Search feels like a solved problem. Until you're managing a network of Drupal sites and your users expect to find content regardless of which one it lives on, that is. At that point, the question stops being "how do we add search?" and starts being "how do we build a unified search experience across an entire digital ecosystem?"
The obvious workaround is to bring in a third-party Solr provider. That works, but it means another vendor, another bill, and another service to monitor and secure. For organizations already invested in Pantheon's managed infrastructure, it further fragments the operational footprint rather than simplifying it.
At Aten, this challenge comes up regularly with clients running multi-site Drupal architectures on Pantheon. The solution we've landed on keeps everything within the platform, using four contributed modules working together as a hub-and-spoke proxy. This post walks through the architecture, why it exists, and how to implement it.
Pantheon's managed Solr is excellent: zero server administration, mTLS-secured connections, schema management handled through a purpose-built API. But it comes with a hard platform constraint: each Drupal site environment gets exactly one Solr core, and that core is network-isolated to that environment.
There is no platform mechanism to point a second Drupal site at another site's Solr instance. Each site can only talk to its own.
This is a reasonable security tradeoff for single-site use. But for a multi-site architecture where you need a single search index spanning many sites, it forces you to think architecturally rather than just reach for a configuration option.
The solution is a hub-and-spoke proxy. One Drupal site (the hub) owns the Solr core and exposes it to other sites over authenticated HTTP. Every other site (the clients) routes its search queries through the hub instead of connecting to Solr directly.
From Pantheon's perspective, only the hub ever touches Solr. The constraint is satisfied. From Search API's perspective, every client is talking to a Solr instance in the normal way. The architecture sits between those two layers.
Four contributed modules make this work:
| Module | Installed on | Role |
|---|---|---|
search_api_pantheon | Hub | Connects to Pantheon Solr via env vars and mTLS |
pantheon_solr_api | Hub | Exposes Solr to authenticated clients via HTTP proxy |
search_api_solr_proxy | Each client | Abstract proxy base; no direct configuration |
search_api_solr_proxy_pantheon_connector | Each client | Routes queries through hub; manages API key via Key module |
search_api_pantheonThis is the only module in the stack that speaks directly to Pantheon's Solr. It extends Search API Solr's standard connector and replaces the typical admin configuration form with auto-discovered values from Pantheon's environment variables (PANTHEON_INDEX_HOST, PANTHEON_INDEX_PORT, PANTHEON_INDEX_CORE, and others). On Pantheon environments, those fields are disabled in the UI; the platform owns them.
For transport, it swaps in a custom cURL adapter that uses the mTLS certificate Pantheon provisions at ~/certs/binding.pem. Schema uploads and core reloads go through Pantheon's proprietary endpoints rather than the standard Solr APIs.
pantheon_solr_apiThis module is what actually opens the hub's Solr to the outside world. It exposes a set of Drupal routes at /solr-proxy/{action} that authenticated client sites can POST and GET against, and a standalone PHP file at /pantheon-solr-proxy.php for high-performance SELECT queries (more on that below).
Every request is validated against a shared API key before it reaches Solr. The key is read from a configured Key module entity (backed by a Pantheon Secret) and compared using hash_equals(), a timing-safe comparison that prevents key enumeration attacks. Only a hardcoded allowlist of Solr actions (select, update, update/json, admin/ping, admin/luke, config, and a handful of others) will be forwarded. Anything outside that list returns a 403.
Client registrations are tracked in Drupal config, keyed by the combination of each site's Search API site hash and index ID, the same namespace Search API Solr uses internally to scope documents.
search_api_solr_proxy + search_api_solr_proxy_pantheon_connectorsearch_api_solr_proxy is a framework-only module. It provides the abstract SolrProxyConnectorBase class but is not useful on its own. search_api_solr_proxy_pantheon_connector is the Pantheon-specific implementation.
On each client site, the connector replaces the standard Search API server configuration (host, port, path, core) with a single hub_url field. A Guzzle middleware stack handles two things:
X-Pantheon-Solr-Key header carrying the API key from the Key module entity./pantheon-solr-proxy.php on the hub; everything else routes to /solr-proxy/{action} through Drupal.Because client sites never manage the Solr schema directly, skip_schema_check is permanently enabled. The connector also auto-detects the Solr version by querying the hub's admin/system endpoint, falling back to 8.11.4 (Pantheon's current managed version) if the endpoint is unreachable.
Here is the path of a typical user search on a client site:
X-Pantheon-Solr-Key header, and rewrites the URL to https://hub.example.com/pantheon-solr-proxy.php?....pantheon-solr-proxy.php runs as a standalone PHP script with no Drupal bootstrap. It validates the API key, constructs the Solr URL from Pantheon environment variables, and forwards the request using the mTLS certificate.SELECT queries bypass Drupal's bootstrap entirely. On a warm server, the round trip through the proxy adds approximately 5ms of overhead. Writes, admin actions, and schema operations go through the Drupal controller instead, which adds around 150ms. That's acceptable for infrequent operations.
composer require drupal/search_api_pantheon drupal/pantheon_solr_api drush en search_api_pantheon pantheon_solr_api
Navigate to Administration > Configuration > Search and metadata > Pantheon Solr API. Select or create a Key entity pointing to the PANTHEON_SOLR_API_KEY Pantheon Secret. This is the shared key your client sites will use to authenticate.
Copy pantheon-solr-proxy.php (provided by pantheon_solr_api) to your hub site's web root. This is the fast-path script for SELECT queries.
composer require drupal/search_api drupal/search_api_solr drupal/search_api_solr_proxy drush en search_api search_api_solr search_api_solr_proxy_pantheon_connector
Create a Search API server using the Pantheon Solr Proxy connector. Set the Hub URL to your hub site's base URL. Configure the Key entity to use the same PANTHEON_SOLR_API_KEY secret.
Create your Search API index on that server as you normally would, with any entity types, fields, and processors you need.
Then run the registration command:
drush pantheon-solr-proxy:registerThis command auto-discovers your Search API server and index, reads the site hash and index ID that Search API Solr uses to namespace your documents, and POSTs that registration to the hub. Back on the hub, run:
drush pantheon-solr-api:update-indexRepeat the client-side steps for each site in your network.
Schema management stays on the hub. Only the hub ever uploads schema files to Pantheon. Client sites have skip_schema_check forced on. If your search requirements across sites are different enough to require separate schemas, this architecture assumes you can reconcile them into a single configset. In practice, the search_api_solr jump-start configset handles most requirements.
Document namespacing is automatic. Search API Solr already scopes every indexed document with a per-site hash and index ID prefix. Each client site's documents live in separate namespaces within the same Solr core. Cross-site queries need to either search all namespaces or be scoped deliberately; your Views or custom query code controls this.
The API key is a Pantheon Secret, not a config value. Keys stored in pantheon_solr_api.settings Drupal config hold a reference to a Key module entity, not the raw key. The actual secret is resolved at runtime from PANTHEON_SOLR_API_KEY. This keeps credentials out of your config exports and codebase.
Unified search across a multi-site Drupal architecture is one of those problems that looks straightforward until you try to implement it on a managed platform. Pantheon's security model solves a lot of problems, but it introduces constraints that require a deliberate architectural response.
The hub-and-spoke proxy described here is that response. It works within the platform's model, keeps credentials out of the codebase, and adds minimal latency to the critical read path.
If you're building a multi-site Drupal ecosystem and working through the hard architectural questions around search, shared data, and cross-site workflows, get in touch with the Aten team. This is the kind of problem we solve.
B2C eCommerce usually gets all the attention, because that’s what most people engage with. They buy stuff from Amazon, Etsy, or a Shopify store without thinking too much about it. The customer comes to the website and makes a purchase. Usually, there is a portal to track the order and some transactional emails for updates, and finally, the package is delivered to their door. If they bought from a company that has its act together, they might spend the next 3-6 months being remarketed to because the company really wants to make this customer a repeat customer.
But this B2C eCommerce experience, while ubiquitous and recognizable to most, is only scratching the surface.
The scale of B2B commerce is actually much larger than its B2C cousin. The global B2B eCommerce market is expected to reach roughly $37 trillion in 2026, approximately six times the size of the global B2C market. Yet despite that enormous footprint, B2B digital commerce remains far less mature than its B2C counterpart. Software that serves the latter doesn’t work for the former. The differences between B2B and B2C commerce run deep, from how deals get made to how orders get shipped to how platforms are architected. Different customers. Different requirements. Different expectations. To add further complications, businesses increasingly need to operate in both worlds simultaneously.
Read more read moreJust two months after the milestone release of Drupal AI 1.3.0, we are thrilled to announce that Drupal AI 1.4.0 is officially here!
With the 1.x branch reaching a high level of maturity and stability, we are excited to transition into a more predictable, bi-monthly minor release cadence. Moving forward, the Drupal community can look forward to a steady, reliable stream of improvements, new integrations, and expanded platform capabilities.
Drupal AI 1.4.0 represents a major evolutionary step, focusing heavily on extensibility, scalability, normalization, and preparing the broader ecosystem for the next generation of AI-powered digital experiences.
Let's dive into what's new in this release.
One of our primary themes for 1.4.0 is giving contributed module developers the tools they need to extend and enrich Drupal AI. We want to make extending this module as seamless as writing a simple prompt.
Contrib modules can now extend the markdown editor experience directly. The newly available Document Loader integration, for example, allows content creators to load content from virtually any document type directly into their editor workflow.
This architectural improvement opens the door for the community to build richer editor experiences and provider-specific tooling without requiring any modifications to Drupal AI core.
To radically accelerate development speed and reduce boilerplate code, we are introducing both AI "skills" and drush generate commands that allow developers to rapidly generate:
For teams utilizing coding agents or AI-assisted development workflows, these new skills can automatically generate integrations that strictly follow Drupal AI best practices—saving hours of development time.
Image showcasing Slack Chat Processor together with the Webform Agent.
One of the most significant architectural milestones in 1.4.0 is the introduction of normalization for chat systems - an abstraction layer that decouples chat interfaces from their underlying AI processors, so integrations are no longer tightly bound to specific implementations.
This opens the door to immediate, practical use cases: the newly introduced Slack Chat processor lets team members communicate with Drupal AI agents directly through Slack.
More broadly, it lays the groundwork for the upcoming AI Agents processor release and makes it significantly easier to build, package, and reuse conversational, multi-channel AI experiences across providers and platforms.
Handling content at scale is one of Drupal's core strengths, and in 1.4.0 we are supercharging this capability. AI Automators can now execute any configured rule or AI type directly as a Views Bulk Operation (VBO).
This integration unleashes massive efficiency gains for content editors and site administrators. Instead of running AI operations page-by-page, teams can trigger complex, AI-driven workflows across hundreds or thousands of entities simultaneously.
Site builders can now configure Views to bulk-execute tasks such as:
This is a massive usability win for teams responsible for maintaining and optimizing large, enterprise-scale content repositories.
Enterprise-grade operations demand high availability. Drupal AI 1.4.0 lays the crucial architectural groundwork for robust failover and redundancy support across your entire AI stack.
The module's architecture is now fully equipped to handle advanced failover processes. In the near future, site builders will be able to use powerful tools like ECA (Events, Conditions, Actions) to configure custom AI routing logic, unlocking enterprise-ready scenarios, such as:
This represents a significant step toward securing permanent, enterprise-grade reliability for AI in Drupal.
The guardrails feature introduced in 1.3.0 has received a massive upgrade in this release, making Drupal AI safer and more production-ready for large-scale, public-facing deployments.
In 1.4.0, guardrails can now:
The input length limit is a vital security layer designed to prevent "denial-of-wallet" attacks, where malicious actors attempt to spike your API costs by sending exceptionally large, resource-intensive prompts to your providers.
Furthermore, our new real-time streaming guardrails represent a unique solution that very few AI frameworks—and virtually no other CMS platforms—can offer out of the box.
Ultimately, Drupal AI 1.4.0 is less about flashy UI features and more about strengthening our platform's foundational architecture for the future.
With normalized chat interfaces, failover-ready systems, hardened security guardrails, deep VBO integrations, and stateful provider capabilities, this release solidifies Drupal AI as a more reliable, more extensible, and more enterprise-ready platform — built for the open web.
Update your modules, explore the new Drush generators, test out the Slack integrations, and let us know what you build!
For details on the roadmap or to get involved in the initiative, visit our project page on Drupal.org.
Just two months after the milestone release of Drupal AI 1.3.0, we are thrilled to announce that Drupal AI 1.4.0 is officially here!
With the 1.x branch reaching a high level of maturity and stability, we are excited to transition into a more predictable, bi-monthly minor release cadence. Moving forward, the Drupal community can look forward to a steady, reliable stream of improvements, new integrations, and expanded platform capabilities.
Drupal AI 1.4.0 represents a major evolutionary step, focusing heavily on extensibility, scalability, normalization, and preparing the broader ecosystem for the next generation of AI-powered digital experiences.
Let's dive into what's new in this release.
One of our primary themes for 1.4.0 is giving contributed module developers the tools they need to extend and enrich Drupal AI. We want to make extending this module as seamless as writing a simple prompt.
Contrib modules can now extend the markdown editor experience directly. The newly available Document Loader integration, for example, allows content creators to load content from virtually any document type directly into their editor workflow.
This architectural improvement opens the door for the community to build richer editor experiences and provider-specific tooling without requiring any modifications to Drupal AI core.
To radically accelerate development speed and reduce boilerplate code, we are introducing both AI "skills" and drush generate commands that allow developers to rapidly generate:
For teams utilizing coding agents or AI-assisted development workflows, these new skills can automatically generate integrations that strictly follow Drupal AI best practices—saving hours of development time.
Image showcasing Slack Chat Processor together with the Webform Agent.
One of the most significant architectural milestones in 1.4.0 is the introduction of normalization for chat systems - an abstraction layer that decouples chat interfaces from their underlying AI processors, so integrations are no longer tightly bound to specific implementations.
This opens the door to immediate, practical use cases: the newly introduced Slack Chat processor lets team members communicate with Drupal AI agents directly through Slack.
More broadly, it lays the groundwork for the upcoming AI Agents processor release and makes it significantly easier to build, package, and reuse conversational, multi-channel AI experiences across providers and platforms.
Handling content at scale is one of Drupal's core strengths, and in 1.4.0 we are supercharging this capability. AI Automators can now execute any configured rule or AI type directly as a Views Bulk Operation (VBO).
This integration unleashes massive efficiency gains for content editors and site administrators. Instead of running AI operations page-by-page, teams can trigger complex, AI-driven workflows across hundreds or thousands of entities simultaneously.
Site builders can now configure Views to bulk-execute tasks such as:
This is a massive usability win for teams responsible for maintaining and optimizing large, enterprise-scale content repositories.
Enterprise-grade operations demand high availability. Drupal AI 1.4.0 lays the crucial architectural groundwork for robust failover and redundancy support across your entire AI stack.
The module's architecture is now fully equipped to handle advanced failover processes. In the near future, site builders will be able to use powerful tools like ECA (Events, Conditions, Actions) to configure custom AI routing logic, unlocking enterprise-ready scenarios, such as:
This represents a significant step toward securing permanent, enterprise-grade reliability for AI in Drupal.
The guardrails feature introduced in 1.3.0 has received a massive upgrade in this release, making Drupal AI safer and more production-ready for large-scale, public-facing deployments.
In 1.4.0, guardrails can now:
The input length limit is a vital security layer designed to prevent "denial-of-wallet" attacks, where malicious actors attempt to spike your API costs by sending exceptionally large, resource-intensive prompts to your providers.
Furthermore, our new real-time streaming guardrails represent a unique solution that very few AI frameworks—and virtually no other CMS platforms—can offer out of the box.
Ultimately, Drupal AI 1.4.0 is less about flashy UI features and more about strengthening our platform's foundational architecture for the future.
With normalized chat interfaces, failover-ready systems, hardened security guardrails, deep VBO integrations, and stateful provider capabilities, this release solidifies Drupal AI as a more reliable, more extensible, and more enterprise-ready platform — built for the open web.
Update your modules, explore the new Drush generators, test out the Slack integrations, and let us know what you build!
For details on the roadmap or to get involved in the initiative, visit our project page on Drupal.org.
Just two months after the milestone release of Drupal AI 1.3.0, we are thrilled to announce that Drupal AI 1.4.0 is officially here!
With the 1.x branch reaching a high level of maturity and stability, we are excited to transition into a more predictable, bi-monthly minor release cadence. Moving forward, the Drupal community can look forward to a steady, reliable stream of improvements, new integrations, and expanded platform capabilities.
Drupal AI 1.4.0 represents a major evolutionary step, focusing heavily on extensibility, scalability, normalization, and preparing the broader ecosystem for the next generation of AI-powered digital experiences.
Let's dive into what's new in this release.
One of our primary themes for 1.4.0 is giving contributed module developers the tools they need to extend and enrich Drupal AI. We want to make extending this module as seamless as writing a simple prompt.
Contrib modules can now extend the markdown editor experience directly. The newly available Document Loader integration, for example, allows content creators to load content from virtually any document type directly into their editor workflow.
This architectural improvement opens the door for the community to build richer editor experiences and provider-specific tooling without requiring any modifications to Drupal AI core.
To radically accelerate development speed and reduce boilerplate code, we are introducing both AI "skills" and drush generate commands that allow developers to rapidly generate:
For teams utilizing coding agents or AI-assisted development workflows, these new skills can automatically generate integrations that strictly follow Drupal AI best practices—saving hours of development time.
Image showcasing Slack Chat Processor together with the Webform Agent.
One of the most significant architectural milestones in 1.4.0 is the introduction of normalization for chat systems - an abstraction layer that decouples chat interfaces from their underlying AI processors, so integrations are no longer tightly bound to specific implementations.
This opens the door to immediate, practical use cases: the newly introduced Slack Chat processor lets team members communicate with Drupal AI agents directly through Slack.
More broadly, it lays the groundwork for the upcoming AI Agents processor release and makes it significantly easier to build, package, and reuse conversational, multi-channel AI experiences across providers and platforms.
Handling content at scale is one of Drupal's core strengths, and in 1.4.0 we are supercharging this capability. AI Automators can now execute any configured rule or AI type directly as a Views Bulk Operation (VBO).
This integration unleashes massive efficiency gains for content editors and site administrators. Instead of running AI operations page-by-page, teams can trigger complex, AI-driven workflows across hundreds or thousands of entities simultaneously.
Site builders can now configure Views to bulk-execute tasks such as:
This is a massive usability win for teams responsible for maintaining and optimizing large, enterprise-scale content repositories.
Enterprise-grade operations demand high availability. Drupal AI 1.4.0 lays the crucial architectural groundwork for robust failover and redundancy support across your entire AI stack.
The module's architecture is now fully equipped to handle advanced failover processes. In the near future, site builders will be able to use powerful tools like ECA (Events, Conditions, Actions) to configure custom AI routing logic, unlocking enterprise-ready scenarios, such as:
This represents a significant step toward securing permanent, enterprise-grade reliability for AI in Drupal.
The guardrails feature introduced in 1.3.0 has received a massive upgrade in this release, making Drupal AI safer and more production-ready for large-scale, public-facing deployments.
In 1.4.0, guardrails can now:
The input length limit is a vital security layer designed to prevent "denial-of-wallet" attacks, where malicious actors attempt to spike your API costs by sending exceptionally large, resource-intensive prompts to your providers.
Furthermore, our new real-time streaming guardrails represent a unique solution that very few AI frameworks—and virtually no other CMS platforms—can offer out of the box.
Ultimately, Drupal AI 1.4.0 is less about flashy UI features and more about strengthening our platform's foundational architecture for the future.
With normalized chat interfaces, failover-ready systems, hardened security guardrails, deep VBO integrations, and stateful provider capabilities, this release solidifies Drupal AI as a more reliable, more extensible, and more enterprise-ready platform — built for the open web.
Update your modules, explore the new Drush generators, test out the Slack integrations, and let us know what you build!
For details on the roadmap or to get involved in the initiative, visit our project page on Drupal.org.
DrupalCon Rotterdam is one of those events that naturally attracts attention across the Drupal ecosystem. Not only because it brings the community together, but because it creates a space where technology, strategy, contribution and real-world digital projects meet.
For anyone working with Drupal, open source or digital experience platforms, the question is not just “what happens at DrupalCon?”, but it might be: “If you have never been before, why should this be the year to go?”
Photo by Joris Vercammen
Rotterdam feels like a strong fit for an event like DrupalCon. It is a city known for innovation, architecture, international connections and a forward-looking mindset — qualities that align naturally with the spirit of the Drupal community.
Bringing DrupalCon to Rotterdam creates an opportunity to connect the European Drupal community in a dynamic and accessible setting. It also gives professionals from different markets the chance to meet, exchange perspectives and discuss how Drupal continues to evolve in a fast-changing digital landscape.
One of the strongest reasons to attend DrupalCon is the quality of the knowledge shared by the community.
This is not only about product updates or technical presentations, It is about learning from people who are building, maintaining and improving digital platforms in real contexts, often with complex requirements, long-term governance needs and ambitious user experience goals.
From technical sessions to strategic case studies, DrupalCon gives attendees access to practical insight that is difficult to get from documentation alone.
Drupal has always been more than a content management system; It is an open-source project supported by a global network of contributors, companies and professionals.
For someone who has never attended before, this is one of the most compelling reasons to go: Online discussions, issue queues and documentation are valuable, but meeting people face to face adds a different layer to the experience.
Conversations during sessions, between talks or at community events can lead to new ideas, partnerships and a better understanding of how others approach similar challenges.
Photo by Matthew Saunders
DrupalCon is also a place to see what organisations are doing with Drupal today.
Real-world examples often show the platform’s value more clearly than feature lists. They reveal how Drupal is being used to support public sector platforms, media websites, higher education, enterprise ecosystems, multilingual content, accessibility requirements and complex editorial workflows.
That is why DrupalCon is relevant beyond development, project managers, designers, UX professionals, marketers, content teams and business leaders can all find useful perspectives on delivery, governance, accessibility, platform strategy and the role of open source in long-term digital transformation.
Attending DrupalCon for the first time is a way to move from observing the community to being part of it.
It is an opportunity to learn from experienced professionals, understand the direction of the platform, discover practical use cases and build connections that can continue long after the event ends.
DrupalCon Rotterdam represents more than another event in the digital calendar, It is a chance to understand Drupal through the people and projects that keep it moving forward.
For a first-time attendee, that may be the strongest reason to go.
Because sometimes the best way to understand the value of a community is not to read about it from the outside. It is to be in the room where that community comes together.
- Article by Daniela Moreira
The JSON:API and REST modules allow you to upload image files to image fields.
The validation rules check the file extension of the uploaded file but not the file MIME type. This may allow a malicious user to upload a file that is not an image.
Certain web-server configurations may serve the uploaded file with its actual MIME type rather than an image type. This may lead to cross-site scripting (XSS) or other unexpected behavior.
Install the latest version:
Drupal 11
Drupal 10
Drupal 11.1.x, Drupal 11.0.x, Drupal 10.4.x, and below are end-of-life and do not receive security coverage. (Drupal 8 and Drupal 9 have both reached end-of-life.)
The Media module comes with support for oEmbed. The oEmbed specification contains two discovery mechanisms, via providers.json and via URL discovery.
The URL discovery code could be leveraged to trick Drupal into making server-side requests to any URL.
Install the latest version:
Drupal 11
Drupal 10
Drupal 11.1.x, Drupal 11.0.x, Drupal 10.4.x, and below are end-of-life and do not receive security coverage. (Drupal 8 and Drupal 9 have both reached end-of-life.)
Most users of the oEmbed functionality in Drupal likely use providers.json to define known providers (such as YouTube and Vimeo) for embedding content.
If you are using URL discovery, you now need to set a list of trusted oEmbed discovery hosts in settings.php.
This is an array containing a series of regular expressions for matching host names for discovery. It follows the same pattern as the existing trusted hosts settings.
Example:
// Only allow URL discovery from example.com.
$settings['media_oembed_discovery_trusted_host_patterns'] = [
'^example\.com$',
];
Drupal core ships a rebuild.php front controller that can be used to rebuild Drupal (clearing the caches and rebuilding the container) when the site is in an unexpected condition.
This script doesn't correctly check the Host header against the list of trusted host patterns. This could result in cache poisoning or a redirect to an attacker-controlled domain.
Install the latest version:
Drupal 11
Drupal 10
Drupal 11.1.x, Drupal 11.0.x, Drupal 10.4.x, and below are end-of-life and do not receive security coverage. (Drupal 8 and Drupal 9 have both reached end-of-life.)
Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists on the site. This so-called "gadget chain" presents no direct threat, but is a vector that can be used to achieve remote code execution or SQL injection if the application deserializes untrusted data due to another vulnerability.
This issue is not directly exploitable.
This issue is mitigated by the fact that in order for it to be exploitable, a separate vulnerability must be present to allow an attacker to pass unsafe input to unserialize().
Install the latest version:
Drupal 11
Drupal 10
Drupal 11.1.x, Drupal 11.0.x, Drupal 10.4.x, and below are end-of-life and do not receive security coverage. (Drupal 8 and Drupal 9 have both reached end-of-life.)
SA-CORE-2019-003 added protection for fields that store serialized data to disallow direct writes via web services.
The above fix did not cover all potential attack vectors for JSON:API. An attacker with appropriate JSON:API write permission could potentially inject a malicious payload in certain rare circumstances, potentially resulting in PHP Object Injection.
This vulnerability is mitigated by the fact that in order to be exploitable:
No field type shipped with Drupal core meets these criteria, and contributed or user-created field types that do appear to be extremely unusual. This update protects all such fields; no changes are required in contributed modules.
JSON:API is read-only by default, so sites are only affected if they have enabled write access (either through administrator configuration or the installation of a contributed or custom module that enables write access).
This issue is being protected by Drupal Steward. In this instance, we believe that the WAF rule will provide mitigation for the common/obvious vulnerability paths, but may not be able to cover all cases or work for all hosting providers. Additionally, several other core security advisories released today are not mitigated by Drupal Steward. Therefore, our recommended action is still to plan an actual Drupal update within 24 hours of this release.
Install the latest version:
Drupal 11
Drupal 10
Drupal 11.1.x, Drupal 11.0.x, Drupal 10.4.x, and below are end-of-life and do not receive security coverage. (Drupal 8 and Drupal 9 have both reached end-of-life.)
Good news for everyone still polishing their entry, we've extended the submission deadline for the International Splash Awards 2026 by four weeks. You now have until 16 July 2026 to submit your project.
As part of our commitment to a fair process, we want to give every Drupal community and agency ample time to put their best work forward. So we're opening the doors wider rather than closing them.
The Splash Awards celebrate the very best Drupal projects from around the world, with winners announced at DrupalCon Rotterdam 2026 (28 September – 1 October). Submitters will be notified of their status in early August.
Learn more & submit your project
Questions? Email drupal@kuonitumlare.com or reach us in #drupalcon_europe on Drupal Slack.
What an exciting time to be a developer. Over the past year, I've gradually begun adopting a number of AI tools to improve the quality of my work, be more efficient, and even dive into areas of development I had never been strong in.
The days of reading blog posts and tutorials or trying code challenges are over. Or are they?
I subscribe to a handful of technical newsletters which arrive in my inbox every week. I always look forward to learning about the new stuff, improvements to old stuff, or the exciting features or tools coming down the development pipeline. I read each one of them in their entirety and if I am too busy, I keep them in my inbox until I have the time to go through them. Sometimes this means I have two issues to read through because I have not been able to get the previous one. I never delete them until I am done with them.
Why waste my time when I can easily ask AI for help? The learning process is exciting for me, it always has been. In the AI era it might even be more important because what if AI is wrong? How do I know the code snippet I am provided is correct or won't cause regressions in my project? Maybe this is the reason I don't use front-end frameworks like Bootstrap or Tailwind in my projects. I have used them for prototyping, but never to dictate the direction or coding conventions in my project.
Let's take a look at a basic example that may seem trivial but could lead to major issues if not understood. Then we will dive into the real reason I decided to write this post.
If you know CSS really well you can skip these examples, but if you don't know what block-level and inline-level elements are in the context of HTML/CSS, you may run into issues with your code you'd think is not working when in fact it might be working as intended.
.block {
display: block; /* 1 */
margin: 24px; /* 2 */
padding: 24px; /* 3 */
width: 100px; /* 4 */
}display:block:
<p>, <div>, <h2>).inline {
display: inline; /* 1 */
margin: 24px; /* 2 */
padding: 24px; /* 3 */
width: 100px; /* 4 */
}display:inline:
<a>, <span>, <img>).inline-block {
display: inline-block; /* 1 */
margin: 24px; /* 2 */
padding: 24px; /* 3 */
width: 100px; /* 4 */
}display:inline-block:
display: inline-block;)Did you know all those specifics about the display CSS property? What if I didn't understand them and wondered why my layout is broken? What if I want to turn an inline-level element into a block-level element and vice versa? What would that do to my layout or spacing around elements?
Here is when it became clear to me that you don't need to be an expert, but at the very least understanding your code can provide you with the ability to question AI's decisions and even push back on its recommendations.
The code challenge was relatively simple because I have done this many times, but this time it was at the end of my day and I was exhausted. So I figured I'd make use of AI to help me complete this task.
I'll focus on only the one piece AI and I had a disagreement on and had to have a heart-to-heart talk about; The card's cta link.
AI built the component for me using Single Directory Component (SDC) conventions along with my custom Storybook's workflow and it worked as expected in Drupal and Storybook, but since this was one of the first components I was building in this new project, I decided that for the link's icon, I wanted to extract the inline SVG from the link.twig template and instead create an <svg>...</svg> asset out of it so I could re-use it in other components.
Originally, AI had opted to use Twig's source() function which is a valid and proper approach for inlining SVGs into components or Twig templates, however, I like to use {% include %} as it provides better cache management especially if I plan to use many icons on my site.
Here's the verbatim conversation about this "simple" change:
Me:
can we extract the icon's svg tag and create a file for it inside src/assets/images/? then twig include it in link.twig? this way we can reuse it in other components
Simple enough, except my project's workflow is unique in that SDC and Storybook share assets (twig, yml, css, js, images), to ensure there is a single source of truth. However, since this was a new project, I had not registered all the required namespaces for Drupal and Storybook to share assets.
AI:
Good call — {% include %} sidesteps source() entirely and avoids the namespace registration work in both Drupal and Storybook.
At this point AI proposed to write a theme hook to register a new Twig namespace Drupal could use to access assets directory.
The proposal of a theme hook to register a new Twig namespace was a NO NO for me because I knew it was not necessary. This takes me back to my original point of being able to understand the code to challenge AI proposed solutions that may not be necessary or an alternative/twig-friendly approach may do just fine.
I immediately questioned the proposal and provided a recommendation.
Me
how about adding a new namespace for drupal that points to src/assets so both storybook and drupal use the same path for assets?
AI
That's the cleanest approach. A single @assets namespace registered in both Storybook and Drupal means the same {% include '@assets/images/icon-arrow.svg' %} line works identically in both environments - no <theme-name>.theme hook needed at all
Needless to say, this was the right call and the final result was summarized by AI as:
AI
For me the main learning lesson of these simple yet real examples is that in the past, “knowing how to code” mostly meant knowing the syntax, semantics and understanding what you were writing. That part is becoming less critical with AI. But the more important skill, "knowing what not to write", hasn’t changed. Avoiding poor tradeoffs, recognizing over-engineered or fragile solutions, those still require judgment. That judgment hasn’t gone away; it’s just being applied later in the process.
These are interesting times for developers. We don’t yet know what this shift means for how we consume knowledge, but I do hope I never lose the desire to read, watch, and try new learning materials, and to still feel excited about them.
Happy learning! 📚
read moreDrupal now ships with HTMX, and there is currently a proposal to add a few of the building blocks into the HTML specification. The effort is nicknamed the triptych and the goal is to add three new HTML features:
Join us THURSDAY, June 18 at 1pm ET / 10am PT, for our regularly scheduled call to chat about all things Drupal and nonprofits. (Convert to your local time zone.)
We don't have anything specific on the agenda this month, so we'll have plenty of time to discuss anything that's on our minds at the intersection of Drupal and nonprofits. Got something specific you want to talk about? Feel free to share ahead of time in our collaborative Google document at https://nten.org/drupal/notes!
All nonprofit Drupal devs and users, regardless of experience level, are always welcome on this call.
This free call is sponsored by NTEN.org and open to everyone.
Information on joining the meeting can be found in our collaborative Google document.
Join us THURSDAY, June 18 at 1pm ET / 10am PT, for our regularly scheduled call to chat about all things Drupal and nonprofits. (Convert to your local time zone.)
We don't have anything specific on the agenda this month, so we'll have plenty of time to discuss anything that's on our minds at the intersection of Drupal and nonprofits. Got something specific you want to talk about? Feel free to share ahead of time in our collaborative Google document at https://nten.org/drupal/notes!
All nonprofit Drupal devs and users, regardless of experience level, are always welcome on this call.
This free call is sponsored by NTEN.org and open to everyone.
Information on joining the meeting can be found in our collaborative Google document.
The question I get most these days is: did AI kill the CMS? Should we still invest in a CMS, switch to AI agents, or wait until the market becomes clearer?
At a friend's birthday party recently, I was talking with engineers and startup CEOs. They were all smart people, but none of them worked in the CMS industry. From where they sat, AI seemed to make the CMS obsolete.
I understand why. AI can now generate copy, design pages, write code, translate content, and assemble websites. If that is what you think a CMS is for, it does look like the CMS is in trouble.
They may be right about one part of the CMS market. But I think they are wrong about the larger picture.
To see why, it helps to separate what a content management system, or CMS, does into two planes: the control plane and the execution plane.
The control plane governs content: who can edit it, what gets approved, which version is canonical, how translations move through workflow, and where content can be used.
The execution plane creates, assembles, and delivers that content into websites, mobile apps, feeds, and other customer experiences.
AI is unbundling these two planes. It is commoditizing the execution plane while making the control plane more valuable. That is why I think AI is killing one corner of the CMS market, but making the CMS more critical everywhere else.
We have seen this pattern before. The printing press made it cheap to produce and distribute content, but it did not make editors or publishers irrelevant. It made them more important, because more content created more need for judgment, trust, and standards.
AI is doing something similar to digital content. It makes production cheaper: drafting, generating, translating, designing, assembling pages, and adapting content for different channels.
But AI should not be the final authority on what is correct, approved, compliant, or safe to publish. It can help, but people and systems still need to own those decisions. The more content AI helps produce and distribute, the more that ownership matters.
As production gets cheaper, control becomes more important, not less.
That is the real test for a CMS. Not whether AI can generate content or build a page, but whether your organization needs a control layer: roles, review, approvals, publishing states, revision history, and more.
Two simple questions can help decide how much you need a CMS:
Put those questions on a grid, and four use cases emerge.
When one person creates and publishes content, and no other systems depend on it, you may not need a CMS. A lightweight publishing tool or AI site builder may be enough.
When multiple people or agents touch content, you need a CMS for coordination: roles, review, approvals, publishing states, and revision history. AI inside the CMS can help teams create, review, and publish faster without losing control.
When many systems touch content, you need a CMS as the trusted source for content, permissions, workflows, and publishing controls. AI around the CMS can coordinate work across tools, but it still depends on the CMS to know what content is approved, who can use it, and where it can go.
In short, when many people and many systems are involved, the CMS becomes the critical control layer for people, agents, and systems working together. It gives people and agents a safe place to create and approve content, and gives other tools a trusted system they can read from, write to, and build on.
This is the simplest case: one person, one system, and little coordination.
If you are creating a new website quickly, an AI site builder may be the right tool. It can turn a prompt into a working site in an afternoon. In that case, a CMS may slow you down more than it helps. This is 1a in the quadrant image: the job is to create, not to manage.
But one person does not always mean a CMS is unnecessary.
My website has been around for more than twenty years. It has more than 1,500 blog posts and 10,000 photos. That is not just a website to create; it is a body of content to manage. Drupal helps me manage that content as structured content: content types, fields, taxonomy, media, revisions, URLs, and search.
I would not move my site to a standalone AI site builder. But I do use an AI agent to work on it through Drupal: updating content, improving existing features, and building new ones. This is 1b on the chart. AI helps with the execution work, while Drupal remains the control plane. This is unbundling at the smallest scale.
So use an AI builder when speed to a new site matters most. Use a CMS when the work is about managing a large or growing body of content over time: keeping it structured, consistent, reusable, and reliable.
This is a clear case for a CMS.
When many people collaborate on one website, the work becomes a "relay": a designer uploads an image, a developer builds a component, a marketer writes the copy, an editor reviews the page, legal approves it, and someone presses publish.
AI does not remove that relay; it makes it move faster. The developer may use an AI coding agent, the marketer may use an AI writing assistant, and the editor may use an AI policy checker. More work moves through the same website, with less time between handoffs.
But the moment several people and several agents are working on the same website, you need a control layer to manage roles, permissions, approvals, revision history, and one source of truth.
A CMS lets teams move at AI speed without losing track of who changed what, which version is approved, and what is safe to publish.
Here the logic changes. You are still one person, so there is little coordination with other people. But the work now spans many systems: a CMS, an email marketing platform, a commerce system, a CRM, and a planning tool.
When one person spans many systems, no single product sees the whole job. The center of gravity moves to the coordinator: an automation tool that connects your systems, or an AI agent that works across their APIs.
That is why this quadrant is debatable. For a short-lived campaign, you may not need a traditional CMS. You might use an AI builder for the site and an automation tool or agent to coordinate the rest.
But that only works while the content is small, short-lived, and easy to manage by hand. Once the content has to be structured, reused, updated, approved, or kept consistent across systems, you need a trusted source for it.
This is the most complex environment, and the clearest case for a CMS.
A company campaign can involve many people and many systems at once: a marketer plans the campaign, a designer reviews the creative, legal approves the content, an editor publishes the page, marketing operations builds the email, and a commerce manager checks the discount. Every person has a role, and every system has a workflow.
AI can remove much of the coordination work: reminders, status updates, handoffs, and manual routing. But coordination is not control. Someone still has to approve the content, approve the promotion, and answer for the campaign's effectiveness.
In this quadrant, the CMS has two jobs. First, it has to govern and accelerate the work that happens inside the CMS. Second, it has to make that work usable by the broader digital ecosystem.
The CMS is not necessarily the orchestrator of that ecosystem. It is the governed workspace where people and agents can work safely, and the trusted source that other systems and agents can read from, write to, and build on.
At this scale, and at AI speed, a weak content foundation becomes expensive fast. A strong CMS is not optional.
One thing the grid does not show is where the market is moving the fastest. Right now, most of the visible energy is on the bottom row of Assist and Delegate, sections 1a and 3a, where no control plane is needed: one person using AI to create and coordinate faster.
In Assist, that means AI site builders that turn an idea into a working website. In Delegate, it means agents and automation for single-person workflows across different systems.
Lovable reportedly reached roughly $400 million in annual recurring revenue less than two years after launch. n8n raised $180 million at a $2.5 billion valuation in 2025.
But once many people are involved, individual productivity is no longer enough. Organizations need productivity, coordination, and control.
The current wave of AI site builders is mostly making one person faster. The next wave has to make organizations faster without losing trust.
AI is unbundling creation from the CMS and driving its cost toward zero. But once creation becomes cheap and abundant, the value shifts to control.
That is where rebundling starts. The next generation of products will combine AI-powered creation with a trusted control plane.
So, is the CMS dead? No. Its role is changing.
The more AI you use to create, translate, update, and publish content, the more you need a system that keeps that work structured, approved, reusable, and safe.
That means that a CMS is not a competing line item to your AI budget. It is what makes that budget pay off.
And the real risk is not that AI replaces your CMS. It is running AI without one.
AI gives you speed. A CMS gives you control at speed.
read moreWorking with larger organizations, it’s common to want to split off a section of content into its own smaller site.
A city may want a separate site for a particular construction project, or a university may want one for a capital campaign. Marketing teams often need smaller, dedicated sites for communication and promotion.
They’re usually not complex. Often it’s a matter of a different navigation, some different branding, and a unique URL. But they still need to be designed, built, hosted, and managed — somewhere. And they’re usually needed quickly (like, now).
Whether you’re launching your first or looking for a better way to manage the ones you have, let’s explore these “mini-websites” and the best options for your organization.
read moreImagine a user visits an encyclopedia website and searches for "survival in extreme conditions." The article they want, about the Ross Sea party being stranded in Antarctica for two years , doesn't contain that phrase anywhere. Nor do dozens of others that would match what they're hoping to find. Standard keyword search can't connect the query to any of them, because the visitor's specific words don't appear in any of the pages they're looking for.
You can try to close that gap with synonym lists, stemming, or manually tagging content with the terms you think people will use. But you can't control what people type, and they're going to use their own words. That gap between what someone types and what your content actually says is the problem Scolta solves.
Start with our introduction to Scolta and the thinking behind it in Introducing Scolta: what it is, why there's no vector database or embedding pipeline in the picture, and how the four-stage search pipeline fits together (the architecture itself goes deeper in The Practical Path to AI Search). This how to guide is the hands-on companion for Drupal: install the module, point it at your content, and tune it until that example query works. Everything here is open source as a Drupal module. Later posts in this series do the same for the other platforms, WordPress next.
To properly demonstrate Scolta on Drupal, we needed a demo corpus that was large, familiar, and verifiable. We couldn't do meaningful testing with lorem ipsum, and a handful of manually crafted test pages wasn't enough. We needed something where a reader could look at the search results and quickly understand whether they made sense.
Wikipedia's Featured Articles turned out to be perfect. These are the most rigorously reviewed entries in the English Wikipedia. We pulled over 6,000 of them spanning every domain of human knowledge: science, history, biography, geography, arts, technology, nature, military history, sports, philosophy. Each article averages 4,000 to 8,000 words with their full section structure preserved.
We built the demo site on Drupal 11 and called it The Athenaeum (it's themed with a library reading room aesthetic: parchment backgrounds, navy headings, burgundy accents, and a library card catalog motif in the search UI). All content is CC BY-SA 4.0 with attribution links back to the original Wikipedia articles on every page. So the demo uses real content, real licensing, and nothing proprietary.
This breadth is what makes the demo work: cross-domain discovery actually happens. A site about one topic can fake good search results with just keywords. An encyclopedia covering everything from quantum mechanics to the Battle of Gettysburg to bowerbird mating rituals can quickly fall apart with standard keyword search.
Scolta integrates with Drupal through the Search API module, which is Drupal's established abstraction layer for search backends. If you've ever configured Solr or Elasticsearch for a Drupal site before, the workflow is familiar, but without infrastructure overhead. If not, it's still straightforward. Scolta is just another Search API backend, which means existing views, facets, and search pages keep working.
composer require drupal/scolta
drush en scolta
Composer pulls in tag1/scolta-php (a shared library that makes Scolta work across Drupal, WordPress, Laravel, and custom PHP applications) and drupal/search_api automatically. The module works on Drupal 10.3+ and 11.x with PHP 8.1+.
drush scolta:build --force
This does two things. First, Scolta exports your Drupal content as static HTML, one file per indexed node, with the title, body, taxonomy, and any other fields you configured in the Search API index. Second, it builds the search index from that exported content using Pagefind, the static search library that scolta-core (the Rust/WASM engine from Introducing Scolta) builds on. The index runs entirely in the visitor's browser, which is why there's no Solr, Elasticsearch, or search daemon anywhere in these instructions.
For over 6,000 articles averaging thousands of words each, the build takes a few minutes on a decent server. The default PHP indexer needs no binary, no Node.js, and no exec(), so it runs even on shared hosting with a 128M memory limit.
Scolta gives you three ways to wire this up:
The admin form at /admin/config/search/scolta shows all available options in a dropdown. When you select the Drupal AI provider, the API key and model fields hide themselves, as at that point those settings come from the Drupal AI module's own configuration.
The next most important setting on the Scolta admin page is the "Site Type" dropdown asking what kind of site this is. Five options get you started:
For a Wikipedia-style encyclopedia, "Recipe & Content Catalog" is the right choice. The name may suggest cooking sites, but the preset is really for structured, timeless, browse-oriented collections, which includes an encyclopedia. There's also a "Documentation & Reference" preset, but it's tuned more for vocabulary bridging (patients searching "my head hurts" on a medical site where the content is more technical), which a later post in this series covers. Wikipedia readers generally search with the right terminology already, so the catalog preset fits better. Select "Recipe & Content Catalog", save, and the scoring parameters update to sensible defaults for encyclopedic content.
At this point you have a working AI search. Drop the Scolta Search block onto a page via Block Layout, and your users can start searching.
That's the "just works" path. It's maybe five minutes if you already know Drupal's Search API workflow. It's a fantastic starting place, but there's a lot of tuning possible.
The content_catalog preset makes three scoring changes that matter for an encyclopedia:
title_all_terms_multiplier, from 1.5 to 2.5: when every word of the query appears in the title, that article gets a strong extra push. Encyclopedia titles are precise identifiers, "Battle of Gettysburg," "Quantum mechanics," "Cleopatra," and when someone types one, the article carrying that title should rank first. The multiplier makes that happen without drowning out body-text matches for broader queries.The preset also widens the funnel: Pagefind fetches 75 candidate results instead of 50 before re-ranking, the AI summary draws from the top 15 results instead of 10, and result pages show 12 instead of 10, because browse-oriented sites reward breadth. Each preset is a starting point, not a cage; every individual parameter can be overridden in the Scoring section of the admin form (collapsed by default, because most people don't need it).
Because Scolta is using Large Language Models (LLMs), the single most important configuration field isn't in the scoring section at all. It's the site description.
The site description is a plain text field in Scolta's Content section. Whatever you put there gets passed directly to the AI model at query expansion time. It's the context that tells whatever model you're using what kind of content it's working with.
For The Athenaeum, the description says the content spans science, history, biography, geography, arts, and technology, and that it's an encyclopedia covering all areas of human knowledge. That description does more for search quality than any scoring parameter adjustment.
When someone searches for a concept, say, "survival in extreme conditions", the AI expands that into specific search terms. Without a good site description, the expansion might focus narrowly, maybe just on survival gear or wilderness tips. With a description that says "cross-domain encyclopedia," the AI knows to think broadly. It expands to Antarctic exploration, extremophile bacteria, deep-sea life, space missions, mountain climbing. The expansion matches the content because the description matches the content.
A great site description with default scoring parameters will outperform a generic description with perfectly tuned scoring. It's held true on every site we've built with Scolta. Tune the description first. Tune the numbers second.
We started with scoring parameters because that's what search engineers expect to tune. It's what we'd reach for on Solr or Elasticsearch. But AI search inverts the priority: the context you give the model matters more than the weights you assign to fields. If you only have five minutes, spend them on the site description.
Here are two queries that show what Scolta does that keyword search can't. Because Scolta uses an LLM to expand each query, the exact results and AI Overview shift from search to search: the articles in the index don't change, but the expanded terms do, so you see a different slice of the same corpus each time. These reflect what we saw writing this post.
Run the same two queries on any keyword search engine and compare.
Finding the right articles is half the problem. The other half is what the AI does with them when it writes a summary.
Most AI search implementations feed the LLM a title, a URL, and a text excerpt per result. That's enough to generate a paragraph that sounds reasonable. But "sounds reasonable" and "actually correct" aren't always the same thing. Ask "which articles have the most citations" and the AI can only guess since it sees the article text but not the citation count. Ask "first article published" and it may hallucinate a date if it couldn't see the actual publish dates.
Scolta solves this by passing all indexed metadata to the AI alongside each result. Not just the text, but also every structured field in the index: word count, reference count, date, taxonomy, and whatever you've configured as sortable or filterable.
Each field is labeled so the AI knows what it's looking at, and if the user sorted or filtered their results, the AI sees that too. In this way it knows which field was sorted, in which direction, and which filters were applied, and it uses this knowledge when responding to site visitors.
For The Athenaeum, that means the AI overview can reference actual numbers. "The longest articles about science" doesn't produce a vague summary about science topics, it produces a summary that cites specific word counts because the AI can see the word_count field for each result. "Most cited articles about history" references real citation counts. Scolta guides the AI response with real data, minimizing hallucinations.
So far we've been talking about finding the right articles, and about the AI summarizing them accurately. Sometimes users also want those results in a particular order: "longest articles about science," "most cited articles about history," "newest articles about chemistry." Each of those has a sort intent baked into the query, and because Scolta already passes the AI your structured fields, it can act on it.
Scolta detects this automatically. When someone types "longest articles about science," Scolta's AI expansion pipeline recognizes two things: the user wants articles about science (the search part), and they want those articles sorted by length (the sort part). The search results come back re-ranked by word count, highest first, with a sort badge below the search box showing "Sorted by: word_count (highest first)" and a dismiss button if you'd rather go back to purely relevance ordering.
"Longest articles about science" returns science-related articles sorted by their actual word count, with the AI overview citing specific word counts because it can see the metadata. On a recent run, the top results included Periodic table (29,840 words), J. Robert Oppenheimer (20,025 words), Plutonium (17,024 words), and Otto Hahn (16,291 words). Your results will differ because Scolta uses an LLM to expand the query, and different expansions surface different articles. The word counts are real and come from the indexed metadata, but which articles the expansion selects as "science" will vary from search to search.
"Most cited articles" works the same way, sorting by reference count. "Newest articles about chemistry" sorts by date. "Shortest science articles" sorts ascending. "Articles about wars sorted by date" demonstrates explicit sort syntax, the user literally says "sorted by" and Scolta catches it regardless of how complex the rest of the query is.
Scolta also knows when not to sort. "Best practices for scientific writing" returns matching results in relevance order, with no sort badge. "Most common elements" is a discovery query, the user is looking for well-known elements, not trying to sort by some metric. Of course, classification isn't perfect and edge cases exist where it may not work as you intend, especially when the same word could mean "sort by this metric" or "tell me about this concept" depending on context.
Sort detection only works if you tell Scolta which fields are sortable. The admin UI at /admin/config/search/scolta has a Sortable Fields section where you add fields and descriptions through a form.
If you prefer config-as-code, the same thing in YAML:
# config/sync/scolta.settings.yml
sortable_fields:
- word_count
- date
- reference_count
sortable_field_descriptions:
word_count: 'Number of words in the article'
date: 'Publication or last-updated date'
reference_count: 'Number of references cited in the article'
Import the config and clear cache:
drush config:import -y
drush cr
Note that the field descriptions actually matter and are configuration. They're passed to the AI so it can map user language to field names. When someone types "most cited articles," the AI reads the description "Number of references cited in the article" and connects "cited" to reference_count. Without the description, it has to guess from the field name alone, and reference_count is less obvious than citation_count would be.
The fields available for sorting are the same fields you index in Pagefind. If your content has a structured field, such as a price, a rating, a difficulty level, or a page count, you can make it sortable.
For Drupal, add the field to your Search API index configuration so it gets exported during the Scolta build, then add it to the Sortable Fields section in the Scolta admin page with a plain-language description so the AI can map user intent to the field. (Or add it to sortable_fields in scolta.settings.yml with a corresponding entry in sortable_field_descriptions, as shown in the example above.)
As a concrete example, say your Drupal site has a "Reading Level" field with values 'Beginner', 'Intermediate', and 'Advanced' that you've mapped to numeric values '1', '2', '3' in your content type. Add reading_level to your sortable fields with the description "Reading difficulty level: 1=Beginner, 2=Intermediate, 3=Advanced." Now "easiest articles about science" returns science articles sorted by reading level ascending. The AI reads the field description, maps "easiest" to "lowest reading level," and sorts accordingly.
The pattern is: structured field in your content → indexed by Pagefind → listed in sortable_fields** with a description → the AI handles the rest. You don't write sort logic or parse the user queries. You describe your data and the AI figures out when sorting applies.
Most sites will never need to go beyond a preset and a good site description. But if you're the kind of person who tunes (and if you're reading a blog post this deep into AI search configuration, you probably are), here's what to look at for encyclopedic content.
maxPagefindResults controls how many results Pagefind returns before Scolta re-ranks them. The default is 50; the catalog preset already raised it to 75, because at over 6,000 pages a query like "ancient civilizations" can match hundreds of articles, and a wider initial fetch gives the re-ranking stage more to work with. Pagefind is fast, so pushing it higher costs little if your corpus is bigger than ours.
aiSummaryTopN controls how many top results get sent to the AI for summary generation. The preset bumped it from 10 to 15, which suits broad queries that surface relevant articles across several domains. Raise it further and the tradeoff is more latency and more tokens per summary.
Custom stop words can help if your corpus has terms that appear everywhere but carry no search signal. For a Wikipedia corpus, you might add "article," "section," "reference", words that are ubiquitous in encyclopedia content but meaningless for ranking.
The admin UI exposes all of this. The Scoring section is collapsed by default (because the preset handles it), but expand it and every parameter has a numeric input with inline help text. Change a value, save, and it takes effect on the next search. No rebuild is needed for scoring changes, only content changes require a rebuild.
For the CLI-inclined, drush scolta:status shows your current configuration and index health. drush scolta:clear-cache wipes the AI response cache if you want to test expansion changes with fresh LLM calls instead of cached ones. By default Scolta is optimized to reuse search results if the same search is made multiple times.
Scolta has plenty of other knobs (multilingual expansion across 29 languages, custom AI prompts, alternate recency curves, per-element index weighting), all exposed in the admin UI. But for most sites the preset, a good site description, and maybe one or two scoring tweaks are the whole job.
When you publish, edit, or unpublish content, the search index needs to reflect those changes.
On Drupal, Scolta hooks into Search API's indexing system. Content changes queue automatically, and drush scolta:build picks them up (running the full export-then-index pipeline). For a site with frequent updates, run it on cron or trigger it from a deployment script. For a static corpus like The Athenaeum where articles don't change, a one-time build is enough.
If you've already exported content and just want to rebuild the Pagefind index (useful when testing scoring changes that affect index structure), drush scolta:rebuild-index skips the export step and re-indexes against already-exported content. Faster when the content hasn't changed.
Scoring changes take effect immediately, no rebuild needed. Change title_match_boost from 2.0 to 2.5, save, and the next search uses the new value. Only structural changes (new content, new fields in the index, and changes to the indexer configuration) require a rebuild.
The next post in this series configures Scolta on a WordPress demo: a fictional diary of the Space Race, over 200 blog posts spanning 1957 to 1973. That content is narrative rather than encyclopedic, so the site type changes and the tunables change with it, with the same Scolta underneath.
A later post deploys Scolta on a medical site, where someone searching "my head hurts" needs to land on the right clinical terminology ("intracranial hypertension," say) buried in a large body of technical content. That's the vocabulary-bridging case the "Documentation & Reference" preset is built for, a different problem from an encyclopedia where readers already know the right words.
Across all of them, Scolta adapts to each platform's native patterns (Search API on Drupal, a settings-page plugin on WordPress, a config file and CLI commands elsewhere) while the presets, the scoring, and the AI underneath stay the same.
The Athenaeum is live at scolta-demo-drupal-pedia.tag1.ai. Search for something conceptual, "art born from suffering," "animals thought to be extinct," and watch what comes back.
Running Scolta on your own Drupal site is the same path this post walked: composer require the module, drush enable it, configure the Search API server, build the index, pick a site type, and write a good site description. For the bigger picture, Introducing Scolta covers the project and where it's headed, and The Practical Path to AI Search goes deep on the four-stage pipeline. Give it a try and let us know how it goes!
read moreToday we are talking about Test Driven Development, ebooks, and Drupal with guest Oliver Davies. We'll also cover Juicer Social Feed as our module of the week.
For show notes visit: https://www.talkingDrupal.com/557
TopicsOliver Davies - oliverdavies.uk opdavies
HostsNic Laflin - nLighteneddevelopment.com nicxvan John Picozzi - epam.com johnpicozzi Scott Falconer - managing-ai.com scott-falconer
MOTW CorrespondentMartin Anderson-Clutz - mandclu.com mandclu
Europe’s open source conversation has shifted from principle to infrastructure. The EU Open Source Strategy situates open technologies within a wider digital sovereignty agenda, with a practical question at its centre: whether Europe can reduce its dependence on closed systems while building software that public institutions can reuse, maintain, and trust.
The useful part is also the uncomfortable part. The European Commission identifies familiar weaknesses in the open source ecosystem, including limited long-term funding, difficulty scaling projects, fragmented visibility, limited access to public procurement, and the risk that value created by European contributors is captured elsewhere. That diagnosis moves the discussion beyond code availability and into maintenance, governance, procurement, and business models.
The editorial test is practical rather than rhetorical. Open source becomes strategic only when institutions fund maintainers, accept open-source bids fairly, publish reusable public assets, map dependency risk, and contribute back to the projects they rely on. Without that, sovereignty remains a policy label attached to the same dependency patterns.
Euro-Office shows why the test is hard. The project has reached a first stable release as a web-based office suite, with integrations planned through platforms such as Nextcloud, IONOS Managed Nextcloud, and XWiki. Its practical weight will depend on partner rollouts, production use, format compatibility, governance, and the unresolved licensing dispute with ONLYOFFICE.
For Drupal, the impact is indirect but important. Public-sector and institutional buyers are likely to ask sharper questions about openness, dependency risk, security baselines, procurement fit, and long-term stewardship. Drupal’s opportunity is not to claim automatic alignment with European sovereignty goals, but to show evidence through maintained modules, transparent roadmaps, security practices, reusable distributions, open standards support, and credible service ecosystems.
The curated story list for this edition follows the editor’s note. Readers can also follow The Drop Times on LinkedIn, Twitter, Bluesky, and Facebook, or join the publication’s Drupal Slack channel at #thedroptimes.
Kazima Abbas
Sub-editor
The Drop Times
Both WordPress and Drupal, with Canvas, let you build pages from blocks and components instead of using just a text area. But the way they go about it is very different.
The two editors look similar, but they work in opposite ways. The easiest way to see the difference is to build the same thing in both. In the video, we build a hero component twice: first as a custom Gutenberg block, then as a Drupal Single Directory Component (SDC).
First we look at the main difference between the two editors. Then we build the hero as a Gutenberg block. Then we build the same hero as a Drupal SDC.
read moreDrupal 12 is coming later this year. As with previous major releases, the contributed ecosystem will require updating for breaking changes . Thousands of modules and themes will need their deprecated API uses updated before they are ready. Doing that by hand, across all of contrib, would cost the community an enormous number of hours.
That is the job the Project Update Bot exists to do. We have refreshed it, and it now targets Drupal 12 readiness: it scans contributed projects automatically and opens issues with patches that fix deprecated API uses for you.
If you are a maintainer, you should already know the bot. For the Drupal 12 cycle, our rector rules grew to cover more than 80% of the deprecated API uses introduced in that release. Using our proven toolset: Gábor Hojtsy's Upgrade Status for the analysis, and Drupal Rector for the fixes, now maintained primarily by SWIS and the glue that puts it all together Project Analysis.
Two things improved this round. Rule coverage is more complete, some of that came from AI-generated rector rules based on Dries Buytaert's drupal-digests. And submodule dependencies are now resolved during analysis. In the earlier cycles we scanned submodules but not their dependencies, which caused failed scans and false errors. That is fixed now, so results are cleaner and considerably more accurate.
Patches arrive as either GitLab or Drupal.org issues. The two work a little differently, and every issue the bot opens explains how to apply the patch, pause the bot, or close it. You stay in control of your project throughout.
If you have questions or want to help, we are in #d12readiness on Drupal Slack. And if a patch looks wrong, tell us so we can fix the rule for everyone, open an issue in the Drupal Rector or project_analysis queue.
The bot builds on a lot of other people's work in Upgrade Status, Drupal Rector and drupal-digests. Thanks also to the maintainers who let us test the refreshed bot on their repositories.
This blog post summarizes the key insights from the CX Decoded podcast episode featuring Dries Buytaert, the founder of Drupal and Executive Chairman of Acquia.
In the fast-moving world of digital experience, few names carry as much weight as Dries Buytaert. As the creator of Drupal, he has spent over two decades navigating the evolution of the web. But in his latest appearance on the CX Decoded podcast, Dries issued a candid warning: AI isn’t just another tool - it is a fundamental disruption that is stress-testing every business model in its path.
During the conversation, Dries broke down the "Stable Triangle" of open source and explored why the rise of AI is creating a period of both incredible excitement and existential fear.
For 20 years, the Drupal ecosystem has relied on three balanced sides:
AI is currently hitting all three sides simultaneously. It is changing user expectations for what a CMS should do, challenging the hourly-billing model of agencies, and flooding the contributor community with "AI slop."
One of the most provocative points Dries made was the distinction between a contribution and a can-tribution.
Because AI lowers the barrier to entry, anyone can now generate a thousand lines of code and submit it to an open-source project. This sounds like a win for innovation, but Dries warns of "AI slop" - low-quality, AI-generated code that lacks context or security rigor. For human maintainers, reviewing this influx of code is exhausting.
The takeaway: Just because you can contribute doesn't mean you should if you don't understand what the AI has produced. Quality and accountability must remain human-led.
The agency world is facing a reckoning. If an AI can generate a website or a specific feature in seconds, charging by the hour becomes a race to the bottom.
Dries argues that agencies must evolve. Their value will no longer be in the "writing of code," but in strategic configuration, high-level architecture, and accountability. In an AI world, clients aren't paying for labor; they are paying for a partner who can guarantee that the AI-generated solution actually works, is secure, and achieves business goals.
Dries also touched on the "broken deal" between publishers and AI companies. Currently, AI crawlers extract value from publishers' content to train models, often giving nothing back in return - no traffic, no revenue, and no attribution.
He highlighted a potential shift toward marketplace models (similar to what companies like Cloudflare are exploring) where publishers can set terms for how their data is used. For mid-sized publishers, this might be the only way to survive the "extraction economy."
The podcast concluded with a sobering example: Tailwind Labs. Dries used this as a "canary in the coal mine" for business models. When the thing you sell (like a CSS framework or specific design components) can be perfectly specified and generated by an AI prompt, your original value proposition disappears.
Dries’s message to CX leaders and developers is simple: Prototype fast with AI, but build for the long term with a robust CMS. AI is an incredible accelerator for those with expertise, but a dangerous trap for those looking for shortcuts. To survive the stress test, businesses must move away from selling "tasks" and start selling "results and reliability."
To hear the full conversation, check out the CX Decoded podcast episode on CMSWire.
Author and photos: Martin Anderson-Clutz
Originally posted on Acquia.com blog
Enterprise AI is about cost management; Drupal's AI Summit shows community-driven acceleration. Drupal: the best CMS for the agentic web.
Attending a massive tech gathering like apidays New York 2026 provides a fascinating macro-lens view of where our industry is heading. With ten co-located conferences happening simultaneously, the event served as a perfect melting pot for the cross-pollination of ideas across different sectors of software architecture. Yet, while APIs served as the undeniable common thread weaving through nearly every presentation, stepping between the mainstream enterprise tracks and the co-located Drupal AI Summit felt like walking into two entirely different worlds.
The contrast highlighted a critical tension in technology today: the corporate race to manage costs and practical enterprise constraints, versus an open-source community’s agile, collaborative push toward a truly agentic web.
In the main apidays sessions, the initial euphoric hype around generative AI has clearly given way to hard-nosed engineering pragmatism. The prevailing sentiment among enterprise builders boiled down to two foundational rules:
While these insights are incredibly valuable for infrastructure stability, the mainstream talks frequently veered toward selling proprietary products rather than exploring open topics, and genuine, collaborative case studies were rare. The most inspiring apidays session that stood completely apart from the product pitches focused on AGTP (Agent Transfer Protocol), presented by Chris Hood of Nomotic. AGTP is a proposed application-layer communication protocol designed to be a peer to commonly used standards like SMTP and HTTP, but architected from the ground up specifically for communication between AI agents. I'll talk more about AGTP more in an upcoming post.
Stepping into the Drupal AI Summit offered a completely different energy, characterized by an optimistic tone and solutions rooted entirely in freely available, open-source tools.
Standing room only at the Drupal AI Summit in New York City
Where the broader enterprise tracks viewed APIs as rigid backend guardrails to keep AI contained, the Drupal tracks explored how these emerging agentic capabilities can transform actual user and author experiences. This was the core focus of my own presentation, "AI-driven DXP: New Horizons for Marketers".
While the enterprise is busy worrying about model optimization, the digital experience platform (DXP) ecosystem is looking at how agentic AI fundamentally redefines how marketing teams create, manage, and orchestrate content. In an AI-driven DXP, the traditional boundaries of content management melt away. Instead of treating the CMS as a passive repository, an ecosystem built on agentic AI allows marketers to deploy autonomous workflows that can intelligently adapt experiences, connect disjointed data sources, and scale personalization without requiring manual engineering oversight.
The summit beautifully balanced these high-level, future-forward visions of marketing horizons with real-world challenges that development teams are solving today.
Unlike the abstract trend-decking found elsewhere, the Drupal sessions were rich with actual deployment stories. The sessions demonstrated how the Drupal community is leveraging its enthusiastic embrace of agentic AI to "maintain our edge". A standout example included a highly practical, real-world case study showing how teams are using autonomous AI agents to seamlessly migrate an existing WordPress site into Acquia Source CMS.
In sum, the contrast between the mainstream enterprise tracks and the Drupal AI Summit highlights a significant divergence in the evolution of the agentic web. While the broader industry focuses on cost management and proprietary guardrails, Drupal has found itself as the best CMS for AI. Drupal holds a significant advantage in today's agentic landscape thanks to its mature tooling for structured content, robust enterprise governance features, and an enthusiastic, collaboration-driven community. This unique combination of open-source agility and enterprise-grade architecture ensures that Drupal remains at the forefront of transforming user and author experiences in an AI-driven world.
All sessions from Drupal AI Summit NYC are now available to watch on YouTube.
We have a number of summits and conferences during the year. Visit our events calendar for more details.
The Drupal Association is responsible for the massive infrastructure that keeps the Drupal ecosystem moving forward. From protecting and upgrading Drupal.org to coordinating global events, managing community programs, and providing resources to our vital Security Team, our work requires reliable funding.
Acquia’s Fair Trade Initiative changes the paradigm by embedding funding directly into the transactional deal flow of the new Acquia Partner Program. When an Acquia partner closes an eligible Drupal deal, 2% of that transaction is automatically directed to the Drupal Association to support our core mission. This ensures a sustainable model that aligns Drupal’s commercial growth with continued investment in its underlying infrastructure.
What makes this model truly exceptional is how it aligns incentives across the board:
We want to extend a massive #DrupalThanks to Acquia for their visionary leadership, and to all the Acquia partners who are now automatically driving the future of the Drupal project with every deal they close.
Together, we aren't just building digital experiences; we are building a sustainable, open web for everyone.
[2026-05-27] Drupal AI Learners Club organizers Amber Matz and Angie Byron joined the Talking Drupal podcast for a lively ;) discussion that ranged from the AI Best Practices for Drupal project, the controversy and tension around AI within the Drupal community that ultimately led to the formation of the Club, and what the "vibe" is like.
[2026-04-05 / 2026-04-08] The Drop Times posted a story announcing our little Club's inaugural meeting on April 8, as well as a recap of the session!