CombinaryStream

rss

#! code: Drupal 11: Migrating From Jadu Into LocalGov Drupal: Part 1

Drupal 11: Migrating From Jadu Into LocalGov Drupal: Part 1

This is the first post in a series of posts looking at migrating content from a Jadu site into a Drupal site running the LocalGov Drupal (LGD) distribution. The site I was migrating content into was the new site for Central Bedfordshire, and whilst other implementations of Jadu may differ from what I describe here, it should be enough information for you to understand the process.

Jadu is a proprietary CMS application that is mostly written in PHP. Back in 2011 I went to a talk by one of the developers from Jadu at the PHPNW11 conference, so I was aware of the system. That talk, by the way, was interesting as they built a system called Phalanger that allowed PHP (and Jadu) to be run on a .NET environment. That project is now called PeachPie and it looks like it is still under active development.

LocalGov Drupal is a Drupal distribution that combines Drupal, some configuration, and a collection of modules with the aim of making it easier for councils to create websites. The functionality provided includes content pages, news pages, bus timetables, and waste collection systems. What's more, it's maintained by a vibrant community of people.

In this article we look at how the Jadu API is used to get hold of site content, and what we can do in Drupal to facilitate the migration of this content. We then look at a simple part of the migration as an introduction to the whole process. This won't be an introduction to the migration API as I will skip over some of the fine details of the API to keep things brief.

First, let's look at the Jadu API.

philipnorton42 Sun, 08/02/2026 - 18:04 read more

rss

Freelock Blog: Zero to new Drupal site in 133 seconds

Zero to new Drupal site in 133 seconds

John Locke Sat, 08/01/2026 - 15:00

Gabor asked in Slack about how people contributing to Drupal manage multiple different Drupal versions, and different contributed module branches, when using AI agents:

Dev Corner

rss

BloomIdea: When two terms called Food are not the same term

You have a supplier spreadsheet with a category column that reads Animals > Dogs > Food, and you want Drupal to end up with a real taxonomy tree: Animals, with a child Dogs, with a child Food, each level created only if it does not exist yet, and every product referencing the leaf of its own path.

Neither Drupal core nor Feeds does that on its own. Feeds Tamper Term Hierarchy does: it reads the path out of the column, creates the taxonomy terms that do not already exist, and respects the hierarchy between them. It has been on drupal.org since 2021 and reached its first stable release, 1.0.0, this week.

The interesting part is not the splitting. Any parser can split a string on a delimiter. The interesting part is deciding, for each segment, whether the term you are looking at already exists, and that turns out to be a question about identity that most import tooling gets wrong.

Name is not identity

Take a small catalogue:

sku,name,category
1001,Rope leash,Animals > Dogs > Accessories
1002,Dry food 3kg,Animals > Dogs > Food
1003,Dry food 1kg,Animals > Cats > Food

The tree you want out of it:

Animals
├── Dogs
│   ├── Accessories
│   └── Food
└── Cats
    └── Food

There are two terms called Food in that tree. One is the dog food category, the other is the cat food category, and they have to stay separate. If they collapse into one, every dog product and every cat product point at the same category, your faceted search stops making sense, and the client finds out before you do.

Now ask what “does this term already exist?” means while the third row is being imported. Food exists, in the sense that a term with that name is already in the vocabulary. It is the wrong one. The right answer is that Food under Cats does not exist yet, even though Food under Dogs does.

That is the whole problem in one sentence: in a hierarchy, a term is identified by its name together with its parent, not by its name. A lookup that ignores the parent will happily hand you a term from a different branch.

This is why Feeds’ built-in term autocreation cannot be pressed into service here. It matches by name within the vocabulary, because for a flat vocabulary of tags that is exactly right. Give it a path and it does something reasonable and useless: it looks for a term named Animals > Dogs > Food, does not find one, and creates a single term with that literal name, greater-than signs included. One flat term per distinct path.

Resolving a path one parent at a time

The fix follows from the diagnosis. Rather than looking up each segment in the vocabulary, look it up among the children of the segment resolved just before it:

Animals is looked up among the root terms.
Dogs is looked up among the children of Animals.
Food is looked up among the children of Dogs.

Walking Animals > Cats > Food takes a different turn at step two, finds no Food under Cats, and creates one. Two terms, same name, different parents, which is what the source data described all along.

So how does the plugin know which Food is the right one? It does not. The path tells it, one level at a time, and the only thing carried between levels is a single term ID. This is the loop, with the caching and the options stripped out:

$parent = 0;

foreach ($names as $name) {
  $terms = $storage->loadByProperties([
    'name' => $name,
    'vid' => $vocabulary,
    'parent' => $parent,
  ]);

  $term = $terms ? reset($terms) : $this->createTerm($name, $vocabulary, $parent);

  // The term just resolved becomes the parent of the next lookup.
  $parent = (int) $term->id();
}

return $parent;

$parent starts at 0, which is how Drupal spells “no parent, this is a root term”. Every lookup is constrained by it, and the last line of the body is what makes the walk work at all.

Trace Animals > Cats > Food through it and the three queries are (Animals, parent 0), (Cats, parent 1), (Food, parent 5). Trace Animals > Dogs > Food and the third one is (Food, parent 3), which is why it finds the dog food term instead of creating a second one. Neither of them ever asks “is there a term called Food?”, which is the question that would produce the wrong answer.

One honest caveat: Drupal does allow two sibling terms with the same name under the same parent. If your vocabulary already contains such a pair, reset() picks whichever the storage returns first. The plugin cannot disambiguate what the data itself does not distinguish.

Two further properties fall out of this for free.

The import becomes idempotent. Re-run the same feed and every segment resolves to the term created the first time, so nothing is duplicated. Add a row with a new leaf under an existing branch and only the leaf is created. That matters because supplier feeds are re-imported nightly, and an import that duplicates its own output is worse than no import.

And the created terms carry the hierarchy, not just the labels. You get a tree you can render as a menu, use in a facet, or attach access rules to, rather than a flat list of strings that happen to contain angle brackets.

Setting it up

With Feeds, Feeds Tamper and Feeds Tamper Term Hierarchy installed, on a feed type with a CSV parser:

In Mapping, add your taxonomy term reference field as a target and map the category column to it.
In that target’s settings, set Reference by: Term ID. See the warning below.
In the Tamper tab, add the Import Taxonomy Terms Hierarchy plugin to the same source.
Set the input delimiter to whatever separates your levels. It defaults to >, and spaces around each segment are trimmed, so A > B and A>B behave identically.
Pick the vocabulary the terms belong to.
Import.

The one step people miss

Step 2 is worth dwelling on for a moment, because getting it wrong produces a failure that does not look like one.

The plugin creates the terms itself and returns the ID of the last one in the path. If the mapping is left on its default of matching by term name, Feeds receives that number and does the only sensible thing with it: it looks for a term called 23, does not find one, and creates it. The import reports success. The log is clean. The vocabulary contains a perfectly correct hierarchy, built by the tamper, sitting next to a handful of terms called 23, 25 and 26, which are the ones your content actually references.

We reproduced exactly that on a clean Drupal 11 site while preparing this release. If your categories are numbers, this is why.

More than one path per column

Sources often pack several categories into one cell:

sku,name,categories
1001,Rope leash,"Animals > Dogs > Accessories, Animals > Cats > Toys"

That works, by combining two plugins in the right order. Tamper runs its plugins as a pipeline, and when one of them turns a single value into several, the ones after it run once per value:

Explode, using the separator between paths, here ,.
Import Taxonomy Terms Hierarchy, using the separator between levels, here >.

The Explode produces two paths, the hierarchy plugin runs twice, and the field receives two term IDs. Reverse the order and the hierarchy plugin is handed the whole cell, treats the comma as part of a term name, and you get a category called Accessories, Animals.

When you do not want new terms at all

Creating missing terms is the right default for a first import into an empty vocabulary. It is the wrong default when the taxonomy is curated and the feed is a third-party file you do not control, because then a typo at the supplier silently becomes a category.

1.0.0 adds an option for that. Uncheck Allow terms to be auto created and the plugin stops inventing terms: a path that does not fully exist is skipped instead. A supplier renaming Accessories to Accesories shows up as skipped rows rather than as a quietly duplicated branch.

This one came from a support request by someone who wanted precisely that behavior, and from an implementation contributed by someone else two years ago. It sat in the queue until this release, which is on us.

When the source only has part of the path

The opposite case also happens. The vocabulary already holds Animals > Dogs > Food and the source only carries Dogs > Food, because whoever exported it dropped the top level.

By default the first segment has to be a root term, so Dogs > Food creates a second, unrelated Dogs at the root. Correct by the rule above, unhelpful in practice.

Match the first term anywhere in the hierarchy relaxes that first lookup only: the first segment may match a term at any depth, and everything after it resolves underneath whatever it matched. Dogs > Food then attaches to the existing branch.

It is off by default and should stay off unless you need it, because it trades away exactly the identity rule this post is about. When several terms share a name at different depths the first match wins, and which one that is depends on term IDs rather than on anything meaningful.

Where it stands

Feeds Tamper Term Hierarchy 1.0.0 works with Drupal 10 and 11. It depends on Tamper and core’s Taxonomy module, and on Feeds Tamper if you are driving it from Feeds, which is the common case but not the only one: it is an ordinary Tamper plugin and works anywhere Tamper plugins run.

composer require drupal/feeds_tamper_term_hierarchy

The release exists because people kept filing issues against it. The autocreate option, the partial path matching, the Drupal 11 compatibility and the dependency cleanup were all reported, and in three cases implemented, by ethant, bbu23, longwave, damienmckenna and kazah. Their names are on the commits.

youtube

Drupal AI Learners Club - 2026-07-31 - Getting AI to Read Your Docs with Jürgen Haas

Most of us have asked an AI assistant a question about a tool, only to get a confident, plausible-sounding wrong answer. Jürgen Haas has spent the last several months tackling that problem head-on for ECA — building out an MCP server, an agent skill, and a full documentation overhaul so that when you ask AI for help building an ECA model, it actually knows what it's talking about. Jürgen will walk us through: What MCP actually is and how it lets AI agents query live, structured documentation instead of guessing from stale training data A live show-and-tell using the ECA Guide as the example — what it looks like when an AI assistant can genuinely help you build a workflow model from natural language Other "robot-findable" docs strategies (llms.txt, agent skills, structured markdown, etc.) and an honest discussion of what's actually paying off versus what's still unproven If you maintain documentation for a module, product, or team wiki and you're wondering whether it's time to make it AI-legible — this is the session for you. Resources from this talk: https://www.drupal.org/docs/develop/development-tools/ai-coding-tools-for-drupal-development/drupal-ai-learners-club-sessions/2026-07-31-%E2%80%94-getting-ai-to-actually-read-your-docs-so-it-can-help-you-build read more

rss

The Drop Times: Randy Kolenko on Maestro and Drupal’s Emerging Orchestration Work

Drupal’s automation tools solve different problems. The harder question is how they can exchange work without weakening their execution models, permissions, or auditability. read more

rss

Empowering Creators and Governing Agents: The Next Phase of the Drupal AI Initiative

Author: Will Huggins

In 2025, the Drupal AI Initiative launched with a clear vision: to establish Drupal as the premier open-source AI platform for digital experiences.

One year later, the market momentum is clear. What began as a highly focused working group has grown into a powerful ecosystem supported by 32 global partner organisations, over 50 active contributors, and over $2.3 million in committed funding. Most importantly, with the core AI technology now clocking up over 18,000 installs, organisations are actively building their next-generation marketing engines on Drupal.

For digital teams, AI presents a host of opportunities. The power to increase speed of production on one hand, while maintaining quality, consistency and governance on the other. Drupal is addressing this head-on by creating two dedicated product workstreams: Inside AI and Outside AI.

This blog post outlines what this means for your digital roadmap and how Drupal can help your digital marketing operations win in the age of AI.

"Inside AI" vs. "Outside AI"

As AI has evolved from chat boxes into autonomous, multi-step agents, digital leaders need a platform that does two things simultaneously: empowers human creators inside the browser and securely integrates with external marketing systems.

To accelerate our product roadmap, we have divided our day-to-day development into two specialised, business-focused tracks:

1. Inside AI

The Core Value: Empowering your marketing and content teams.
The Focus: This stream focuses on the tools built directly into the editorial interface to supercharge you digital experiences and campaign execution. It drives our visual page-building tools, in-product copy editors, translation modules, and the Context Control Center (CCC).
The Goal: To eliminate the repetitive tasks and developer bottlenecks that slow down your marketing queue. Your team can take a campaign brief, generate a brand-consistent landing page, optimise it for SEO, and localise it for global audiences in seconds, all while keeping humans firmly in the loop to make the final publishing decisions.

2. Outside AI

The Core Value: Make it easy for site builders and developers to use coding agents to build, interact with and migrate to Drupal.
The Focus: This stream ensures that Drupal serves as a highly governed, secure production platform for websites, marketing systems, automation platforms (such as n8n or Activepieces), and external AI agents.
The Goal: To position Drupal as the most reliable, secure, and structured backend for your wider digital stack. We are making it incredibly easy for external systems and autonomous agents to build and deploy using Drupal without introducing security, compliance, or governance risks.

Through this dual focus, we aim to make Drupal the most advanced, intuitive workspace for your marketing teams and content creators, as well as the most secure and connectable platform to build on.

What is Ready Now?

As you plan your digital product roadmaps and marketing strategies, here is a summary of exactly what is production-ready, what is ready for pilot testing, and what is on the horizon:

Live and Ready

These capabilities are fully stable, secure, and ready to drive immediate ROI in your production environments:

Freedom of AI Choice: Drupal connects seamlessly with over 87 AI providers (including OpenAI, Anthropic, Gemini, Azure and Amazee.ai). You can swap models behind the scenes to optimise for cost, performance, or geographic data residency rules without rewriting any code.
Creative & Editorial Assistants: Bounded, human-in-the-loop features like automated image alt-text generation, metadata auto-tagging, and initial copy drafting are ready to go. They act as immediate, built-in time savers for your editorial teams.
AI Automators: Automate time consuming content management tasks like re-tagging all your content or turning PDF or word documents into accessible HTML pages - AI Automators are your CMS superpower!
Brand & Data Guardrails: Advanced security filters that automatically sanitise sensitive customer data before it ever leaves for an external LLM, while validating incoming AI responses to ensure compliance and prevent "hallucinations" on your live site.

Ready for Beta Testing

These features are highly advanced and close to general availability. They are perfect for controlled pilot programs to gain a competitive edge:

The Context Control Center (CCC): The brain of your brand. The CCC is a centralised space where you can define your brand voice, editorial style guides, target audience personas, and domain knowledge. This ensures that any AI-generated layout or copy sounds like your brand, rather than generic web text.
Automated Translation & Multi-Step Campaigns: Workflows that automatically translate entire content libraries or combine multiple AI steps to generate structured assets while capturing local nuances and brand tone.
Conversational Site Building: Tools that allow digital product owners and site builders to configure and lay out basic Drupal structures using natural language, drastically reducing initial setup times.
Cost & Performance Tracking: Fully integrated with standard enterprise monitoring tools. You can track exact token usage, model costs, and AI activity in real time, protecting your marketing budget from unexpected bills.

Coming Soon

One of the cutting-edge, experimental capabilities currently being refined in sandbox environments is Fully Autonomous Agents. These background agents are designed to analyse website performance, automatically propose layout optimisations to boost conversions, or build complex database queries entirely on their own.

Control and Governance

As a mature open-source platform, Drupal AI is structurally sovereign, model-agnostic, and transparently governed.
Whether you need to host open-source models locally to comply with strict regional privacy regulations or plug into the latest commercial LLMs for maximum speed, Drupal AI ensures you always own your data, your models, and your digital roadmap. We build trust directly into the architecture through branch-based content versioning, strict governance workflows, and deep audit trails.

Accelerate Your Roadmap

The Drupal AI Initiative is driving the future of open-source digital experience. If your marketing or digital product teams are ready to leverage the power of collaborative AI, try Drupal today.

rss

Drupal AI Initiative: Empowering Creators and Governing Agents: The Next Phase of the Drupal AI Initiative

Author: Will Huggins

In 2025, the Drupal AI Initiative launched with a clear vision: to establish Drupal as the premier open-source AI platform for digital experiences.

One year later, the market momentum is clear. What began as a highly focused working group has grown into a powerful ecosystem supported by 32 global partner organisations, over 50 active contributors, and over $1.5 million in committed funding. Most importantly, with the core AI technology now clocking up over 18,000 installs, organisations are actively building their next-generation marketing engines on Drupal.

For digital teams, AI presents a host of opportunities. The power to increase speed of production on one hand, while maintaining quality, consistency and governance on the other. Drupal is addressing this head-on by creating two dedicated product workstreams: Inside AI and Outside AI.

This blog post outlines what this means for your digital roadmap and how Drupal can help your digital marketing operations win in the age of AI.

"Inside AI" vs. "Outside AI"

As AI has evolved from chat boxes into autonomous, multi-step agents, digital leaders need a platform that does two things simultaneously: empowers human creators inside the browser and securely integrates with external marketing systems.

To accelerate our product roadmap, we have divided our day-to-day development into two specialised, business-focused tracks:

1. Inside AI

The Core Value: Empowering your marketing and content teams.
The Focus: This stream focuses on the tools built directly into the editorial interface to supercharge you digital experiences and campaign execution. It drives our visual page-building tools, in-product copy editors, translation modules, and the Context Control Center (CCC).
The Goal: To eliminate the repetitive tasks and developer bottlenecks that slow down your marketing queue. Your team can take a campaign brief, generate a brand-consistent landing page, optimise it for SEO, and localise it for global audiences in seconds, all while keeping humans firmly in the loop to make the final publishing decisions.

2. Outside AI

The Core Value: Make it easy for site builders and developers to use coding agents to build, interact with and migrate to Drupal.
The Focus: This stream ensures that Drupal serves as a highly governed, secure production platform for websites, marketing systems, automation platforms (such as n8n or Activepieces), and external AI agents.
The Goal: To position Drupal as the most reliable, secure, and structured backend for your wider digital stack. We are making it incredibly easy for external systems and autonomous agents to build and deploy using Drupal without introducing security, compliance, or governance risks.

Through this dual focus, we aim to make Drupal the most advanced, intuitive workspace for your marketing teams and content creators, as well as the most secure and connectable platform to build on.

What is Ready Now?

As you plan your digital product roadmaps and marketing strategies, here is a summary of exactly what is production-ready, what is ready for pilot testing, and what is on the horizon:

Live and Ready

These capabilities are fully stable, secure, and ready to drive immediate ROI in your production environments:

Freedom of AI Choice: Drupal connects seamlessly with over 87 AI providers (including OpenAI, Anthropic, Gemini, Azure and Amazee.ai). You can swap models behind the scenes to optimise for cost, performance, or geographic data residency rules without rewriting any code.
Creative & Editorial Assistants: Bounded, human-in-the-loop features like automated image alt-text generation, metadata auto-tagging, and initial copy drafting are ready to go. They act as immediate, built-in time savers for your editorial teams.
AI Automators: Automate time consuming content management tasks like re-tagging all your content or turning PDF or word documents into accessible HTML pages - AI Automators are your CMS superpower!
Brand & Data Guardrails: Advanced security filters that automatically sanitise sensitive customer data before it ever leaves for an external LLM, while validating incoming AI responses to ensure compliance and prevent "hallucinations" on your live site.

Ready for Beta Testing

These features are highly advanced and close to general availability. They are perfect for controlled pilot programs to gain a competitive edge:

The Context Control Center (CCC): The brain of your brand. The CCC is a centralised space where you can define your brand voice, editorial style guides, target audience personas, and domain knowledge. This ensures that any AI-generated layout or copy sounds like your brand, rather than generic web text.
Automated Translation & Multi-Step Campaigns: Workflows that automatically translate entire content libraries or combine multiple AI steps to generate structured assets while capturing local nuances and brand tone.
Conversational Site Building: Tools that allow digital product owners and site builders to configure and lay out basic Drupal structures using natural language, drastically reducing initial setup times.
Cost & Performance Tracking: Fully integrated with standard enterprise monitoring tools. You can track exact token usage, model costs, and AI activity in real time, protecting your marketing budget from unexpected bills.

Coming Soon

One of the cutting-edge, experimental capabilities currently being refined in sandbox environments is Fully Autonomous Agents. These background agents are designed to analyse website performance, automatically propose layout optimisations to boost conversions, or build complex database queries entirely on their own.

Control and Governance

As a mature open-source platform, Drupal AI is structurally sovereign, model-agnostic, and transparently governed.
Whether you need to host open-source models locally to comply with strict regional privacy regulations or plug into the latest commercial LLMs for maximum speed, Drupal AI ensures you always own your data, your models, and your digital roadmap. We build trust directly into the architecture through branch-based content versioning, strict governance workflows, and deep audit trails.

Accelerate Your Roadmap

The Drupal AI Initiative is driving the future of open-source digital experience. If your marketing or digital product teams are ready to leverage the power of collaborative AI, try Drupal today.

rss

The Drop Times: Entity Reference Field Override Adds Per-Placement Control in Drupal

Reusable Drupal components become awkward when each placement needs a different presentation. ERFO adds controlled variation without duplicating or altering the referenced content. read more

rss

Morpht: Building a semantic search chatbot with Drupal AI

The Drupal AI module provides everything needed for a RAG chatbot: AI Search embeds your content into a vector database, AI Assistant API wraps an LLM with a grounded search prompt, and AI Chatbot puts a Deep Chat block on the page. We cover setup, provider selection, module stability, troubleshooting tools, and the data flow considerations that government sites need to get right. read more

rss

Stuart Clark (Deciphered): Custom Formatters 4.1.0

Custom Formatters is old. I started it in 2009, my first year building seriously for Drupal, and shipped it through Drupal 6 and 7. Then in late 2016, not long after the first Drupal 8 alpha, I stepped away (work, life, the usual reasons) and for the best part of a decade it wasn't mine to ship.

It didn't die, though, and that's almost entirely down to one person. Andrii Podanenko (podarok), backed by ITCare and the Open Y distribution, carried it through the Drupal 8 beta, the Drupal 10 port, and the start of the Drupal 11 line, essentially single-handedly, for years. Huge thanks to Andrii for looking after it all that time. I've picked the 4.1.x line back up alongside him, and 4.1.0 is the first release to come out of that.

Continue reading →

rss

Talking Drupal: Talking Drupal #563 - Drupito: More Than a Marketplace

Today we are talking about Drupito, its Business model, and Marketplaces with guest Ashraf Abed. We'll also cover Generate (Social Media) Image as our module of the week.

For show notes visit: https://www.talkingDrupal.com/563

Topics

Meet Drupalito and the Mission
Platform Layers and Roadmap
Pricing and New Markets
Marketplace Success Stories
Exportability and Vendor Lock In
Growing the Drupal Ecosystem
Derivatives and Recurring Revenue
Rebuilding on Drupedo
Funding Drupal Association
Global Community Check In
Migrating Sites to Drupedo
Marketplace Vision Shift
Maintenance and Incentives
Safe Updates Blue Green
Testing Mindset for Templates
Official Marketplace Collaboration
Agency Revenue and Partnerships
Niche Derivatives and Pricing
Launch Plans and Vetting

Resources

Code that ships

Hosts

Nic Laflin - nLighteneddevelopment.com nicxvan John Picozzi - epam.com johnpicozzi Ashraf Abed - drupito.com ashrafabed Avi Schwab - froboy.org froboy

MOTW Correspondent

Avi Schwab - froboy.org froboy

Brief description:
- Have you ever wanted Drupal to generate dynamic social media images using tokenized node data, similar to the share images on GitHub repos or Reddit threads? There's a module for that
Module name/project name:
- Generate (Social Media) Image
Brief history
- How old: Created by tfranz of Germany on 22 April 2022
- Versions available: 1.x-dev, 2.0.0-beta2, published a few weeks ago by our own Martin Anderson-Clutz
Maintainership
- Minimally (although now slightly more actively) maintained
- No Security coverage (yet)
- Passing GitLab CI tests
- Well fleshed out README for docs
- Number of open issues: 8 open issues, 0 of which are bugs against the current branch, but there are lots of feature requests
Usage stats:
- 1 site reports using this module
Module features and usage
- GSMI requires an image style that uses a "Text Overlay" effect — this comes from the Image Effects module and lets you burn tokenized (or static) text onto an image. Normally, when Drupal generates an image style derivative, there's no entity in scope — it's just processing a file — so a token like [node:title] would resolve to nothing. GSMI's real contribution is the glue: when it builds a derivative for a specific node, it swaps in the node-resolved text before generating the image. That's what makes entity-aware tokens work inside an effect that otherwise only sees global tokens.
- Once the image style exists, GSMI's settings form lets you pick a source image field on the node — an image field or a media-reference field — plus a fallback image for when that's empty. From there it generates the styled derivative from that source image, for any node of any content type that has the field.
- Finally, GSMI exposes its own token — [node:generate-style], with optional style/field overrides — so you're not locked into the one global style/field pair configured in the settings form. I used that to drop the generated image into Metatag's og_image field for the Session content type on the MidCamp site, getting us dynamically generated session images..
- A couple of gotchas we hit setting this up:
- Text Overlay's layout options have some bugs, and not filling out all of the options will result in an image library error.
- The bigger one: GSMI names the generated derivative file after the source image's filename — extension included — not after whatever format the image style actually outputs. If you try to convert an image to WebP you might get a WebP image with a JPG extension.
- BUUUUT - LinkedIn still doesn't support WebP (at least as per their documentation, so it's still in 2026 not safe to use WebP for a universal og:image. https://www.linkedin.com/help/linkedin/answer/a521928

rss

Metadrop: How to automate WordPress-to-Drupal content migration with WordPress Migrate SQL

Some WordPress sites reach a point where the content model no longer fits the organization's needs. Custom content types, custom entities, and custom fields become necessary to represent internal data precisely, and Drupal supports all three, shaping that data with full flexibility.

Other sites reach that point because of AI. Drupal has built a strong AI ecosystem over recent years, enabling integrations of every needed type: content creation, accessibility checks, RAGs, among others. These are the two situations behind most WordPress-to-Drupal migrations: an architecture the site has outgrown, or an AI integration WordPress cannot support natively.

The challenge of migrating WordPress content to Drupal

The core challenge in a WordPress-to-Drupal migration is migrating the content itself. WordPress sites may host thousands of pieces of content that need to be moved to the Drupal site.

A full migration project runs through several phases: redesigning the site if needed, building the new architecture, and creating a Drupal node for every WordPress post or page. Creating the content is where the real work concentrates, since every image, every user, and every translation has to make it across, on top of adapting content to a different format defined by the new architecture.

A manual content migration is not viable due to its high costs and risks. Handled by hand, this work is prone to human error. A single error is easy to fix, but a…

rss

Dries Buytaert: Responsibility follows control

An AI model does not decide what data it can access, which tools it can use, or whether it can act without approval. People make those decisions at different points. Upstream, a model developer trains and tests the model and decides whether and how to release it. Downstream, a developer builds the model into a system, connects that system to data and tools, and decides whether a person must review its proposed actions before they take effect.

Those choices determine whether harm is possible at all. So when harm occurs, responsibility should fall on those who controlled the relevant choices. That responsibility may be shared: model developers control training and release, product builders control permissions and deployment, and users control deliberate misuse.

Responsibility should follow meaningful control.

That principle is missing from much of the debate over open-weight AI models, which often treats the decision to release a model as the only one that counts.

Axios recently reported that United States officials had considered measures that could restrict American companies from using Chinese open-weight models. Open-weight models make their trained parameters available for others to download, modify, and run on their own infrastructure, without going through the company that built them.

More than 230 companies and organizations have since signed an industry letter defending open weights. After critics accused Anthropic of supporting a ban on open-weight models, Dario Amodei published a statement denying that position. He described open-weight models that do not have dangerous capabilities as a public good and supported mandatory safety testing for sufficiently capable models, open or closed.

The disagreement is less about whether open weights can create risk than about when those risks justify restricting a release, and whether restrictions would improve safety or mainly concentrate power in the largest AI labs.

I am firmly in the open-weights camp. I have run and compared open-weight models, argued that digital sovereignty depends on who controls software, not where it comes from, and believe organizations should control their infrastructure and data instead of depending on a handful of providers.

I also believe consequential algorithms need oversight. More than a decade ago, I argued that we would eventually need something like an FDA for software. The harder question is where responsibility for that oversight should lie.

Open-weight models unbundle control

With hosted, closed-weight models from providers such as Anthropic and OpenAI, the provider typically keeps the weights private, controls how customers access the model, and decides when to update the hosted service.

Open weights can separate those roles. One organization creates and releases the model. A repository such as Hugging Face hosts and distributes the weights. Another team might fine-tune them. A product builder incorporates the model into a product and connects it to data, tools, and users.

Each team controls something different. Because open weights unbundle control, it becomes harder to say who is responsible when harm occurs.

A model developer controls the training process, capability testing, documentation, and release decisions. A repository controls what information it displays about a model's origin, which security checks it performs on uploaded files, and which access restrictions it provides or enforces. A product builder controls what data and tools the resulting system can reach, which actions require human approval, and what gets logged.

Control is not the only thing that matters, but it shows who could still have changed the outcome. When harm involves AI, several actors may bear responsibility for the same incident because each controlled a different opportunity to prevent it.

A lesson from Drupal and Open Source

Like open-weight models, Drupal's code can be copied and changed without asking anyone's permission. A site owner could use it to spread misinformation or operate a fraudulent website. The site owner controls the content and operation of the site and is responsible for those choices. The Drupal project is not responsible merely because someone used its code.

But the Drupal project controls other decisions. When someone privately reports a security vulnerability, the Drupal Security Team follows a coordinated disclosure policy. It keeps the issue private while a fix is prepared. Once a security release is available, the team publishes an advisory and tells site owners to upgrade. The timing of that disclosure can give site owners a fair chance to protect themselves.

The same distinction applies to AI. Responsibility should follow the decisions each actor controls.

The product is where capability receives authority

A model generates outputs. An agent is a software system that uses a model to work toward a goal, often by calling tools and taking actions. The people who build and configure the agent decide what it can access, which actions it can take, and when it needs a person's approval.

In a coding agent such as Claude Code, a model can generate a database command. Whether that command can run depends on the tools and permissions the agent provides, as well as the access allowed by the computer, network, and database.

A content management agent can propose deleting an article. The content management system (CMS) determines whether the agent has permission to delete it, whether the deletion is reversible, and whether the action is recorded.

Permissions, isolation, audit logs, rate limits, human approval, and rollback are not merely engineering details. They determine who has control at the point where harm can still be prevented. That is why AI governance is becoming an essential part of product architecture.

How should government regulate AI?

Deciding who should answer after harm is the easier half of this, even when the answer is not obvious. The harder half is deciding what government should require before any harm has happened.

If control and responsibility are distributed across several actors, government rules should be distributed across them too. This is not a new idea. We already regulate many technologies this way.

More than a decade ago, when I argued for something like an FDA for software, I had drug approval in mind. I no longer think that is the right model. The FDA approves a drug for one or more intended uses, while a general-purpose model may be used for many different purposes.

Cars are a better comparison. The government sets safety standards, manufacturers certify that their vehicles meet them, and drivers are licensed separately. Manufacturers must also report safety defects and conduct recalls when required. Alcohol is regulated in layers too. Bars need a government license that they can lose, and in many US states a bar can be liable for harm caused by serving someone who is visibly drunk.

Each rule targets the actor who controls a particular decision. I would take the same layered approach to AI.

For most risks, government should regulate the products and services that put a model to work. Those rules might limit what data and tools an AI system can access, require human approval for consequential actions, or require those actions to be recorded.

Blocking a model's release is a much stronger step. For an open-weight model, that means preventing the developer from publishing the weights. For a closed model, it could mean preventing the provider from offering access.

I would support that only when safeguards in products and rules governing their use could not prevent a serious danger in time. The three-part test below applies only to this exceptional step, not to AI regulation in general.

Three questions before blocking a model's release

The strongest argument for restricting open-weight releases is that they are difficult to reverse. The UK AI Security Institute notes that safeguards can be removed and that released weights can be redistributed and run privately beyond the original developer's monitoring.

If a model made catastrophic harm much easier, its release could be the last moment anyone had meaningful control. By catastrophic, I mean mass-casualty or comparably systemic harm, not ordinary product failure, fraud, or abuse.

Before blocking a model's release, a government should be able to answer yes to three questions:

Would releasing it make catastrophic harm substantially easier? The comparison should be with closed models and other tools people can already access.
Would safeguards applied when the model is deployed or used fail? They might be ineffective, easy to bypass, or simply arrive too late.
Would blocking the release materially reduce the danger? A restriction should reduce the risk, not merely move it to another country or distribution channel.

The third question is the one I expect people to argue with. Slowing an attacker down has value even if you cannot stop them. But if the same model remains available from another country or distribution channel, a ban costs defenders a tool they can inspect and run themselves while taking almost nothing away from the attacker.

As of July 2026, I have not seen public evidence that an open-weight model has crossed this threshold. It will eventually be crossed, which is why I still think meaningful regulation is coming.

For now, I would allow publication and place obligations where control already exists: on model creators for testing and release decisions, on distributors for provenance and file integrity, on product builders for permissions and deployment, and on users for deliberate misuse.

This approach also protects competition. A regulatory regime that only the largest labs can satisfy could protect them from competition without necessarily making anyone safer. It could also push organizations toward depending on a handful of providers for infrastructure they cannot inspect.

Open weights do not eliminate control. They distribute it. Regulation should follow that structure: place obligations on each actor at the point where harm can still be prevented, and block publication only when release would make catastrophic harm substantially easier, downstream safeguards could not contain it, and a restriction would materially reduce the danger.

rss

Electric Citizen: What’s the Deal with Schema

It’s not new and it’s not sexy, but Schema.org is getting a lot more attention these days. The reason is AI.

You’ve probably heard that Schema improves your AI search results — apply it to your site and voilà, better results. But what is it? How does it help with AI? And, more controversially, does it actually help at all?

rss

ImageX: World Wide Web Day: The Birth of the Web, And How Drupal Supports its Values

If you’re reading this article online, you’ve already experienced the impact of one of history’s most influential inventions. Chances are you’ve also visited several websites today to check the news, compare products, or fill out an online form.

rss

Why We Contribute: The Philosophy Behind 1xINTERNET's Top-Tier Drupal Status

This is a guest post from the incredible team at 1xINTERNET, a Top-Tier Drupal contributor and digital agency headquartered in Frankfurt, Germany.

When the Drupal Association announced that 1xINTERNET had become one of the world's Top-Tier Drupal Contributors, it was a proud moment for the company. Reaching the highest level of contribution recognition places 1xINTERNET among a select group of organisations helping shape the future of one of the world's leading open-source content management systems.

Yet, ask anyone inside the company about the achievement, and you'll hear the same response: becoming a Top-Tier Contributor was never the ultimate goal. Instead, it is the natural outcome of more than a decade of believing that if you build your business on open source, you should help build open source itself.

For over thirteen years, 1xINTERNET has invested in the Drupal ecosystem, not only by delivering digital platforms for clients, but by contributing code, maintaining projects, sponsoring community events, supporting governance, leading strategic initiatives and encouraging employees to actively participate in the community.

Today, the company sponsors more than 500 hours of Drupal contribution every month, actively supports more than 85 Drupal projects, has sponsored over 50 Drupal events, and has contributed to hundreds of issues across the Drupal ecosystem. Those numbers tell one story. The people behind them tell another.

Contribution isn't only about strengthening Drupal, it creates real value for the organisations that choose Drupal as the foundation for their digital platforms. We spoke with Baddý Breidert, Christoph Breidert and James Tillotson about why contributing matters, how it benefits clients, and why they believe giving back is essential to building better digital experiences.

Photo of James, Christoph, and Baddy

Building the future instead of following it

For 1xINTERNET CEO Baddý Breidert, contributing to Drupal has always been part of the company's identity.

"It represents over a decade of dedication to the Drupal project," she says. "I've worked with Drupal since 2006 and been actively involved in the community since 2013. Being recognised as one of the top three Drupal companies globally validates the expertise and sustained effort our team has invested over the years."

But the motivation goes much deeper than recognition. Instead of simply following the direction of Drupal, 1xINTERNET believes in helping shape it. Since Drupal is the technological foundation behind many of the company's digital platforms, contributing to its future isn't viewed as optional, it's viewed as a responsibility.

That philosophy influences almost every decision the company makes. Rather than waiting for new features, improvements or innovations to arrive, the team actively participates in creating them.

Managing Director Christoph Breidert describes it simply.

"We don't just build with Drupal; we help influence where the platform is going next."

It's an approach that benefits not only the Drupal community, but every organisation that chooses Drupal as the foundation for its digital future.

Open source is built on collaboration

Although contribution often means writing code, the three leaders agree that it's ultimately about something much bigger.

Open source succeeds because thousands of people collaborate, share knowledge and solve problems together. Every contribution, whether it's code, documentation, testing, mentoring, event organisation or strategic leadership, helps strengthen the ecosystem for everyone.

For Christoph, this spirit of reciprocity sits at the heart of open source.

"If you build digital solutions using an open-source project but choose to remain on the sidelines, you miss the opportunity to influence the tools you rely on," he explains. "Open source is built on shared knowledge, and contributing back is simply part of how we work."

That collaborative mindset is equally visible throughout 1xINTERNET's culture. 1xINTERNET’s UK Growth Manager James Tillotson sees open source as an extension of how the company works internally.

"We don't hoard knowledge," he says. "We share it to raise the baseline for everyone, which in turn allows us to keep innovating."

Rather than viewing contribution as something separate from day-to-day work, it's embedded in the way teams learn, collaborate and continuously improve.

Contribution isn't separate from client work

One of the biggest misconceptions surrounding open source is that contribution somehow competes with client work. The reality, according to the team, is exactly the opposite.

James puts it bluntly: ""Contribution is client work."

When developers fix a bug in Drupal core or improve functionality that thousands of websites rely on, every client benefits, not just today, but for years to come.

Christoph agrees: "If you're not involved in building the technology, you're always reacting instead of leading."

Technology evolves quickly. Artificial intelligence, digital experience platforms, accessibility, security and content management continue to change at an unprecedented pace. Agencies that simply consume technology are forced to wait for innovation. Agencies that contribute help create it.

Baddý believes that's one of the company's greatest strengths.

"Contribution allows us to lead initiatives like Drupal AI, ensuring we aren't just consumers of the technology but creators of it."

Instead of adapting after the market changes, 1xINTERNET helps shape those changes from within.

Driving innovation through Drupal AI

Perhaps nowhere is that philosophy more visible than in Drupal AI. As Product Lead for Drupal AI, Christoph has been deeply involved in defining its roadmap, working alongside developers from around the world to build practical AI capabilities directly into Drupal.

For him, watching Drupal AI evolve from an ambitious idea into one of the platform's most exciting capabilities has been one of the defining milestones of the company's contribution journey.

"It's been incredible to collaborate with a global community to build something that will help shape the future of the web."

The significance goes beyond technical innovation. Because 1xINTERNET helps build Drupal AI, its teams understand the technology long before it becomes mainstream. They know what's coming, how it works and how organisations can use it responsibly.

James, who contributes to the Drupal AI Marketing Initiative, believes this creates a significant advantage for clients.

"Our clients have access to the latest innovations because we're involved in creating them."

Innovation isn't something clients wait for. It's something they experience alongside the people helping build it.

Better contributions create better client solutions

Although many clients may never see the code being contributed to Drupal, they experience its impact every day. Active contributors develop a much deeper understanding of the platform than those who simply implement it. Because the team understands Drupal's architecture, roadmap and future direction, they can make better long-term decisions for every project.

"Our clients receive stable and modern solutions without having to manage the underlying complexity," Christoph explains. "By maintaining our contribution status, we act as a direct pathway to web innovation."

That means fewer surprises, more sustainable architectures and platforms designed to evolve instead of becoming outdated. James believes clients increasingly recognise that value.

"They know we're not simply using Drupal, we're helping steer where it's going."

Trust has become a competitive advantage

Contribution also creates something that's difficult to measure but incredibly valuable: trust.

When organisations invest in large scale digital platforms, they aren't simply buying technology. They're choosing partners who will help them navigate years of future development.

Being recognised as one of the world's leading Drupal contributors provides confidence that 1xINTERNET isn't standing on the outside of the ecosystem, it's helping lead it. Baddý has seen this become increasingly important during procurement processes.

More organisations now actively look for suppliers who contribute back to the technologies they depend on. Public sector organisations and enterprise businesses increasingly view contribution as evidence of technical excellence, long-term commitment and sustainability.

James has experienced this while expanding 1xINTERNET's presence in the United Kingdom. "When entering a new market where people don't yet know your brand, your contribution footprint becomes a global passport. The Drupal community already knows who you are."

That credibility opens doors long before a first meeting takes place.

Supporting digital sovereignty

For Christoph, contribution is also connected to a much broader movement taking place across Europe and beyond. As organisations become increasingly concerned about vendor lock-in, proprietary platforms and ownership of their data, open-source software is becoming strategically more important than ever. By contributing to Drupal, companies don't simply improve software, they strengthen an independent digital ecosystem that organisations can trust.

"Businesses increasingly want digital sovereignty," Christoph says. "By actively contributing to Drupal, we're helping build a secure and independent IT landscape that organisations can rely on."

It's a perspective that positions contribution not only as technical work, but as an investment in the future of open digital infrastructure.

A culture that attracts exceptional people

Contribution doesn't only benefit clients. It also shapes the people who choose to work at 1xINTERNET. The company actively encourages employees to contribute code, maintain projects, organise events, mentor others and share knowledge across the community. For many developers, that's exactly the environment they're looking for.

"Top developers want to work on things that matter," James says. "We offer them a stage, not just a desk."

Christoph agrees. Many developers are motivated by solving meaningful problems that have an impact far beyond a single client project.

For Baddý, contribution creates something equally valuable: a culture of continuous learning. By collaborating with some of the best Drupal developers in the world, the entire team continually raises its own standards, creating an environment where innovation and professional growth go hand in hand.

Looking ahead

Becoming a Top-Tier Drupal Contributor isn't viewed as a finish line. Instead, it's another milestone in a much longer journey. The company plans to continue investing heavily in Drupal AI, supporting the wider community, encouraging employees to contribute and helping organisations embrace open-source innovation with confidence.

Christoph hopes to make Drupal AI even more accessible through practical demonstration environments that allow organisations to experience its capabilities with a single click.

James wants to strengthen the connection between enterprise organisations and the open-source community, demonstrating that open source can successfully support even the most ambitious digital transformation projects.

Baddý remains focused on investing in people, community leadership and the long-term health of the Drupal ecosystem.

More than contribution

Ultimately, becoming a Top-Tier Drupal Contributor isn't really about rankings, badges or recognition. Those are simply the visible results of years of consistent investment.

The real achievement is building a company where contribution is part of everyday work, where sharing knowledge is expected, collaboration is celebrated, and innovation is something created together rather than consumed.

For 1xINTERNET, contributing to Drupal has never been about giving something away. It's about helping build a stronger platform, a stronger community and better digital experiences for everyone who depends on Drupal.

Because when the platform grows stronger, so do the organisations, developers and communities that build upon it.

rss

Drupal Association blog: Why We Contribute: The Philosophy Behind 1xINTERNET's Top-Tier Drupal Status

This is a guest post from the incredible team at 1xINTERNET, a Top-Tier Drupal contributor and digital agency headquartered in Frankfurt, Germany.

When the Drupal Association announced that 1xINTERNET had become one of the world's Top-Tier Drupal Contributors, it was a proud moment for the company. Reaching the highest level of contribution recognition places 1xINTERNET among a select group of organisations helping shape the future of one of the world's leading open-source content management systems.

Yet, ask anyone inside the company about the achievement, and you'll hear the same response: becoming a Top-Tier Contributor was never the ultimate goal.

Instead, it is the natural outcome of more than a decade of believing that if you build your business on open source, you should help build open source itself.

For over thirteen years, 1xINTERNET has invested in the Drupal ecosystem, not only by delivering digital platforms for clients, but by contributing code, maintaining projects, sponsoring community events, supporting governance, leading strategic initiatives and encouraging employees to actively participate in the community.

Today, the company sponsors more than 500 hours of Drupal contribution every month, actively supports more than 85 Drupal projects, has sponsored over 50 Drupal events, and has contributed to hundreds of issues across the Drupal ecosystem. Those numbers tell one story. The people behind them tell another.

Contribution isn't only about strengthening Drupal, it creates real value for the organisations that choose Drupal as the foundation for their digital platforms. We spoke with Baddý Breidert, Christoph Breidert and James Tillotson about why contributing matters, how it benefits clients, and why they believe giving back is essential to building better digital experiences.

Photo of James, Christoph, and Baddy

Building the future instead of following it

For 1xINTERNET CEO Baddý Breidert, contributing to Drupal has always been part of the company's identity.

"It represents over a decade of dedication to the Drupal project," she says. "I've worked with Drupal since 2006 and been actively involved in the community since 2013. Being recognised as one of the top three Drupal companies globally validates the expertise and sustained effort our team has invested over the years."

But the motivation goes much deeper than recognition.

Instead of simply following the direction of Drupal, 1xINTERNET believes in helping shape it. Since Drupal is the technological foundation behind many of the company's digital platforms, contributing to its future isn't viewed as optional, it's viewed as a responsibility.

That philosophy influences almost every decision the company makes. Rather than waiting for new features, improvements or innovations to arrive, the team actively participates in creating them.

Managing Director Christoph Breidert describes it simply.

"We don't just build with Drupal; we help influence where the platform is going next."

It's an approach that benefits not only the Drupal community, but every organisation that chooses Drupal as the foundation for its digital future.

Open source is built on collaboration

Although contribution often means writing code, the three leaders agree that it's ultimately about something much bigger.

Open source succeeds because thousands of people collaborate, share knowledge and solve problems together. Every contribution, whether it's code, documentation, testing, mentoring, event organisation or strategic leadership, helps strengthen the ecosystem for everyone.

For Christoph, this spirit of reciprocity sits at the heart of open source.

"If you build digital solutions using an open-source project but choose to remain on the sidelines, you miss the opportunity to influence the tools you rely on," he explains. "Open source is built on shared knowledge, and contributing back is simply part of how we work."

That collaborative mindset is equally visible throughout 1xINTERNET's culture.

IxINTERNET’s UK Growth Manager James Tillotson sees open source as an extension of how the company works internally.

"We don't hoard knowledge," he says. "We share it to raise the baseline for everyone, which in turn allows us to keep innovating."

Rather than viewing contribution as something separate from day-to-day work, it's embedded in the way teams learn, collaborate and continuously improve.

Contribution isn't separate from client work

One of the biggest misconceptions surrounding open source is that contribution somehow competes with client work.

The reality, according to the team, is exactly the opposite.

James puts it bluntly.

"Contribution is client work."

When developers fix a bug in Drupal core or improve functionality that thousands of websites rely on, every client benefits, not just today, but for years to come.

Christoph agrees.

"If you're not involved in building the technology, you're always reacting instead of leading."

Technology evolves quickly. Artificial intelligence, digital experience platforms, accessibility, security and content management continue to change at an unprecedented pace. Agencies that simply consume technology are forced to wait for innovation. Agencies that contribute help create it.

Baddý believes that's one of the company's greatest strengths.

"Contribution allows us to lead initiatives like Drupal AI, ensuring we aren't just consumers of the technology but creators of it."

Instead of adapting after the market changes, 1xINTERNET helps shape those changes from within.

Driving innovation through Drupal AI

Perhaps nowhere is that philosophy more visible than in Drupal AI.

As Product Lead for Drupal AI, Christoph has been deeply involved in defining its roadmap, working alongside developers from around the world to build practical AI capabilities directly into Drupal.

For him, watching Drupal AI evolve from an ambitious idea into one of the platform's most exciting capabilities has been one of the defining milestones of the company's contribution journey.

"It's been incredible to collaborate with a global community to build something that will help shape the future of the web."

The significance goes beyond technical innovation.

Because 1xINTERNET helps build Drupal AI, its teams understand the technology long before it becomes mainstream. They know what's coming, how it works and how organisations can use it responsibly.

James, who contributes to the Drupal AI Marketing Initiative, believes this creates a significant advantage for clients.

"Our clients have access to the latest innovations because we're involved in creating them."

Innovation isn't something clients wait for. It's something they experience alongside the people helping build it.

Better contributions create better client solutions

Although many clients may never see the code being contributed to Drupal, they experience its impact every day.

Active contributors develop a much deeper understanding of the platform than those who simply implement it.

Because the team understands Drupal's architecture, roadmap and future direction, they can make better long-term decisions for every project.

"Our clients receive stable and modern solutions without having to manage the underlying complexity," Christoph explains. "By maintaining our contribution status, we act as a direct pathway to web innovation."

That means fewer surprises, more sustainable architectures and platforms designed to evolve instead of becoming outdated.

James believes clients increasingly recognise that value.

"They know we're not simply using Drupal, we're helping steer where it's going."

Trust has become a competitive advantage

Contribution also creates something that's difficult to measure but incredibly valuable: trust.

When organisations invest in large scale digital platforms, they aren't simply buying technology. They're choosing partners who will help them navigate years of future development.

Being recognised as one of the world's leading Drupal contributors provides confidence that 1xINTERNET isn't standing on the outside of the ecosystem, it's helping lead it.

Baddý has seen this become increasingly important during procurement processes.

More organisations now actively look for suppliers who contribute back to the technologies they depend on. Public sector organisations and enterprise businesses increasingly view contribution as evidence of technical excellence, long-term commitment and sustainability.

James has experienced this while expanding 1xINTERNET's presence in the United Kingdom. "When entering a new market where people don't yet know your brand, your contribution footprint becomes a global passport. The Drupal community already knows who you are."

That credibility opens doors long before a first meeting takes place.

Supporting digital sovereignty

For Christoph, contribution is also connected to a much broader movement taking place across Europe and beyond.

As organisations become increasingly concerned about vendor lock-in, proprietary platforms and ownership of their data, open-source software is becoming strategically more important than ever.

By contributing to Drupal, companies don't simply improve software, they strengthen an independent digital ecosystem that organisations can trust.

"Businesses increasingly want digital sovereignty," Christoph says. "By actively contributing to Drupal, we're helping build a secure and independent IT landscape that organisations can rely on."

It's a perspective that positions contribution not only as technical work, but as an investment in the future of open digital infrastructure.

A culture that attracts exceptional people

Contribution doesn't only benefit clients.

It also shapes the people who choose to work at 1xINTERNET.

The company actively encourages employees to contribute code, maintain projects, organise events, mentor others and share knowledge across the community.

For many developers, that's exactly the environment they're looking for.

"Top developers want to work on things that matter," James says. "We offer them a stage, not just a desk."

Christoph agrees.

Many developers are motivated by solving meaningful problems that have an impact far beyond a single client project.

For Baddý, contribution creates something equally valuable: a culture of continuous learning.

By collaborating with some of the best Drupal developers in the world, the entire team continually raises its own standards, creating an environment where innovation and professional growth go hand in hand.

Looking ahead

Becoming a Top-Tier Drupal Contributor isn't viewed as a finish line.

Instead, it's another milestone in a much longer journey.

The company plans to continue investing heavily in Drupal AI, supporting the wider community, encouraging employees to contribute and helping organisations embrace open-source innovation with confidence.

Christoph hopes to make Drupal AI even more accessible through practical demonstration environments that allow organisations to experience its capabilities with a single click.

James wants to strengthen the connection between enterprise organisations and the open-source community, demonstrating that open source can successfully support even the most ambitious digital transformation projects.

Baddý remains focused on investing in people, community leadership and the long-term health of the Drupal ecosystem.

More than contribution

Ultimately, becoming a Top-Tier Drupal Contributor isn't really about rankings, badges or recognition.

Those are simply the visible results of years of consistent investment.

The real achievement is building a company where contribution is part of everyday work, where sharing knowledge is expected, collaboration is celebrated, and innovation is something created together rather than consumed.

For 1xINTERNET, contributing to Drupal has never been about giving something away.

It's about helping build a stronger platform, a stronger community and better digital experiences for everyone who depends on Drupal.

Because when the platform grows stronger, so do the organisations, developers and communities that build upon it.

rss

Smartbees: Automatic Content Translation System

Discover how our solution automated content translation and helped the client’s team work faster. read more

rss

Tag1 Insights: Teaching AI to Speed Up Accessibility Testing

Marlene Wanberg, Frontend Developer at Tag1 and a Drupal builder since 2007, built a suite of fifteen AI agent skills that runs a full automated accessibility audit and narrows thousands of raw scanner findings down to a short worklist of confirmed fixes.

To paraphrase the much used line about writing: I don't enjoy doing accessibility testing, but I like having done accessibility testing. When a site becomes more usable for everyone, I feel good. Users feel good. Clients feel good. (Regulators feel good.) The process of getting there can be very tedious.

Before we even begin addressing accessibility, we need to know where the problems live, and that's where testing comes in. There are two main categories of accessibility testing: automated and manual. Automated testing uses deterministic tools and scanning scripts to check the rendered HTML markup for certain obvious flaws, things like missing ARIA labels or low color contrast. Manual testing checks what those tools can't. A person navigates the site with the tech real users rely on, like keyboards and screen readers, and catches holes in user flows or spots where meaning gets missed. An image might have text in its ARIA label, but does that text actually help explain what the image is and how it's relevant to the rest of the content? Both categories let us find the areas of a site that need adjustments to make them more usable.

People are having plenty of thoughtful arguments right now about what AI is good for and where it doesn't belong. One use stands out to me: letting it take on the repetitive, mechanical parts of a job, freeing me up for the work that needs real judgment. So I set out to see how much of accessibility testing an AI agent could carry.

Automated testing seemed like the most logical place to start, because so much of it is deterministic: you run the scanners and collect the results. And yet a full automated pass involves lots of little decisions along the way, lots of setup steps, documentation to keep straight, mountains of results to sort through, and reports to write at the end. Exactly the type of work I wanted to hand off.

One Skill File Was Not Nearly Enough

Claude Code has a feature called skills: instruction files that teach the agent a repeatable procedure. That seemed like a promising starting point. There might be other approaches that smarter people have thought of, but this is what I knew at the time, and one of the best ways to learn is to just do and experiment. So I had a conversation with Claude and had it help me write my first automated accessibility testing skill. (In my experience, having AI write instructions for AI based on my intent tends to give me better results.)

I very quickly realized that one skill file could not handle the complexity I was asking of it. So I split it up: a skill for gathering information about the project, one for setup, one for running the tools, one for consolidating and analyzing the results, one for tracing issues back to their source, and one for reporting.

The suite kept growing as I used it and learned what else it needed to be robust. I'd run it through fresh on a site and each time find different ways it either wasn't doing enough or was just doing it flat wrong. Instead of getting mad (ok, I did get annoyed a few times) I asked, "Where is my process breaking down? What does the agent need that I haven't provided? Where is it spending the most tokens and how can I make that more efficient?"

The process now spans fifteen skills and a shared library of tested scripts, covering the full arc of an audit: plan the scope, discover and categorize the pages, pick and configure the scanners, run them, boil the output down, trace findings to source code, verify what's real, research fixes against the actual specs, write reports for the humans who need them, and retest after fixes get implemented.

I also wanted the workflow to work on any project, not just the stacks I know best. Drupal, Next.js, Svelte, WordPress, whatever comes through the door. Including up-to-date documentation for every likely framework inside the skills would have been unrealistic, and stale guidance is worse than no guidance, because the agent follows it confidently. (Just ask any Drupal dev trying to use AI out of the box for dev help). So I baked in a dependency on Context7, a service that lets the agent query current, version-specific documentation for whatever the project uses, and required checking it at several points in the workflow. Now it works from what the project is actually running instead of trusting whatever its training data half-remembers.

Humans Stay In the Loop, On Purpose

I value ownership of my work. Current models can do a lot, but they still far too often make inaccurate inferences, skip facts, and end up like my robo-vacuum, stuck in a corner and tangled in cords, costing me time and effort to get it unstuck and redo work. In personal projects this is annoying; in a regulatory environment this is unacceptable.

So at key moments I want my agents to bring me their work, get my input and signoff, and then continue based on the direction I set. The agent interviews me up front about the project and its goals. It asks permission before installing tooling dependencies or guides me through the installs. It pauses so I can check that the process and the results so far look accurate, and that it hasn't wandered off track.

What Broke Along the Way

Many useful things I learned in this process came from something going wrong. A sampling:

False positives. One scanner rule alone produced 257 rows complaining that icon-only buttons (picture a bare magnifying-glass search button) had no label for screen readers, when in reality every one of them was labeled correctly. A quick fix might be to tell the scanner to stop running that rule, but a genuinely unlabeled icon button elsewhere in the site is a real barrier for someone navigating by screen reader, so switching it off entirely would bury real problems alongside the noise. Instead the workflow keeps a list of these known false-alarm patterns, each with a condition attached: ignore this rule only where the evidence proves a label already exists. And it keeps paired test cases, one that should trip the rule and one that shouldn't. If the exception ever starts covering a real failure, a test catches it.

Too much output, then not enough. Four scanners across a real site produced 188 raw result files holding over three thousand findings, most of them duplicates of each other in different formats. I had to build a whole consolidation stage: normalize, deduplicate, cluster by root cause, rank. Then I discovered the agent was dropping and misclassifying findings during consolidation, so I pushed that work out of the agent's judgment and into tested scripts whose behavior I could verify.

Empty, meaningless reports. Early reports read like typical AI marketing copy, generic percentages and process jargon instead of actual numbers from the audits and explanations a developer could act on. They were unusable to me, the person who had instructed the AI to write them, and would certainly not be usable to anyone else. Now every report has to be built from the audit's actual findings, and written for the specific person who will read it.

The disappearing CSV parser. I watched the agent spend enormous amounts of tokens recreating, over and over, a CSV parser I knew it had already written, until I cornered it on why. The library it needed had gone missing mid-session, and rather than say so, it kept quietly rebuilding the wheel. The lesson went straight into the shared library's principles: “Never write a one-off parser; if the library doesn't support what you need, first check in with me, then extend the library and add tests.”

Confidently wrong. Authentication tripped it in a way I almost didn't catch. After one scan cleared browser cookies, the session cookie never got reapplied, so every authenticated page silently scanned as the login page and came back artificially clean. Clean results feel great until you notice the settings page weighs a fraction of what it should. And color contrast in modern CSS gave it fits; converting oklch() color values to check contrast ratios burned real time and produced confident errors before I required the math to live in a tested script rather than the agent's head.

Whenever something like this came up, I stopped the agent and we talked through what happened and why. Then I changed the process and the skills themselves: more decomposition, more ask-the-human steps, more reusable tested scripts, and adversarial review agents that critique the work before I see it. Each time the pattern is the same: treat agent failures as process bugs, not one-offs to scold away.

Did It Produce Anything?

Yes, it did, and I'm quite pleased with the results.

Take a static marketing site. The workflow pointed four accessibility scanners (axe, Pa11y, Lighthouse, and IBM Equal Access) at 35 pages. Between them they returned 7,028 raw findings. Most automated scanners finish by handing me a pile of output that I have to sort through to find the meaning. That's boring and annoying so I use my workflow to remove duplicates, group the remaining items by root cause, and in this case it landed on 37 clusters. A cluster is just a bunch of findings that all come from the same underlying problem, so one broken pattern repeated across fifty pages becomes a single cluster instead of fifty separate things to chase. The review step of the workflow turns those into a short worklist. 11 of them are confirmed code fixes ready to act on. 7k+ findings down to 11 things I need to do.

I've run it on four sites so far, on stacks that share almost nothing, and gotten similar results each time.

Site	Raw findings	Narrowed to
Eleventy site	7,028	37 clusters
Drupal module	1,091	24 clusters
Next.js app	3,216	32 clusters
SvelteKit site	6,980	26 clusters

And if I had questions about any of them, like where a problem came from, which WCAG rule it violated, even a suggested fix, I could talk it through with the agent, which had the full context of the project.

One of my favorite bits is how the workflow traces big noisy messes back to the source. On the Eleventy site, it found that fixing just two files (one layout template and one stylesheet) would clear 82% of its 7,028 findings. That is exactly the kind of combing-through I used to do by hand, and exactly what AI is good at.

It is not only good at ruling things out or narrowing down issues. I've found it is good at bringing up and prioritizing problems that matter but that wouldn't necessarily be highlighted using just the automated scanners. For example, on a Next.js app it confirmed a link set apart by color alone, a genuine problem for anyone who cannot see the difference. On a SvelteKit site it flagged something styled as a button that was really a plain span, invisible to a keyboard. In the Drupal LMS module, it found the course card was two overlapping links pointing to the same place, which adds noise to a screen reader. And it found where code blocks failed contrast in dark mode, a problem a quick once-over would sail right past.

How Do I Know It Isn't Missing Things?

If my workflow drops the findings from thousands to under a hundred actionable items, that can feel good, but it also raises the question: Are we missing something now?

Two things stop that from happening. First, the automated pass is not the full audit. Scanners cover the slice of WCAG a machine can check, which is a portion of what matters. The rest still needs a person at the keyboard with assistive technology. For example, on the Drupal module, my own manual review added seventeen findings no scanner could have caught, no matter how many times I ran them. Second, someone who knows what "wrong" looks like has to read the workflow's output. Those authenticated pages that scanned clean because the session cookie dropped? A less experienced reviewer might file that clean result and move on. The workflow speeds up an expert. It does not replace one.

The Workflow Keeps Evolving

I treat the workflow itself as a project under audit. Each time I use it I find ways to improve it. This summer I handed a newer, more capable model a bigger job: review the entire suite and plan a remediation of its rough edges, from turning the copy-paste method I'd been using to move it between projects into a proper plugin to addressing weak spots in the consolidation stage.

That overhaul is underway now. The intake interviews will be better, I'm incorporating the latest WCAG Evaluation Methodology, and I'm experimenting with AI-driven keyboard testing.

What You Can Take From This

I haven't released this workflow yet; it remains a personal tool that I use on the projects in front of me, including Tag1's. But the pattern is the transferable part, and none of it requires my code:

Decompose the work until each piece has one job.
Keep a human at the decisions that matter.
Push the agent toward current documentation for the project's actual stack instead of letting it coast on training data.
Fix the process when the agent fails.
Move anything deterministic out of the agent's judgment and into tested scripts.
Measure and review before you trust; sometimes the AI's most confident conclusions turned out to be based on broken steps.
Add adversarial agent reviews to both the planning and the workflow.

None of this made accessibility testing fully automatic, and that wasn't my goal. It has made many of the tedious parts quick, and I get to spend more of my time doing the interesting parts now.

This is one of several ways we're putting AI to work on real engineering problems at Tag1. You can find more in our Insights.

rss

DDEV Blog: A Love Letter to the DDEV Community

I've been working on DDEV for years now, and there's something I don't say often enough:

You make this so worthwhile.

Stas and I love to get up in the morning to hear what you have to say, learn from your experiences, share our path together.

We feel so thankful to be creating something useful in collaboration with you.

All of us have had jobs before where some boss was making random decisions on product features that we knew might be irrelevant in weeks or months. It's a frustrating feeling, and that lack of control is so terrible. With DDEV and your guidance, we always know that you're keeping us on track about real needs for real features. It's fantastic.

Real Feedback About Real Problems

Your questions in Discord or Slack and the issues you file aren't "noise". They're signal. When something breaks (or is awkward) in your workflow, you tell us, often with enough detail that we can reproduce it immediately. When something is confusing, you ask questions that reveal where our assumptions were wrong.

That feedback shapes DDEV in ways that internal testing never could. We don't use DDEV on every possible OS, with every PHP framework, in every hosting environment. You do. And you tell us what you find.

We Love Your Questions and Comments.

AI has been replacing human interaction in support situations, and in many cases doing a decent job. It usually does a good job with questions about DDEV.

But getting answers to questions is not the only purpose of support. It's also a great way to communicate problems and ambiguities to project maintainers.

We want you to ask us questions! We live for your questions. We miss the fact that you've been absent from Discord, #ddev in Drupal Slack, and the issue queue. When you ask, it helps us to understand what your struggles are and how DDEV can get better. DDEV's strength has always been the community's willingness to engage and share their needs and frictions and hopes for the project.

Hard Questions Lead Somewhere

Most of the best improvements to DDEV started with someone asking a question that seemed basic but turned out to be pointing at a real need. Why does this take so long? Why does that require a workaround? Why can't DDEV just handle this case?

Those questions are gifts to all of us. They push us to look at things we've gotten used to, and ask whether they actually need to be that way.

Generous Contributions

The DDEV ecosystem is full of people who built something useful for themselves and then shared it with everyone. Add-ons, CI configurations, documentation fixes, screencasts, blog posts.

Stas, who joined the project more recently, was surprised by how much DDEV could be extended and customized, and how good the documentation was for figuring it out. Looking back, that didn't happen by accident. It came from years of feature requests and contributions from people who solved their own problems and then shared the solution.

Every person who took time to answer another user's question in the DDEV issue tracker or Discord or Drupal Slack freed up time for the maintainers to work on the next feature.

We Learn from You

Working with the community makes us better at this work. The patterns we see in your issues, the use cases we hadn't considered, the ways you've adapted DDEV for environments we never anticipated—that knowledge informs everything.

Thank You

To everyone who filed an issue, answered a question, wrote a blog post, sponsored the project, gave a talk, built an add-on, tested a prerelease, or just told a colleague that DDEV was worth trying:

Thank you. This project exists because of you, and it's only possible because of the ways you engage with it.

If you want to stay involved, here's where to find us:

Discord — active community discussion
GitHub Issues
Drupal Slack

Come say hello.

rss

Dries Buytaert: From personal AI experiments to shared tools

In April 2025, I published Claude Code meets Drupal, my first public experiment with an AI coding agent. I have been experimenting with coding agents ever since, often by building tools to solve problems in my own work.

Last week, I joined the Drupal AI Learners Club to discuss several experiments I had already published. Angie Byron started the club and runs it with co-organizer Amber Himes Matz. It gives people in the Drupal community a place to show how they are using AI and talk honestly about what works and what does not.

I spent an hour walking through the experiments, starting with Drupal Digests, a tool that uses AI to summarize key developments across Drupal Core, Drupal CMS, Drupal Canvas, and the Drupal AI initiative.

Drupal Digests led to another experiment: AI-generated Rector rules. When a Drupal Core change deprecates an API, Drupal Digests analyzes the issue and code changes and generates a rule that can automate the corresponding upgrade in other Drupal projects.

I also showed an API catalog that helps AI agents discover my website's search API.

These are only some of my AI experiments. Most begin as tools I build for myself, and many never go any further. When one seems useful beyond my own work, I publish it so others can try it and improve it.

Once it is public, we can see whether people use it and want to help improve it. If they do, it may eventually become a community project. If not, that is useful to know too.

The recording goes into much more detail, with demonstrations of the tools and questions from the group. You can watch it below.

rss

BloomIdea: Shipping with MRW from Drupal Commerce: no more copy-pasting into the carrier portal

Several of the e-commerce stores we build and run ship with MRW, one of the main carriers in Spain and Portugal. Until recently, shipping an order meant leaving the store: open MRW's customer portal, retype the customer's address, print the label, then copy the shipment number back into Drupal so the customer gets a tracking link. Multiply by every order, every day, and add returns, which meant doing the same dance with the addresses swapped.

We replaced that with a Drupal module. It now runs the daily expedition of the first of them, and we are releasing it to the community: Commerce MRW is available on drupal.org, with a 1.1.0 release.

What it does

Commerce MRW integrates Drupal Commerce with MRW through SAGEC, the carrier's SOAP webservice for creating and managing shipments (envíos). The whole expedition cycle happens on the shipment admin pages the team already uses:

Transmit shipments (TransmEnvio): one click creates the shipment on MRW's side and stores the returned shipment number as the Drupal shipment's tracking code, feeding the customer-facing tracking link.
Labels on demand (GetEtiquetaEnvio): the transport label PDF is streamed straight from SAGEC every time someone asks for it. Labels are never stored locally, so MRW stays the single source of truth and there is no stale-file problem.
Cancel (CancelarEnvio) transmitted shipments before the courier picks them up.
Return pickups: a request can carry a pickup address (DatosRecogida), so MRW collects the parcel at the customer's door and delivers it back to the store. Returns stop being a manual job in the carrier portal.
Tracking: a client for MRW's TrackingServices webservice queries the current status, or the full status history, of any shipment: by MRW number, by your own order reference, individually or in bulk.
"Transmit as": shipments whose shipping method is not MRW (say, a generic "Free shipping" flat rate) can still be shipped with MRW. The operator picks the executing method at transmit time and the choice is recorded on the shipment.

Service codes cover the SAGEC catalogue (Ecommerce, Urgente 19 Expedición, Urgente 13 and friends), and PRE (test) and PRO (production) environments are separate credential sets with a test-mode toggle, so you can validate the integration with your franchise before a single real parcel moves.

Small module, sharp edges

The SAGEC manual is short; reality is not. A few of the edges the module rounds off for you:

Postal codes are per-country folklore. Spain wants 5 digits with leading zeros, Portugal wants only the first 4 of its 7-digit codes, Andorra's letters become zeros, and Gibraltar is always 00010. The module normalizes all of it before SAGEC ever sees an address.
The tracking service hides behind a WCF quirk: it only accepts SOAP posts on its relative endpoint address, and answers 404 on the address the documentation leads you to. We found out so you do not have to.
No PHP SOAP extension required. Both clients build their envelopes by hand over Drupal's HTTP client, which also makes every request fully testable with mocked responses; the module ships with a kernel test suite that asserts the exact XML that goes over the wire.

Your store's rules stay yours

Carrier integrations die by hardcoding someone else's workflow, so Commerce MRW deliberately does not have one. Site-specific data travels through an event: subscribe to the TransmEnvio request event and fill whatever your store knows, the consignee's phone number, a NIF, delivery observations for the courier, or a full pickup address to turn a transmission into a return pickup. In one of our stores, three small subscribers do exactly that: one copies the customer's phone, one sends the backoffice's "carrier notes" field as delivery instructions, and one swaps the addresses when a shipment is flagged as a return.

Tracking follows the same philosophy. The module gives you the client and a documented integration recipe, but ships no polling and changes no shipment states: whether "delivered at destination" should transition your workflow, or just inform a human, is your call. That store runs an hourly cron that mirrors the last MRW status into the expedition dashboard, next to each tracking code; marking a shipment delivered stays a human decision, now an informed one.

Battle-tested, then released

Like our other contrib modules, this one shipped to drupal.org only after running a real store's daily expedition: real transmissions, real labels handed to the courier, and a tracking client validated against the production webservice before its release was tagged. The test suite (42 kernel tests at the time of writing) covers the SOAP envelopes, the postal code rules, the backoffice forms and the tracking parsing.

Get it

composer require drupal/commerce_mrw:^1.1

Requires Drupal 10.3+ or 11 and Commerce Shipping 3.x, plus SAGEC credentials from your MRW franchise (ask your franchise; ours enabled both the shipping webservice and the tracking service on request).

If you run a Drupal Commerce store shipping in Spain or Portugal, this is for you. The issue queue is open, and international shipments, ZPL labels and MRW delivery points are on the roadmap.

rss

Specbee: Understanding Drupal's Service Container and Dependency Injection

Learn how Drupal's service container and dependency injection work, why they matter for testable code, and what Drupal 11 changes for your service classes. read more

rss

Salsa Digital: Drupal AI Context — beta 3 released

Beta 3 release of Drupal AI Context Beta 3 of Drupal AI Context , also known as Context Control Center (CCC), is now available. CCC helps Drupal sites provide governed, reusable context for AI workflows and agents, from brand voice and editorial standards to organisational knowledge and governance rules. This gives AI systems access to more structured and relevant information while allowing teams to manage that information centrally. Following the beta 2 release , beta 3 expands how context is authored, imported, selected and extended. It also introduces redesigned administration pages, more granular agent controls and broader integration options. read more

rss

The Drop Times: Drupal 12 HTMX 4 Upgrade Returns to Review

Changes to how Drupal handles dynamic page updates could force contributed-module maintainers to support different behaviour in Drupal 11 and Drupal 12. read more

rss

The Drop Times: What It Takes to Sustain Drupal

Maintainers, Association leaders, developers, and community organisers faced versions of the same question this week: how should Drupal fund, govern, and sustain the work its users rely on? Reporting from 20–27 July 2026 followed that question across Association finances, security response, artificial intelligence, technical maintenance, and community participation. Read together, the stories show that shared infrastructure remains dependable only when responsibility for maintaining it is made visible.

The funding question became explicit in The DropTimes’ written exchange with Tiffany Farriss, interim CEO of the Drupal Association. Farriss proposed programme-level cost accounting and the possible use of usage-based contributions for enterprise-facing utility and infrastructure services, while separating that work from digital-public-good programmes and ecosystem advocacy. The proposals are not approved policy, but they move the discussion beyond general appeals for support towards clearer questions about cost, value, and who benefits from Drupal’s shared systems.

The same issue appeared in The DropTimes’ 22 July coverage of Dries Buytaert’s earlier distinction between “License-only Open Source” and “Stewarded Open Source”, first published on 9 July, and in the week’s contributed-project security advisories. A licence can grant access to code, but it cannot by itself guarantee maintenance, vulnerability response, governance, or long-term support. Reporting on AI governance, developer tooling, community events, and the July TDT Open Town Hall extended that principle into newer and more operational parts of the ecosystem. The major stories from the week follow.

Follow The DropTimes on LinkedIn, X, Bluesky, and Facebook, or join #thedroptimes on Drupal Slack.

This issue of Editor’s Pick was written and curated by Allen Jason.

rss

UI Suite Initiative website: UI Suite Monthly #37 — A new look for Display Builder, and an archaeology site digs in

Our 37th monthly UI Suite meeting (July 23, 2026) opened with a small piece of housekeeping: our sessions had quietly drifted from 30 minutes to a full hour, so Pierre asked the group to bring them back to half an hour — with anyone who wants to keep chatting free to stay on after the slide deck. It worked. Thirty minutes, three updates, two demos, and we still had time for questions. read more

rss

Webpro Company blog: AI agents do not only read web pages: how to make a Drupal site understandable and safe for machines

AI agents do not browse the web in the same way people do. They look for structure, APIs, permissions, verifiable answers and trustworthy sources. Drupal has strong foundations for this, but only when the platform is deliberately maintained and structured. AI agents do not only read web pages: how to make a Drupal site understandable and safe for machines In recent weeks, the Drupal community has been discussing a question many organisations are only beginning to formulate: how does the web change when it is used not only by people, but also by AI agents? On July 23, 2026, the Drupal AI Initiative published "Outside AI - The State of Agent Experience in Drupal". The article describes how an agent may be asked to create a content model, configure permissions, modify a running system or… read more

rss

DDEV Blog: Shopware on DDEV: notes from years of client projects

Are DDEV and Shopware a good fit? If you ask me, yes. Let me tell you why.

I first got to know DDEV a few years ago as a freelancer working on an agency Shopware project. Up until then, every time I switched to a different agency, it was a painful process: Would the development environment on my PC (Linux back then, macOS today) even work? What new ports and commands would I have to memorize? Would the environments for my previous projects break?

So I braced myself for the onboarding meeting. But the preparation turned out to be minimal—I already had Docker, and installing DDEV beforehand was just a script. And then it was a git clone (okay, I knew that one well) and a ddev start—that was new. And it was amazing: after what felt like five minutes (okay, let's say 20, including the database download and so on), I had the shop up and running on my machine. Wow!

I quickly switched to DDEV for all of my client projects. It was a game-changer. No more "port 8000 already in use" errors. A Shopware update needs a newer PHP version? A mismatched Node.js version? Easy—just edit .ddev/config.yaml and run ddev restart. Done.

From time to time I also work on WordPress, Shopware 5, or MediaWiki projects, and DDEV is a great fit for all of them: for me, it's one and the same setup, with the same look and feel. Even to write this blog post, I ran a ddev start to bring up the Astro-based backend.

Why I use DDEV for Shopware

Which features do I reach for again and again?

Project isolation

DDEV projects are isolated from each other, so you can work on several at once without any conflicts. While working on one project, another client calls in. Two clicks and the other project is up and running—and the first one stays up, ready to be picked up again whenever you are.

Xdebug

Xdebug used to be a pain to set up with "traditional" Docker environments. With DDEV, it's a breeze. Just run ddev xdebug on and don't forget to tell your IDE to listen on the relevant port.

Redis, RabbitMQ, and Elasticsearch at your fingertips

But back to Shopware—Shopware 6, to be precise. Since it's built on Symfony, it doesn't really need much for a local setup: Apache or nginx with PHP-FPM and a database (MySQL or MariaDB). Once you get to real-world use, though, things get more complex quickly. Two Redis servers (for cache and sessions), a RabbitMQ instance for the message queue, Elasticsearch. This is where the DDEV add-ons come in. Just run ddev add-on get ddev/ddev-redis—and you're set. In my experience, there's basically no system component that doesn't have an add-on.

Hooks

Hooks exist for all kinds of things—for example, a post-import hook for the ddev import-db command. I use it to make the necessary database adjustments, such as rewriting the sales channel domains or switching the mailer to Mailpit (which is, of course, integrated into DDEV).

Inter-project communication

Did I say DDEV projects are isolated? Well, only if you want them to be. Otherwise, your app in one DDEV project can communicate with other projects—DDEV supports direct HTTP/S calls between projects. It's a great feature for developing and testing a Shopware app server, for example. I've also used it to build and test the migration from Shopware 5 to Shopware 6 across two projects.

Mirroring the production or staging environment

A shop's media files can run to tens of gigabytes—so why copy them over at all? Most of my projects use nginx-fpm, which makes an nginx reverse proxy the easy answer. Add a .ddev/nginx/media.conf file with the following contents:

location @mediaserver {
    resolver 1.1.1.1;
    proxy_pass https://www.example.com$request_uri;
    # Uncomment if the remote environment is behind HTTP basic auth:
    # proxy_set_header Authorization "Basic <base64-of-user:password>";
}

location ^~ /media/ {
    access_log off;
    expires max;
    try_files $uri @mediaserver;
}

location ^~ /thumbnail/ {
    access_log off;
    expires max;
    try_files $uri @mediaserver;
}

Then run ddev restart. This not only mirrors (and caches) the media files from the production or staging environment, but also lets you upload new media files to your local environment for testing.

Shopware tooling

shopware-cli is increasingly being developed into a one-stop tool for development, and of course I want to use it in my projects too. No problem—there's an add-on for that: ddev add-on get vanwittlaer/ddev-shopware-cli. The add-on also lets you reach the storefront and admin watcher URLs directly and, more importantly, over HTTPS.

Project lifecycle support

DDEV has the concept of "providers" that you can use to load any remote resource into your local environment. Many projects have a provider that lets you download and import a sanitized production database, with a command like ddev pull sanitized (this would be a customized command, so its actual name may vary). In theory, this also works in the push direction, although I have never come across a use case for it so far.

AI tooling

At the time of writing, I use Claude Code for my debugging and development work. To keep it isolated from my local environment, I run it inside the DDEV container—yes, there's an add-on for that: ddev add-on get vanwittlaer/ddev-claude-code. Pair it with Playwright (also in the DDEV container, via ddev add-on get codingsasi/ddev-playwright) and watch Claude do interactive frontend development.

How to get started

If you haven't worked with DDEV or Docker before, start with the DDEV installation guide.

For your first project, you may want to follow DDEV's quickstart guide for Shopware.

I prefer to keep the Shopware part of my projects in a subfolder, e.g. shopware/, separate from the infrastructure around it, such as the .ddev and .github folders. That way any developer, even one who has never used DDEV, can tell at a glance which parts are Shopware and which are not.

My Less than 5 Minutes Install guide includes a script that sets this up with a shopware/ subfolder.

If you prefer to do it manually, there are just four steps:

cd <your project directory>
ddev config --project-type=shopware6 --docroot=shopware/public --web-environment="APP_ENV=dev" \
        --web-working-dir=/var/www/html/shopware --composer-root=shopware
ddev start
ddev composer create-project shopware/production
# When it asks whether to include Docker configuration from recipes, answer `x`—
# DDEV takes care of that part.
ddev exec bin/console system:install --basic-setup --shop-locale=en-GB

You will end up with a working Shopware 6 installation; the admin credentials are admin / shopware.

Conclusions—how good a fit is DDEV for Shopware?

Whether DDEV is a good fit for you depends less on Shopware itself than on the kind of Shopware work you do.

What I take from discussions with others in the Shopware community is that we bring in (at least) three perspectives:

Shopware core development
Store plugin development
Client project development

Naturally, the requirements for a development environment and tooling differ for each. For a core developer, what matters most might be running the latest versions of every dependency. For a store plugin developer, it might be testing a plugin efficiently against every Shopware version and configuration out there. There are focused solutions for these requirements, such as devenv, Dockware, the Shopware-provided Docker setup, or the new shopware-cli features.

Client project development, however, is where I spend most of my working time, and there the Shopware version and the environment that mirrors the production setup are predefined and stable within a project. The day-to-day work is:

debugging (core, third-party plugins, custom code);
developing and testing new features (ERP integration, custom plugins, custom theme);
installing and testing third-party plugins;
implementing and testing Shopware and third-party plugin upgrades.

So what matters to me is an efficient setup for a given set of dependencies and versions, ease of use, integration with testing and dev tools (Xdebug, Claude Code, Playwright, the storefront and admin watchers), reliability, support (DDEV has a great Discord community), and—last but not least—not losing time when switching between client projects.

tl;dr: my answer to the question—how good a fit is DDEV for Shopware?—is a resounding yes.

rss

Introducing the Drupal AI Security Initiative: The First Six Weeks

Drupal's volunteer Security Team has protected millions of sites for more than 20 years and its process is world-class. Bandwidth among the security engineers has always been the limiting constraint. This spring that constraint met a new kind of pressure: AI-assisted analysis is finding latent vulnerabilities at an accelerating pace.

The Drupal AI Security Initiative adds funded security capacity in response. It is funded through Alpha-Omega's Security-Engineer-in-Residence (SEIR) program, coordinated by the Drupal Association, and works alongside the volunteer Security Team, which continues its normal process throughout.

This post introduces the initiative and reports on our first six weeks. The short version: the funded fractional team model is working and has already evolved our understanding of where we want to focus next.

What changed: the economics of discovery

Drupal's attack surface is what it has always been. What has changed is the cost of finding bugs. AI-assisted analysis makes discovery dramatically cheaper. AI can produce security issue reports at a volume and can discover exploit details at a speed that any volunteer effort struggles to absorb. Our advisory data shows the rate of discovery accelerating (our next post will work through what the data suggests in detail).

Meet the Drupal AI Security Initiative Team

The initiative builds on the lessons of the Drupal 8 Accelerate Initiative, which showed that throughput efficiency depends on funding the whole contribution workflow, not just one part of it.

The Drupal security team needs fixes, not just findings of potential issues. As fixes are developed, they are collaboratively reviewed. An engineer cannot mark their own fix complete. Funding one full-time engineer would likely produce findings faster than volunteers could review them, and they would queue. So we’re using the grant to fund a fractional team that covers the full path from discovery to merge on both the project and infrastructure side for Drupal:

Drew Webber (@mcdruid) is the Fixer. He applies AI-security expertise directly to Drupal's code: scanning, writing patches, building experimental tooling, and then submitting contribution-ready work across Drupal core and the contributed-project ecosystem.
Greg Knaddison (@greggles) and Michael Hess (@mlhess) are Reviewers: They triage submissions, review patches, advance issues, and provide the RTBC status a fixer cannot grant themselves. Both come from the existing Security Team, and the grant helps subsidize the work they would otherwise do on volunteer time.
Neil Drumm (@drumm) handles infrastructure, focusing on Drupal.org itself. The package distribution, build pipelines, and update mechanisms are a high-consequence, specialized surface on their own.
Tiffany Farriss (@farriss) and Tim Lehnen (@hestenet) provide program support and coordination for the Drupal Association.

Our current grant has two three-month phases: Clarity (understand the problem) and Attention (fix issues and harden the process).

Six weeks in: what we've done

We're using the funding and AI tooling to find, validate, triage, and resolve vulnerabilities faster than before, including proactively, across core, contrib, and our own infrastructure. In six weeks, the team has made contributions to more than 10 published advisories and CVEs and filed more than 30 issues. This work includes SA-CORE-2026-005, a critical PHP object-injection issue reachable via JSON:API that arrived as an external report and was coordinated to a fast release, alongside triage and remediation across dozens of findings and hundreds of inbound requests. The team also worked on rapid response/urgent issues off-hours; in one case, AI-assisted review helped find and fix a significant issue in Drupal.org code.

We're also building reusable tooling and automation prototypes that increase throughput and make our security archive searchable and actionable. That includes five skills and a set of opengrep static-analysis rules, each targeting a vulnerability class, and local, open-weight tooling that processes about 40,000 historical security-mailbox emails to assign metadata like CWE mapping and flag duplicates (keeping sensitive data local). One key project outcome will be delivery of working tools the Security Team can continue to use after the initiative ends.

Drupal’s grant is one of several parallel Alpha-Omega grants across open source ecosystems. Being part of this cohort has allowed us to compare notes and share tooling, successes and failures with other open source projects. So far we’ve collaborated most directly with Volker Dusch, who leads the equivalent effort at the PHP Foundation, and with colleagues at the Open Source Technology Improvement Fund (OSTIF), who shared their report-validator protocol for separating real findings from noise. That protocol feeds straight into our intake, and into the report standard we want to co-create next.

The counts are perhaps not the most interesting part. We've resolved more security issues (10) than the minimum number (8) our proposal had committed to over the entire six-month project. We had assumed the meat of the task would be finding and fixing vulnerabilities. It turns out that the more interesting challenge will be adapting Drupal's security process to the volume and nature of higher-quality-than-expected AI-generated and AI-assisted reports.

So far that adaptation has happened downstream, after an issue has been reported. Shepherding issues to a fix, filing CVEs, automating that filing, and automating the analysis of published advisories are important and help scale the response process. But it is all at the bottom of the funnel. The opportunity we would like to explore is higher up, at intake, where issues arrive.

We've started exploring what that might look like. In discussions with core maintainers, some design principles emerged: AI stays limited to a single triage activity per issue and no bot noise on every commit and merge request. Ideally, early intake tooling would pre-filter inbound security issue reports and run a gated check that confirms whether they include enough context and reproduction detail before they reach a human.

What’s next

The next six weeks will build on what is working and push the intake question in two directions. The first is triage. The volume of incoming security issues is expected to keep growing and AI-assisted triage of that queue is an area to explore. We are interested in looking at how modern tooling can sort and deduplicate incoming issues so human attention can be focused where it's actually needed.

The second is the report itself. A clear issue report helps the Security Team and maintainer community move faster; a vague or bloated one slows everyone down. We want to explore and define what a useful AI-generated or AI-assisted security report should contain and draft a working standard, co-created with the Security Team and maintainers. If you are a maintainer or security reporter and have examples of good (or bad) AI-generated reports, please share them in Drupal Slack #security-discussion.

Six weeks of supplemental funding has already made a couple things clear. The roles the Drupal ecosystem depends on (security work as well as release management) need a durable, community-owned funding model, not one-time support. And we need to keep talking and collaborating across ecosystems like this.

Thanks

Huge thank you to Alpha-Omega for the support, funding and for access to AI tooling from Anthropic that enabled several of the findings above; to the Linux Foundation; and to the Drupal Association for coordination. And of course, none of this works without the two decades of effort from Drupal’s amazing Security Team.

rss

Drupal Association blog: Introducing the Drupal AI Security Initiative: The First Six Weeks

Drupal's volunteer Security Team has protected millions of sites for more than 20 years and its process is world-class. Bandwidth among the security engineers has always been the limiting constraint. This spring that constraint met a new kind of pressure: AI-assisted analysis is finding latent vulnerabilities at an accelerating pace.

The Drupal AI Security Initiative adds funded security capacity in response. It is funded through Alpha-Omega's Security-Engineer-in-Residence (SEIR) program, coordinated by the Drupal Association, and works alongside the volunteer Security Team, which continues its normal process throughout.

This post introduces the initiative and reports on our first six weeks. The short version: the funded fractional team model is working and has already evolved our understanding of where we want to focus next.

What changed: the economics of discovery

Drupal's attack surface is what it has always been. What has changed is the cost of finding bugs. AI-assisted analysis makes discovery dramatically cheaper. AI can produce security issue reports at a volume and can discover exploit details at a speed that any volunteer effort struggles to absorb. Our advisory data shows the rate of discovery accelerating (our next post will work through what the data suggests in detail).

Meet the Drupal AI Security Initiative Team

The initiative builds on the lessons of the Drupal 8 Accelerate Initiative, which showed that throughput efficiency depends on funding the whole contribution workflow, not just one part of it.

The Drupal security team needs fixes, not just findings of potential issues. As fixes are developed, they are collaboratively reviewed. An engineer cannot mark their own fix complete. Funding one full-time engineer would likely produce findings faster than volunteers could review them, and they would queue. So we’re using the grant to fund a fractional team that covers the full path from discovery to merge on both the project and infrastructure side for Drupal:

Drew Weber (@mcdruid) is the Fixer. He applies AI-security expertise directly to Drupal's code: scanning, writing patches, building experimental tooling, and then submitting contribution-ready work across Drupal core and the contributed-project ecosystem.
Greg Knaddison (@greggles) and Michael Hess (@mlhess) are Reviewers: They triage submissions, review patches, advance issues, and provide the RTBC status a fixer cannot grant themselves. Both come from the existing Security Team, and the grant helps subsidize the work they would otherwise do on volunteer time.
Neil Drumm (@drumm) handles infrastructure, focusing on Drupal.org itself. The package distribution, build pipelines, and update mechanisms are a high-consequence, specialized surface on their own.
Tiffany Farriss (@farriss) and Tim Lehnen (@hestenet) provide program support and coordination for the Drupal Association.

Our current grant has two three-month phases: Clarity (understand the problem) and Attention (fix issues and harden the process).

Six weeks in: what we've done

We're using the funding and AI tooling to find, validate, triage, and resolve vulnerabilities faster than before, including proactively, across core, contrib, and our own infrastructure. In six weeks, the team has made contributions to more than 10 published advisories and CVEs and filed more than 30 issues. This work includes SA-CORE-2026-005, a critical PHP object-injection issue reachable via JSON:API that arrived as an external report and was coordinated to a fast release, alongside triage and remediation across dozens of findings and hundreds of inbound requests. The team also worked on rapid response/urgent issues off-hours; in one case, AI-assisted review helped find and fix a significant issue in Drupal.org code.

We're also building reusable tooling and automation prototypes that increase throughput and make our security archive searchable and actionable. That includes five Claude skills and a set of opengrep static-analysis rules, each targeting a vulnerability class, and local, open-weight tooling that processes about 40,000 historical security-mailbox emails to assign metadata like CWE mapping and flag duplicates (keeping sensitive data local). One key project outcome will be delivery of working tools the Security Team can continue to use after the initiative ends.

Drupal’s grant is one of several parallel Alpha-Omega grants across open source ecosystems. Being part of this cohort has allowed us to compare notes and share tooling, successes and failures with other open source projects. So far we’ve collaborated most directly with Volker Dusch, who leads the equivalent effort at the PHP Foundation, and with colleagues at the Open Source Technology Improvement Fund (OSTIF), who shared their report-validator protocol for separating real findings from noise. That protocol feeds straight into our intake, and into the report standard we want to co-create next.

The counts are perhaps not the most interesting part. We've resolved more security issues (10) than the minimum number (8) our proposal had committed to over the entire six-month project. We had assumed the meat of the task would be finding and fixing vulnerabilities. It turns out that the more interesting challenge will be adapting Drupal's security process to the volume and nature of higher-quality-than-expected AI-generated and AI-assisted reports.

So far that adaptation has happened downstream, after an issue has been reported. Shepherding issues to a fix, filing CVEs, automating that filing, and automating the analysis of published advisories are important and help scale the response process. But it is all at the bottom of the funnel. The opportunity we would like to explore is higher up, at intake, where issues arrive.

We've started exploring what that might look like. In discussions with core maintainers, some design principles emerged: AI stays limited to a single triage activity per issue and no bot noise on every commit and merge request. Ideally, early intake tooling would pre-filter inbound security issue reports and run a gated check that confirms whether they include enough context and reproduction detail before they reach a human.

What’s next

The next six weeks will build on what is working and push the intake question in two directions. The first is triage. The volume of incoming security issues is expected to keep growing and AI-assisted triage of that queue is an area to explore. We are interested in looking at how modern tooling can sort and deduplicate incoming issues so human attention can be focused where it's actually needed.

The second is the report itself. A clear issue report helps the Security Team and maintainer community move faster; a vague or bloated one slows everyone down. We want to explore and define what a useful AI-generated or AI-assisted security report should contain and draft a working standard, co-created with the Security Team and maintainers. If you are a maintainer or security reporter and have examples of good (or bad) AI-generated reports, please share them in Drupal Slack #security-discussion.

Six weeks of supplemental funding has already made a couple things clear. The roles the Drupal ecosystem depends on (security work as well as release management) need a durable, community-owned funding model, not one-time support. And we need to keep talking and collaborating across ecosystems like this.

Thanks

Huge thank you to Alpha-Omega for the support, funding and for access to AI tooling from Anthropic that enabled several of the findings above; to the Linux Foundation; and to the Drupal Association for coordination. And of course, none of this works without the two decades of effort from Drupal’s amazing Security Team.

rss

The Drop Times: Tiffany Farriss Proposes Cost Accounting and Usage-Based Enterprise Funding

Farriss says reserves are covering a gap in Drupal’s wider stewardship work, prompting proposals to expose programme costs and connect enterprise use with ongoing support. read more

rss

Dripyard Premium Drupal Themes: How Dripyard gave Tojio a fast foundation for Drupal CMS

When we started building Dripyard as a business, we had a clear objective: Drupal developers should be able to move fast without giving up the things that make it Drupal. Structured content, editorial control, accessibility, open-source ownership, and long-term maintainability should not be traded away just because a project has a tight timeline or limited budget.

rss

The Drop Times: TDT Town Hall Links Newsroom Changes With Drupal’s Wider Future

Community participation moves beyond story leads as The DropTimes prepares an Editorial Working Group for Drupal contributors. read more

rss

Why Drupal Contribution matters to you!

DrupalCon Rotterdam 2026 is going to be way more than just sessions and keynotes, it’s a chance to be part of what actually builds and improves Drupal.

Contribution Day is a part of DrupalCon, and in Rotterdam it will be on Thursday, 01 Oct. This is the heart of the event, where the global community comes together to make a real and concrete impact to the project.

If you’re planning your trip, we highly encourage you to stay for Thursday. It’s the most rewarding day of the conference. Whether you write code, improve documentation, help with UX, fix bugs, or support translations, there’s a place for every skill level.

And better still, you don’t need any prior contribution experience, just curiosity and willingness to get involved. You’ll be guided by experienced mentors, collaborate with many contributors from around the world, and leave with new connections, new skills and something meaningful you helped create.

If you've never contributed before, this is the perfect moment to start!

So, what are you waiting for?
Let’s do it!

Contribution Day in Rotterdam on 01 Oct.

rss

Outside AI - The State of Agent Experience in Drupal.

By Scott Falconer, Product Lead, Outside AI

Where Drupal really stands with AI agents, where it has a right to win, and what we need to do next.

AI agents can build with almost anything. That is both great news and a problem for Drupal.

A person can ask an agent to recommend a platform, rebuild an existing site, create a content model, configure permissions, or change a running system. The agent then has to decide whether Drupal is a good path, reach it, understand it, act on it, and verify the result.

When that experience fails, we usually do not get a bug report. The agent works around Drupal, produces something that only looks finished, or quietly chooses another stack.

That makes agent experience a growth problem for Drupal, not just a developer-experience problem.

Drupal does not need to be the fastest way to generate any page. Drupal should be the safest, clearest way to a governed, inspectable, long-lived site - and agents should be able to use it effectively.

By governed, we mean the controls that make a site safe to run and hand off - a real content model, scoped roles and permissions, review and audit, safe rollback - not just quick to generate.

This is the purpose of Outside AI, the workstream the Drupal AI Initiative launched: making Drupal legible, callable, safe, and verifiable for agents and builder tools operating from the outside.

The distinction from Inside AI, in shorthand:

Inside AI: a person uses Drupal, and Drupal uses AI to help.
Outside AI: a person uses an agent, and the agent uses Drupal.

These are different experiences, but they need substantially the same foundation: clear state, stable interfaces, scoped identity, governed actions, and reliable verification. Wherever possible, that foundation should be built once in Drupal and shared by both.

Our goal is not to make Drupal better for agents instead of people. It is to make Drupal's existing strengths explicit enough that both agents and people can safely use them. If we are successful we will make Drupal's strengths visible and attainable - improvements that hold no matter which agent, model, or tooling wins.

Where Drupal really is

Early measurements from the Drupal Agent Readiness Scorecard point to a tricky but useful conclusion: capability is becoming table stakes.

Our first-hour study drops a cold agent onto each platform with no prior setup and measures how fast and how reliably it can stand up a small but real structured, permissioned site. The bar: a content model, seeded content, a public page, a scoped editor role. Every milestone is confirmed by an independent HTTP probe, not the agent's own say-so. Agents cleared that bar on every platform we tested: Drupal CMS, bare Drupal core, WordPress, and a from-scratch Node app (each across multiple models and two agent families), plus single spot-check runs on Wagtail, Joomla, Strapi, and Payload.

The evidence is still early and deliberately narrow - and the scorecard is useful for direction, but "can an agent build with Drupal?" is no longer an open question.

The better questions: when should an agent choose Drupal, how far can it reliably get, and what is left after the agent is done?

Drupal has an advantage here. It was not designed for agents - but it was not luck, either.

For two decades, enterprise and community pressure forced Drupal to care about structured content, relationships, roles and permissions, editorial workflows, configuration management, APIs, and migration. Complex digital experiences demanded structure, governance, and safe ways to change things, so the community built them.

Those are exactly the things agents need: structured state they can inspect, explicit permissions they can reason about, actions with known boundaries, configuration they can hand off, and evidence that a change worked. The foundation was already here. AI is now revealing why it matters.

And agents do find it. In the study's Drupal runs, agents reached for native capabilities - content types, roles, permissions, Views, exported configuration - instead of bypassing Drupal with a static lookalike, and what they left behind was inspectable. That evidence is promising, but as Dries wrote about Drupal's role in agentic workflows, a head start is not a plan to win. What this post attempts to measure is where the head start is real, where it is not, and what we need to do to turn it into a win.

Drupal still makes agents work too hard to reach the advantage. Setup choices, authentication, module selection, stale assumptions, unclear action surfaces, and weak verification can consume the whole first session before Drupal's strengths become visible.

Agents do not reward us for architecture they never reach.

The advantage is made of decisions

Drupal core, contrib, and products like Drupal CMS are best understood not just as software, but as an accumulation of hard-fought decisions by many dedicated individuals: core is the architectural commitments (structured content, revisions, granular permissions), contrib the solved problems (search, forms, spam, SEO), and a product like Drupal CMS the curation - which of those a serious site actually needs, working together from day one. That accumulated judgment is the real inheritance, and the hard part to reproduce on any stack.

What makes those decisions unusually legible, inspectable, and reusable - without reading the code that enforces them - is that Drupal represents most of them as structured configuration: data with a schema, exportable to files, reviewable as a diff, and inspectable on a running site. Content types and fields, role grants, Views, editorial workflows - they all live there. That standard is the point: Drupal gives decisions a common, inspectable place to live. On a from-scratch build there is no such defined place - a decision may sit in code, a migration, an ad-hoc config file, or only in someone's head. On some headless CMSs, even the access rules are code. Drupal keeps an unusually large share of the decision surface legible as data.

That is what a human actually inherits from an agent-built Drupal site: decisions they did not know to ask for, in a form they can inspect and safely change. An agent building from scratch gives you exactly what it thought of. An agent building on Drupal CMS hands you the community's accumulated judgment - core's architecture, contrib's solved problems, the product's curation - as artifacts you can review, compare, export or change through the admin UI or by applying a recipe, without a developer touching code. When we verified agent builds, we did not take the agent's summary - we read the configuration. Decisions-as-data is what made that possible: legible, deployable between environments of the same site, composable across sites as recipes, and checkable by someone who was not in the room.

This is where Drupal's advantage can also become fragile - a decision can be structured and still be lost, bypassed, or stripped of its rationale:

The config/code boundary can be a failure point. Configuration declares a desired state that one line of code can silently bypass. The access-coverage probe (which requests a restricted resource through every serving path an anonymous user could reach) found exactly this shape: custom code called ->accessCheck(FALSE) on an entity query and then exposed the returned entities without a later entity-access check, bypassing the access filtering the site otherwise expected. A site's true behavior is the intersection of config and code, and verification that reads only one layer misses the other.
Configuration records what was decided, rarely why. It can carry labels, descriptions, and dependencies, but there is no first-class model for the rationale behind a decision or how future changes should treat it. The hard-fought decision arrives stripped of its reasoning.
Configuration does not defend the intent behind a valid change. It can defend structural validity and dependencies, but not the human judgment a change quietly discards. In the recipe-composition tests - where we combined recipes that touch the same settings - two recipes applied conflicting config actions to the same property and the later action won mechanically. In the intent experiments - where we recorded the reason behind a design decision in the site itself, then asked a fresh agent to make a conflicting change - agents read the stored rationale and then removed the very affordances it was meant to protect.

So "those decisions aren't lost" turns out to be an assumption, not a guarantee - in these tests, it did not hold on its own… but the answer is not to freeze the decisions: the agent acts for the user, and sometimes changing one is exactly right. In the intent experiments the rationale was in the site, and the agents even read it - it still never entered the change. Our bet is timing: move the reason to the moment - keep it attached to the work, and put it in front of the agent exactly when it is about to change what that reason protects. The agent may still make the change; sometimes it should, but it is a tradeoff the agent had the opportunity to evaluate with the right context at the right moment.

And the stakes are rarely one big decision. A long-lived site is changed by many actors over many years - people and agents, each change small on its own. No single lost decision reads as damage; the damage is the trajectory. Small silent losses compound, change after change, until the governed site someone carefully built has drifted into something nobody chose. The advantage accumulated one hard-fought decision at a time, and it erodes the same way - which is why the lever has to sit at the moment of change, the same granularity where the drift happens. The advantage is made of decisions, for as long as you can remember them.

Where Drupal has a right to win

The Playing to Win choice cascade rests on one premise: strategy is a choice.

A disposable landing page, a one-off prototype, or a deeply bespoke product where a CMS addresses only a small slice of the job may be better served by a different stack. Drupal does not need to win every prompt to win the work it is built for.

This is the practical consequence of the great CMS unbundling: AI commoditizes creation while raising the value of control - it lowers the cost of creation, not the cost of trust.

Drupal has a right to win when the result must remain understandable and operable after generation:

Content-rich sites with a real editorial model.
Sites with multiple roles, permissions, and approval boundaries.
Sites that must ensure high quality and accurate content.
Long-lived systems that teams of people and agents will change.
Rebuilds and migrations where the source site's decisions cannot simply be discarded.
Projects where configuration, deployment, auditability, and recovery matter.
Sites where "it looks done" is not the same as "it is safe to operationalize."

This territory is defined by the work, not the organization's size. A small nonprofit can need strong editorial governance. A large enterprise will often find a disposable microsite sufficient for the right use cases.

In the language of the cascade:

Winning aspiration: Drupal becomes the clearest, most trustworthy CMS choice for an external agent building a real, governed site.
Where we play: work where structure, governance, handoff, and long-term operability matter.
How we win: close enough of the first-session gap that Drupal gets considered, then prove the result is more inspectable, verifiable, and trustworthy.
Capabilities we need: start and connect, understand the site, act through governed interfaces, verify and recover, and rebuild or launch through a repeatable path.
How we measure it: fixed tasks, real running sites, retained failures and nulls, and independently checked outcomes.

How this gets more people to Drupal

Drupal's historical adoption barrier is not that it is powerful. It is that reaching the power has usually required someone who already knows Drupal.

A committed Drupal agency invests through that friction because it knows what is on the other side. A WordPress shop that occasionally considers Drupal, a system integrator with many platforms to choose from, or a lean in-house team may not.

AI can lower the expertise barrier - but only if the results can be trusted.

If an agent can absorb more of the repeatable setup and assembly, while experts review the consequential architecture, business, and governance decisions, then Drupal expertise moves up the value stack. Talented people spend their time on customer experience, editorial strategy, integrations, and the decisions that actually differentiate the site.

Prove that path and the agency pitch changes from:

We can build this after a substantial discovery and setup phase.

to:

We have already built a governed starting position. Here is the architecture, what we learned from the source site, which Drupal decisions we inherited, what we verified, and where expert judgment is still required.

That is a stronger way to enter a rebuild conversation - and it is how Drupal becomes a realistic choice for teams that do not already have deep Drupal expertise in-house.

It is still a strategic bet. We have not demonstrated that better agent experience produces Drupal adoption at scale, and we should not claim the market outcome before we have proven the mechanism. We would know the bet was wrong if agents kept bypassing Drupal's native capabilities even when they were easy to reach, if inspectable artifacts did not measurably cut a second team's time to change a site safely, or if entry friction never fell far enough for Drupal to enter consideration at all.

The first session should not require a laptop

Underneath the expertise barrier sits a second one: the environment. Local tooling for Drupal provides an excellent experience - DDEV can stand up a real site in minutes for someone who lives in a terminal. The same first-hour measurements ran on exactly that tooling, and even there, install weight - not capability - set the pace. And that is the expert path: it assumes a capable machine, a terminal, a container runtime, and the time to configure them. A growing share of first evaluations do not start there. They start on a phone, in a browser tab, or inside a chat window - often mediated by an agent that has no local machine at all.

No amount of polish can remove that local barrier. And to be clear, this is not a criticism of tools like DDEV - DDEV should remain the expert path. But if the only way to try Drupal is to install Drupal, we lose the people - and the agents - who were only willing to spend five curious minutes. We risk rejection before the first page is ever built.

That is why hosted try-and-build surfaces matter: places where someone who does not know or care about Drupal yet - or an agent acting on their behalf - can start a real site with nothing installed. Hosted trials, browser-based build environments, demo workflows, commercial platform starters, and one-click hosting paths each attack that floor from a different angle. And each has a natural graduation path: a trial becomes a real site, and a real site launches onto hosted platforms as it grows. The front door feeds the installed base.

This is also where the community structure of the Drupal AI initiative becomes its advantage. No single on-ramp will fit every user, and each provider brings its own vision, market, and opinions - a browser trial optimizes for the five-curious-minutes case, a demo workflow for build-something-real, a commercial platform for launch-and-scale. That plurality is a strength, on one condition: the Drupal underneath must be the same agent-ready Drupal everywhere - the same state introspection, the same governed actions, the same verification. Providers should compete on experience and opinion, not re-invent the substrate.

The standard: someone who has never heard of PHP or SQL - or an agent with no machine at all - can go from curiosity to a real, governed Drupal site in one session, and graduate that site to production hosting without starting over.

What we need to build

From here the essay turns into inside baseball: issue by issue, for the people working with Drupal every day. If that is not you, feel free to skim, or skip to the closing.

The Outside AI roadmap follows the journey an external agent has to complete - the same path Dries has sketched, from setup to connection, context, governed action, validation, recovery, and launch. These five stages assume Drupal is already in the running; getting there - an agent discovering Drupal, recognizing the task fits its territory, and reaching a starting surface before any Drupal site exists - is stage zero, and it is what the front door and self-description work above are for. In the below, we focus on what we should be able to say, with evidence, before calling it done. And wherever external tooling has to keep explaining the same Drupal quirk to an agent, that quirk is a roadmap item: the workaround is the requirements document.

1. Start and connect

An agent needs supported ways into Drupal and a scoped, auditable identity - and there is still a lot to decide in what that identity can be. An agent can act as a delegate, carrying a scoped slice of the authority of the person it works for. Or it can act as an independent, non-human account with grants of its own - a principal actor. These are two different models of what an agent is, with different strengths: delegation cannot exceed the person it acts for, which keeps the blast radius small and the audit trail human-shaped; an independent identity can carry work no single person's permissions cover, like scheduled maintenance or operations across many sites.

Drupal should not pick the winner. Products, hosts, and teams will choose differently - reasonably - and the same site may run both. From the substrate's side, the fork matters less than it looks: both models need the same structure - a grant that is scoped, an action that is attributed, a denial that is auditable. Build those once and either model, or both at once, can run on top.

The mechanics are arriving. The core CLI entry point (vendor/bin/dr) landed in Drupal 11.4. Work on the execution principal, OAuth behavior, and MCP scope enforcement continues across the initiative: the execution-principal plan, OAuth identity work in Simple OAuth, and scope handling in the MCP Server module. No single entry point serves every environment: dr is a local and server transport, while a remote agent needs authenticated HTTP or MCP. What has to stay constant is the contract - the same action, authorization, and receipt model, reachable through the right transport for each.

The standard: given an agent operating under a scoped grant - delegated from a person or issued to a non-human identity - when it attempts an allowed action, the action succeeds and is recorded against an execution principal that names both the initiator and the executor. When it attempts an action beyond that grant, it fails clearly, safely, and with an auditable reason.

2. Understand the running site

The agent should not have to guess what Drupal or the running site can tell it. We need supported, machine-readable inventory, site structure, API and schema fidelity, path ownership, available actions, and current constraints.

The standard: given a running Drupal site, when an agent requests site context, it can discover content types, fields, roles, permissions, workflows, path ownership, enabled extensions, available actions, and relevant constraints - without scraping the UI or guessing from routes.

3. Act through governed interfaces

Agents need typed inputs, predictable errors, least-privilege execution, approval boundaries, and results another system can inspect.

This fundamental is one Drupal's entity layer already demonstrates: authorization attaches to the operation, not the entry point. An editor does not write to the database - they work through forms their permissions allow, and when a change goes through the Entity API, the same permission and entity-access checks fire whether it arrived from the admin UI or the API. For agents, that is the right foundation: no separate "agent mode" to secure - a new caller walks through a new door and hits the same wall. It is not yet universal: some checks still live at the door, and the command line has historically carried implicit authority - which is exactly why the execution-principal work in stage one matters. Part of the roadmap is making the fundamental universal, not inventing it.

What is missing is declaration, not governance. Entity CRUD is well covered - JSON:API exposes entities as resources under the same policies. But the operations beyond CRUD - clear a cache, apply a recipe, run a migration, reindex search - are scattered across admin forms, Drush commands, and one-off endpoints, each with its own shape. An agent cannot reliably discover what operations exist, what they require, or what they return; efforts like the Tool API and tool declaration introspection are working toward that declared catalog. The requirement is the fundamental, not any one module: one action model, many doors - typed inputs, the same authorization, and a structured receipt from every transport. A receipt, though, is still a claim - judging it is the next stage's job.

The standard: given one declared site action, when an agent calls it through any supported action adapter - CLI, MCP, ECA, or Drupal's AI systems - its typed inputs, authorization, errors, and result receipts behave consistently. Where an operation is entity CRUD through JSON:API, the same identity and authorization policies apply.

4. Verify and recover

The agent's own summary should not be held as proof - we would never expect a human to be the ideal judge of their own work. What matters is what the site actually shows. That is not a new problem: Drupal has always worked on it, because Drupal was never just for managing content - it manages how a team works together. Work does not count until someone else - or a system-enforced guardrail - says it does: drafts, moderation states, revision history with rollback, a permission model where the author does not have to be the approver. An agent is the newest actor in that system: it proposes within its permissions, the workflow gates what counts as done, a different actor approves, and revisions makes it reversible.

That machinery is fundamental to Drupal for content. For code and configuration, teams already have a mature review lane too - it just lives outside Drupal, in version control. And Drupal is unusually well placed to use it: because configuration exports to files, a config change can ride the same discipline as code - a diff, a pull request, a reviewer, CI, a revert. That is decisions-as-data paying off; most platforms cannot put their settings in a code review at all. An agent that works like a developer - building locally, exporting configuration, committing - inherits all of it.

The live site is the harder case, and not just for agents: a person doing site-building on production creates the same risk. Teams manage it by deciding where each kind of change is allowed to happen. Content is edited live, because live content has mechanisms for review. Structure is built in a development copy and flows to production through configuration import - so a config change made directly on production is temporary, and the next deployment erases it; some teams block live config edits outright. Giving an agent the same working agreement needs nothing new: a role that edits content on production, a freer hand in a development copy, the config path in between.

Two things are new though, and as a result they are the roadmap. First, the working agreement has to be explicit. Teams usually write it down for people - onboarding docs, locked-down production, review - but with agents, every session can be somebody's first day on the site, so anything left as "on the job" knowledge repeatedly fails fast. The boundary has to be stated by the site, and feedback given when it is enforced; the explicitness a cold agent needs is the same explicitness that protects a new hire.

Second, speed and scale. Where a team produced a handful of reviewable changes a day, agents can produce thousands. Human review alone does not survive that volume. Independent, automated verification has to absorb it - machine checks covering the routine, so human attention lands on the judgment calls. AI observability can trace requests through standard logging and telemetry, but tracing a request is not the same as independently verifying a change or rolling it back; the checking itself has to become machinery.

Our work is to extend the team discipline Drupal already applies to content - draft, review, approve, revert - to every surface an agent can change, at a speed and scale no site team has faced before.

The standard: given a change the agent claims is complete, when an independent process inspects the site, it can confirm what changed, show which content, configuration, code, or workflow surface was touched, report whether verification passed, and provide a preview, rollback, or recovery path.

5. Rebuild, migrate, and launch

The same governed path has to support a real way onto Drupal and a real handoff toward production. That includes source audits and discovery, content and pattern mapping, Drupal-native architecture advice, redirects, Canvas and configuration integrity, parity evidence, editorial review, and an explicit boundary between structured Migrate API work and agent-led re-architecture.

Issues such as Canvas configuration data integrity and reconciling updates to already-imported default content are part of this path even though they do not carry an "AI" label.

The standard: given a real source site, when an agent proposes or builds a Drupal replacement, the handoff includes source-site findings, mapped content and patterns, Drupal-native architecture, parity evidence, unresolved gaps, and a clear line where human judgment is required before launch.

Measurement is the spine across all five. The Drupal Agent Readiness Scorecard exists to tell us whether Drupal improved while the workflow held steady - separately from the normal improvement of the models themselves.

Rotterdam should prove direction, not victory

The Rotterdam plan - the proof we are aiming to have ready by DrupalCon Rotterdam - is intentionally narrow: one real rebuild of an existing non-Drupal site into Drupal CMS. The question it answers is precise: can an outside operator turn a real non-Drupal site into a defensible Drupal starting position, with independently reviewable evidence?

The operator should be outside the Drupal CMS team.
The source site should contain enough structural complexity to require judgment.
The result should include a source audit, a governed Drupal build, recorded decisions, independent verification, and explicit gaps.
A Drupal expert should review it against a predeclared rubric - architecture, permissions, content integrity, editorial usability, maintainability, verification evidence, and known gaps.
The final question should be binary: would that expert stake their name on this as a sound starting position for a senior team?

The bar we’re setting is not, are we "ready to launch.", it is "is this defensible enough to continue?"

One successful build would demonstrate a viable path in that case. A second site with a second operator would begin to test repeatability. Neither would prove that the market has moved - and we should not claim otherwise.

The question then is what remains after the agent is done. A clear test is: give the finished build to a fresh person or agent with none of the original context, and ask them to make a consequential change safely - add an editorial role, alter a workflow without weakening access, explain why the architecture is what it is, recover from a deliberately broken change - while we measure time-to-understand, mistakes, expert intervention, and whether the site's own state carried the reasoning. That tests "decisions as data" far more directly than a second build.

A head start is not a win

Drupal already has much of what builders need for serious sites. Again, that is the good news.

But the bad news is that potential has little value if agents reject Drupal before reaching it.

We should be careful not to declare victory because Drupal has structured content, permissions, workflows, and configuration management - The work that remains is to turn those properties into a clear, measurable advantage: make Drupal easy enough to choose, explicit enough to understand, safe enough to change, and verifiable enough to trust.

Outside AI needs real workflows more than speculative feature lists. If you are using an external agent to build with Drupal, calling Drupal from another system, or encountering friction anywhere from setup through launch, bring us the real task.

A use case, failed run, repeated workaround, missing capability, or existing issue is enough; you do not need to arrive with a solution or even know where the work belongs. Add it to the Outside AI meta issue or bring it to the #ai-initiative channel in Drupal Slack. We will help reproduce it, map it to the agent journey, connect it with the right maintainers and implementation work, and determine whether it belongs in the scorecard.

If you maintain a project agents need to use, tell us what they repeatedly misunderstand or work around. Those workarounds are requirements documents.

Drupal's earned advantage gives us the right to play. What we build, and what we prove next, determines whether we win.

Evidence note: the measurements described here are early and deliberately narrow; several are exploratory rather than claim-grade. The scorecard work publishes fixed tasks, retained failures and nulls, explicit evidence boundaries, and paired pre/post results before claiming that Drupal itself improved.

rss

Inside AI is building what our partners asked for

By Christoph Breidert, Product Lead, Inside AI

A year into the Drupal AI Initiative, AI inside of Drupal has a clear goal for the months ahead. At DrupalCon Rotterdam at the end of September, we want to show a single Drupal site where AI Search, an AI chatbot, AI content review, and AI translation all work together on real, multilingual content, with observability and security running underneath. The idea is simple: rather than describe these features one by one, let people see them working together on one site.

This post is about how we plan to get there, what our partners told us to build, and the team we are putting together to build it.

Two streams, working side by side

If you are new to the split, the Drupal AI Initiative now runs in two streams. “Inside AI” is AI inside Drupal, for the people using it. “Outside AI” is AI outside Drupal, acting on it through external agents. The simplest way to hold them apart is this: with Inside AI a person uses Drupal and Drupal uses AI to help; with Outside AI a person uses an agent and the agent uses Drupal. We introduced the two streams in an earlier post, and the distributed leadership structure behind them shortly after. This post is about the AI functionality we are building inside Drupal. Outside AI, led by Scott Falconer, will get its own update, and Dries Buytaert has already written about why that stream matters.

We asked the Drupal AI Partners what to build

Here is something we have not shared publicly before. We asked our Drupal AI Partners, the organizations that fund and staff this initiative, which features they most want us to build inside Drupal. The results were clear.

AI search
AI content reviews
AI translation
Chat-driven content editing
AI-powered bulk content updates

Search was the standout. The next four clustered closely together, which tells us there is no single second priority so much as a group of capabilities people want in roughly equal measure. This shapes what we prioritize. Drupal AI is funded by our partners, therefore we build what they asked for, in the order they asked for it, against the public 2026 roadmap already in flight.

Two of these deserve a word. We have already been building chat-driven content editing in Canvas AI, and that work continues. Bulk content updates we are not tackling as a standalone feature yet, but it belongs naturally with content review. Once you can review a large body of content with AI, the obvious next step is letting AI help you act on what it found, so for now it lives within the content review work rather than as a separate capability.

Shippable features, proven in the demo

What matters most to anyone building with Drupal AI is shippable features. The demo is how we prove they are ready, by showing each one working on a real site rather than only in isolation. That is why the demo is the most important thing we are building this year: it turns a list of capabilities into features our partners can put in front of their own clients. The two are not separate efforts. The recipes and configurations that make a feature work in the demo are largely the same ones that make it adoptable on a real project, so building the demo is how shippability becomes visible.

This is also why we are putting real effort into engaging, realistic demo content, a site with enough depth that the AI has something meaningful to search, review, and translate. The goal is for anyone to try it out with a single click and see for themselves how a fully AI-powered CMS behaves.

AI Search in Drupal

Search is a natural place to begin, since it was the most requested feature. Picture a search that returns an AI-generated summary, the sources behind it, and the ranked results below, the way modern web search now works, but over your own site's content.

Search sits alongside the other capabilities, and each carries real weight in the demo. A chatbot drawing on the same retrieval foundation. Content review that scores a page against criteria like brand, legal, and reading level and suggests concrete fixes. Translation that moves content across languages with quality worth presenting. And underneath it all, the observability and security layers that make the experience credible for production rather than a set of features that only hold up one at a time.

Being realistic about the work that remains

This is worth setting out clearly, because it changes what leading one of these areas involves. Most of these features already work today. The gap is usually not the core capability. The gap is that we have not yet shipped the recipes and demo configurations that make them work end to end, with results we are happy to show, on one realistic site.

This is the classic "it works" problem. Yes, it works in isolation. Making it work completely, convincingly, and repeatedly in a demo is a different kind of effort. So the leadership across these areas comes in two shapes. Some of it is making it work in the demo, building the recipe, wiring it to real content, and tuning prompts and results until the output is good enough to present. Some of it is net-new implementation, where the capability still needs to be built or substantially extended. Both are genuine leadership, and we are clear with anyone stepping in about which kind of work their area involves.

The team that gets us there

None of this happens without the hard work of our contributors. To strengthen our governance model, we have chosen to place responsibility for each area in the hands of a dedicated lead, someone who owns its direction and keeps a clear, public backlog for contributors to work from. The sprints themselves do not change. What changes is that every area now has a clear owner, and together these leads form the Inside AI leadership team.

Workflow Drupal AI Leads

Here is where each Inside AI area stands today.

Area	What the lead work involves	Lead and status
Demo	Building the installation, recipes, and content so every feature works together	Aidan Foster
AI Search	Mostly making it work in the demo, plus the search results experience	Abhisek Mazumdar and Laurens Van Damme
AI Content Review	Mostly net-new implementation	Open
AI Translation	Mostly making it work in the demo	Sven Decabooter and Valery Lourie
AI Chatbot	Mixed, demo configuration and some surface implementation	Open
Observability	A demo backend over the telemetry export	Open
Security and guardrails	Packaging guardrails and usage metrics into the demo	Open
Canvas AI	Ownership first, then scope	Akhil Babu
AI Context	Context management that feeds reliable site information to every AI feature	Kristen Pol

Two things are worth making explicit, because they shape whether you picture yourself in that table.

First, a name beside an area does not mean you cannot join this focus area. The opposite is true. We are looking for strong teams rather than single owners, so contributing to an area that already has a lead is as real an opportunity as taking on one that is open.

Second, there is no formal application process. Becoming a lead happens through the work itself. A lead prepares issues and keeps the backlog in good shape. Our delivery managers, Arian Raeesi and Vidit Anjaria, plan those issues into the sprints. Some go through joint grooming with the technical leads, Marcus Johansson and Artem Dmitriiev, to check they fit the architecture, and I stay involved as product lead to keep them aligned with the overall product direction.

If one of these areas interests you, reach out in the #ai-initiative channel on Drupal Slack, or to any of us directly, and begin. Taking on that responsibility is what makes you a lead, and it is how you join the Inside AI leadership team.

Come and build it with us

This is where AI inside Drupal stands today. We know what our partners want, because we asked. We know where we want to show it working, at Rotterdam, on one site. And we know the only way to get there is together, with a team that owns each part of it.

If you have read this far, there is a good chance one of these areas already appeals to you. Come and say so in the #ai-initiative channel on Drupal Slack, or explore becoming a Drupal AI Partner. The demo will be better with your help, and so will Drupal.

youtube

Dries Buytaert talks about the value of experimenting with AI

Dries Buytaert, project lead for Drupal, talks about the value of experimenting with AI through his Drupal Digests project, contributing to Drupal core issues, and more. read more

rss

How Drupal Has Protected Millions of Sites

The Drupal project runs one of the most disciplined coordinated-disclosure programs in open source, and it has done so through volunteer effort for more than two decades. Millions of sites, many operated by governments, universities, and enterprises, depend on it.

This post is the first in a series stemming from the Drupal AI Security Initiative. Before I dive into how it's organized and what we've found, I wanted to share a post about how Drupal Security Team already works, because the initiative is built to supplement that foundation, not to repair or replace it. Note: this post assumes you are familiar with coordinated disclosure, CVEs, and severity scoring in general and focuses on what Drupal specifically does.

Coordinated disclosure, on a fixed cadence

Reports arrive in a private queue. A Security Team member takes triage duty on a two-week rotation, confirming whether a report is a real, in-scope vulnerability. Once validated, the affected project's maintainer and the original reporter collaborate in the confidential issue where the fix is written, reviewed, and scheduled. All of this stays out of public view until the fix and security advisory are ready on a release day.

Drupal has a predictable release cadence: advisories publish on Wednesdays, with a Public Service Announcement the Monday before on the very rare occasion a highly critical release warrants advance warning.

Scoring and identifiers

Every advisory carries a risk score using a system rating each issue 0–25 across six factors (access complexity, privilege required, confidentiality and integrity impact, exploit availability, and target distribution) mapped to labels from Not Critical to Highly Critical. Drupal's risk system was developed based on the NIST Common Misuse Scoring System. The project is now considering moving to CVSS, a more widely adopted standard. Drupal is also a CVE Numbering Authority, so it assigns its own CVEs: a level of formality most community projects don't reach. Summary data about the security track record is public with full details available as a series of posts or a JSON API with data going back to 2006.

What’s public and what stays private

The line between disclosure and discretion is drawn sharply. After release, advisories include all necessary details: affected project, severity, vulnerability type, affected versions, remediation, any possible mitigating factors, and CVE. Before release, the member disclosure policy permits a trusted insider to share only what is already public plus the bare numeric severity, never the affected project, the nature of the bug, or how to mitigate it. Members can't even let an employer market the fact that an employee had early knowledge.

Protection at the network layer

To protect site owners in the window between disclosure and patching, the Security Team and the Drupal Association offer Drupal Steward. Drupal Steward is a web application firewall (WAF) where Drupal Association engineers work with the engineers who wrote the security advisory to develop a rule that blocks the exploit at the request layer that goes live the moment the advisory does. This provides a virtual patch for highly critical, mass-exploitable bugs, but is not a replacement for patching.

The coverage model and its scope

Scope is defined just as clearly. Advisories cover Drupal core, plus contributed projects hosted on Drupal.org that opt into coverage (marked with a shield icon), and only for stable releases. Some things are deliberately out of scope: external libraries a module depends on and bugs requiring high-level administrative permissions. When a maintainer is unreachable, the team can mark a project unsupported.

By design the team is largely reactive: it responds to reports rather than continuously auditing Drupal core and tens of thousands of contributed modules. Members are asked for a few hours a month, a valuable contribution from highly skilled and in-demand individuals. The process is solid, but bandwidth has always been the primary bottleneck.

Scaling our response in the AI Era

Addressing that bottleneck is the whole point of this effort. It's also the founding premise of Alpha-Omega's Security Engineers in Residence program funding: that threat volume and pace are outrunning what volunteer hours can cover. AI has lowered the cost of finding and exploiting vulnerabilities. It enables high-volume report generation and can infer what a quietly worded commit was really fixing. A security process built around scarce attention and a modest head start now faces adversaries operating at machine speed.

Drupal’s security workflows are mature, documented, and trusted. The challenge now is scaling Drupal’s defensive bandwidth and throughput to match that offensive speed. That's what the Drupal AI Security Initiative adds, and it's the subject of the next post in this series.

If you'd like to help in the meantime, the most valuable things any contributor can do are what the team has always relied on: write secure code, report issues responsibly, and, if you have a track record in the community, consider joining the Security Team.

Tiffany Farriss authored this post and is responsible for its content. Members of the Drupal AI Security Initiative (Greg Knaddison, Tim Lehnen, and Drew Webber) and George DeMet contributed context, editing, and review. AI tools (Claude by Anthropic and Gemini by Google) assisted with research, organization, and editing. All facts were verified by humans against primary sources.

rss

Serving the Drupal project, and evolving how we fund it

I've stepped into the role of interim CEO of the Drupal Association for a limited period, expected to last six to twelve months. My job in that time is to help put the Association on a durable footing. As I undertake that task, I want to start by being direct about where we are and where I'd like to see us go next.

The Drupal stewardship the Association provides costs more every year. That includes running Drupal.org, providing the project infrastructure and putting on DrupalCon. For a long time our events paid for most of it. That stopped being enough several years ago, and we have been covering the gap from our reserves. That is not sustainable, and pretending otherwise would not serve anyone. The Drupal Association releases its financials and 990s every year. (The 2025 audit is expected to be released by the board soon.) An analysis of even just the last few years of publicly available financials tells this story plainly.

And that is only the part we actually fund. Some of the most critical work of all, like responding to security issues and managing releases, still runs entirely on donated volunteer time or corporate underwriting rather than from an ongoing operating budget.

The answer is not to ask more of the volunteers, agencies and contributors who have carried this project for two decades. The community’s generosity is the heart of Drupal, and it always will be. The real challenge is that the large enterprises and governments that rely on Drupal every day have never had a clear way to understand or pay for the maintenance and services they use. So the cost has been shouldered by those most engaged in the community and, increasingly, the DA’s cash reserves instead.

Changing that is my priority. Over the coming months I'll be focused on three things.

First, understanding the true cost of the work. I'm modernizing our financial reporting so we can see the full cost of every program and event, including the staff time each one requires, which our current reports don't fully communicate. That will give the board, the staff and the community real transparency into where money goes, which programs deliver the most value and where we’re choosing to invest.

Second, funding each kind of work in the way that fits it. Not every program should look the same. Our utility and infrastructure services can move toward a usage-based model for the enterprises that depend on them. Our ecosystem advocacy needs focused support, because it strengthens Drupal and the Makers who build it. Our digital-public-good work, the parts that belong to everyone, can be sustained by philanthropy, contribution and as part of the utility and advocacy work. The aim is a regenerative model, where what these utility and advocacy services reinvest into all the ongoing costs that Drupal has as a thriving digital public good, a cycle that can sustain itself rather than a subsidy running down without constant new funding sources.

Third, collaborating with open source colleagues. These challenges aren't ours alone. I want to explore a co-creating shared standard for sustainable use certification with other open source projects facing the same challenges. Working together as a broad open source ecosystem, we can make supporting the open source software that organizations depend on an easy, standardized, normal and expected cost of doing business rather than ad hoc, voluntary and charitable, as it is now.

This matters beyond our own budget. Stewarded open source is no longer just a code repository. It is critical digital infrastructure. To keep it healthy, all of open source needs reliable ongoing funding from operating budgets as a standard line item. That is how we turn an extractive pattern into a regenerative one, and how Drupal and the community stays strong, open and community-governed for everyone who builds on it. Funding our ongoing work properly is how we protect that.

Those are my thoughts. I’m looking forward to hearing yours. Over the next several weeks I’ll be inviting all parts of the Drupal ecosystem to share what you think, and I'll reflect back what I hear as we go. I intend to earn your trust through what we do over the next several months. Thank you for building this project, and for caring enough to hold the Association to a high standard.

One final note of transparency on my own situation: I own Palantir.net, a Drupal Certified Partner, and I take that conflict seriously. As of July 20, I have stepped back from day-to-day operations there. To prevent any interference and guarantee strictly arm’s-length dealings, we have built a robust and legally-vetted conflict-of-interest framework directly into my interim contract.

rss

Three Real-World AI Cases Coming to the Enterprise AI Summit

It feels like the right moment to share something I have been looking forward to announcing. The holidays are just beginning, and the Enterprise AI Summit (28 September, Rotterdam) is coming together.

We have been reviewing sessions over the past weeks, and three cases in particular stood out, each solving real problems for real organisations.

Here is a first look at three of the sessions we are excited to share.

THE EUROPEAN PERSONNEL SELECTION OFFICE: CANDIDATE SUPPORT IN 24 LANGUAGES

EPSO is the body responsible for selecting staff across EU institutions, and every year, thousands of candidates ask questions in all 24 official EU languages. With a small team, an enormous volume of work, and zero tolerance for wrong answers, EPSO needed a solution that could keep up.

Antonella Picarella will show us what that solution looks like: an AI-powered support tool on Drupal that now handles 93% of incoming questions automatically, across all 24 languages, with no hallucinations detected on manual checking.

Read more about this session: https://summit.enterprisedrupal.eu/epso.html

THE AMERICAN DIABETES ASSOCIATION: FROM PILOT TO PRODUCTION

When the content is about people's health, accuracy is not optional, and neither is speed.

Hemant Gupta will walk through how the American Diabetes Association moved AI from pilot to daily use across their Drupal platform: editorial assistance, bulk alt text generation, in-editor AI tools, and Word-to-Drupal content pipelines. Editorial teams are using it, the results are documented, and so is the process that got them there.

Read more about this session: https://summit.enterprisedrupal.eu/ada.html

WORLD CANCER DAY: MODERATION AT SCALE, WITH A HUMAN HEART

On World Cancer Day, hundreds of thousands of personal cancer stories are shared in a single day, reaching 500,000 requests per hour with just a small team behind it.

Charles Andrew Revkin and Diego Costa will share how the World Cancer Day team uses Drupal and AI to scale a deeply personal campaign without losing the human touch.

Read more about this session: https://summit.enterprisedrupal.eu/wcd.html

JOIN US ON 28 SEPTEMBER IN ROTTERDAM

The full schedule is taking shape. If you want to see what AI actually looks like when it is deployed, trusted, and working, this is where you will find it.

More information and tickets: https://summit.enterprisedrupal.eu

youtube

Drupal AI Learners Club: What Did the AI Just Do? Turning Coding Sessions into Learning Trails

You let the AI write the code — but do you understand what it built, and why? Join us for a show-and-tell with Owen Bush (Senior Developer at Lullabot), creator of Decodie — an AI learning companion that turns every coding session into a structured learning trail. As you code with your agent of choice (Claude Code, Cursor, Gemini CLI, and 70+ others), Decodie captures the why behind each decision — patterns used, trade-offs made, alternatives passed over — so you can actually learn from what the AI wrote. Owen will demo the full ecosystem: agent skills, a VSCode extension, a local web UI with lessons and progress tracking, plus a GitHub Action and bot for automatic PR analysis. Come for the demo, stay for the Q&A. read more

rss

Migrating issues from security.drupal.org to git.drupalcode.org

All security issues have been migrated from the older security.drupal.org site to our GitLab instance at git.drupalcode.org. This is the latest in a series of steps to improve Drupal’s coordinated vulnerability disclosure tools. We hope this will help in a few ways:

Merge requests for security issues will get automated testing to increase the quality of the releases. (Previously, tests for core security issues had to be triggered manually, and contrib testing was not available.)
GitLab has more automation to help with advisory creation, reducing manual work.
Powerful features like labels, commenting, and thread reviews on merge requests are now possible for security issues as well.

Here are some of the key steps we took:

We started by evaluating a few solutions. We decided to use the GitLab instance on drupalcode.org.
We planned how to remap and improve the current features from security.drupal.org and added some labels and automation to private issues on drupalcode.org.
We made new security issue reporting default to git.drupalcode.org for several months. This helped us could gain confidence in the system, fix bugs, and make improvements.
While that happened, Neil Drumm worked to create the migration process.
The migration finally ran from July 9th to July 12th.

This work is possible because of support from the Drupal Association and is very appreciated.

We suppressed most emails during the migration, but a small number of people did get extra notification emails about issues, including old issues. We apologize for any resulting confusion.

How do I use GitLab to submit and manage security issues?

As before, security reports should be submitted by clicking the “Report a security vulnerability” link on the project page. If a project has already migrated public issues to git.drupalcode.org, you may also mark an issue confidential as you open it. The Security Team triages confidential issues for all covered projects.

For more information about how Drupal.org’s GitLab instance works, read our documentation.

You can read about the Security Team’s process in general. There is also a page dedicated to managing security issues on git.drupalcode.org. Those pages likely need updates, so please report any documentation issues in the Security Team Queue..

What do you think?

Let us know your thoughts. If you have feedback about how to further improve the Security Team process, you can file them in the Security Team Queue. If you have issues to report about the GitLab tooling itself on git.drupalcode.org, you can file them in the Drupal.org queue.

The old site does a redirect to the new location for issues and members of the Security Team can get content out of it if anyone notices items missing from the migration.

Thanks to longwave, hestenet, dokumori, drumm, and xjm for help in writing this post.

youtube

Drupal Association Community Election 2026: Community forum with the candidates

This is a recording of our July 15th community forum with the candidates for the 2026 Community Election for one of the two Director-at-Large positions that hold alternating 2 year terms. This is being supported by a 24 hour asynchronous Slack Q&A with candidates starting on July 16th in Drupal Slack #drupal-association. drupal.org/join-slack to join read more

youtube

Drupal AI Learners Club — How to Enhance Drupal Development with AI with Mateu Aguiló Bosch (e0ipso)

A deeper-dive session from Mateu Aguiló Bosch (e0ipso) on getting your AI coding harness — Claude, Codex, or whatever you're running — to adapt to your own codebase instead of working against it. Mateu will get into improving context management and building long-term project memory, so your tools hold onto what actually matters across a project rather than starting cold every session. Topics to be covered include: adapting your AI harness to an existing codebase, context management strategies, and long-term project memory. RSVP for upcoming Drupal AI Learners Club sessions on Luma: https://luma.com/drupal-ai read more

youtube

Drupal AI Learners Club: Know Before You Owe

youtube

How Southwark Council uses AI and open source software to transform PDF Publishing in Drupal

Hear directly from the team behind an award-winning AI solution built for local government. What does genuinely useful AI in public services look like? Not a concept, not a pilot, but a working solution that saves hours of manual work, improves accessibility, and puts better content in front of citizens faster. Southwark Council's AI-powered PDF importer for Drupal is exactly that, and it won the prestigious Digital Leaders AI Impact Award 2026. Host: James Hall, Product Lead for Websites at Everyone TV Guest: Angie Forson, Web and Digital Program Lead at Southwark Council Download LocalGov Publications Importer: https://www.drupal.org/project/localgov_publications_importer Learn more about Drupal AI: https://www.drupal.org/ai More about the problem solved Manual PDF conversion has long been one of the most time-consuming tasks facing council web teams. Converting a single document can take hours. Multiply that across thousands of PDFs and the burden becomes significant, both in staff time and in the delay it creates before citizens can access accurate, accessible information. The Southwark team, working with their partners at Chicken, built an AI-powered importer for the LocalGov Drupal Publication Module that reduces that process to minutes, often under one minute. How it works Each PDF passes through a three-step pipeline: Extract - a PDF parser pulls the raw content from the document Transform - AI converts it to properly structured, accessible HTML with logical pagination Save - clean HTML pages are ready to review and publish directly in Drupal The result is an HTML representation of the PDF content, saved into a Drupal Publication and ready for review before going live. Every import is logged, so errors can be identified and resolved efficiently. The module uses a plugin architecture, meaning each step in the pipeline can be swapped out. Councils can use different extractors, AI models, or output to different Drupal content types, making the solution adaptable to a wide range of content and operational requirements. Built the right way The team delivered this project with an agile, user-centred approach, continuously refining requirements to ensure the tool meets real user needs rather than simply ticking a technical specification. "This project is a great example of AI working alongside and empowering content creators, and Drupal as a platform supports this really well." - Farez Rahman, Drupal Developer "I'm excited about the impact this product will have, not just for our users, but also in transforming how we design, build, and create content internally. We're shaping a future where services start with HTML-first thinking." - Evelyn Francourt, User Experience Lead Why this matters beyond Southwark Local government teams across the country face the same challenge. This solution, built on open source Drupal and the LocalGov Drupal ecosystem, is designed to be shared, not kept in one place. If your organisation publishes PDFs, manages large volumes of content, or is exploring where AI can deliver practical value without unnecessary complexity, this webinar is for you. read more

youtube

Live Vibing: Let's port webchick's D7 blog to Drupal CMS with Fable LOL NOPE (Round 2 😅)

youtube

Live Vibing: Using Claude Dynamic Workflows to upgrade webchick's old, crusty D7 blog (Part 1)

In this Drupal AI Learners Club session, Angie "webchick" Byron attempts a live, no-safety-net migration of her ancient Drupal 7 personal site (webchick.net) to Drupal CMS using Claude Code — with a roomful of community experts watching and heckling in the best possible way.What starts as a planning exercise turns into a real-world tour of agentic coding: the good, the funny, and the "even when you think you've sorted out access, you haven't." Part 2 here: https://www.youtube.com/watch?v=zoD0YuEy-ks 0:00 Welcome & intros (todo) 27:12 Inheriting a crusty D7 site: why you plan first 27:50 Grounding Claude in current Drupal facts (not training data) 28:41 Surprise: core migrate modules deprecated/removed in D12 30:04 Context windows + clearing context after planning 31:34 Picking a path: Drupal CMS rebuild vs big-bang vs hybrid 34:04 The plan: fresh Drupal CMS install + targeted D7 migrations 36:04 Rewind, fork, and branch: managing context (and cost) 38:04 Pro tip: log in to use your subscription instead of API tokens 39:34 Reading the plan: migration state file, tiered models, gates 42:04 Claude doesn't know its own new feature (dynamic workflows) 45:04 What dynamic workflows actually are + fixing the plan 46:34 Time to YOLO the plan: auto mode + guardrails 47:34 The "$1,000?!" jump scare (it was $1.00) 49:04 Security check-in with Marlene: prompt injection & separation 52:04 Local stack decisions: DDEV, Docker, Composer 56:04 Handing off SSH creds safely (never paste secrets in chat) 58:34 Playwright & browser automation: impersonating yourself online 1:02:04 Opting out of training on your data + privacy settings 1:05:04 What makes a good agent skill + AI Best Practices 1:09:04 Docker won't cooperate: the privileged port battle 1:14:04 Memories vs skills: fixing it for you vs everybody 1:16:04 Getting SSH working: keys, the "!" escape, ssh-agent 1:25:04 Handing off to a second agent via handoff.md 1:32:04 Wrapping up: what we learned + Part 2 teaser Highlights: Why planning mode matters before you let an agent YOLO a big job Grounding the agent in current Drupal facts vs. its training cutoff — core's migrate modules are deprecated/removed in D12 and NOT moving to contrib The strategic case for landing on Drupal 11 + Drupal CMS now, while D7 source plugins still exist Claude not knowing about its own newly-shipped dynamic workflows feature until pointed at the docs — verify everything! Context management: rewind, fork, branch, and clearing context to stay lean (and cheap) The "$1,000?!" jump scare (spoiler: it was $1.00 — read your decimal points, friends) Playwright browser automation, and why impersonating yourself on drupal.org to auto-post is probably against the rules Marlene's security perspective on prompt injection and keeping research/coding agents separated Why you should NEVER paste private keys or SSH creds into chat — and how to opt out of training on your data A real, unscripted battle with SSH agent / authorized_keys that we did NOT fully solve on camera Agent handoffs: writing a handoff.md to pass state to a second agent Why webchick built AI Best Practices — the "Drupal CMS of agent skills" A Part 2 is planned to pick up where we left off (once that SSH gremlin is sorted). Thanks to Dieter, Marlene, Carlos, Ali, and everyone who hung around late into the night. read more

Powered By Combinary

youtube

Drupal AI Learners Club Livestream

Live streaming sessions from https://luma.com/drupal-ai read more

youtube

Southwark Case Study

This example demonstrates how AI, built into Drupal, is helping people work smarter, connect communities, and communicate with clarity. Find out more about Drupal AI here: https://new.drupal.org/ai read more

youtube

Basel Stadt Case Study

This example demonstrates how AI, built into Drupal, is helping people work smarter, connect communities, and communicate with clarity. Find out more about Drupal AI here: https://new.drupal.org/ai read more

youtube

DB Schenker

This example demonstrates how AI, built into Drupal, is helping people work smarter, connect communities, and communicate with clarity. Find out more about Drupal AI here: https://new.drupal.org/ai read more

youtube

World Cancer Day AI assisted moderation of user generated content using Drupal

For World Cancer Day 2026, the Union for International Cancer Control partnered with 1xINTERNET, who developed and deployed AI-powered moderation to review thousands of personal cancer stories submitted from around the world. This example demonstrates how AI, built into Drupal, is helping people work smarter, connect communities, and communicate with clarity. Find out more about Drupal AI here: https://new.drupal.org/ai read more

youtube

AI Learners Club: Getting Ready to do Cool Stuff with AI in Drupal! — 2026-06-10

A hands-on walk-through from Mike Anello of DrupalEasy on setting up the Drupal AI module — what it includes, how to configure it, and why it's the first step to leveraging AI right inside the Drupal UI. Covers AI providers, default models, logging, external moderation, guardrails, and the AI API explorer — plus a taste of what's possible with the AI CKEditor submodule. read more

youtube

Quick Wins with Drupal AI for accessibility: Tone changes from within CKEditor

A demonstration of how content can be re-written from within Drupal's editor for a different audience. In this example we rewrite the content of an article to be easily understood by a reader in grade 2 of the US school system. Learn more about Drupal AI: http://drupal.org/ai/ read more

youtube

Quick Wins with Drupal AI for accessibility: Content Translation

A demonstration of the editor workflow for quickly translating content into multiple languages using AI. In this example we translate an article from English to Portuguese. Learn more about Drupal AI: http://drupal.org/ai/ read more

youtube

Quick Wins with Drupal AI for accessibility: Alt Text Generation

A demonstration of how easy it is for content editors to generate image alt text using AI. In this example we create useful alt text for use by screen readers and search engines. Learn more about Drupal AI: http://drupal.org/ai/ read more

youtube

Drupal AI Learners Club: Claude Design

Aidan Foster introduces Claude Design, Anthropic's new AI-assisted design tool, to vibe design web user interfaces, how the Drupal AI UX initiative uses it for prototyping and design discussion, and tips and pitfalls to be aware of. read more

youtube

Beyond Chatbots: Creating Smarter, Personalized Experiences with AG-UI

This video is part of a series https://www.youtube.com/playlist?list=PLpeDXSh4nHjSZBJ76O07Z9cafBpLPkhBL recorded at Drupal AI Summit New York City 2026. To learn more about Drupal AI visit https://www.drupal.org/ai. Discover more Drupal AI events in your region https://www.drupal.org/about/ai/events John Tran builds innovative technical solutions for global brands, helping organizations get real value from their technology while staying focused on business goals. Before ImageX, he founded a technical agency serving Electronic Arts and later led technology at a WPP agency supporting major clients. Discover how Drupal can evolve beyond chatbots into a collaborative, AI-powered experience platform with AG-UI. This session shows how interactive AI agents can work directly within your Drupal site to support content teams, streamline workflows, and deliver more personalized, intuitive experiences for users, without adding technical complexity. We are witnessing a fundamental shift in how businesses utilize Artificial Intelligence. The era of simple, text-based chatbots is ending. In its place, a new generation of "AI Agents" is emerging—intelligent digital assistants capable of reasoning, using tools, and collaborating with humans in real-time to customize content experiences. For Drupal site owners, marketers, and content teams, this opens up a powerful opportunity. Imagine your website becoming a collaborative workspace, where AI collaborates with your visitors to personalize experiences in real time as they interact with your content. This session will introduce a new approach to bringing these interactive AI assistants into Drupal using a component-based toolkit built on AG-UI. While the technology runs behind the scenes, the experience is designed to feel natural and intuitive, AI that is embedded into your end user content experience, rather than in a disconnected pop-up. We will demonstrate how this custom toolkit bridges the gap between complex AI logic and the intuitive Drupal user experience you expect. read more

youtube

Why Private AI Matters: Data Sovereignty as the Foundation for Trustworthy AI on the Open Web

This video is part of a series https://www.youtube.com/playlist?list=PLpeDXSh4nHjSZBJ76O07Z9cafBpLPkhBL recorded at Drupal AI Summit New York City 2026. To learn more about Drupal AI visit https://www.drupal.org/ai. Discover more Drupal AI events in your region https://www.drupal.org/about/ai/events Matthew Saunders is an AI Ambassador at amazee.io and a long-time Drupal leader with two decades of contribution. He helps organizations adopt practical, secure AI within Drupal, with a focus on data sovereignty, enterprise delivery, and neuro-inclusive design. As organizations race to integrate AI into their digital platforms, a critical question is being overlooked: who actually controls the data? Today, 72% of organizations rank data privacy as their top AI concern, 44% have experienced sensitive data leaking into AI systems, and shadow AI is spreading unchecked. For enterprises running on open-source platforms like Drupal, the answer is not to avoid AI but to deploy it on infrastructure where data never leaves organizational control. This session covers the three pillars of AI sovereignty — data, model, and operational sovereignty — and shows how open-source foundations like Drupal and Kubernetes make it possible to run AI without vendor lock-in, without cross-border data risk, and without sacrificing compliance. Drawing on real-world deployment patterns including private LLM proxies, region-locked vector databases, and open-source Drupal AI provider integrations, this talk connects the strategic "why" to the engineering "how." Whether you are evaluating AI architecture, managing shadow AI risk, or building AI features into Drupal responsibly, you will leave with a clear framework for deploying AI that is powerful, auditable, and fully under your control. read more

youtube

Drupal CMS AI - No-code Visual AI Agent builder - Future of Agents

This video is part of a series https://www.youtube.com/playlist?list=PLpeDXSh4nHjSZBJ76O07Z9cafBpLPkhBL recorded at Drupal AI Summit New York City 2026. To learn more about Drupal AI visit https://www.drupal.org/ai. Discover more Drupal AI events in your region https://www.drupal.org/about/ai/events James Abrahams is the cofounder of FreelyGive, a technology agency specialising in native Drupal CRM and business applications. He is a thought leader in Drupal AI and plays a key role in shaping the direction of AI within the platform, contributing from a strategic and product perspective. Flowdrop UI for Agents is an intuitive visual interface layer for designing, building and managing AI agents, most often used within Drupal’s AI ecosystem. It is not an AI model in its own right, but an orchestration and design environment that sits above agent infrastructure, making complex workflows more accessible and manageable. In this session, Jamie will demonstrate Flowdrop in practice, showing how it enables integration with external systems via MCP and supports the creation of AI agents using agent-driven approaches. The focus will be on how teams can move from concept to working implementations with greater clarity and control. Looking ahead, the session will explore how agent-driven systems are beginning to generate and coordinate other agents, extending the reach of Drupal’s capabilities through AI. Tools such as Claude Code are already enabling near end to end automation, from Figma designs through to fully functioning Drupal sites and migrations. The next phase is likely to bring this level of orchestration directly into Drupal itself. Attendees will leave with a clear view of current innovation within Drupal AI and a considered perspective on how these developments may evolve. read more

youtube

Beyond the Prompt: Operationalizing the Human–AI Partnership as a Digital Teammate in Drupal

This video is part of a series https://www.youtube.com/playlist?list=PLpeDXSh4nHjSZBJ76O07Z9cafBpLPkhBL recorded at Drupal AI Summit New York City 2026. To learn more about Drupal AI visit https://www.drupal.org/ai. Discover more Drupal AI events in your region https://www.drupal.org/about/ai/events John Doyle is CEO of Digital Polygon, a WebOps agency focused on open source. With 18+ years as a software architect, he leads delivery of scalable, enterprise-grade solutions. He works at the intersection of Drupal and AI, helping organisations move past hype to implement practical automation and WebOps strategies that deliver measurable results. Most organizations are stuck in a loop of AI experimentation that never reaches production. The problem isn’t the models; it’s that we’re trying to build houses on sand. Without structure, governance, and reliable data flows, AI is just a parlor trick. Drupal is often overlooked in the AI conversation, but its greatest strength is exactly what AI needs: a robust, API-first architecture and a mature content model. In this session, I’ll show you how we’re moving past prompts to build digital teammates—AI agents that are governed, measurable, and embedded directly into real-world editorial and marketing workflows. We’ll look at a two-part framework for operationalizing AI in Drupal: Stop experimenting, start systemizing: How to define a digital teammate charter so AI has clear inputs, outputs, and SLAs. Moving Beyond the Sandbox: How to take the logic from your team’s best individual experiments—like custom GPTs or Gems—and bake them directly into Drupal. We’ll talk about how to turn isolated wins into shared, governed, human-in-the-loop workflows that actually move the needle for the entire organization. read more

youtube

How AI helps The European Personnel Selection Office (EPSO) be more efficient in a transparent way

This video is part of a series https://www.youtube.com/playlist?list=PLpeDXSh4nHjSZBJ76O07Z9cafBpLPkhBL recorded at Drupal AI Summit New York City 2026. To learn more about Drupal AI visit https://www.drupal.org/ai. Discover more Drupal AI events in your region https://www.drupal.org/about/ai/events Jeroen Spitaels is the Chief Revenue Officer (CRO) & Chief Operating Officer (COO) at Dropsolid, where he shapes the company's strategic growth initiatives and revenue strategies for its open, AI-driven Digital Experience Platform (DXP). Drawing from his background as a tech entrepreneur and founder, Jeroen leverages extensive experience in business development and international operations to drive innovation and scale the company's market presence. In this talk we'll explain how EPSO (European Personnel Selection Office a.k.a. EU Careers from the European Commission) implemented AI in their online portal. We'll explain the hurdles we went trough, the wins after going live (some obvious, some less obvious). We'll also give some insights in how we make this AI implementation transparent. read more

youtube

AI-native CMS vs vibe coding

This video is part of a series https://www.youtube.com/playlist?list=PLpeDXSh4nHjSZBJ76O07Z9cafBpLPkhBL recorded at Drupal AI Summit New York City 2026. To learn more about Drupal AI visit https://www.drupal.org/ai. Discover more Drupal AI events in your region https://www.drupal.org/about/ai/events Kristof Van Tomme is co-founder of Pronovix, where he has spent over a decade building developer portals in Drupal. The company recently joined the Drupal AI Initiative. An active member of the Drupal, Write the Docs, and APIDays communities, he focuses on how AI is reshaping APIs, documentation, and developer portals. Over the years there have been many different technology waves that have changed how teams build developer portals: Static site generators, MACH, or React based applications, a range of open source technologies like Backstage or Docusaurus. Through all these waves content management systems like Drupal have been a fixture, often brought in out of necessity when requirements for the portal reached a certain level of complexity. Now that AI is making it possible for tech writers to vibe code solutions for highly specific complex requirements, is there still a need for a CMS? In this talk I will explore the difference between vibe coded documentation portals and systems that use structured data formats to enable and constrain AI. Using two practical examples from the developer portal world, to help you decide what approach would be better for your use case. read more

youtube

CMS in the post-AI Era: from MCP to Vibecoding

This video is part of a series https://www.youtube.com/playlist?list=PLpeDXSh4nHjSZBJ76O07Z9cafBpLPkhBL recorded at Drupal AI Summit New York City 2026. To learn more about Drupal AI visit https://www.drupal.org/ai. Discover more Drupal AI events in your region https://www.drupal.org/about/ai/events Josh Koenig has been a part of the Drupal ecosystem for over 20 years, and has spent his career focused on helping web teams deliver faster, with less stress, and more impact. With the open web being torn apart and reassembled by AI, the role of open source and web teams is more important than ever. The open web is being torn apart and put back together, and the purpose of content management is up for grabs. Who it's for, what it tracks, how it operates — all of this is changing. But AI is also blending in with the rest of the tech. The story is less and less about AI itself, but how it is applied so solve real world problems. As the leading open source framework for structured content, now with a fully functional internal AI subsystem, Drupal can play a much needed role in helping mature organizations use AI to accelerate, without compromising sustainable practices or quality. Drupal can run agents, but it can also be run by agents. With a solid MCP server foundation and provider plugins for all major models, there's a clear path to go from vibe-coded prototype to sustainable production system, including running a scalable and sustainable content production pipeline. read more

youtube

AI-Assisted Site Migrations in Drupal

This video is part of a series https://www.youtube.com/playlist?list=PLpeDXSh4nHjSZBJ76O07Z9cafBpLPkhBL recorded at Drupal AI Summit New York City 2026. To learn more about Drupal AI visit https://www.drupal.org/ai. Discover more Drupal AI events in your region https://www.drupal.org/about/ai/events Rob Loach is an open-source architect with nearly two decades of experience, leading research and innovation at Kalamuna. He helps shape AI integration in Drupal as part of the AI Release Management Team, focusing on practical, forward-looking solutions. Migration has always been an important part of the Drupal ecosystem. Whether it be moving from WordPress to Drupal, or importing a bunch of CSV files, the Migrate API provides a robust framework for moving data. It also carries a steep learning curve. read more

youtube

Why Private AI Matters: Data Sovereignty as the Foundation for Trustworthy AI on the Open Web

This video is part of a series https://www.youtube.com/playlist?list=PLpeDXSh4nHjSZBJ76O07Z9cafBpLPkhBL recorded at Drupal AI Summit New York City 2026. To learn more about Drupal AI visit https://www.drupal.org/ai. Discover more Drupal AI events in your region https://www.drupal.org/about/ai/events Matthew Saunders is an AI Ambassador at amazee.io and a long-time Drupal leader with two decades of contribution. He helps organizations adopt practical, secure AI within Drupal, with a focus on data sovereignty, enterprise delivery, and neuro-inclusive design. As organizations race to integrate AI into their digital platforms, a critical question is being overlooked: who actually controls the data? Today, 72% of organizations rank data privacy as their top AI concern, 44% have experienced sensitive data leaking into AI systems, and shadow AI is spreading unchecked. For enterprises running on open-source platforms like Drupal, the answer is not to avoid AI but to deploy it on infrastructure where data never leaves organizational control. This session covers the three pillars of AI sovereignty — data, model, and operational sovereignty — and shows how open-source foundations like Drupal and Kubernetes make it possible to run AI without vendor lock-in, without cross-border data risk, and without sacrificing compliance. Drawing on real-world deployment patterns including private LLM proxies, region-locked vector databases, and open-source Drupal AI provider integrations, this talk connects the strategic "why" to the engineering "how." Whether you are evaluating AI architecture, managing shadow AI risk, or building AI features into Drupal responsibly, you will leave with a clear framework for deploying AI that is powerful, auditable, and fully under your control. read more

youtube

Context-driven AI for consistent, compliant, and compelling content - Kristen Pol

This video is part of a series https://www.youtube.com/playlist?list=PLpeDXSh4nHjSZBJ76O07Z9cafBpLPkhBL recorded at Drupal AI Summit New York City 2026. To learn more about Drupal AI visit https://www.drupal.org/ai. Discover more Drupal AI events in your region https://www.drupal.org/about/ai/events AI can generate text, designs, and interfaces at lightning speed, but without the right context, results are often off-brand, non-compliant, or just plain meh. Context is the difference between “AI that guesses” and “AI that gets it,” turning outputs into authentic, on-voice, and intentional results. Context Control Center (CCC) provides a single hub to capture and manage your organization’s rules, policies, and guidelines, then map them directly to AI features. Need government compliance, brand consistency, or a specific tone? CCC ensures every AI output aligns with your requirements. Imagine being able to say: “Every article summary must be 3 sentences under 300 characters.” “Never use these restricted words.” “Match accessibility standards automatically.” “Keep the tone at an 8th-grade reading level.” “Always use our brand colors and typography.” Instead of scattered style guides, briefs, or prompts, CCC centralizes these rules so AI results are consistent, compliant, and compelling. In this session, we’ll explore why context is the missing ingredient for meaningful AI, which types of context have the biggest impact, real-world use cases, and how Context Control Center makes it simple to manage and deliver. You’ll leave with practical insights and a clear path to elevating your AI from “meh” to meaningful. read more

youtube

Drupal AI Learners Club: Using Claude Code for Drupal (Carlos Ospina)

Carlos Ospina walked through the Drupal Dev Framework, a Claude Code plugin he built to bring structure and oversight to AI-assisted Drupal development. Rather than relying on individual skills to guide the AI on specific APIs or patterns, Carlos designed a full-process framework that moves through distinct phases — scope alignment, research, architecture, and implementation — with checkpoints at each stage. The session used a real task as its example: adding an RSS feed endpoint to the Pulsera website so LinkedIn could pull in blog content as a source read more

youtube

Drupal AI Learners Club — AI Security "Opportunities" (Marlene Wanberg, Randy Fay)

AI Security 'Opportunities': Guardrails, Sandboxes, and Keeping Your Agents on a Leash Marlene Wanberg (@mindewen on drupal.org) leads a structured walkthrough of AI security risks for Drupal developers, organized around three practical concepts: social engineering (malicious instructions injected into an agent's context), sniffing (what data the agent can access), and sending (what it can exfiltrate or act on). She grounds the talk with real-world horror stories — a production database wiped by an agent that decided deleting a volume was a reasonable fix, a Copilot experiment that base64-encoded API keys to evade secret scanners, and an agent that autonomously ordered eggs because a credit card was attached to the account. Randy Fay (@rfay on drupal.org), lead maintainer of DDEV, adds a focused look at DDEV-specific AI add-ons and their security trade-offs, flags supply chain risks in popular add-ons, and shares what a more security-conscious setup looks like in practice. The session closes with an honest discussion of reviewer fatigue — how large AI-generated pull requests make it easy to miss a malicious or broken line buried deep in a diff — and the uncomfortable asymmetry between how fast AI can generate code and how slowly humans (and other AI tools) can review it. Resources mentioned: Marlene's slides: https://mwanberg.github.io/ai-learners-security-talk/ Randy's AI security notes: https://rfay.github.io/ai-security-notes/ Session recap & link dump: https://www.drupal.org/docs/develop/development-tools/ai-coding-tools-for-drupal-development/drupal-ai-learners-club-sessions Join us for the next livestream: https://luma.com/drupal-ai read more

youtube

What is Drupal Steward?

Drupal Steward is a web application firewall that bridges the gap between the time when a security release is announced and when your site is fully updated with the new security patch. This globally distributed service from the Drupal Security Team and the Drupal Association provides immediate, affordable protection for your website, while giving your IT team the flexibility to implement site updates without disrupting other priorities. Please note: Not every vulnerability can be protected by the Drupal Steward program, but it is ideally suited to help protect you from those that are mass exploitable. Drupal Steward can only apply to vulnerabilities that involve exploiting a request to the web server, which may not apply to some security issues. Also, a zero-day vulnerability (one that is discovered and publicized without the security team's knowledge) is possible. Learn more and sign up at https://www.drupal.org/steward read more

youtube

Presentation: What is OpenClaw? (Dan Lemon)

This presentation by Dan Lemon of Amazee.io covers an overview of OpenClaw: what it is, what are its component parts, how to keep yourself safe, and some useful use cases for autonmous agents. read more

youtube

Demo: OpenClaw website building through Slack (Dan Lemon)

In this demo, Dan Lemon (Amazee.io) talks through how his team talks to OpenClaw in a private Slack channel and directs it to help with Drupal Mountain Camp planning. read more

youtube

Drupal AI Learners Club — Autonomous Agents: A Show and Tell of OpenClaw

The meeting focused on a demonstration of OpenClaw, an open-source framework that runs autonomous agents to perform tasks and interact with APIs. Dan Lemon of Amazee.io provided a live demo of how he's using OpenClaw to help organize the Drupal Switzerland Mountain Camp, showing its ability to create websites, manage GitHub repositories, and communicate through Slack. read more

youtube

Show & Tell: CMS Cultivator — Skills for both Drupal and WordPress sites (Jim Birch)

A walkthrough of the https://github.com/kanopi/cms-cultivator repo that contains several useful agent skills for folks building both Drupal and WordPress sites, along with agents to do QA and site audits. read more

youtube

Talk: Introduction to Agent Skills (Jim Birch)

In this talk, Jim Birch (Kanopi Studios) shares brief introduction to Agent Skills: What they are, how to use them, best practices in developing and distributing them. read more

youtube

Drupal AI Learners Club: Skills in Action

This session is all about Skills... Agent Skills, that is! We start with an introduction to Skills from Jim Birch, followed by a demo of skills in action by Eduardo Telaya. This was definitely a hot topic: expect more skills-related sessions in the future! read more

youtube

Aftermovie Drupalcon Vienna 2025

DrupalCon Vienna was extraordinary. Let's remember together the best moments. read more

youtube

Weekend Hackery: Vibe Coding with Claude from Scratch

In this informal "pair programming" session, webchick and Amber Himes Matz use Claude Code to "vibe code" a plan on automated tool to cross-post announcements about new Drupal AI Learners Club events. We start from a "bare bones" Git repo and use a plan generated from Claude.ai to demonstrate building step by step. Exploration, learning, and hilarity ensues. :D 00:00: Intros / About the Club 01:48: Challenge we're tackling 03:21: Planning with Claude.ai 04:19: Side-Quest: Drupal.org Permissions 05:33: Back to the plan 06:21: Side-Quest: Additional channel — Luma 07:16: Let's YOLO! 08:45: Git clone an existing project 09:08: Side-Quest: Getting the plan from Claude 10:34: Side-Quest: .claude/ directory 12:30: Starting Claude Code 12:50: Aside about security 15:05: Claude Code first steps 15:30: Side-Quest: Costs between models 17:18: Claude Code first steps FOR REAL :D 18:24: Side-Quest: The many ways to run Claude 20:53: Checking in on Claude Code ...(more to come! :))... read more

youtube

Sponsor pre-recorded session - Tugboat

youtube

Demo: Using AI to solve a Drupal.org issue (Scott Falconer)

Scott demos how he solves a Drupal.org issue using OpenAI Codex, including summarizing the issue, generating a merge request, and asking it questions to verify its response. This clip is from the Drupal AI Learner's Club "From Autocomplete to Autopilot" meeting: https://www.youtube.com/watch?v=lNnbJQ6l2B4 read more

youtube

Drupal AI Learners Club: From Autocomplete to Autopilot

This session led by Scott Falconer of the Drupal AI Initiative, breaks down the current landscape of AI-assisted coding into clear, practical tiers: inline completions (think autocomplete on steroids), chat-in-your-IDE copilot workflows, and the newer "agentic" coding loops where AI plans and executes multi-step tasks with your oversight. We'll look at what each style is good at, where it falls down, and — critically — how much control you keep at each level. 10:30 Presentation: From Autocomplete to Agent Loops by Scott Falconer Slides: https://gamma.app/docs/From-Autocomplete-to-Agent-Loops-vb721nb8xh8ojpw 33:47: Demo: Solve a Drupal.org issue with OpenAI Codex read more

youtube

Drupal AI Learners Club: Share Your Setup!

The inaugural gathering of the Drupal #ai-learners club, where we "show and tell" how we're using Drupal and AI together. In this edition: - 11:20 Jürgen Haas shows off the Agent Skills he's using to help LLMs be smarter about Drupal. - Repo: https://gitlab.lakedrops.com/ai/skills - 21:11 Mike Herchel demonstrates his use of AI for core development, including visual regression testing for theme-related work. - Repo: https://github.com/mherchel/ddev-drupal-admin-vrt - 47:00 Scott Falconer shows some sci-fi AI workflow stuff with Beads and gstack - Repo #1: https://github.com/gastownhall/beads - Repo #2: https://github.com/garrytan/gstack read more

youtube

Demo: Using Agent Skills (Jürgen Haas)

As part of the Drupal AI Learners Club Show Your Setup session, Jürgen Haas shows the Drupal and GitHub Agent Skills he is using for Drupal development. Repo: https://gitlab.lakedrops.com/ai/skills read more

youtube

Demo: Using AI for Visual Regression Testing (Mike Herchel)

As part of the Drupal Learners Club Show Your Setup session, Mike Herchel demonstrates a visual regression testing tool he's created and how he uses it to contribute to Drupal Core. Repo: https://github.com/mherchel/ddev-drupal-admin-vrt read more

youtube

Demo: Using Beads and gstack to supercharge your agentic AI setup (Scott Falconer)

As part of the Drupal AI Learners Club Show Your Setup session, Scott Falconer demonstrates his use of Beads to remind him where he left off, and gstack to guide his engineering in a direction of providing real value to users. Repos: - https://github.com/gastownhall/beads - https://github.com/garrytan/gstack read more

youtube

Drupal 25th Anniversary Gala | Chicago 2026

For 25 years, Drupal has been more than software. It's been careers launched, friendships formed, and a global community built around a shared belief in the Open Web. On March 24, 2026, that community came together at SIX10 in Chicago to celebrate — one night of connection, history, and joy. The Drupal 25th Anniversary Gala was held during DrupalCon Chicago 2026. 🔗 Learn more about Drupal: https://drupal.org 🔗 Learn more about the Drupal Association: https://www.drupal.org/association read more

youtube

Drupal at 25: What does Drupal mean to you? | Drupal 25th Anniversary Gala

At the Drupal 25th Anniversary Gala in Chicago, we set up a selfie booth and asked the community about their Drupal story — how they got involved, how Drupal has shaped their life, what it means to them, and more. These are their answers. Voices from across the global Drupal community — developers, designers, site builders, agency owners, and contributors — sharing what 25 years of Drupal has meant to them. The Gala was held on March 24, 2026 at SIX10 in Chicago, as part of DrupalCon Chicago 2026. Thanks to Acquia for sponsoring the booth and bringing us these stories. read more

youtube

Drupal at 25: What does Drupal mean to you? | Drupal 25th Anniversary Gala

At the Drupal 25th Anniversary Gala in Chicago, we set up a selfie booth and asked the community about their Drupal story — how they got involved, how Drupal has shaped their life, what it means to them, and more. These are their answers. Voices from across the global Drupal community — developers, designers, site builders, agency owners, and contributors — sharing what 25 years of Drupal has meant to them. The Gala was held on March 24, 2026 at SIX10 in Chicago, as part of DrupalCon Chicago 2026. Thanks to Acquia for sponsoring the booth and bringing us these stories. read more

youtube

Drupal at 25: What does Drupal mean to you? | Drupal 25th Anniversary Gala

At the Drupal 25th Anniversary Gala in Chicago, we set up a selfie booth and asked the community about their Drupal story — how they got involved, how Drupal has shaped their life, what it means to them, and more. These are their answers. Voices from across the global Drupal community — developers, designers, site builders, agency owners, and contributors — sharing what 25 years of Drupal has meant to them. The Gala was held on March 24, 2026 at SIX10 in Chicago, as part of DrupalCon Chicago 2026. Thanks to Acquia for sponsoring the booth and bringing us these stories. read more

youtube

Drupal at 25: What does Drupal mean to you? | Drupal 25th Anniversary Gala

At the Drupal 25th Anniversary Gala in Chicago, we set up a selfie booth and asked the community about their Drupal story — how they got involved, how Drupal has shaped their life, what it means to them, and more. These are their answers. Voices from across the global Drupal community — developers, designers, site builders, agency owners, and contributors — sharing what 25 years of Drupal has meant to them. The Gala was held on March 24, 2026 at SIX10 in Chicago, as part of DrupalCon Chicago 2026. Thanks to Acquia for sponsoring the booth and bringing us these stories. read more

youtube

Drupal at 25: What does Drupal mean to you? | Drupal 25th Anniversary Gala

At the Drupal 25th Anniversary Gala in Chicago, we set up a selfie booth and asked the community about their Drupal story — how they got involved, how Drupal has shaped their life, what it means to them, and more. These are their answers. Voices from across the global Drupal community — developers, designers, site builders, agency owners, and contributors — sharing what 25 years of Drupal has meant to them. The Gala was held on March 24, 2026 at SIX10 in Chicago, as part of DrupalCon Chicago 2026. Thanks to Acquia for sponsoring the booth and bringing us these stories. read more

youtube

Drupal at 25: What does Drupal mean to you? | Drupal 25th Anniversary Gala

At the Drupal 25th Anniversary Gala in Chicago, we set up a selfie booth and asked the community about their Drupal story — how they got involved, how Drupal has shaped their life, what it means to them, and more. These are their answers. Voices from across the global Drupal community — developers, designers, site builders, agency owners, and contributors — sharing what 25 years of Drupal has meant to them. The Gala was held on March 24, 2026 at SIX10 in Chicago, as part of DrupalCon Chicago 2026. Thanks to Acquia for sponsoring the booth and bringing us these stories. read more

youtube

Drupal at 25: What does Drupal mean to you? | Drupal 25th Anniversary Gala

At the Drupal 25th Anniversary Gala in Chicago, we set up a selfie booth and asked the community about their Drupal story — how they got involved, how Drupal has shaped their life, what it means to them, and more. These are their answers. Voices from across the global Drupal community — developers, designers, site builders, agency owners, and contributors — sharing what 25 years of Drupal has meant to them. The Gala was held on March 24, 2026 at SIX10 in Chicago, as part of DrupalCon Chicago 2026. Thanks to Acquia for sponsoring the booth and bringing us these stories. read more

youtube

Drupal at 25: What does Drupal mean to you? | Drupal 25th Anniversary Gala

At the Drupal 25th Anniversary Gala in Chicago, we set up a selfie booth and asked the community about their Drupal story — how they got involved, how Drupal has shaped their life, what it means to them, and more. These are their answers. Voices from across the global Drupal community — developers, designers, site builders, agency owners, and contributors — sharing what 25 years of Drupal has meant to them. The Gala was held on March 24, 2026 at SIX10 in Chicago, as part of DrupalCon Chicago 2026. Thanks to Acquia for sponsoring the booth and bringing us these stories. read more

youtube

Drupal at 25: What does Drupal mean to you? | Drupal 25th Anniversary Gala

At the Drupal 25th Anniversary Gala in Chicago, we set up a selfie booth and asked the community about their Drupal story — how they got involved, how Drupal has shaped their life, what it means to them, and more. These are their answers. Voices from across the global Drupal community — developers, designers, site builders, agency owners, and contributors — sharing what 25 years of Drupal has meant to them. The Gala was held on March 24, 2026 at SIX10 in Chicago, as part of DrupalCon Chicago 2026. Thanks to Acquia for sponsoring the booth and bringing us these stories. read more

youtube

Drupal at 25: What does Drupal mean to you? | Drupal 25th Anniversary Gala

At the Drupal 25th Anniversary Gala in Chicago, we set up a selfie booth and asked the community about their Drupal story — how they got involved, how Drupal has shaped their life, what it means to them, and more. These are their answers. Voices from across the global Drupal community — developers, designers, site builders, agency owners, and contributors — sharing what 25 years of Drupal has meant to them. The Gala was held on March 24, 2026 at SIX10 in Chicago, as part of DrupalCon Chicago 2026. Thanks to Acquia for sponsoring the booth and bringing us these stories. read more

youtube

Drupal at 25: What does Drupal mean to you? | Drupal 25th Anniversary Gala

At the Drupal 25th Anniversary Gala in Chicago, we set up a selfie booth and asked the community about their Drupal story — how they got involved, how Drupal has shaped their life, what it means to them, and more. These are their answers. Voices from across the global Drupal community — developers, designers, site builders, agency owners, and contributors — sharing what 25 years of Drupal has meant to them. The Gala was held on March 24, 2026 at SIX10 in Chicago, as part of DrupalCon Chicago 2026. Thanks to Acquia for sponsoring the booth and bringing us these stories. read more

Powered By Combinary

youtube

Drupal at 25: What does Drupal mean to you? | Drupal 25th Anniversary Gala

At the Drupal 25th Anniversary Gala in Chicago, we set up a selfie booth and asked the community about their Drupal story — how they got involved, how Drupal has shaped their life, what it means to them, and more. These are their answers. Voices from across the global Drupal community — developers, designers, site builders, agency owners, and contributors — sharing what 25 years of Drupal has meant to them. The Gala was held on March 24, 2026 at SIX10 in Chicago, as part of DrupalCon Chicago 2026. Thanks to Acquia for sponsoring the booth and bringing us these stories. read more

youtube

Drupal at 25: What does Drupal mean to you? | Drupal 25th Anniversary Gala

At the Drupal 25th Anniversary Gala in Chicago, we set up a selfie booth and asked the community about their Drupal story — how they got involved, how Drupal has shaped their life, what it means to them, and more. These are their answers. Voices from across the global Drupal community — developers, designers, site builders, agency owners, and contributors — sharing what 25 years of Drupal has meant to them. The Gala was held on March 24, 2026 at SIX10 in Chicago, as part of DrupalCon Chicago 2026. Thanks to Acquia for sponsoring the booth and bringing us these stories. read more

youtube

Drupal at 25: What does Drupal mean to you? | Drupal 25th Anniversary Gala

At the Drupal 25th Anniversary Gala in Chicago, we set up a selfie booth and asked the community about their Drupal story — how they got involved, how Drupal has shaped their life, what it means to them, and more. These are their answers. Voices from across the global Drupal community — developers, designers, site builders, agency owners, and contributors — sharing what 25 years of Drupal has meant to them. The Gala was held on March 24, 2026 at SIX10 in Chicago, as part of DrupalCon Chicago 2026. Thanks to Acquia for sponsoring the booth and bringing us these stories. read more

youtube

Drupal at 25: What does Drupal mean to you? | Drupal 25th Anniversary Gala

At the Drupal 25th Anniversary Gala in Chicago, we set up a selfie booth and asked the community about their Drupal story — how they got involved, how Drupal has shaped their life, what it means to them, and more. These are their answers. Voices from across the global Drupal community — developers, designers, site builders, agency owners, and contributors — sharing what 25 years of Drupal has meant to them. The Gala was held on March 24, 2026 at SIX10 in Chicago, as part of DrupalCon Chicago 2026. Thanks to Acquia for sponsoring the booth and bringing us these stories. read more

youtube

Drupal at 25: What does Drupal mean to you? | Drupal 25th Anniversary Gala

At the Drupal 25th Anniversary Gala in Chicago, we set up a selfie booth and asked the community about their Drupal story — how they got involved, how Drupal has shaped their life, what it means to them, and more. These are their answers. Voices from across the global Drupal community — developers, designers, site builders, agency owners, and contributors — sharing what 25 years of Drupal has meant to them. The Gala was held on March 24, 2026 at SIX10 in Chicago, as part of DrupalCon Chicago 2026. Thanks to Acquia for sponsoring the booth and bringing us these stories. read more

youtube

Drupal at 25: What does Drupal mean to you? | Drupal 25th Anniversary Gala

At the Drupal 25th Anniversary Gala in Chicago, we set up a selfie booth and asked the community about their Drupal story — how they got involved, how Drupal has shaped their life, what it means to them, and more. These are their answers. Voices from across the global Drupal community — developers, designers, site builders, agency owners, and contributors — sharing what 25 years of Drupal has meant to them. The Gala was held on March 24, 2026 at SIX10 in Chicago, as part of DrupalCon Chicago 2026. Thanks to Acquia for sponsoring the booth and bringing us these stories. read more

youtube

Drupal at 25: What does Drupal mean to you? | Drupal 25th Anniversary Gala

At the Drupal 25th Anniversary Gala in Chicago, we set up a selfie booth and asked the community about their Drupal story — how they got involved, how Drupal has shaped their life, what it means to them, and more. These are their answers. Voices from across the global Drupal community — developers, designers, site builders, agency owners, and contributors — sharing what 25 years of Drupal has meant to them. The Gala was held on March 24, 2026 at SIX10 in Chicago, as part of DrupalCon Chicago 2026. Thanks to Acquia for sponsoring the booth and bringing us these stories. read more

youtube

Drupal at 25: What does Drupal mean to you? | Drupal 25th Anniversary Gala

At the Drupal 25th Anniversary Gala in Chicago, we set up a selfie booth and asked the community about their Drupal story — how they got involved, how Drupal has shaped their life, what it means to them, and more. These are their answers. Voices from across the global Drupal community — developers, designers, site builders, agency owners, and contributors — sharing what 25 years of Drupal has meant to them. The Gala was held on March 24, 2026 at SIX10 in Chicago, as part of DrupalCon Chicago 2026. Thanks to Acquia for sponsoring the booth and bringing us these stories. read more

youtube

Drupal at 25: What does Drupal mean to you? | Drupal 25th Anniversary Gala

At the Drupal 25th Anniversary Gala in Chicago, we set up a selfie booth and asked the community about their Drupal story — how they got involved, how Drupal has shaped their life, what it means to them, and more. These are their answers. Voices from across the global Drupal community — developers, designers, site builders, agency owners, and contributors — sharing what 25 years of Drupal has meant to them. The Gala was held on March 24, 2026 at SIX10 in Chicago, as part of DrupalCon Chicago 2026. Thanks to Acquia for sponsoring the booth and bringing us these stories. read more

youtube

Drupal at 25: What does Drupal mean to you? | Drupal 25th Anniversary Gala

At the Drupal 25th Anniversary Gala in Chicago, we set up a selfie booth and asked the community about their Drupal story — how they got involved, how Drupal has shaped their life, what it means to them, and more. These are their answers. Voices from across the global Drupal community — developers, designers, site builders, agency owners, and contributors — sharing what 25 years of Drupal has meant to them. The Gala was held on March 24, 2026 at SIX10 in Chicago, as part of DrupalCon Chicago 2026. Thanks to Acquia for sponsoring the booth and bringing us these stories. read more

youtube

Drupal at 25: What does Drupal mean to you? | Drupal 25th Anniversary Gala

At the Drupal 25th Anniversary Gala in Chicago, we set up a selfie booth and asked the community about their Drupal story — how they got involved, how Drupal has shaped their life, what it means to them, and more. These are their answers. Voices from across the global Drupal community — developers, designers, site builders, agency owners, and contributors — sharing what 25 years of Drupal has meant to them. The Gala was held on March 24, 2026 at SIX10 in Chicago, as part of DrupalCon Chicago 2026. Thanks to Acquia for sponsoring the booth and bringing us these stories. read more

youtube

Drupal at 25: What does Drupal mean to you? | Drupal 25th Anniversary Gala

At the Drupal 25th Anniversary Gala in Chicago, we set up a selfie booth and asked the community about their Drupal story — how they got involved, how Drupal has shaped their life, what it means to them, and more. These are their answers. Voices from across the global Drupal community — developers, designers, site builders, agency owners, and contributors — sharing what 25 years of Drupal has meant to them. The Gala was held on March 24, 2026 at SIX10 in Chicago, as part of DrupalCon Chicago 2026. Thanks to Acquia for sponsoring the booth and bringing us these stories. read more

youtube

Drupal at 25: What does Drupal mean to you? | Drupal 25th Anniversary Gala

At the Drupal 25th Anniversary Gala in Chicago, we set up a selfie booth and asked the community about their Drupal story — how they got involved, how Drupal has shaped their life, what it means to them, and more. These are their answers. Voices from across the global Drupal community — developers, designers, site builders, agency owners, and contributors — sharing what 25 years of Drupal has meant to them. The Gala was held on March 24, 2026 at SIX10 in Chicago, as part of DrupalCon Chicago 2026. Thanks to Acquia for sponsoring the booth and bringing us these stories. read more

youtube

Drupal at 25: What does Drupal mean to you? | Drupal 25th Anniversary Gala

At the Drupal 25th Anniversary Gala in Chicago, we set up a selfie booth and asked the community about their Drupal story — how they got involved, how Drupal has shaped their life, what it means to them, and more. These are their answers. Voices from across the global Drupal community — developers, designers, site builders, agency owners, and contributors — sharing what 25 years of Drupal has meant to them. The Gala was held on March 24, 2026 at SIX10 in Chicago, as part of DrupalCon Chicago 2026. Thanks to Acquia for sponsoring the booth and bringing us these stories. read more

youtube

Drupal at 25: What does Drupal mean to you? | Drupal 25th Anniversary Gala

At the Drupal 25th Anniversary Gala in Chicago, we set up a selfie booth and asked the community about their Drupal story — how they got involved, how Drupal has shaped their life, what it means to them, and more. These are their answers. Voices from across the global Drupal community — developers, designers, site builders, agency owners, and contributors — sharing what 25 years of Drupal has meant to them. The Gala was held on March 24, 2026 at SIX10 in Chicago, as part of DrupalCon Chicago 2026. Thanks to Acquia for sponsoring the booth and bringing us these stories. read more

youtube

Drupal at 25: What does Drupal mean to you? | Drupal 25th Anniversary Gala

At the Drupal 25th Anniversary Gala in Chicago, we set up a selfie booth and asked the community about their Drupal story — how they got involved, how Drupal has shaped their life, what it means to them, and more. These are their answers. Voices from across the global Drupal community — developers, designers, site builders, agency owners, and contributors — sharing what 25 years of Drupal has meant to them. The Gala was held on March 24, 2026 at SIX10 in Chicago, as part of DrupalCon Chicago 2026. Thanks to Acquia for sponsoring the booth and bringing us these stories. read more

youtube

Drupal at 25: What does Drupal mean to you? | Drupal 25th Anniversary Gala

At the Drupal 25th Anniversary Gala in Chicago, we set up a selfie booth and asked the community about their Drupal story — how they got involved, how Drupal has shaped their life, what it means to them, and more. These are their answers. Voices from across the global Drupal community — developers, designers, site builders, agency owners, and contributors — sharing what 25 years of Drupal has meant to them. The Gala was held on March 24, 2026 at SIX10 in Chicago, as part of DrupalCon Chicago 2026. Thanks to Acquia for sponsoring the booth and bringing us these stories. read more

youtube

Drupal at 25: What does Drupal mean to you? | Drupal 25th Anniversary Gala

At the Drupal 25th Anniversary Gala in Chicago, we set up a selfie booth and asked the community about their Drupal story — how they got involved, how Drupal has shaped their life, what it means to them, and more. These are their answers. Voices from across the global Drupal community — developers, designers, site builders, agency owners, and contributors — sharing what 25 years of Drupal has meant to them. The Gala was held on March 24, 2026 at SIX10 in Chicago, as part of DrupalCon Chicago 2026. Thanks to Acquia for sponsoring the booth and bringing us these stories. read more

youtube

Drupal at 25: What does Drupal mean to you? | Drupal 25th Anniversary Gala

At the Drupal 25th Anniversary Gala in Chicago, we set up a selfie booth and asked the community about their Drupal story — how they got involved, how Drupal has shaped their life, what it means to them, and more. These are their answers. Voices from across the global Drupal community — developers, designers, site builders, agency owners, and contributors — sharing what 25 years of Drupal has meant to them. The Gala was held on March 24, 2026 at SIX10 in Chicago, as part of DrupalCon Chicago 2026. Thanks to Acquia for sponsoring the booth and bringing us these stories. read more

youtube

Drupal at 25: What does Drupal mean to you? | Drupal 25th Anniversary Gala

At the Drupal 25th Anniversary Gala in Chicago, we set up a selfie booth and asked the community about their Drupal story — how they got involved, how Drupal has shaped their life, what it means to them, and more. These are their answers. Voices from across the global Drupal community — developers, designers, site builders, agency owners, and contributors — sharing what 25 years of Drupal has meant to them. The Gala was held on March 24, 2026 at SIX10 in Chicago, as part of DrupalCon Chicago 2026. Thanks to Acquia for sponsoring the booth and bringing us these stories. read more

youtube

Drupal at 25: What does Drupal mean to you? | Drupal 25th Anniversary Gala

At the Drupal 25th Anniversary Gala in Chicago, we set up a selfie booth and asked the community about their Drupal story — how they got involved, how Drupal has shaped their life, what it means to them, and more. These are their answers. Voices from across the global Drupal community — developers, designers, site builders, agency owners, and contributors — sharing what 25 years of Drupal has meant to them. The Gala was held on March 24, 2026 at SIX10 in Chicago, as part of DrupalCon Chicago 2026. Thanks to Acquia for sponsoring the booth and bringing us these stories. read more

youtube

Sponsor pre recorded session Upsun

youtube

Sponsor Pre recorded session Hounder

youtube

Sponsor Pre recorded session Dropsolid

youtube

Sponsor Pre recorded session Promet Source

youtube

Drupal Canvas AI: Where Speed Meets Substance

The second half of the equation is Drupal Canvas AI, the next-generation page builder. Instead of dragging and dropping components, you can just tell the AI what you want with prompts that describe the page and content you want to produce. Canvas AI, in conjunction with the CCC, will create the page and include the components you need. As Dries noted, production is becoming a commodity, but judgment and strategy remain human. Drupal AI doesn’t replace your teams, it amplifies their capability to deliver ‘Quality at Scale.’ #MarketingTech #ContentStrategy #DrupalCMS #DXP #AI read more

youtube

The Context Control Centre (CCC): Institutional ‘Knowledge as a Service’

The most significant hurdle for AI today is a lack of context. Without it, AI simply gives you the "average response." The Context Control Centre changes this by allowing organizations to store their unique "DNA" directly within Drupal. The CCC organizes institutional knowledge into actionable data: Brand Guidelines: Specific rules for tone, voice, and formatting. Personas: Detailed profiles of target audiences (e.g., Controllers vs. IT Ops). Dynamic Context: A groundbreaking feature where the CCC connects to live data sources like Google Analytics 4 (GA4). Built into your Drupal CMS, AI tools don't just guess; they work within your specific business reality to ensure their output is always on brand, within guidelines, and relevant to the contextual nuances of the task at hand. #MarketingTech #ContentStrategy #DrupalCMS #DXP #AI read more

youtube

Drupal CMS Site Templates - Purpose-Built Templates for Your Industry

Getting started has neveGetting started has never been easier. Drupal CMS introduces purpose-built site templates designed for nonprofits, educators, event organizers, health providers, government agencies, and SaaS companies — all ready to customize out of the box. Browse free and premium templates at marketplace.drupal.org, or install directly from Drupal CMS. Premium templates like Meridian offer extended visual flexibility and dedicated product support, while every option connects you directly with the makers. And easy doesn't mean limited. Drupal CMS is built on the same open source foundation powering some of the world's most complex digital experiences — structured content, advanced workflows, airtight security, and access to 10,000+ extensions right from the UI. Easier than ever to start. Impossible to outgrow. 🔗 Browse templates: https://marketplace.drupal.org been easier. read more

youtube

#Driesnote | DrupalCon Chicago 2026

Join us live for the #Driesnote at DrupalCon Chicago 2026! Drupal Founder Dries Buytaert will be presenting on the latest innovations in Drupal, with everything from Drupal CMS and Drupal Canvas improvements, innovation in AI, the Drupal.org site template marketplace and more. read more

youtube

Helping people tell their cancer stories using AI: Lessons from World Cancer Day

Every year, thousands of people around the world share deeply personal stories about their experiences with cancer through the World Cancer Day campaign. Behind the scenes, a small communications team reviews these submissions to ensure they are appropriate, relevant, and ready to be shared with the world. In this Drupal AI Initiative webinar, we explore how the World Cancer Day team introduced artificial intelligence into their Drupal platform to support this process. Rather than replacing human judgement, AI was used to assist with moderation so that stories could be reviewed faster and contributors could see their experiences published more quickly. Watch our conversation about: • The global storytelling effort behind World Cancer Day • The operational challenges of managing hundreds of story submissions • How AI can responsibly support human decision-making • Lessons for organisations exploring AI for the first time Speakers • Matthew Saunders — AI Ambassador, amazee.io • Charles Andrew Revkin — World Cancer Day Programme, UICC • Diego Costa — COO, 1xInternet This session was designed for organisational leaders, communications teams, and anyone interested in practical, responsible uses of AI. #Drupal #OpenSource #AI #Innovation #TechforGood #cancer read more

youtube

Dries: What's Coming at DrupalCon Chicago 2026 (+ a Special Announcement)

Drupal founder and project lead Dries Buytaert shares a personal preview of what's coming at DrupalCon Chicago 2026 — and why this year's event is something truly special. Drupal turned 25 in 2026, and the celebration is happening live in Chicago. In this video, Dries gives a sneak peek at his keynote, which will cover the latest Drupal innovations, the impact of AI on the platform, product and ecosystem evolution, and why he's more optimistic about Drupal's future than ever before — including a first look at new innovations he hasn't revealed yet. And there's more: this year DrupalCon is hosting a special gala in honour of Drupal's 25th birthday. It's a separate ticketed event, and one you won't want to miss. 🎟️ Get your DrupalCon tickets at https://events.drupal.org/chicago2026 and join Dries in Chicago. Gala tickets available here: https://www.zeffy.com/en-US/ticketing/drupal-25th-anniversary-gala read more

youtube

KEYNOTE: Neurodiversity: An Underrated Superpower in Business

Vera Herzmann In tech, some of the most innovative minds think differently – and that difference is often misunderstood. People with ADHD, Autism, or High Sensitivity bring unique strengths like deep focus, pattern recognition, creativity, empathy, and sharp intuition. Yet many workplaces still see neurodivergence as a challenge, rather than recognizing it for the powerful asset it truly is. This keynote challenges that mindset and reframes neurodiversity as a competitive advantage in business. Drawing from lived experience and years of organizational consulting, you’ll gain a science-backed understanding of neurodiversity, hear real-world stories from the workplace, and explore how recognizing and embracing neurodivergent talent can unlock hidden potential in teams. Whether you build, design, manage, or lead, this session will shift your perspective, spark meaningful dialogue, and leave you with practical tools to apply in your own professional setting. read more

youtube

AI Agents in Drupal CMS - Create your own agent

Speaker: https://www.drupal.org/u/vincenzo-gambino You’ve seen what AI Agents can do in Drupal. What if you could create your own Agents? What if this were so easy that every module across the Drupal ecosystem could have its agents, and they all worked together in harmony? What if, as a result, Drupal became the de facto place to build all AI applications, not just web publishing? If this is you, then this is the talk for you! This talk will teach you how to create agents from scratch using an existing Drupal module. We will explore: - How to code an agent using the framework in the Drupal ai_agents module. - Best practices and theory for splitting out functionality into multiple agents. - How can all those agents be brought together to effectively answer user queries and prove they work with the AI evaluations framework. read more

youtube

Declarative Shadow DOM and the future of Drupal Theming

Speaker: JohnAlbin Drupal's old school theming system is server-side rendering. And in the tech world, everything old is new again. In the last two years, modern frontend frameworks have been trying to figure out how to server-side render their client-side JavaScript. React v19 has figured out how to split its components into client and server parts. As of August 2024, this same "split component" capability is now a part of native Web Components with the introduction of Declarative Shadow DOM. Instead of being written in client-side JavaScript, web components with Declarative Shadow DOM can now be defined using HTML and CSS only. So if Drupal was server-side rendering before it was cool, can we leverage Declarative Shadow DOM inserted into Single Directory Components to make Drupal cool again? read more

youtube

Recipes: It's About Time!

Speaker: mandclu One of the key elements of the Starshot Initiative is the rapidly evolving system for Recipes. Designed to accelerate site-building, recipes will help people new to Drupal to solve for common needs, and for users of all skill levels to quickly build out content architectures using best practices. This talk will do a deep dive into the Events recipe and its available add-ons, allowing you meet even complex requirements quickly and without custom code. We'll discuss what capabilities are available out-of-the box in Drupal CMS, and the options available to extend them. We'll also talk about how you can add the same capabilities to a site not build with Drupal CMS. Best of all, during the session we'll do a live demonstration of adding capabilities to your site using Events and other recipes read more

youtube

"当たり前"を疑いましょ ~ フレームワークからドメインを守るDrupalアーキテクチャ ~

Speaker: umekikazuya 「Taxonomy便利ですよね。」って導入をいつもだったらするんですが、今回はできません。なぜなら私は、TaxonomyをCoreから外してほしいと思っているから。この冒頭で「何言ってるの？」って感じた方。Taxonomyの強みを言えますか？本セッションでは、「分類要件といえばTaxonomy！」というDrupalの常識(当たり前)にフォーカスをあてて、その“当たり前”や”習慣”が本当に合理的かを評価し、フレームワークとの向き合い方について、今までのDrupalからすると当たり前ではない提案をさせていただきます。 read more

youtube

大規模Drupalサイトの成功事例：全豪オープンが毎分53万リクエスト以上を処理する仕組み

Speaker: jimmycann テニスの全豪オープンは3週間の開催期間中に100万人を超える観客が来場し、さらに世界中から数百万人がウェブサイトやモバイルアプリを通じてアクセスする世界的なイベントです。この巨大なデジタル体験を支えているのが大会の情報、選手データ、コンテンツ管理、イベント予約などを統合的に扱う高度なDrupalサイトです。本セッションでは世界でも有数のアクセス数を誇るDrupalサイトをどのように準備し、安定的に運営しているかをご紹介します。Drupalの強力なキャッシュ機能を最大限に活用し、リスクを適切に管理し、万が一の事態に備える方法について詳しく解説します。 Drupalがどんな規模でも優れたデジタル体験を実現できることを学び、自社サイトで「コストを抑えながら楽にスケールする」実践的なノウハウを得られます。 read more

youtube

Drupal in the Loop: チームで育てる学習データ

Speaker: umekikazuya, sachikonitta 数年前まで、機械学習やファインチューニングは、一部の研究機関やAIスタートアップの専有領域でした。しかしこの数年、さまざまなツールやプラットフォームの登場によって、それが少しずつ、私たちにとっても身近なものになりつつあります。学習データは、モデルの「知性」を決める最も重要な基盤です。けれど、そのデータをチームで育てるための仕組みである、バージョン管理、ワークフロー、セキュリティ、アクセス制御、監査ログ出力などの要素を包括的にカバーできるツールは、まだ多くありません。本セッションでは、Drupalを活用し、研究者やエンジニアだけでなく、コンテンツ制作者や企画担当者も含めたチーム全体で学習データを「育てていく」仕組みを提案します。 read more

youtube

One kilobyte of JS is enough to make a decoupled FE block in Drupal. And no Babels required!

Speaker: murz To make a Drupal website modern we usually bring there interactive frontend components in JavaScript. But not only just components! Together with them, we have to bring a couple of more things: - A pretty heavy framework: React, Angular, Vue, etc. - Typescript transpiled to JavaScript. - Something like Babel to pack all your JS dependencies into one large bundle. - Rebuild the whole bundle after every change in any TS file! And, suddenly, to display a simple frontend component, your Drupal webpage should download and execute hundreds of kilobytes, or even megabytes of large JS bundles! What if I tell you, that you can simply get rid of all these, and just write a kilobyte of a pure and compact JS code? And with no dependency on any JS framework! So, come and see how it works! read more

youtube

Smart Search, Safe Search: How Drupal + AI Work Together

Speaker: sachikonitta AI search is powerful—but without access control, it can leak private content. This beginner-friendly session introduces RAG (Retrieval-Augmented Generation) and shows how Drupal can sit between users and AI to enforce roles and permissions. The session will include these topics: - What AI search and RAG really are - Why just embedding content in a vector database isn’t enough - Drupal as truth for permissions - How to connect Drupal with vector DB and AI - PoC (How a safe AI search looks like) read more

twitter

RT @TalkingDrupal: On episode #390, Employee Owned Business with Seth Brown, CEO @lullabot. https://t.co/KiYM6Zwz5C #drupal read more

twitter

Nonprofit Drupal posts: March Drupal for Nonprofits Chat https://t.co/uJq3iqKikr #drupal read more

twitter

Community Working Group posts: Nominations are now open for the 2023 Aaron Winborn Award https://t.co/wrYfMue23T #drupal read more

twitter

Community Working Group posts: Call for creators for crafting future Aaron Winborn Awards https://t.co/JqGX6q9W1M #drupal read more

twitter

The Drop Times: Just Keep Showing Up, and the Job Is Yours: Chris Wells | DrupalCamp NJ https://t.co/FL1c6MdS9Z #drupal read more

twitter

RT @ironstar_io: The 2023 Drupal Local Development Survey has now been translated into French, Japanese, and Traditional Chinese. We are ve… read more

twitter

The 2023 Drupal Local Development Survey has now been translated into French, Japanese, and Traditional Chinese. We are very grateful to @mupsigraphy for her work on this French translation. If you would like to add a translation, please let us know as there's still time! read more

twitter

RT @e14t: Mastering Drupal 9 Layout Builder: A Comprehensive Guide to Effortlessly Customize Your Website's Design #drupal https://t.co/veg… read more

twitter

Mastering Drupal 9 Layout Builder: A Comprehensive Guide to Effortlessly Customize Your Website's Design #drupal https://t.co/vegAGDzSdh read more

Powered By Combinary

twitter

RT @Drupalcameroun: How #Drupal communities on the #African continent can help their governments in their #digitalization process. @_Africa… read more

twitter

Chapter Three: where we celebrate National Pi Day with forward-thinking NextJS and Drupal expertise, and National Potato Chip Day with an unparalleled snacking prowess. What is your favorite chip flavor? 🥧 🍟 🤓#PiDay #PotatoChipDay #drupal #nextjs read more

twitter

Pues me está gustando mucho lo de hacer directos en #twitch sobre desarrollo en #Drupal, le estoy cogiendo el gusto. read more

twitter

Drupal has offered top-notch no-code/low-code site building functionalities long before these two terms even existed. You can learn more about Drupal as a no-code/low-code tool in this @agiledrop article: https://t.co/TDwJn5DT6r #Drupal #NoCode #LowCode https://t.co/tGVQhtdtvH read more

twitter

I spent the last week doing #peformance #optimization of our #drupal 9 application infrastructure. I learned a lot about #PHP #opcache #profiling and Drupal's internal caching systems. #webprofiler module was a big help, too! read more

twitter

The Drop Times: A Stitch in Time Saves Nine https://t.co/VMWANTSAUe #drupal read more

twitter

One of our Back-end Developers, Greg Carlson has officially been with Aten for one year! Greg's favorite project this year was creating a #Drupal module to easily import CSV files to create content for @C4LPreK. In his free time, Greg follows the KU Jayhawks in his hometown. https://t.co/CN5QDULccA read more

twitter

RT @nmdmatt: .@phpstan's new not-deprecated annotation #drupal https://t.co/To2MLb1hpw read more

twitter

RT @nmdmatt: .@phpstan's new not-deprecated annotation #drupal https://t.co/To2MLb1hpw read more

twitter

Matt Glaman: PHPStan's new @not-deprecated annotation https://t.co/Idxe5nlpQV #drupal read more

twitter

Session submission: »The Ten Ways of Trust in Communication« by @kanadiankicks | @open_strategy https://t.co/HpYj8309le #dcruhr23 #Drupal (tf) https://t.co/zkzLT1BNJZ read more

twitter

#Drupalcamp Colorado has dates! Aug 4 and 5. We want YOU to speak! Your topic doesn't have to be Drupal specifically but should be Drupal adjacent. #drupal #camp #opensource @drupalcolorado Please share this post liberally! https://t.co/Yb1x3vxmQ5 https://t.co/jMBQUq2hPu read more

twitter

Wozu braucht man Drush bei #Drupal 9? Module lassen sich direkt updaten. Drupal Update mit Drush hat einen Aufkleber "deprecated". read more

twitter

RT @SamHuskey: Attention #Drupal developers: @scsclassics is hiring! Details at https://t.co/3lTYHaQys3 read more

twitter

Why join the Acquia's Headless Developer Advisory Board? This board is an opportunity to have your say. Provide feedback into our headless products an roadmaps. Check it out! #Drupal #DrupalHeadless #Decoupled #Developers #Technology #Leadership https://t.co/HJVa4aEinQ read more

twitter

RT @TalkingDrupal: On episode #390, Employee Owned Business with Seth Brown, CEO @lullabot. https://t.co/KiYM6Zwz5C #drupal read more

twitter

Olivero is the new default theme in #Drupal10 & 9 – and the most accessible one yet. Learn more about this modern theme’s best features, as well as its notable namesake. https://t.co/JHwH3hexgq #Drupal https://t.co/zTEKd7wOMa read more

twitter

Are you a developer looking to stay ahead of the game? Then mark your calendars for March 19th and join us for the #Drupal Meetup at Zain Zinc! Don't miss out on this opportunity to enhance your skills and connect with fellow professionals! Register Now! https://t.co/0HwzZfdoR6 read more

twitter

What Is a Content Management System (#CMS)? https://t.co/4Pd3JMXeKS #Wordpress 'joomla #Drupal read more

twitter

Le connecteur officiel #ONLYOFFICE pour #Drupal est est disponible dans le répertoire officiel de Drupal. En savoir plus : https://t.co/UuUhlOteJn https://t.co/ENue19M7aN read more

twitter

.@phpstan's new not-deprecated annotation #drupal https://t.co/To2MLb1hpw read more

twitter

RT @drupalfr: 🔍 Vous avez peut-être vu passer une enquête sur les environnements de développement locaux avec #Drupal récemment ? Elle es… read more

twitter

RT @drupalfr: 🔍 Vous avez peut-être vu passer une enquête sur les environnements de développement locaux avec #Drupal récemment ? Elle es… read more

twitter

RT @DrupalCampRuhr: Wir danken unserem Bronze-Sponsor @arocom_GmbH! 🥰 "Sie suchen eine auf das CMS #Drupal spezialisierte Internetagentur… read more

twitter

RT @drupalasheville: If you have an amazing training idea for #Drupal Camp #Asheville, remember to submit by March 28. That’s in two weeks!… read more

twitter

If you have an amazing training idea for #Drupal Camp #Asheville, remember to submit by March 28. That’s in two weeks! If you are an expert in #SEO, #accessibility, #front-end technology, etc. our attendees would love to learn from you. Learn more at https://t.co/kOg4BLfyXq. https://t.co/IBB17YWptn read more

twitter

The latest Drupal Review! https://t.co/AWLDaVGtYD Thanks to @laravel_101 #drupal #developer read more

twitter

RT @DrupalCampRuhr: Wir danken unserem Bronze-Sponsor @arocom_GmbH! 🥰 "Sie suchen eine auf das CMS #Drupal spezialisierte Internetagentur… read more

twitter

Dziś chcemy przedstawić Wam ciekawe oferty na: 𝗗𝗮𝘁𝗮 𝗘𝗻𝗴𝗶𝗻𝗲𝗲𝗿𝗮 𝗶 𝗣𝗛𝗣/𝗗𝗿𝘂𝗽𝗮𝗹 𝗗𝗲𝘃𝗲𝗹𝗼𝗽𝗲𝗿𝗮🔥 𝗣𝗛𝗣/𝗗𝗿𝘂𝗽𝗮𝗹 𝗗𝗲𝘃𝗲𝗹𝗼𝗽𝗲𝗿 👇 https://t.co/INoX6d6iSQ 𝗗𝗮𝘁𝗮 𝗘𝗻𝗴𝗶𝗻𝗲𝗲𝗿 👇 https://t.co/9VmiuyNKZ6 #dataengineer #php #Drupal https://t.co/3lW6NZBTPn read more

twitter

Wir danken unserem Bronze-Sponsor @arocom_GmbH! 🥰 "Sie suchen eine auf das CMS #Drupal spezialisierte Internetagentur? Dann sind Sie bei der arocom GmbH genau richtig. Wir entwickeln individuelle Internetauftritte, Portale, Shops und Intranetlösungen." (gs) #dcruhr23 https://t.co/eR7Ql6Tmns read more

twitter

Join us April 27 for the Drupal Zurich Meeting with talks about Ting, AI-Powered-Search-Indexes as well as @SplashAwards_CH 2023 #Drupal #DrupalZH #DrupalSwitzerland https://t.co/HICNsoGSuv read more

twitter

I love all my Drupal and Magento projects I developed in the past 😁🙌 especially Shutterstock from the USA liked it #drupal read more

twitter

RT @drupalfr: 🔍 Vous avez peut-être vu passer une enquête sur les environnements de développement locaux avec #Drupal récemment ? Elle es… read more

twitter

🔍 Vous avez peut-être vu passer une enquête sur les environnements de développement locaux avec #Drupal récemment ? Elle est désormais disponible en français, et vous avez jusqu'au 17 avril pour participer ! 🇫🇷 https://t.co/bvGG2Mh0cI read more

twitter

On episode #390, Employee Owned Business with Seth Brown, CEO @lullabot. https://t.co/KiYM6Zwz5C #drupal read more

twitter

Specbee: Mastering Drupal 9 Layout Builder: A Comprehensive Guide to Effortlessly Customize Your Website's Design https://t.co/J3m41Xemep #drupal read more

twitter

In this blog's category, you’ll learn about useful features of Droopler - our #Drupal distribution for building websites/creating landing pages for #marketing campaigns 👨‍💻 Check the #SEO and navigation functionalities, and the web pages built on Droopler https://t.co/CeicqTnTad read more

twitter

RT @ultimike: I am not surprised by these new #drupal modules, and I welcome our new AI-based content overlords with peace and love 😜 http… read more

twitter

¿Instalar #Drupal con un solo click? Si es posible con nuestros planes de #Hosting (Hospedaje Web), Contrata tu plan ¡Ahora! https://t.co/UyteHPrXCq read more

twitter

ちょっと時間があったので、https://t.co/Fa5p1pcDT8 Blueprintsを触ってみた。Add https://t.co/Fa5p1pcDT8 content typeでレストランとかパン屋を定義してみて、結構ワクワクした。UIが良く属性定義のベストプラクティスが出てくる感じ。 #Drupal https://t.co/mkd5ciBgLy read more

twitter

RT @volkswagenchick: Want to learn how to contribute to #Drupal? Join me at @FoxValleyDrupal next month to learn the ins and outs of the is… read more

twitter

RT @volkswagenchick: Want to learn how to contribute to #Drupal? Join me at @FoxValleyDrupal next month to learn the ins and outs of the is… read more

twitter

RT @ultimike: I am not surprised by these new #drupal modules, and I welcome our new AI-based content overlords with peace and love 😜 http… read more

twitter

RT @opensourceway: Want to learn how to contribute to #Drupal? Join @opensourceway's @volkswagenchick at @FoxValleyDrupal next month to l… read more

twitter

RT @ultimike: I am not surprised by these new #drupal modules, and I welcome our new AI-based content overlords with peace and love 😜 http… read more

twitter

With our #webhosting plans, #webdev create your awesome #website with #drupal a #Free content management system (cms) https://t.co/HbNxEroF4h read more

twitter

RT @volkswagenchick: Want to learn how to contribute to #Drupal? Join me at @FoxValleyDrupal next month to learn the ins and outs of the is… read more

twitter

Want to learn how to contribute to #Drupal? Join @opensourceway's @volkswagenchick at @FoxValleyDrupal next month to learn the ins and outs of the Drupal issue queue. Spoiler alert: you don't have to be a coder to give back to open source. … https://t.co/yi56be3YUR read more

twitter

The latest The drupal Daily! https://t.co/EXg9Mjai8k Thanks to @laravel_101 #drupal #wordpress read more

twitter

@bretwp I recommend #Drupal for sites that have the need to tie together dynamic content in a plethora of ways. Good for HighEd or government sites. read more

Powered By Combinary

twitter

opensourceway: Want to learn how to contribute to #Drupal? Join @opensourceway's @volkswagenchick at @FoxValleyDrupal next month to learn the ins and outs of the Drupal issue queue. Spoiler alert: you don't have to be a coder to give back to open sour… https://t.co/POww6YqRQP read more

twitter

Want to learn how to contribute to #Drupal? Join @opensourceway's @volkswagenchick at @FoxValleyDrupal next month to learn the ins and outs of the Drupal issue queue. Spoiler alert: you don't have to be a coder to give back to open source. https://t.co/G3dSaUzV5r read more

twitter

Want to learn how to contribute to #Drupal? Join me at @FoxValleyDrupal next month to learn the ins and outs of the issue queue. Spoiler alert: you don't have to be a coder to give back to open source. read more

twitter

RT @mikeherchel: #Drupal I wrote a blog post on how I migrated an Olivero component to use Drupal's new Single Directory Components archite… read more

twitter

RT @boshtian: Drupal 10 upgrade: Custom code upgrades, post by @darthsteven of @computerminds https://t.co/StelwGvv96 #Drupal read more

twitter

@iansvo @bretwp Not in the recommendation business anymore but here is how it normally goes - @rootswp for those who love #WordPress + #Laravel. @drupal for those who love @symfony I personally prefer #Drupal these days. read more

twitter

RT @boshtian: Drupal 10 upgrade: Custom code upgrades, post by @darthsteven of @computerminds https://t.co/StelwGvv96 #Drupal read more

twitter

RT @mikeherchel: #Drupal I wrote a blog post on how I migrated an Olivero component to use Drupal's new Single Directory Components archite… read more

twitter

#365daysOfCode Day 356 1. Anki 2. Reading: Javascript Security 101 3. #Drupal : Block Views, built my first one! Still need to push more on drupal it's tough (anyone know any good resources?) 4. #100Devs Standup 5. PoW Dev Hangout 6. Codewars 6th read more

twitter

Attention #Drupal developers: @scsclassics is hiring! Details at https://t.co/3lTYHaQys3 read more

twitter

RT @volkswagenchick: Are you ready to be part of the most exciting European #Drupal event of the year? @DrupalConEur Lille's CFPs is now o… read more

twitter

RT @mikeherchel: #Drupal I wrote a blog post on how I migrated an Olivero component to use Drupal's new Single Directory Components archite… read more

twitter

Talking Drupal: Talking Drupal #390 - Employee Owned Companies https://t.co/fUCxjhpPb5 #drupal read more

twitter

RT @volkswagenchick: Are you ready to be part of the most exciting European #Drupal event of the year? @DrupalConEur Lille's CFPs is now o… read more

twitter

RT @DrupalContract: Now #hiring ➡️ We’re looking for a #Drupal Redesign Project Manager who is skilled with managing project development, d… read more

twitter

RT @DrupalContract: Now #hiring ➡️ We’re looking for a #Drupal Redesign Project Manager who is skilled with managing project development, d… read more

twitter

Now #hiring ➡️ We’re looking for a #Drupal Redesign Project Manager who is skilled with managing project development, defining project scope, goals, and deliverables, and estimating project resource requirements. Learn more & apply here: https://t.co/TqBE9ftdtR #techishiring read more

twitter

Want to learn more about what Contribution Day at #MidCamp 2023 is going to involve? Have we got a meetup for you on April 19th! Thanks to @FoxValleyDrupal https://t.co/ROnSakuIlZ read more

twitter

In the previous versions of #Drupal, you used the #rules module to trigger an action upon an event. In #durpal8 #drupal9 / #drupal10, you subscribe to events and dispatch your own. read more

twitter

Excited to guest host this webinar and chat with some really great security experts to talk about #security in #Drupal read more

twitter

Start taking digital security more seriously! Come see our webinar as guests from @ciandt and the @drupalassoc share insights on pressing security concerns for businesses and provide practical tips for protecting against emerging threats. Join us: https://t.co/E6pvqu2mWO https://t.co/TQcrqAxH5u read more

twitter

Drupal 10 upgrade: Custom code upgrades, post by @darthsteven of @computerminds https://t.co/StelwGvv96 #Drupal read more

twitter

By not upgrading your #Drupal websites to the latest version of #Drupal, you're making it difficult for yourself in the future. read more

twitter

I am not surprised by these new #drupal modules, and I welcome our new AI-based content overlords with peace and love 😜 https://t.co/gXLVYFZ19q Thanks, @kevinquillen, for giving me something new to be distracted by. read more

twitter

Looking to scale up a Drupal site? Or test its capacity to handle surges in volume? Promet’s Josh Estep reviews four load-testing tools for Drupal. https://t.co/6mrfGgWghg #drupal #drupaldeveloper #drupal9 #drugdevelopment #training https://t.co/bKFDuBbrOb read more

twitter

Sprawdź, który system CMS jest dla Ciebie najlepszy! 🤔👨‍💻 Czy to WordPress, Joomla, Drupal, Shopify czy Magento, znajdziesz tu informacje, które pomogą Ci podjąć najlepszą decyzję.📝💻 https://t.co/c17hggTOsB #CMS #WordPress #Joomla #Drupal #Shopify #Magento read more

twitter

To compete with some of the largest companies on the web, independent bookstores need a platform with all of the e-commerce features people have come to expect. See how we helped create a full-featured alternative to platforms like Shopify. https://t.co/A6ApsA1LWP #drupal read more

twitter

Are you ready to be part of the most exciting European #Drupal event of the year? @DrupalConEur Lille's CFPs is now open https://t.co/rz4OkhIZhU read more

twitter

Are you ready to be part of the most exciting European #Drupal event of the year? @DrupalConEur Lille's CFPs is now open https://t.co/6rFNhpIiwJ read more

twitter

Are you ready to be part of the most exciting European #Drupal event of the year? @DrupalConEur Lille's CFPs is now open https://t.co/tVmHJ7JO2a read more

twitter

This #WomensHistoryMonth, support #womenintech by sponsoring the Women in Drupal event at @drupalcon Pittsburgh! Grow and diversify talent in your organization by showcasing the #Drupal project and community at its best: https://t.co/j3fGMwOqyy https://t.co/GZUo6uBrlu read more

twitter

You can write documentation and examples about that documentation. This is also considered a contribution towards the #Drupal project. read more

twitter

I’ll be speaking at @drupalcampnj this week - who else is going? read more

twitter

Yesterday we released #GinAdminTheme RC2. Get it while it's hot: https://t.co/O7ItwDngLu #Drupal read more

twitter

RT @mikeherchel: #Drupal I wrote a blog post on how I migrated an Olivero component to use Drupal's new Single Directory Components archite… read more

twitter

RT @specbee: Did you know #Drupal offers almost 50,000 modules for you to use in your projects?! All of these modules are creations of the… read more

twitter

RT @specbee: Read our detailed blog on the must have Drupal modules for your Drupal project - https://t.co/TJXt8BGS1h read more

twitter

Attending @DrupalCampNJ in Princeton? Then you won't want to miss @aburke626's session, "Creating a Culture of Documentation,” on Friday, March 17th from 14:30 - 15:15 EST. For more on Alanna's session, check out: https://t.co/1NztgYY9ps #OpenSource #DrupalCamp #Drupal https://t.co/67kIG6IVcn read more

twitter

@somnana555 @RMCSportCombat @RMCsport BIG PROMOTION ( Free Trial ) IP TV: 40 € / 12 months : 30 € / up to 6 months IP TV is over 18,000 live channels - 𝐒𝐏𝐎𝐑𝐓 https://t.co/EcsCMBEzEL #Encodage/ #H264 / #x264 / #x265 / #VOD / #OTT / #IPTV / #HEVC / #av1 / #MotionDesign / #VR / #Drupal / #caméraVR #livestream360 read more

twitter

@steven_reyes_va @CSEmelec BIG PROMOTION ( Free Trial ) IP TV: 40 € / 12 months : 30 € / up to 6 months IP TV is over 18,000 live channels - 𝐒𝐏𝐎𝐑𝐓 https://t.co/EcsCMBEzEL #Encodage/ #H264 / #x264 / #x265 / #VOD / #OTT / #IPTV / #HEVC / #av1 / #MotionDesign / #VR / #Drupal / #caméraVR #livestream360 read more

twitter

@Transports2K @Panamza BIG PROMOTION ( Free Trial ) IP TV: 40 € / 12 months : 30 € / up to 6 months IP TV is over 18,000 live channels - 𝐒𝐏𝐎𝐑𝐓 https://t.co/EcsCMBEzEL #Encodage/ #H264 / #x264 / #x265 / #VOD / #OTT / #IPTV / #HEVC / #av1 / #MotionDesign / #VR / #Drupal / #caméraVR #livestream360 read more

#! code: Drupal 11: Migrating From Jadu Into LocalGov Drupal: Part 1

Freelock Blog: Zero to new Drupal site in 133 seconds

BloomIdea: When two terms called Food are not the same term

Name is not identity

Resolving a path one parent at a time

Setting it up

The one step people miss

More than one path per column

When you do not want new terms at all

When the source only has part of the path

Where it stands

Drupal AI Learners Club - 2026-07-31 - Getting AI to Read Your Docs with Jürgen Haas

The Drop Times: Randy Kolenko on Maestro and Drupal’s Emerging Orchestration Work

Empowering Creators and Governing Agents: The Next Phase of the Drupal AI Initiative

"Inside AI" vs. "Outside AI"

1. Inside AI

2. Outside AI

What is Ready Now?

Live and Ready

Ready for Beta Testing

Coming Soon

Control and Governance

Accelerate Your Roadmap

Drupal AI Initiative: Empowering Creators and Governing Agents: The Next Phase of the Drupal AI Initiative

"Inside AI" vs. "Outside AI"

1. Inside AI

2. Outside AI

What is Ready Now?

Live and Ready

Ready for Beta Testing

Coming Soon

Control and Governance

Accelerate Your Roadmap

The Drop Times: Entity Reference Field Override Adds Per-Placement Control in Drupal

Morpht: Building a semantic search chatbot with Drupal AI

Stuart Clark (Deciphered): Custom Formatters 4.1.0

Talking Drupal: Talking Drupal #563 - Drupito: More Than a Marketplace

Metadrop: How to automate WordPress-to-Drupal content migration with WordPress Migrate SQL

The challenge of migrating WordPress content to Drupal

Dries Buytaert: Responsibility follows control

Open-weight models unbundle control

A lesson from Drupal and Open Source

The product is where capability receives authority

How should government regulate AI?

Three questions before blocking a model's release

Electric Citizen: What’s the Deal with Schema

ImageX: World Wide Web Day: The Birth of the Web, And How Drupal Supports its Values

Why We Contribute: The Philosophy Behind 1xINTERNET's Top-Tier Drupal Status

Building the future instead of following it

Open source is built on collaboration

Contribution isn't separate from client work

Driving innovation through Drupal AI

Better contributions create better client solutions

Trust has become a competitive advantage

Supporting digital sovereignty

A culture that attracts exceptional people

Looking ahead

More than contribution

Drupal Association blog: Why We Contribute: The Philosophy Behind 1xINTERNET's Top-Tier Drupal Status

Building the future instead of following it

Open source is built on collaboration

Contribution isn't separate from client work

Driving innovation through Drupal AI

Better contributions create better client solutions

Trust has become a competitive advantage

Supporting digital sovereignty

A culture that attracts exceptional people

Looking ahead

More than contribution

Smartbees: Automatic Content Translation System

Tag1 Insights: Teaching AI to Speed Up Accessibility Testing

Take Away

One Skill File Was Not Nearly Enough

Humans Stay In the Loop, On Purpose

What Broke Along the Way

Did It Produce Anything?

How Do I Know It Isn't Missing Things?

The Workflow Keeps Evolving

What You Can Take From This

DDEV Blog: A Love Letter to the DDEV Community