Planet Drupal

A Brotli decoder flaw in Node.js can lead to remote code execution. Updating npm packages doesn’t replace the runtime, so check the Node.js version wherever it runs: containers, build pipelines, a Drupal site’s decoupled front end, and DDEV.

Looking back on a year of AI experimentation, I want to document my tips and tricks for using AI with Drupal development. Early in this journey, after reading books like Beyond Vibe Coding, listening to the creator of Claude Code, and attending Drupal events, I saw and heard how people using AI dramatically increased their productivity.

I keep coming back to Kent Beck's quote: "The value of 90% of my skills just dropped to $0. The leverage for the remaining 10% went up 1000x. I need to recalibrate." It led me to conclude that my goal when using AI is to 10x my productivity by focusing on that remaining 10%: experience, judgment, and understanding of how Drupal works.

Here are my tips and tricks to 10x my productivity using the remaining 10% of my skills. I am highlighting those that can 2x productivity and lead you toward 10x and beyond.

Funny side note: when I asked AI to review this post, it was really unhappy that the 2x tips math didn't add up to 10x, but you get the goal of this post. My hope is that you'll scan or consume this list, take something away, and keep up with our fast-moving times.

AI

Models

I like the output and price of GPT-5.6 Luna. I’d heard that in Ultra mode it rivals the more expensive models, but when I tried it, the code was worse and it took longer.

Read more

Muhammad Tanweer Khan shares his DrupalCon Rotterdam experience, discussing AI's impact on developers, Drupal advocacy, public-sector adoption in Asia, and the value of community connections.

A customer writes in: the sole of the left shoe has come away, three weeks after delivery. Someone answers the email, someone else notes it in a spreadsheet, the repair is agreed by phone with the workshop, and when the pair is ready, a shipment has to be made for an order that shipped a month ago. Six months later, nobody can say whether gluing fails more often than stitching, or on which model.

Commerce Quality Incident turns that complaint into a record in the store itself, attached to the order, the order item and the SKU that failed, with its own number, workflow and history. It is free software under GPL-2.0-or-later, published on drupal.org, and it builds on what a Commerce site already has: orders, State Machine, Commerce Log and Commerce Number Pattern. Version 1.1.0 adds the last step: the shipment that takes the repaired or replaced item back to the customer.

Read more

Drupal recipes let you reuse modules, content types and config across sites. Learn how they differ from profiles and how to create and apply your own.

A government may be free to change software suppliers but lack the capacity to do so. Rotterdam contributors explain why that distinction matters for digital sovereignty.

Drupal has long relied on organisations and individuals who contribute beyond their immediate needs. Yet that responsibility remains unevenly distributed. According to figures published by the Drupal Association in February 2025, just 219 of the 1,440 organisations active on Drupal.org accounted for 96% of recorded contributions in 2024. The challenge is not simply attracting more contributors, but making responsibility for Drupal's upkeep more widely shared.

Two proposals outlined by Drupal Association Interim CEO Tiffany Farriss on 28 October 2026 suggest how that might happen. A broader Drupal Certified programme could recognise makers, patrons and advocates, extending recognition beyond agencies. Alongside it, a dedicated maintainers fund could help organisations without development capacity financially support the people maintaining software they depend on.

Together, these proposals revisit Dries Buytaert's long-standing makers-and-takers argument. They also raise questions about what counts as a fair contribution. Financial support cannot automatically substitute for technical responsibility, and certification must recognise different capacities without favouring organisations that can afford to pay. How funding reaches maintainers, and how their work is valued, will matter as much as the proposed framework itself.

Read more

A new setup recipe handles the basics, but one unused Canvas template blocked publishing in the tested Starter site. Here is how the author completed the translation.

In the Open is a weekly series from Drupal Association Interim CEO Tiffany Farriss, sharing what she is hearing across the Drupal community and where the Association is headed. In this episode: how AI is changing vulnerability discovery for everyone, what the Drupal Security Team and the Alpha-Omega funded SEIR program have achieved in five months, and how site owners, hosts, and organizations can help.

"In Drupal now that finding these bugs is really cheap, fixing them and fixing it safely is not."

The following is a transcript of Tiffany’s remarks, lightly edited for readability.

What’s changing for everyone

Today I want to talk about security. I think Drupal’s story is about a community that is adapting pretty well to some pretty trying times.

I want to talk about what’s changing for everybody, what we do, what we’ve seen so far, and then how you can help and get involved.

It’s a completely new situation in the last 12 months. AI-assisted analysis is making finding vulnerabilities cheap and automatable in commercial software and open source software. It’s not a Drupal problem. It’s not an open source problem. It’s an everyone problem.

AI is astonishingly good at finding vulnerabilities. And it’s not just individual vulnerabilities, it’s about chaining them together. In COVID, we all learned about the Swiss cheese model of safety, the idea being that the holes in the cheese don’t line up in the various layers. But AI is just so good at figuring out how to chain one vulnerability to another one, to another one, and it navigates it at a pace and in a way that we just haven’t ever seen before.

From an open source perspective, we know that open source is in almost everything. 96% of all applications use open source libraries, and every vendor’s product inherits the security of all of the dependencies, whether they’re in your software or they’re in open source.

Read more

A growing share of the visits a website gets are AI assistants that read the page to do something on someone’s behalf, such as compare prices or fill in a form. We built Agentic Web Census to find out how ready the web is for them, and we publish it every month with open data. The Agentic Web Census home page, with the field to check a site. What Agentic Web Census is It is a free website that scores the whole web on how ready it is for AI agents. We call the score AWCS, short for Agentic Web Census Score, and it goes from 0 to 100%. We publish it for the web as a whole and...

Financial services website design from 50 big-bank homepages: 20 of 36 already show the new FDIC sign due April 2027. What to ship, and where Drupal fits.

We checked the CMS behind the 50 biggest US news sites and 27 Drupal publishing projects. What publishers run, and how to choose a CMS for yours.

Migrate Redirect Map 1.0 builds the Drupal redirects a Drupal 7 to 10/11 migration needs and lists every old URL that would 404. Here is how it works.

Drupal 12.0.0 and 11.5.0 are scheduled for the week of December 7, 2026. In preparation for these upcoming releases, our schedule targets release candidates for these versions for less than two weeks from now, the week of November 9.

Before we create our release candidates, we will commit several "beta target" changes that are likely to conflict with existing core merge requests. These include issues to increase Drupal's PHPStan rule level to 3 for improved testing of coding standards and static analysis, and specific large cleanups like adopting constructor property promotion and removing a legacy test annotation format. New PHPStan failures are also likely on existing merge requests.

These beta targets need to be committed in a certain order, and will conflict with each other as well as many other merge requests in the Drupal core issue queue. Commits that introduce merge conflicts with the beta targets may be reverted in order to ensure these large changesets can land smoothly without needing to be repeatedly regenerated.

Once the beta targets are completed, Drupal 12.0 and 11.5 will enter their release candidate phase, and all disruptive changes (aside from critical dependency updates and similar issues) will begin targeting Drupal 12.1.

I have watched work shrink for myself and other developers. At the same time, AI lets me try ideas I previously lacked the time or money to pursue. I write about this change from my own experience: what needs rethinking and where I want to focus as a developer. I do not yet know what the field of development will look like. In my experience, two things are happening at once: there is less demand for some familiar work, while some new ideas have become more affordable to build. Both need to be taken into account. I am trying to understand which problems benefit most from my experience and where new tools fit. It is a question I am exploring through my everyday work. When work becomes part of your identity When you have spent years learning, rescuing projects and tracking down difficult…

Today we are talking about AI, Drupal, and what's new with guests Dr. Christoph Breidert & Scott Falconer. We'll also cover Drupal AI Demo as our module of the week.

For show notes visit: https://www.talkingDrupal.com/576

Topics

• Inside vs Outside AI
• Agent Permissions and Scoping
• Drupal Org and GitLab Future
• Outside AI Examples Teaser
• Why CMS Still Matters
• Agent Swarms Expose Data
• Shadow IT And Liability
• CMS As Context Engine
• Content Governance At Scale
• Provenance And Regulation
• MCP And Client Integrations
• Rosetta Sprint Challenges
• Keeping Up With AI

Resources

• Drupal AI Initiative: introducing Inside AI and Outside AI

Guests

Christoph Breidert - 1xINTERNET.com breidert Scott Falconer - managing-ai.com scott-falconer

Hosts

Nic Laflin - nLighteneddevelopment.com nicxvan John Picozzi - epam.com johnpicozzi

Read more

A blocked Drupal 11 upgrade usually comes down to a specific package, version constraint, or environment requirement. This guide explains how to identify the blocker, resolve it safely, and verify your site before deployment.

The Netherlands has committed to greater open-source collaboration. But what will it take to turn that commitment into shared digital services that governments can develop and maintain together?

Dashi demonstrates Drupal CMS's multilingual editing capabilities, but its first release exposes two compatibility problems that affect local installations.

Why it is a migration, not an upgrade Drupal 10 or Drupal 11? The steps of a Drupal 7 migration The risks to keep under control What makes a migration cost more or less What if I don't migrate yet? Drupal migrations with Omitsis Drupal 7 reached its end of life on 5 January 2025. Since then it gets no security fixes from the community, and every month there are more abandoned modules, more incompatibilities with new PHP versions and more risk. If your website still runs on Drupal 7, the question is no longer whether to migrate, but how to do it without losing content, Google...