that always needed another round of maintenance, and it kept sliding.

Then Ryan Szrama wrote about someone cold calling the Centarro phone number looking for a way to sell online. Commerce Kickstart already did what the caller needed, so instead of selling him an engagement, Ryan pointed him to simplytest.me to try it.

Get your content cited by AI engines and get back that traffic you just lost. Read this AEO/GEO playbook to find out how.

Read more

In April 2025, there was no Top Tier badge in the plan. There was a conviction that Drupal needed coordinated investment in AI. Today, Dropsolid's recognition makes that choice visible.

What Top Tier really means

Dropsolid is now listed as a Top Tier Drupal Certified Partner. I am genuinely proud of that. Not simply because we have reached the highest level in the Drupal Certified Partner Program, but because of what this recognition measures.

We chose to help build Drupal's future. Today, that choice became visible.

drupalTuesday, September 8, 2026 - 12:57

The code of a Drupal or Backdrop site is the part everyone rebuilds, upgrades and throws away with a light heart; the uploads are the part nobody plans for, and they are the only part which cannot be downloaded again tomorrow. On a BOA server the files and private directories live outside the codebase, in the account's own store, with two symlinks in the site pointing there, so a platform rebuild, a core update or a move to a newer codebase never touches them, a clone gets a real copy of its own, a rename carries them along, a restore sets the old content aside instead of deleting it, and a delete moves the site's uploads into a dated archive, never removes them, and never blocks reusing the name. Every move is dry-run first, refused when the disk is short, and written down; the one thing the machine will not do on its own is delete your uploads, and the one thing it cannot stop is the store growing.

composer drupal-patch-check

A composer plugin created to make it easy for humans to upgrade their patched Drupal websites.

If you ever wanted to know if you still needed that patch after an update, or if your custom patch would still apply to the new version of the module, or if your 15 levels patch tower still applies after the update, this is the tool for you. Install the composer plugin and get started using the remote API.

theodore September 7, 2026

Debate over open-weight AI moved from model releases into policy at the G20 technology meeting on 1 September 2026. Meta chief executive Mark Zuckerberg argued against broad restrictions on open-weight models, while the United States urged governments to avoid sweeping new AI rules. The discussion turns "open" from a technical distribution choice into a term that governments and technology companies are also using when arguing about access and control.

That distinction became more concrete two days later. The Institute of Foundation Models released K2 Horizon, a family of six AI models for which it published weights, code, training data or detailed data-construction information, intermediate checkpoints, configurations and other parts of the training lifecycle. Meta's Muse Glimmer, released on 10 August, makes its model weights available under the Apache 2.0 licence, but the K2 release illustrates how many additional components may sit behind a broader claim of openness.

The Open Source Initiative provides a more specific framework through its Open Source AI Definition. It defines open-source AI through the freedoms to use, study, modify and share a system and says the preferred form for making modifications must include information about training data, the relevant source code and the model parameters. Downloadable weights can therefore provide meaningful control without, by themselves, establishing that every part of an AI system is open source.

Read more

With some recent security advisories for Cross Site Scripting (XSS), it feels like an opportune time to remind those who author Twig templates for Drupal:
If you're using Twig's |raw filter, you're probably doing it wrong
 

by lee.rowlands / 7 September 2026Background

Let's cast our minds back to Drupal 7. A time before twig. We had .tpl.php templates with PHP template as the default templating engine. Every variable available in your template had to be carefully sanitized before being printed to avoid XSS.

This meant remembering to call check_plain or check_markup in preprocessing hooks on every variable.

Not surprisingly security advisories for Cross Site Scripting (XSS) were the the number one vector in Drupal contrib security advisories for Drupal 7 and below.

The release of Drupal 8 saw the adoption of Twig as the default templating engine. With auto-escaping by default, Twig promised to provide enhanced security against XSS vectors. No more needing to remember to call check_plain or check_markup - any variable available to Twig was escaped on output!

Using raw bypasses Twig's protection

Which brings us to using the |raw filter. When you use it you're saying to Twig - actually, don't auto-escape this variable, I know better.

But there are very few cases where this is the correct approach.

And in reaching for |raw you're most likely opening an XSS vector.

What to use instead

If you're looking at a template and you're finding that a variable is being double-escaped. E.g. instead of Mathematics & Data Science you're seeing Mathematics & Data Science you might be tempted to reach for raw to fix it.

Read more

Rebuilding a data-driven Drupal site: Page templates with Layout Builder

In the previous post in this series, I described how we migrated existing page elements from Panels to Layout Builder.

Pages on this site are assembled from configurable page elements implemented as block plugins. These elements display data managed by an external system. Drupal stores their arrangement and configuration, but not the underlying data.

berliner Sun, 09/06/2026 - 21:59

Tags

• layout builder
• frontend editing
• architecture
• config

Drupal 11 is on 36% of reporting Drupal sites — and climbing at roughly half the speed Drupal 10 managed at the same age. On 9 December 2026 Drupal 10 reaches end of life, and the share of the Drupal web running unsupported code nearly triples overnight. The live numbers, the method, and what the curve actually says. Updated quarterly.

Companies and organizations rely on a wide variety of online forms for communication with their audiences. In one of our latest articles, we explored the basics of creating essential types of forms every Drupal site needs.

Author: Will Huggins

Imagine asking an AI assistant:

"Show me waterproof jackets under £150, in size M, available for delivery tomorrow".

Today, the assistant might search the web, read several retail websites and summarise what it finds. But what if, instead of reading pages, the agent could ask retailers directly which products matched those requirements?

With that information, you could fast-track your shopping journey and ask:

"Add [my chosen product] to my basket"

The important change here isn't the chatbot; it’s what sits behind it. A traditional website can tell an AI agent what products it has and provide the details. Tomorrow’s website will give the agent a controlled way to buy it.

That is the shift from publishing pages to publishing capabilities. It fundamentally changes what we expect a CMS to do.

Ever since the early days of the internet, content management systems have had a fairly straightforward job: someone creates a piece of content, the CMS publishes it as a page, a person finds that page, and then reads it and decides what to do next.

Over time, CMS capabilities developed around improved findability of content and the experience humans have when they land on a page. AI agents are now changing that equation, introducing a different type of interaction that moves beyond pages altogether, in search of capabilities that solve a problem rather than pages to read.

Read more

We’ve all been there. Anyone who has worked with content knows that feeling when critical changes are lost because of human error or a technical glitch. The first instinct might be to panic and call your development team to restore last night’s database backup. 

Someone told me this week, correctly, that ClaudeBot and GPTBot respect robots.txt, so there is no need to block them by other means, and that the really bad bots disguise as Chrome anyway, so a user-agent is useless; watch behaviour, get a WAF. Every fact in that is right and the conclusion is still wrong, and the gap between the two is the story of why the old ways of guarding a Drupal or Backdrop site have quietly stopped working. Not one of the seven stock robots.txt files a Drupal or Backdrop site ships names a single AI agent, and on a core past its end of life that file will never change again; one vendor honours your notice for its crawler and waives it for its assistant in the same document; a hand-kept blocklist goes stale in a month, and a WAF only ever refuses what someone already knew how to describe. What holds is a server which says no cheaply for what it can recognise, and judges the rest by what it does today.

DrupalClaw pushes AI assistance beyond code suggestions into setup, debugging, database work, and repeatable Drupal operations. Paulo Maia Carvalho’s testing also shows where that delegation can fail and why version context, approval gates, and human review still matter.