We are proud to share that the Drupal Association has been awarded a grant from the Alpha-Omega Project, a project of The Linux Foundation, which seeks to help open source projects identify and mitigate security vulnerabilities.
As AI-generated commits and AI-driven security threats become the norm, open-source ecosystems must evolve rapidly. This funding directly strengthens the already mature Drupal Security Team, ensuring our core ecosystem is hardened against the modern, AI-age vulnerabilities.
The funding provided by Alpha-Omega will enable the Drupal Security Team to build the program we need to stay ahead in this fast moving environment. Drupal’s already excellent security position will be even better going forward.
~ Tim Doyle, CEO at Drupal Association.
Security has been a defining pillar of the Drupal ecosystem. This collaboration with the Alpha-Omega Project underscores our ongoing commitment to open-source resilience, solidifying Drupal's position as the gold standard for secure enterprise content management.
Drupal is, and will continue to be, one of the most secure CMS platforms in the world.
We are proud to share that the Drupal Association has been awarded a grant from the Alpha-Omega Project, a project of The Linux Foundation, which seeks to help open source projects identify and mitigate security vulnerabilities.
As AI-generated commits and AI-driven security threats become the norm, open-source ecosystems must evolve rapidly. This funding directly strengthens the already mature Drupal Security Team, ensuring our core ecosystem is hardened against the modern, AI-age vulnerabilities.
The funding provided by Alpha-Omega will enable the Drupal Security Team to build the program we need to stay ahead in this fast moving environment. Drupal’s already excellent security position will be even better going forward.
~ Tim Doyle, CEO at Drupal Association.
Security has been a defining pillar of the Drupal ecosystem. This collaboration with the Alpha-Omega Project underscores our ongoing commitment to open-source resilience, solidifying Drupal's position as the gold standard for secure enterprise content management.
Drupal is, and will continue to be, one of the most secure CMS platforms in the world.
We're thrilled and thankful to announce that Upsun has completed the transfer of the DDEV trademarks to the DDEV Foundation.
The DDEV Foundation now owns the DDEV name outright, and DDEV's name and identity belong to its community.
When we were on the verge of losing the right to use the name "DDEV" several years ago, Platform.sh (now Upsun) stepped in to acquire and hold the trademark on the project's behalf. That act of generosity kept the project alive under its own name. Since then, as documented in our December 2025 post, Upsun had been in the process of transferring that trademark to the DDEV Foundation as the foundation matured into a stable home for the project.
That transfer is now complete.
The DDEV Foundation is the independent, community-governed home for the DDEV project. With the trademark in the foundation's hands, DDEV's governance and identity are fully decoupled from any corporate sponsor.
This is exactly the kind of long-term resilience that open-source projects need to thrive across decades, not just years.
You can learn more about the foundation's structure, board, finances, and mission at ddev.com/foundation.
Upsun/Platform.sh has done so much for this project over the years:
This is a real contribution to the open-source ecosystem, and we're grateful for it.
Trademark ownership is a milestone, but it doesn't pay for development. The DDEV Foundation funds the developers who maintain the project you rely on every day — and we still have a funding gap.
We're excited that we've made it to 78% of our monthly sponsorship goal. Here's how you can help to get us over the top:
Contact us to talk through what works for your organization, or join the conversation in Discord.
DDEV serves about 20,000 developers every week. Your sponsorship keeps it maintained, secure, and growing.
Claude Code assisted with editing for this post.
read moreJoin us THURSDAY, May 21 at 1pm ET / 10am PT, for our regularly scheduled call to chat about all things Drupal and nonprofits. (Convert to your local time zone.)
We don't have anything specific on the agenda this month, so we'll have plenty of time to discuss anything that's on our minds at the intersection of Drupal and nonprofits. Got something specific you want to talk about? Feel free to share ahead of time in our collaborative Google document at https://nten.org/drupal/notes!
All nonprofit Drupal devs and users, regardless of experience level, are always welcome on this call.
This free call is sponsored by NTEN.org and open to everyone.
Information on joining the meeting can be found in our collaborative Google document.
Join us THURSDAY, May 21 at 1pm ET / 10am PT, for our regularly scheduled call to chat about all things Drupal and nonprofits. (Convert to your local time zone.)
We don't have anything specific on the agenda this month, so we'll have plenty of time to discuss anything that's on our minds at the intersection of Drupal and nonprofits. Got something specific you want to talk about? Feel free to share ahead of time in our collaborative Google document at https://nten.org/drupal/notes!
All nonprofit Drupal devs and users, regardless of experience level, are always welcome on this call.
This free call is sponsored by NTEN.org and open to everyone.
Information on joining the meeting can be found in our collaborative Google document.
Build a custom AI agent in Drupal Canvas to score news article engagement and suggest readability improvements.
There will be a Drupal core security release for all supported branches on May 20, 2026, between 17:00 and 21:00 UTC. (To see this in your local timezone, refer to the Drupal Core Calendar.) The Drupal Security Team urges you to reserve time for core updates at that time because exploits might be developed within hours or days.
The risk is currently rated as:
Highly critical 20 ∕ 25 AC:None/A:None/CI:All/II:All/E:Theoretical/TD:Uncommon.
Not all configurations are affected. Reserve time on May 20 during the release window to determine whether your sites are affected and in need of an immediate update. Mitigation information will be included in the advisory.
We recommend updating to the latest supported patch (bugfix) release for your site's version of Drupal before May 20, so that you can address any other upgrade issues before the security window. (Recommendations for specific Drupal versions follow.)
This issue is being protected by Drupal Steward. Sites that use Drupal Steward are already protected from known attack vectors, but should upgrade in the near future in case additional attack vectors are discovered.
Security releases will be provided for all the currently supported branches of Drupal core, which are:
Sites on one of these supported versions should update to the latest patch release for the given branch now in preparation for the security window.
While the Drupal Security Team does not normally provide security releases for unsupported releases, given the severity of the issue, we are providing 11.1.x and 10.4.x releases that include the fix for sites which have not yet had a chance to update. Therefore, in advance of the window:
These sites should apply the security update as soon as it is released on May 20, then plan to update to Drupal 11.3 or 10.6 in the near future. (Two other recent security advisories, SA-CORE-2026-001 and SA-CORE-2026-002, will not be addressed for 11.1 or 10.4.)
These major versions are fully end-of-life, so no releases will be created for these branches. However, given the potential severity of this issue, we will provide patch files for Drupal 8.9 and 9.5.
These patches must be applied manually. They are not guaranteed to work correctly, and might introduce other bugs or regressions. However, they may help mitigate the vulnerability for sites still on these old major versions until they upgrade to a supported release.
For the best chance of the patches being applied successfully:
We strongly recommend Drupal 8 or 9 sites update to at least Drupal 10.6 soon. Drupal 8 and 9 include numerous other, previously disclosed security vulnerabilities that will not be addressed by either Drupal Steward or the best-effort patch files.
Drupal 7 is not affected.
Neither the Security Team nor any other party is able to release any more information about this vulnerability until the announcement is made. The announcement will be made public at https://www.drupal.org/security, on Bluesky, Mastodon, X (formerly Twitter), and LinkedIn, and in email for those who have subscribed to our email list. To subscribe to the email list: log in on Drupal.org, go to your user profile page and subscribe to the security newsletter on the Edit » My newsletters tab.
Security release announcements will appear on the Drupal.org security advisory page which also has RSS feeds.
Today we are talking about The Open Web, What it means, and Why it's important with guest Alex Moreno. We'll also cover AI Schema.org JSON-LD as our module of the week.
For show notes visit: https://www.talkingDrupal.com/553
TopicsAlex Moreno - alexmoreno
HostsNic Laflin - nLighteneddevelopment.com nicxvan John Picozzi - epam.com johnpicozzi Bernardo Martinez - bernardm28
MOTW CorrespondentJacob Rockowitz - jrockowitz.com jrockowitz
Among last week’s more closely watched Drupal business developments was a new initiative from Acquia that directs 2% of eligible partner-driven transactions to the Drupal Association. The contribution is built into Acquia’s updated partner programme and funded by the company itself, meaning partner incentives and customer pricing remain unchanged.
What drew attention across the community was not simply the contribution percentage, but the way the programme has been structured. Drupal funding conversations have often returned to the same pressure points around sponsorship cycles, institutional support, and long-term maintenance responsibilities. Acquia’s framing moves that discussion toward routine commercial activity rather than a separate community-facing commitment.
Both James Sims and Dries Buytaert described the initiative in terms of continuity and alignment rather than philanthropy. Their comments pointed to the same underlying argument: if commercial Drupal activity continues to scale, support structures around the project may also need models that scale more predictably alongside it.
Whether similar approaches emerge elsewhere remains uncertain. For years, much of Drupal’s organisational support has depended on periodic sponsorships and voluntary reinvestment. Acquia’s model, in contrast, ties funding directly to ongoing commercial activity, introducing a level of predictability that community funding discussions have often lacked.
With that said, here’s what else The Drop Times covered across the Drupal community last week.
Additional developments from across the Drupal ecosystem were published during the week. Readers can follow The Drop Times on LinkedIn, Twitter, Bluesky, and Facebook for ongoing updates. The publication is also active on Drupal Slack in the #thedroptimes channel.
Kazima Abbas
Sub-editor
The Drop Times
The Modeler API completes the architectural separation between model owners (systems like ECA and Migrate) and modelers (visual UIs like BPMN.iO and Workflow Modeler). Module maintainers can now offer visual configuration without building custom UIs. The API automatically provides routing, permissions, save orchestration, import/export, testing, and Drush commands. This is infrastructure that compounds: 4 model owners × 3 modelers = 12 working combinations with zero glue code. Each new model owner makes every modeler more valuable, and vice versa. Designed at DrupalCon Atlanta in early 2025 and developed in the following months, the Modeler API positions Drupal ahead of competitors with architecture for visual configuration of any complex system.
TL;DR This 30-minute video shows DDEV from zero to everything on a completely blank new MacBook Neo (exactly the same on any macOS device.)
Using Windows or Linux? See DDEV on Windows in 10 Minutes, DDEV on WSL2 from Scratch, or DDEV on Linux in 10 Minutes.
DDEV is a local development environment based on Docker containers that gets you up and working on your project fast. When you’re ready for additional configuration and customization, you won’t be starting from scratch and can lean on the expertise of the DDEV community.
In this screencast we walk through installing Homebrew, setting up OrbStack as a Docker provider, installing DDEV, and getting started with a basic project — all on a brand-new MacBook Neo with only 8GB of RAM. We use a Composer-managed Drupal 11 project as an example, and also cover setting up Xdebug with both PhpStorm and VS Code. The presentation slides are also available.
After watching this tutorial, you’ll be able to run websites on your computer with minimal configuration and have multiple sites with different configurations available locally, all because Docker does the heavy lifting while DDEV does the simplifying. Whether you’re a solo engineer or a member of a team, DDEV will help you be more efficient.
This screencast references the regular DDEV documentation:
#ddev channel: See Support docsHere’s the video table of contents (opens in YouTube):
I saw two thoughtful posts in my LinkedIn feed over the last week that I wanted to reshare here before the LinkedIn feed buried them. Both were spot on, honest, and deserve a longer shelf life.
The first was from Hynek Naceradsky:
I'm pissed.
Not at Drupal. At the people confidently hating on it without ever having understood what it actually does.
"Drupal is outdated." "Drupal is too complex." "Nobody uses Drupal anymore."
Tell that to the EU institutions, governments, universities, and enterprises quietly running mission-critical platforms on it.
Here is what actually gets me though: the Drupal community lets this narrative win.
I am guilty of this too.
We literally have thousands of contributed modules, maintained for free, by people who owe you absolutely nothing. The security team responds faster than most paid vendors. The community has been showing up for 20+ years.
And yet we're somehow losing the PR war to frameworks that can't handle a proper content workflow without three paid plugins and a prayer.
Drupal people: talk louder. Write the posts. Go to the meetups. Tell the stories, fight for Drupal.
Because the Drupal community is honestly the best thing in Open Source, and both it and Drupal deserve way better than silence.
The second was from Thomas Scola, writing from a Drupal AI event in New York (lightly trimmed):
I overheard a couple people say, "Drupal? Is that still around?"
Hell yes it is.
And not only is it still around, I'd argue pretty heavily that Drupal is uniquely positioned for what comes next with the agentic web.
API-first before API-first was cool and trendy. Structured content that actually makes sense. Mature permissions, workflows, governance, integrations.
A lot of platforms are now scrambling to figure out how AI fits into what they already built.
Drupal doesn't have to force it. The architecture has been there.
But honestly, the tech is only part of it. The community is what always gets me. The people, passion and innovation. [...]
What comes next? Who knows.
But if I'm betting on a community to adapt, build, and help define that future, I'm putting my money on this one, and on what we've all built together.
For a platform people love to ask if it's "still around", it feels more relevant than ever.
I could not agree more with both posts. Drupal is one of the strongest Open Source platforms out there right now, but too few people realize it. The Drupal community has been modernizing the platform faster than its reputation evolves.
If the loudest narrative about Drupal is that it is outdated, people will keep repeating it, even when it is wrong. AI systems will too, because they absorb the same narratives, blog posts, forum threads, and social chatter the rest of the industry does.
The danger is not just that Drupal is misunderstood today. It is that the gap between what Drupal actually is and how people perceive it may be growing, not shrinking.
The narratives we reinforce today become part of how AI describes Drupal tomorrow. Drupal's silence today becomes tomorrow's AI consensus.
So if you're in the Drupal community, take Hynek's advice and help set the record straight. Not for AI, but for people. Write about the great work happening in Drupal: share the case studies, the technical breakthroughs, the AI innovation, and the hard problems being solved every day.
I know many people in Open Source dislike marketing or self-promotion. I do too, sometimes. But if we don't document what is great about Drupal, others will define Drupal for us.
Every accurate case study, technical blog post, demo, or success story helps future developers, evaluators, and AI systems understand what Drupal actually is.
Drupal does not need hype. It needs a better public record.
read moreI recently gave a talk at DrupalSouth Wellington 2026 covering something a lot of us in the Drupal community have been wrestling with: has the past couple of years been a market correction or something more fundamental? And more importantly - how can Drupal remain competitive in a CMS market that's changing quickly?
When I last spoke at DrupalCon Singapore I was very confident about PreviousNext's position after 15 years of stability. What followed was our business contracting through 2025 as clients reduced budgets, so it’s been a tough couple of years for many digital agencies.
But here's what gave me some comfort: we're not alone. Global digital holding companies like WPP, Publicis Groupe have seen their businesses shrink by around 30% and their share prices have seen corresponding falls. These aren't small Drupal shops. They employ thousands of developers across dozens of countries. The downturn has been a global phenomenon.
The single biggest reason is now clear. During COVID, organisations pulled forward years of digital transformation budgets to move services online quickly. By 2025, that spend had run dry. Enterprise marketing budgets generally halved and new projects froze. The good news, as of early 2026, is that the freeze is starting to thaw - projects that were put on hold still need to be completed.
Compounding this is AI. Companies have shifted budget toward AI investments, web traffic (Including Google search) is down around one third as people increasingly get information without visiting websites, and clients are questioning the ROI of large digital investments. This is real disruption - not incremental change.
With that context set, the more interesting question is: where does Drupal actually sit competitively?
When people talk about Drupal's "decline", they tend to cite overall install numbers. At its peak between 2014-2016, Drupal powered around 1.2 million sites. Today it's around 735,000 - a 40% fall on paper. But that framing misses the point entirely.
Drupal 8 made a deliberate strategic choice to cede the small-site market to SaaS platforms and focus on larger, more complex sites. What happened to those 500,000 sites that moved off older versions? Most were the exact sites Drupal had consciously repositioned away from. In their place, modern Drupal (version 8 and above) has grown to over 500,000 sites concentrated at the upper end of the enterprise market - exactly where the strategy aimed.
The data from builtwith.com is striking. Across the internet as a whole, Drupal sits in the top ten CMS platforms. Narrow it to the top million sites by traffic and Drupal is a clear second behind WordPress, with four times the presence of Adobe. Narrow further to the top 100,000 and Drupal is still second. In the top 10,000 - the sites that matter most - still second. For a product that critics routinely describe as being in decline, holding second place across every meaningful traffic tier is a remarkable result.
The CMS market itself is also growing, not shrinking. With around 900 CMS products for clients to choose from, it reached $30.9 billion in 2025 and is forecast to hit $45.7 billion by 2030 - 15-20% annual growth. There are still 250,000 websites launched every single day, generating 400 exabytes (400 million terabytes) of data annually for six billion internet users. The world's need to manage content isn't going away.
It's a fair question to ask whether AI will eventually replace the CMS entirely. The honest answer is: for basic brochureware sites, this is already happening. Tools like static site generators, SaaS website builders, and even WordPress sites at the simpler end of the market are genuinely at risk from AI that can generate and deploy a good-looking site quickly.
But Drupal is more insulated. A university platform with hundreds of content editors, 15 years of content governance, complex workflows, security requirements, and dozens of third-party integrations can't be vibe-coded overnight. The governance and institutional knowledge wrapped around these platforms isn't in the code - it's in the people, the processes, and the content structures that have evolved over time. That's not something AI replaces soon.
The bigger near-term pressure is client expectations. AI will accelerate Drupal development - modules, themes, migrations, custom functionality. Clients will start expecting projects to cost less and move faster. Agencies that adapt to this reality will thrive. Those that don't will find it a hard road.
Drupal competes across three distinct categories. DXP (Digital Experience Platform) competitors like Adobe and Sitecore offer monolithic, all-in-one platforms. Composable/MACH competitors like Contentful offer headless, API-first approaches. And then there's Drupal - which does both, often simultaneously.
When a client needs an enterprise-grade DXP, Acquia's stack, built on Drupal, competes directly with Adobe Experience Manager at substantially lower total cost of ownership. When a client wants API-first composable architecture, Drupal has been doing that since 2015 - not API-only, because you retain all of Drupal's power for user management, content modelling, and workflows while delivering content via headless interfaces. And for organisations that need a hybrid - vast content management capability combined with headless interfaces and third-party integrations - that's Drupal's genuine sweet spot.
Uniquely positioned to serve all three categories is not a weak compromise. It's a unique competitive advantage.
Where Drupal has historically struggled is in sales pitches. If you've ever had to spend weeks building a custom demo just to show a prospect what Drupal could do, or watched a client get dazzled by an proprietary CMS demo while yours involved explaining modules, you'll understand the problem. Drupal's out-of-the-box experience was, to be blunt, severely lacking.
The Starshot initiative launched in early 2024 to address exactly this problem. In under a year, Drupal CMS 1.0 shipped in January 2025. A year later, version 2.0. Achieving this in an open source project, coordinating volunteers across working groups while keeping Drupal Core stable, was remarkable to see unfold. If you or your organisation contributed, it deserves to be said: it wouldn't have happened without you.
Drupal CMS changes what's possible in a pitch. You can now install Drupal CMS, launch a polished, fully functional demo in minutes, and show a client exactly what they'll be working with. The days of "trust us, it can do that" are over.
The key feature releases in Drupal CMS 2.0 are worth highlighting:
Acquia Source also launched in late 2025, offering Drupal CMS as a SaaS product for organisations that want the power of Drupal without managing infrastructure.
Find out more about Drupal CMS »
Pamela Barone, the Drupal CMS Product Lead (sponsored by her employer Technocrat), gave a fantastic keynote at DrupalSouth Wellington that provides a much deeper dive into the rapid innovation that's been possible.
For agencies and end-user organisations leaving this talk (or reading this post), here's what I'd ask you to take away.
One: The market opportunity is real. The web is still growing. Drupal is still dominant behind Wordpress at every tier that matters. Recent innovations have substantially strengthened the competitive position. There's a bright future ahead for organisations that lean into it.
Two: Leverage the hybrid CMS position. Drupal's ability to function as DXP, composable, or hybrid in a single platform is a genuine differentiator. Use it in client pitches. Most alternatives force a choice between these models.
Three: Drupal CMS changes what's possible. Use it for client demos and smaller projects. You can secure clients by building smaller projects faster while retaining Drupal Core's full power when clients need to scale.
Four: Adapt to AI now. It's the new operational reality. Agencies and organisations that maintain human accountability while using AI to increase speed and reduce cost will win.
Five: Invest in the open source technology your organisation relies on. Drupal is open source, which means there's no single company responsible for its future. The Drupal Association manages the infrastructure, coordinates initiatives, and facilitates the community that keeps it all going. If your agency makes money building on Drupal, or your organisation has saved hundreds of thousands of dollars in licensing fees by using it, supporting the Drupal Association is an investment in your own future - not a donation.
A few specific actions worth taking:
If you're an agency that's not already a Drupal Certified Partner, the entry level requirements are minimal, so there really is no excuse. It's becoming a real differentiator in pitches - being able to say "we don't just use Drupal, we actively help build it" carries enormous weight with informed buyers.
The Drupal Marketing Initiativeis actively seeking involvement from Drupal Certified Partners. The DA is doing the top-of-funnel work for the community - helping expose Drupal to enterprise buyers who might not have considered it. That benefits every agency selling Drupal.
The Drupal AI Initiativehas 31 partners and $1.5 million in cash and in-kind contributions committed to defining how AI is integrated ethically and effectively into Drupal. Getting involved now gives you a seat at the table as those decisions are made.
The CMS market is still growing strongly and Drupal holds a unique competitive position. Recent product innovation has addressed legacy weaknesses and the community that builds and sustains Drupal is a benchmark that other open source projects to aspire to. Despite the recent digital market downturn and impact of AI, Drupal's future remains bright for agencies that build projects with it and for organisations that rely on it keeping pace with evolving requirements.
Over half of all web traffic in 2024 was automated. That is the headline number from the Imperva 2025 Bad Bot Report, and it is the first time bots have outnumbered humans in more than a decade. Drupal sites sit squarely in that traffic mix, and the old defensive playbook — block an IP, ban a user agent, drop a robots.txt entry, lean on Fail2ban — does not hold up anymore.
This is the companion post to my DrupalSouth Wellington 2026 talk, Bots, scrapers, and proxies: defending Drupal sites in an automated internet. The talk walked through the defences I actually use at amazee.io and recommend on client sites. The post covers the same ground, with a bit more room to show config and link out to the projects.
The technical context underneath bot defence has shifted in three ways that matter:
externalagent is one recent example. There will be more.Mimicry is now the baseline, not the edge case. A modern scraper will rotate IPs, randomise user agents, replay realistic TLS fingerprints, and pace itself slowly enough to look like a real user. You cannot rely on signal that lives in one HTTP header.
If this still sounds like a niche problem, the numbers say otherwise.
On the amazee.io platform globally, 13% of incoming requests can be flagged as non-human based on the user agent alone. That is the lazy bots. The actual share of automated traffic is higher once you account for the ones that try to blend in. In absolute terms it adds up to hundreds of millions of requests every month.
Before going through the defences, one thing I am careful to say up front, both on stage and here: the goal is not to block all bots. That is unwinnable, and the closer you get to it the more real users you break.
Search crawlers, RSS readers, uptime monitors, link-preview generators in Slack and iMessage, accessibility tooling - all bots, all wanted. The goal is to reduce abuse where it hurts most, on the endpoints that cost you real money or real performance, while leaving everything else alone.
The defences closest to your application are the smartest. They can see the path, the user, the form, the cache state. They are also the most expensive per blocked request, because every block at this layer has already cost you a full PHP bootstrap.
The Perimeter module drops requests matching known-bad patterns: /wp-admin, /.env, xmlrpc.php, all the WordPress scanner noise that hits every Drupal site daily. It is the cheapest win on the list. It will not stop a serious scraper, but it will keep your logs clean and your error rate honest.
CrowdSec is a local agent plus a community blocklist. Every site running CrowdSec contributes detected attacks back to a shared signal, and pulls down the latest list of bad actors. It is the closest thing the open-source world has to a distributed reputation system.
AbuseIPDB is a reputation lookup service. You query an IP, you get a confidence score. It is most useful on the forms and login flows where you can afford the latency of an external API call. Both are available as Drupal modules.
If you run Search API with facets, this is the single cheapest huge win available to you. Faceted search URLs are catnip for scrapers: every combination of filters is a new URL, every URL is uncached, every uncached request hits the database. A bot that crawls a faceted listing can take a site down without trying.
The Facet Bot Blocker module acts as a rate limit on requests that include at least one facet in the URL. Configure it to use Redis or memcache for the counter so you are not making the problem worse by hitting the database to record the request. On one of our hosting customers, this one module cut Search API load by more than half.
Logins, registrations, password resets and contact forms all need their own treatment, separate from page-level defence:
Every block at the Drupal layer has already cost you a PHP bootstrap. That is fine when the absolute volume is small. It is not fine when you are eating hundreds of millions of bot requests and bootstrapping PHP for each one. This is why you cannot stop at the application layer.
One layer out, the web server can drop requests before PHP ever runs. The trade-off flips: you save the bootstrap cost, but you lose access to application context.
nginx ships with limit_req_zone, Apache has mod_ratelimit. Both are blunt but effective on volume. A starting point for nginx looks roughly like this:
limit_req_zone $binary_remote_addr zone=search:10m rate=10r/m;
location /search {
limit_req zone=search burst=5 nodelay;
proxy_pass http://drupal;
}
Ten search requests per minute, per IP, with a burst of five. Tune to taste. The $binary_remote_addr key is cheap on memory; a 10MB zone holds around 160,000 IPs.
Geo blocking is the other infrastructure-level lever. It is pragmatic and occasionally controversial. If your audience is the New Zealand public sector, blocking inbound from regions you do not serve is a defensible call. If your audience is global, it is not. Know your traffic before reaching for it.
ModSecurity with the OWASP Core Rule Set is a proper WAF you can self-host. Once tuned, it is real protection. The tuning is the catch — out of the box it will flag Drupal admin actions, file uploads, anything that looks like SQL in a body or a query string. Expect to spend real time pruning rules and adding exceptions for legitimate site behaviour before you stop generating false positives.
A request that hits the cache costs you nothing. Whatever else you do, get your cache headers right. Vary on the bits that need to vary, cache aggressively on the bits that do not, and lean on the page cache or the reverse proxy in front of Drupal. The cheapest bot is the one that asks for a page you have already served.
(shamless plug) you can also use my site Caching Score to review your current caching setup, to see if there is anything better you can be doing.
Rate limits, ModSecurity rules and geo blocks are great at volume and bad at quality. They cannot tell a scraper trickling one request per minute apart from a real user. For that you need either the edge or the application.
The edge is where the big vendors live, and it is where you push the cheapest blocks. A scraper rejected by Cloudflare at the network edge never gets to your origin at all.
The free tier already includes Bot Fight Mode, basic challenges, and Turnstile. For most small-to-medium Drupal sites, this is a good baseline at zero extra cost. The paid Bot Management product adds custom rule logic, JA3 and JA4 TLS fingerprinting, and machine-learning-based bot scoring you can wire into firewall rules. The jump from free to paid is significant in price; the jump in capability is also significant.
Fastly offers the Next-Gen WAF (originally Signal Sciences) with a Bot Management add-on. Akamai sits at the enterprise tier with the most sophisticated fingerprinting available, and a price tag to match. Beyond those, there is AWS WAF with Bot Control, DataDome, HUMAN, and Imperva — all credible, all paid, all priced for sites where bot abuse is costing real money.
Bot Management at the edge solves real problems. It also comes with real costs that the vendor demos skip past:
The newest piece in the picture, and the one that has me genuinely interested.
Anubis is an open-source reverse proxy (MIT licensed) that sits in front of your site and issues a proof-of-work challenge to clients before letting them through. It was built specifically for the AI scraper era — for the case where the scraper is mimicking a real browser well enough that classifying it on signal alone has stopped working.
The interesting move with Anubis is who pays the cost. A real user pays a few hundred milliseconds of CPU once when they first arrive, and never sees it again for the lifetime of the cookie. A scraper hitting you a million times pays the cost a million times.
That asymmetry is the whole point. CAPTCHAs put the cost on humans (the people who lose patience trying to identify traffic lights). Anubis puts it on whoever is doing the hammering. That is closer to the right shape of the trade.
You do not want Anubis in front of your whole site. You want it in front of the endpoints that are expensive and uncacheable. From the talk, my shortlist:
?page=2348 is not a real userStatic pages stay fast. The cache stays warm. The PoW cost only applies on the routes where it earns its keep.
This is the first question every site owner asks, and the answer is good. Anubis ships with allowlists for known good crawlers, matching IP ranges against the published lists from Google, Bing, and the rest. The allowlist is maintained upstream, which means you need to keep Anubis deployed on a reasonable cadence to pull in the latest changes. New legitimate crawlers do show up.
You can see Anubis in action with a demo Drupal 11 site I put together, the login form has Anubis in front of it, the homepage does not.
None of these defences is a silver bullet on its own. Each layer is cheap at one thing and bad at another, and the trick is matching the layer to the threat.
Block the cheap traffic at the edge. Block the lazy bots with rate limits and ModSecurity at the web server. Put Anubis in front of the endpoints that are expensive and uncacheable. Let Drupal-native modules handle the application-aware decisions where you actually need to see the user, the form, or the facet state.
You do not need to win the bot war. You just need to make your site a worse target than the next one.
The slides from the talk are on the DrupalSouth schedule page. The recording will be posted here once the DrupalSouth team have edited and uploaded it — check back in a few weeks.
read moreMark your calendars. MidCamp is returning April 27-29, 2027!
We are excited to officially announce the dates for the next MidCamp, the Midwest's community-driven event for designers, developers, strategists, content creators, marketers, project managers, and open source enthusiasts.
After another incredible year of learning, collaboration, and community, we are already looking ahead to what comes next. And yes, as announced during closing remarks, MidCamp will be returning to DePaul next year just in time for Norah Schrum's birthday, which feels like the perfect excuse to gather this community again. MidCamp 2027 will once again bring together people from across Chicago, the Midwest, and beyond for several days of connection, practical learning, hallway conversations, contribution, and the kind of idea-sharing that keeps open source communities thriving.
Whether you are a longtime MidCamp regular or considering your first trip, MidCamp is built to be welcoming, approachable, and full of opportunities to learn from one another.
What to expect as planning gets underway:
Our organizing team is just getting started, and there will be many ways to get involved in the months ahead, from volunteering and sponsoring to submitting sessions and helping shape the event.
As was said during closing remarks: bringing value to others is the best gift, and this community proves that year after year.
For now, the most important thing to do is simple: save the date, bring your friends, and plan to be part of it.
Missing MidCamp already? You can relive this year's sessions by watching the recordings on our MidCamp 2026 YouTube playlist while we get planning underway for next year.
More details will be shared on the MidCamp 2027 event page as planning progresses.
We cannot wait to do it all again with this amazing community.
read moreToday Acquia announced something I'm really proud of. We're calling it the Acquia Fair Trade Initiative.
When an Acquia partner closes a deal, 2% of that deal flows directly to the Drupal Association, credited in the partner's name, to fund Drupal's infrastructure and long-term growth.
Imagine an Acquia partner closes a $100,000 Drupal deal with Acquia. $2,000 goes to the Drupal Association, attributed to that partner. The 2% comes from Acquia, not from partner margins, so the partner keeps their full revenue and incentives.
The donation is publicly attributed in the Acquia Partner Portal and counts toward the partner's standing in the Drupal Association's Certified Partner Program. It is recognized as financial support for the Drupal Association, separate from non-financial contributions like code, case studies, or community participation.
Most of all, I like that this program is structural. It is not a one-time gift or sponsorship campaign. It is built into the economics of Acquia's partner program, so Drupal's funding grows automatically as Acquia and its partners grow.
Too often, funding for Open Source projects depends on periodic fundraising or individual goodwill. That can work, but it rarely scales in a predictable way.
Open Source sustainability works best when incentives align. With the Fair Trade Initiative, the Drupal Association receives more predictable funding, partners receive recognition through the Drupal Association's Certified Partner Program, and Acquia invests in the long-term health of the Drupal ecosystem its business depends on. And yes, this also creates more incentive for partners to work with Acquia on Drupal projects. Drupal wins, Acquia's partners win, and Acquia wins too. That is what incentive alignment looks like.
I set a reminder for myself to report back in a year, maybe sooner. I'm curious to see what this model can become.
read moreDiscover how the Drupal AI Initiative is revolutionizing open-source marketing. Learn how 31 companies and a global team of specialists are scaling Drupal’s AI roadmap and driving enterprise adoption through radical collaboration.
read more13,980 active installs, 30+ Partner organizations, 25+ FTE committed. A look at what the Drupal AI Initiative is shipping right now and what comes next.
read moreAI ate my work
I've been experimenting with using AI to build Drupal modules for the past few months. Two weeks ago, I released a module called the AI Schema.org JSON-LD module and wrote a blog post about it. The module essentially replaces the primary outcome of my Schema.org Blueprints module, which is to enhance SEO by providing high-quality Schema.org JSON-LD markup. The AI Schema.org JSON-LD module generates Schema.org JSON-LD by having contrib modules work together to call an AI provider with a simple prompt.
This simple module, which I built in four days, supersedes my work on the Schema.org Blueprints module, which I've been working on for four years. I could resent the fact that this new AI-powered module, created using AI, was replacing me and my work, but instead, it's just changing how I view the work I'm doing.
With AI, it's easier for me to explore new ideas and take on more ambitious tasks, while knowing that the code and modules I'm creating remain flexible and extendable by humans and machines. There's a fine line between feeling like AI is eating our work, replacing it, consuming it, or improving it. We should talk about it.
What does AI mean for me?
The most immediate thing I have to think about is how I took something I had previously built, saw how AI could replace it, and had to be open to recognizing the opportunity that AI could do things differently, better, and faster. Everyone needs to lean into that reality with AI: things can get done faster and with more possibilities.
It took me a while to realize that things had changed. I built a few very simple modules to understand how AI coding agents plan, document, build, test, and maintain code. After a few weeks, I began to see the...Read More
read moreThis post tells the story of the ten months that took ECA from Dries Buytaert' private "1% of what it could be" feedback in June/July 2025 to a keynote at Drupal DevDays Athens in April 2026, by way of DriesNote moments in Vienna and Chicago. It opens a 9-post series exploring how UX research with Emma Horrell, Mark Dodgson and Lauri Timmanee, close collaboration with Shibin Das, and a focused build sprint produced in-context customization, a new React-based Workflow Modeler, integrated testing and replay, AI-powered documentation, and a vision for Drupal as an orchestration hub.
The Enterprise Drupal Summit Europe 2026 will take place on 28 September 2026 in the SS Rotterdam.
We are now accepting session proposals.
The program focuses on Drupal in enterprise contexts, with emphasis on:
The event is aimed at practitioners and decision-makers working on enterprise digital platforms.
We are prioritizing submissions that are based on real implementations.
Relevant topics include:
Accepted formats include:
Proposals will be evaluated on:
Submissions are open via Pretalx.
Looking forward to seeing you there!
Article by: Aidan Foster, Foster Interactive
The three human skills that turn AI into a multiplier.
Creativity, strategic thinking, and articulation are the three skills that decide whether AI makes you better or just faster. - Aidan Foster
The AI discourse has one dominant message: automate faster, cut the grunt work, reduce headcount, ship more.
Most leaders are responding by getting better at execution. Better prompts. Faster workflows. More output per person.
Execution still matters. It's just not where the constraint is anymore. The leaders who pull ahead in the next three years won't be the ones who automated the most; they'll be the ones who understood where the real constraint moved.
Think back to five years ago. A new landing page meant a brief, a copywriter, a designer, a developer, a round of revisions, and three weeks of calendar time. A campaign asset required coordinating four people across two time zones for something that might run for six days before you killed it.
That friction was real. Teams were sized around it. Agencies were built on it. Budgets accounted for it. That friction is gone.
A capable team can now produce a landing page in hours. Drafts, variants, and structured content at a pace that would have required six people two years ago. The execution ceiling collapsed.
The bottleneck didn't disappear. It moved upstream, to the quality of thinking that goes in before AI touches anything.
Strategic clarity. Creative direction. Precise articulation of what you actually want.
That's where the value lives now. That's where most teams are dangerously underprepared.
A CMO walks into a strategy review and knows something is wrong. They've seen this pattern fail before, in a different market with a different product. They remember exactly how it ended.
That's not intuition in the mystical sense. It's pattern recognition built through immersion. You watch your confident calls go wrong, you figure out why, you adjust.
Strategic thinking requires experiencing consequences. You have to have been wrong, and had something depend on you being right.
Researchers studying scientists at the frontier of human knowledge found the same principle. The best of them use cultivated judgment to ask better questions, to know where to go next. AI needs to be pointed. It executes brilliantly within a defined frame. The frame has to come from somewhere.
Our sense for aesthetics, meaning and embodiment give us a vital advantage over our technological creations.
Why Human Intuition Is Still Science's Greatest Tool In The Age Of AI - Noema Magazine, 2026
Most people believe creativity is an innate trait. Either you have it or you don't. That's wrong.
86% more ideas after 3 months of training. The untrained control group barely changed.
Creativity is a muscle. It responds to reps, to practice, to deliberate exposure to new inputs. A controlled study at Radboud University found that students who went through structured creativity training nearly doubled their ideation output in under a year. The untrained group stayed completely flat. (PLOS ONE, 2020)
You cannot read your way to it. You have to do the reps.
Research across Nobel laureates and major creative contributors identified two distinct types of creativity with two distinct peak ages. Conceptual innovators - the ones who execute one brilliant overarching idea - tend to peak young. Experimental innovators - the ones who synthesize across years of accumulated experience and observation - peak in their 50s. (Galenson and Weinberg, via Big Think)
The kind of creativity that matters most in marketing is the experimental kind. The kind that gets better the more you've seen.
The senior strategist who's been in the game 15 years isn't past their creative peak. The research says they may not have hit it yet.
Articulation gets your thinking and creativity out of your head and into a form AI can use.
A VP with sharp strategic instincts and genuine creative range can still get generic output from AI if they can't extract what's in their head and structure it precisely.
Imprecise input produces generic output. Always.
The model doesn't know what your brand sounds like. It doesn't know who your buyers are, what language they use, or what keeps them up at night. It doesn't know what you've learned over three years about what actually converts.
All of that has to come from you, structured in a way AI can use. Articulation responds to deliberate practice faster than the other two. Most people never treat it as something worth developing. (Canadian Marketing Association AI Playbook, 2025)
The skills AI cannot replicate are the ones that take years to build. But knowing that doesn't help unless you act on it. Three things worth doing now:
Audit your process assumptions, not your expertise. The judgment you've built is the asset. The habits formed around the old production bottleneck are what need to change.
Treat articulation as a skill to develop deliberately. Document what you know about your buyers, your brand, your market. Structure it. That structured knowledge is what separates useful AI output from generic noise.
Do the creative reps. Consistent exposure to new inputs and new problems. New disciplines.
Give yourself and your team time to be creative. Whiteboard ideas as a group. Collect interesting work and express what specifically about it grabbed your attention.
Skip the reps and your creative edge fades.
Leaders who invest in all three first will pull ahead. The advantage compounds.
Most teams I talk to are strong on execution. The upstream work - the strategic clarity, the creative direction, the structured articulation of what makes them different - is where the gap is.
That gap is also where the opportunity is.
Drop a comment. I'd like to hear how others are thinking through this.
Sources: Noema Magazine (2026), Radboud University / PLOS ONE (2020), Galenson and Weinberg / De Economist (via Big Think), Canadian Marketing Association AI Playbook (2025)
At DrupalCon Chicago, the Driesnote included a visualization with “community” as one of the three pillars of Drupal, along with “platform” and “agencies.” That framing felt memorable, and worth exploring further.
If you attended DrupalCon Chicago, you might have experienced a slightly differently shaped triangle. I don’t know the attendance numbers, but I saw technical sessions with packed rooms, while community-focused sessions had plenty of empty seats. That’s not new. It’s been true for years. People care about community, but when the schedule forces a choice between a session on AI integration and one on community health, most folks choose the technical session. I understand why. Technical work feels concrete. Community work is generally not why employers send folks to a DrupalCon.
This raises a question: how can all of us work together to close that gap without having to attend community sessions at DrupalCon?
I serve on the Community Working Group (CWG), specifically on the Community Health Team. A lot of people don’t know there are two teams inside the CWG, so here’s the short version:
Both teams matter. And beyond the CWG, the DrupalCon Code of Conduct offers advice for all of us. It includes a section titled “We are collaborative,” which says:
If and when misunderstandings occur, we encourage people to work things out between themselves where this is practical. Where support is beneficial to achieve this, participants agree to ask for help. People are encouraged to take responsibility for their words and actions and listen to constructively-presented criticism with an open mind, courtesy, and respect.
I suspect that many people read the harassment list and the reporting email and stop there. That’s understandable. Those parts exist for a reason. But the passage above describes the wide middle ground where most friction in our community occurs.
If the only two options we envision are “this is fine” and “file a report,” we end up with a lot of buried resentment, a few dramatic blowups, and not much in between. Most day-to-day friction doesn’t rise to the level of a Code of Conduct violation. It’s tone. Assumption. Misread intent. A comment in an issue queue from someone who didn’t scroll up to read what had already been said. A joke that came off differently than it was intended.
The Community Health Team’s work is to strengthen the middle. That means helping people develop the habits and skills to address friction directly, kindly, and early, so it doesn’t compound into something that needs the Conflict Resolution Team. The Code of Conduct invites everyone to do this work. Not just CWG members. Everyone.
Here are four situations I’ve seen in the community, and in some cases been part of. None of these are scripts. They’re illustrations. The point is that the Code of Conduct invites you to try, and that you’re allowed to. You don’t need permission.
If you need help figuring out the best way to handle a situation like this, the Community Health Team is available. We can help you talk through a situation, decide whether a direct conversation is possible, or offer a second perspective. You can reach out at any time. We don’t investigate, and we don’t take sides. We think with you.
The Code says “where this is practical.” Sometimes it isn’t.
We live in a world with power differences. If the person on the other side holds significant authority over your ability to contribute, a direct conversation may not be safe for you. Ongoing patterns of behavior are different from single incidents. Safety concerns are different from style concerns. And if the other person has shown they aren’t willing to engage in good faith, you are not obligated to keep trying.
Those are incidents for the Conflict Resolution Team. Those are the situations the people on that team signed up for, and you can reach them through the incident report form. Filing a report is not escalation for its own sake. It’s using the right tool for the situation.
Returning to the Driesnote, if community is one of three pillars holding up Drupal, then the pillar can’t only be carried by the folks who show up to CWG sessions. The math doesn’t work. Community health has to happen in the rooms with the technical sessions, on the Slack channels where the code review happens, or at the dinner table where someone just got interrupted for the third time.
Most of the work the Community Health Team cares about isn’t work you need a whole session to learn. It’s work you’re already in a position to do. The next time something said in an issue queue doesn’t feel right, you catch yourself venting about someone, or you see a newcomer get talked over, you have a chance to support Drupal’s community.
Community is a pillar, which means it doesn't get held up by a small group of people with CWG in their session title. It gets held up, or it doesn't, by how we talk to each other on a Tuesday afternoon when no one's watching.
Drupal’s Code of Conduct doesn’t just give you a way to report harm. It also asks you to do the smaller, harder thing first. That’s where most community health happens.
Article by: María Fernanda Silva
If you’ve spent any time around Drupal lately, you’ve probably noticed that AI is everywhere — in the keynotes, in the hallway conversations, in the issue queues. You may also have noticed that everyone else seems to know what they're doing, while you're still trying to figure out where to start.
You are not. Not even close.
Those questions — what is actually going on, and where do I even start? — are exactly what the Drupal AI Learners Club was built for.
Angie Byron (webchick) has been part of the Drupal community since 2005: core committer, one of the driving forces behind Drupal 8, and one of those people everyone seems to know. She did not come to DrupalCon Chicago 2026 planning to start anything. She came to celebrate Drupal's 25th anniversary and catch up with old friends.
But somewhere between the hallway conversations and the late-night tables, she started picking up on something: a lot of people were anxious about AI, unsure what it meant for their work, their identity as Drupal developers, their community — and quietly terrified to admit they did not have it figured out.
"I don't know what is going on, and neither do you," she would later describe as the feeling she wanted to create space for. "It's fine. Nobody knows. It's changing too fast."
That feeling stuck with her. And the Drupal AI Learners Club was born. Not as a space to hype AI, and not as a space to condemn it, but as a place to cut through the noise and talk honestly about what these tools actually do, how people are using them, and where they fall short.
The club runs on a simple premise: come as you are. Sessions are low-pressure, informal, and require no prepared presentation. Participants share their setups, their workflows, what is working, and what is not.
The first session launched on April 8, 2026, with the topic "Share Your Setup!" and brought together community members to walk through the models, modules, agents, IDEs, and tools they were actually using day-to-day.
Sessions happen whenever someone steps up to talk about something (currently, ~weekly) and are recorded, so anyone who cannot attend live can catch up afterward. And as Angie puts it, there are no stupid questions. Everyone is here to learn, including the people who have been doing this the longest.
The Drupal AI Learners Club is not here to tell you AI is the future. It’s here to make sure that wherever this is going, the Drupal community goes together — developers, site builders, contributors, and everyone in between.
There are many ways to join the club: attend a session, suggest a topic, volunteer to present, or join the organizing team. Sessions are published to a playlist on the Drupal Association YouTube channel so you can catch up anytime, and the conversation keeps going in the #ai-learners channel on Drupal Slack.
And remember, as the Spanish proverb says: there is no silly question — only silly people who do not ask.
As we migrate more projects to GitLab on git.drupalcode.org, we have discovered improvements to make in the mapping of Drupal.org project maintainers to GitLab’s project members, ensuring that it is a 2-way synchronization.
The next time you update maintainers for your project on Drupal.org, this will update all maintainers’ access in GitLab. Please review project members in GitLab, and under Activity, the Team events. Syncing is now more thorough, so there might be more maintainership and member changes than you expect.
In the next few days we plan to bulk update GitLab project members for all projects that have maintainers with “Maintain issues” on Drupal.org, granting them the project planner role in GitLab. This will enable more access for them to manage issues and merge requests in GitLab.
We reviewed all the mappings and have settled on:
Syncing is two-way, so that saving maintainers in Drupal will keep choices made in GitLab.
Reporter is very similar to planner, however it acts the same as guest for maintainership mapping. This preserves access when flipping between setting permissions in GitLab or Drupal. Access to “Maintain issues” in Drupal is mostly irrelevant with issues migrating.
Maintainer in GitLab previously did not grant “Administer maintainers.” It should because in GitLab, it allows the Manage project members permission, so it is a direct mapping.
Removing a maintainer in GitLab will
In addition to filling the gaps in the mappings, updates to maintainership in GitLab were missed, we hadn’t implemented a listener for the user_update_for_team webhook. So updating maintainers on Drupal.org will catch up all project member roles in GitLab.
Once all issues are migrated, “Maintain issues” will be removed from Drupal, and GitLab itself will be the only way to manage access below developer.
You can find the full details in the issue at #3586519: Migrate maintainers from Drupal.org projects as GitLab members
For any specific implementation questions, please comment on the issue. For general feedback, post to Drupal Slack's #gitlab-issue-feedback channel.
Join us to hear directly from the team behind an award-winning AI solution built for local government. What does genuinely useful AI in public services look like? Not a concept, not a pilot, but a working solution that saves hours of manual work, improves accessibility, and puts better content in front of citizens faster.
Southwark Council's AI-powered PDF importer for Drupal is exactly that, and it won the prestigious Digital Leaders AI Impact Award 2026.
We are delighted to invite you to a webinar where you can hear the story first-hand.
Date: Tuesday 16th June | 16:00 BST
Guest: Angie Forson, Web and Digital Programme Lead, Southwark Council
Host: James Hall, Product Lead, Websites at Everyone TV
This is a rare opportunity to hear directly from a senior stakeholder about how Drupal and AI are delivering real, measurable value in an area that truly matters: public services for the citizens of Southwark.
Angie will walk through the journey, the challenges, the outcomes, and what it means for the wider local government sector.
Manual PDF conversion has long been one of the most time-consuming tasks facing council web teams. Converting a single document can take hours. Multiply that across thousands of PDFs and the burden becomes significant, both in staff time and in the delay it creates before citizens can access accurate, accessible information.
The Southwark team, working with their partners at Chicken, built an AI-powered importer for the LocalGov Drupal Publication Module that reduces that process to minutes, often under one minute.
Each PDF passes through a three-step pipeline:
The result is an HTML representation of the PDF content, saved into a Drupal Publication and ready for review before going live. Every import is logged, so errors can be identified and resolved efficiently.
The module uses a plugin architecture, meaning each step in the pipeline can be swapped out. Councils can use different extractors, AI models, or output to different Drupal content types, making the solution adaptable to a wide range of content and operational requirements.
The team delivered this project with an agile, user-centred approach, continuously refining requirements to ensure the tool meets real user needs rather than simply ticking a technical specification.
"This project is a great example of AI working alongside and empowering content creators, and Drupal as a platform supports this really well." - Farez Rahman, Drupal Developer
"I'm excited about the impact this product will have, not just for our users, but also in transforming how we design, build, and create content internally. We're shaping a future where services start with HTML-first thinking." - Evelyn Francourt, User Experience Lead
Local government teams across the country face the same challenge. This solution, built on open source Drupal and the LocalGov Drupal ecosystem, is designed to be shared, not kept in one place.
If your organisation publishes PDFs, manages large volumes of content, or is exploring where AI can deliver practical value without unnecessary complexity, this webinar is for you. Tuesday 16th June | 16:00 BST | Online.
This is the fourth post in our GitLab issue migration series. The earlier posts focused on what is changing and how maintainers should set up their projects. This one is for the rest of us — the people who file bugs, review code, push fixes, and triage queues without wearing a maintainer hat. If your favorite contrib project has just moved its issues to git.drupalcode.org, here's what you need to know.
When a project's issues are migrated, they move from www.drupal.org/project/{name}/issues to git.drupalcode.org/project/{name}/-/work_items. Old URLs redirect to the new ones, and issue numbers (NIDs) are preserved as GitLab IIDs — so an #3409678: Opt-in GitLab issues you find in a commit message will still resolve to the same issue.
In GitLab, "issues" are technically a subtype of "work items," but the term issue still applies, and you'll see it throughout the UI. If you've worked on any GitHub or GitLab project before, the experience will feel familiar.
A lot has not changed:
It's worth naming a few real wins for contributors:
A few permission details are worth knowing up front, because they're tighter than what you may be used to on the old issue queue:
That last point is real friction for contributors who triage and label issues, and we're addressing it directly. #3559846: Allow changing GitLab issues labels for all contributors is building a label-management UI that will live on drupal.org, alongside the existing contribution credit and issue fork management screens. Once it ships, any contributor will be able to manage labels on any issue without needing a project role on GitLab. This is also an upstream issue, but it doesn't seem to be worked on.
Until then, if metadata needs updating, leave a comment noting what should change. Maintainers and other contributors with the role can apply it.
Good news for anyone with muscle memory for Drupal's NW / NR / RTBC dance: the conventions weren't dropped in the migration. They were preserved as scoped labels on GitLab issues — state::rtbc, the equivalent state labels for needs-work and needs-review, priority labels, and so on. Each project's setup may vary, but the familiar conventions carried over, and contributors can keep using them.
| Convention | Now |
|---|---|
| Needs work | state::needsWork label (alternative: MR set to Draft) |
| Needs review | state::needsReview label (alternative: MR set to Ready) |
| RTBC | state::rtbc label (alternative: MR approval) |
| Needs reroll | Push a rebase to the issue fork branch |
Two notes:
Navigate to the project, click Work items in the left sidebar, then New item. The form is just a title and description; labels and metadata are added afterwards by users with the appropriate role. If a project has set up issue templates (markdown files in the repo), you'll see them in a dropdown.
The first comment on every new issue is posted by DrupalBot. It's the bridge to the things that still live on drupal.org:
The fork management screen on drupal.org works the same way for GitLab issues as it has for Drupal.org issues. From there, you can create a shared issue fork, request access if one already exists, push a branch, and open an MR. Branching and merging happen in GitLab's native UI, where they're already optimized.
During the transition, contributors will be working with both Drupal.org issues and GitLab issues, sometimes in the same comment. The syntax differs by direction:
[ #123456 ] (unchanged)#123456 (no brackets)For "related issues" entries on Drupal.org, always use the full URL when pointing at a GitLab issue.
A few oddities are worth flagging if you're working through historical issues:
#123456 still maps to the same issue. The original author's name is preserved in the first line of the issue description.Found a bug in the migration itself or in the integration between Drupal.org and GitLab? Please file it in the Drupal.org customizations issue queue.
Have a question, or want to share feedback on the new workflow? Join the #gitlab-issues-feedback channel on the Drupal community Slack.
We're actively iterating on this transition based on what we hear from contributors and maintainers in opted-in projects. The more feedback we get now — while we're still in the opt-in phase — the better the experience will be when the rest of contrib gets batch-migrated.
For more detail on any of the GitLab features mentioned in this post, the official GitLab documentation is the canonical source.
Issues and work items
Labels and permissions
Merge requests
Markdown
Related blog posts in this series:
Related issues
* We used Claude AI to refine our first draft and help link related materials like the GitLab documentation.
One year ago, at Drupal Developer Days in Leuven, something special happened.
The Drupal AI Initiative was not officially launched yet. That would happen later, in June. But Leuven was where the spark happened. It was where the first real momentum came together. Where conversations turned into commitment. Where a shared belief became a shared plan.
Five companies stepped up to kickstart the initiative: Dropsolid, Acquia, 1xINTERNET, FreelyGive, and Salsa Digital. Together, they helped turn an ambitious idea into the beginning of a movement.
Now, one year later, as we gather again at Drupal Developer Days in Athens, we celebrate one year since that moment of conception.
Leuven was where the initiative was kickstarted. June was when it officially went live. Athens is where we celebrate how far it has come.
The Drupal AI Initiative was created with a bold ambition: to help Drupal become the leading open source CMS for AI-powered digital experiences.
But from the beginning, this was never just about adding AI features.
It was about building AI into Drupal in a way that reflects the values of the Drupal community: open, flexible, responsible, transparent, and collaborative. It was about giving organizations the tools to innovate with AI while keeping control over governance, content, security, editorial workflows, and long-term digital strategy.
Over the past year, the initiative has grown from a spark in Leuven into one of the most ambitious collaborative efforts in Drupal’s history.
Since the official launch of the Drupal AI Initiative, the team has made major progress. The amount of installs is growing significantly, 13980 at the time of writing. Adoption is accelerating. According to shared data we’re growing at about 260 sites per week and accelerating.
This is only the sites that share numbers, the real share is much higher.
Between Drupal Con Vienna and Chicago, the initiative added 12 new partners, a total of 34, representing a 50% increase in participation. We are on track to match this growth in support between now and DrupalCon Rotterdam, a key goal for this year.
The initiative also successfully established and executed the delivery management RFP process, putting important operational frameworks in place, including:
These may sound like operational details, but they are what make collaboration at scale possible. They help turn enthusiasm into structure, and structure into delivery.
The Drupal AI Initiative has become the largest multi-company collaboration in Drupal community history.
- Dries Buytaert
The initiative is now actively funding critical roles across multiple organizations, including product management, innovation management, technical leadership, and program management. This marks a major milestone: the Drupal AI Initiative has become the largest multi-company collaboration in Drupal community history.
The 2026 roadmap was finalised earlier this year, informed by customer demand and industry insight. Delivery is actively underway.
At the same time, marketing efforts have been elevated to position Drupal as the leading AI-powered open source CMS globally, supported by ongoing storytelling and visibility through the Drupal AI Initiative blog.
Focused effort on strategically important features, combined with a growing number of partners committing resources and strong community participation, has driven a significant increase in momentum and impact.
The tag clouds below visually represent the many Drupal community members who in the past 12 months have contributed to the AI Initiative (sized according to number of fixed issues worked on). Includes code and non code contributions.
The following organizations have also contributed to the Drupal AI Initiative in the past year.
From small beginnings with Paul Johnson and Frederik Wouters taking on marketing, we now have a cross disciplinary high performing team with 10 leads across areas of specialization.
Focussing on introducing Drupal to new audiences the emphasis has been on webinars, participating in external events and organising major new customer facing events of our own. These include Drupal AI Summit Paris and New York City (14th May 2026), The AI Summit London (10-11 June 2026) and the latest Enterprise AI Summit Rotterdam (28 September 2026).
Our work has included facilitating Southwark Council, London, winning Digital Leaders AI Impact Award 2026, producing video case studies and highlighting major new AI features announced during the DriesNote with social video content. All these activities have substantially raised Drupal’s profile to a wider audience.
The next major milestone is already taking shape.
In Rotterdam, the initiative will launch an exclusive Drupal Enterprise AI event, available only to Drupal AI Initiative partners. The event will bring together European decision-makers aboard the SS Rotterdam for peer networking, customer case studies, and strategic conversations about building AI-powered content management solutions with Drupal.
Participation in this event is limited to partners who join the Drupal AI Initiative by June 30.
That creates a powerful moment for companies that want to be part of Drupal’s AI future. The initiative is scaling, the roadmap is active, the team is growing, and the opportunity to help shape what comes next is open now.
A strong foundation for what comes next
The Drupal AI Initiative is in a strong position.
With $380,000 in cash and $1.5 million in in-kind contributions, more than 50 contributors from partners, the initiative has the resources and commitment needed to continue scaling. The plan is to onboard an additional 12 partners by Rotterdam, further strengthening the team and accelerating delivery.
The message is clear: You counted on Drupal AI, and we delivered. Now we want to create more efficiency and scale.
That is what this next phase is about. More delivery. More visibility. More impact.
This milestone belongs to many people.
It belongs to everyone who joined those early conversations in Leuven.
It belongs to Frederik Wouters, who brought the right people together at the right moment and helped create the spark that started it all.
It belongs to the five companies that kickstarted the initiative: Dropsolid, Acquia, 1xINTERNET, FreelyGive, and Salsa Digital.
It belongs to every partner, contributor, sponsor, strategist, developer, product thinker, marketer, and community member who has helped move this initiative forward.
And it belongs to the wider Drupal community, whose openness and willingness to collaborate make initiatives like this possible.
The Drupal AI Initiative is growing, and companies can still become part of it.
If your organization believes in the future of Drupal, if you want to help shape responsible AI in open source, or if you want to be part of the group building the next generation of AI-powered content management, now is the time to join.
Become part of the 34 makers already helping to build Drupal’s AI future.
To join the Drupal AI Initiative as an organization and become a partner, contact Dominique at dominique@dropsolid.com.
From Leuven to Athens, this has been an incredible first year.
And the best part? We are only just getting started!