28 Jul 2026
Drupal.org aggregator
Salsa Digital: Drupal AI Context — beta 3 released
Beta 3 release of Drupal AI Context Beta 3 of Drupal AI Context , also known as Context Control Center (CCC), is now available. CCC helps Drupal sites provide governed, reusable context for AI workflows and agents, from brand voice and editorial standards to organisational knowledge and governance rules. This gives AI systems access to more structured and relevant information while allowing teams to manage that information centrally. Following the beta 2 release , beta 3 expands how context is authored, imported, selected and extended. It also introduces redesigned administration pages, more granular agent controls and broader integration options.
28 Jul 2026 8:05am GMT
27 Jul 2026
Drupal.org aggregator
The Drop Times: What It Takes to Sustain Drupal
Maintainers, Association leaders, developers, and community organisers faced versions of the same question this week: how should Drupal fund, govern, and sustain the work its users rely on? Reporting from 20-27 July 2026 followed that question across Association finances, security response, artificial intelligence, technical maintenance, and community participation. Read together, the stories show that shared infrastructure remains dependable only when responsibility for maintaining it is made visible.
The funding question became explicit in The DropTimes' written exchange with Tiffany Farriss, interim CEO of the Drupal Association. Farriss proposed programme-level cost accounting and the possible use of usage-based contributions for enterprise-facing utility and infrastructure services, while separating that work from digital-public-good programmes and ecosystem advocacy. The proposals are not approved policy, but they move the discussion beyond general appeals for support towards clearer questions about cost, value, and who benefits from Drupal's shared systems.
The same issue appeared in The DropTimes' 22 July coverage of Dries Buytaert's earlier distinction between "License-only Open Source" and "Stewarded Open Source", first published on 9 July, and in the week's contributed-project security advisories. A licence can grant access to code, but it cannot by itself guarantee maintenance, vulnerability response, governance, or long-term support. Reporting on AI governance, developer tooling, community events, and the July TDT Open Town Hall extended that principle into newer and more operational parts of the ecosystem. The major stories from the week follow.
Follow The DropTimes on LinkedIn, X, Bluesky, and Facebook, or join #thedroptimes on Drupal Slack.
This issue of Editor's Pick was written and curated by Allen Jason.
27 Jul 2026 4:30pm GMT
UI Suite Initiative website: UI Suite Monthly #37 — A new look for Display Builder, and an archaeology site digs in
Our 37th monthly UI Suite meeting (July 23, 2026) opened with a small piece of housekeeping: our sessions had quietly drifted from 30 minutes to a full hour, so Pierre asked the group to bring them back to half an hour - with anyone who wants to keep chatting free to stay on after the slide deck. It worked. Thirty minutes, three updates, two demos, and we still had time for questions.
27 Jul 2026 12:00pm GMT
DDEV Blog: Shopware on DDEV: notes from years of client projects

Are DDEV and Shopware a good fit? If you ask me, yes. Let me tell you why.
I first got to know DDEV a few years ago as a freelancer working on an agency Shopware project. Up until then, every time I switched to a different agency, it was a painful process: Would the development environment on my PC (Linux back then, macOS today) even work? What new ports and commands would I have to memorize? Would the environments for my previous projects break?
So I braced myself for the onboarding meeting. But the preparation turned out to be minimal-I already had Docker, and installing DDEV beforehand was just a script. And then it was a git clone (okay, I knew that one well) and a ddev start-that was new. And it was amazing: after what felt like five minutes (okay, let's say 20, including the database download and so on), I had the shop up and running on my machine. Wow!
I quickly switched to DDEV for all of my client projects. It was a game-changer. No more "port 8000 already in use" errors. A Shopware update needs a newer PHP version? A mismatched Node.js version? Easy-just edit .ddev/config.yaml and run ddev restart. Done.
From time to time I also work on WordPress, Shopware 5, or MediaWiki projects, and DDEV is a great fit for all of them: for me, it's one and the same setup, with the same look and feel. Even to write this blog post, I ran a ddev start to bring up the Astro-based backend.
Why I use DDEV for Shopware
Which features do I reach for again and again?
Project isolation
DDEV projects are isolated from each other, so you can work on several at once without any conflicts. While working on one project, another client calls in. Two clicks and the other project is up and running-and the first one stays up, ready to be picked up again whenever you are.
Xdebug
Xdebug used to be a pain to set up with "traditional" Docker environments. With DDEV, it's a breeze. Just run ddev xdebug on and don't forget to tell your IDE to listen on the relevant port.
Redis, RabbitMQ, and Elasticsearch at your fingertips
But back to Shopware-Shopware 6, to be precise. Since it's built on Symfony, it doesn't really need much for a local setup: Apache or nginx with PHP-FPM and a database (MySQL or MariaDB). Once you get to real-world use, though, things get more complex quickly. Two Redis servers (for cache and sessions), a RabbitMQ instance for the message queue, Elasticsearch. This is where the DDEV add-ons come in. Just run ddev add-on get ddev/ddev-redis-and you're set. In my experience, there's basically no system component that doesn't have an add-on.
Hooks
Hooks exist for all kinds of things-for example, a post-import hook for the ddev import-db command. I use it to make the necessary database adjustments, such as rewriting the sales channel domains or switching the mailer to Mailpit (which is, of course, integrated into DDEV).
Inter-project communication
Did I say DDEV projects are isolated? Well, only if you want them to be. Otherwise, your app in one DDEV project can communicate with other projects-DDEV supports direct HTTP/S calls between projects. It's a great feature for developing and testing a Shopware app server, for example. I've also used it to build and test the migration from Shopware 5 to Shopware 6 across two projects.
Mirroring the production or staging environment
A shop's media files can run to tens of gigabytes-so why copy them over at all? Most of my projects use nginx-fpm, which makes an nginx reverse proxy the easy answer. Add a .ddev/nginx/media.conf file with the following contents:
location @mediaserver {
resolver 1.1.1.1;
proxy_pass https://www.example.com$request_uri;
# Uncomment if the remote environment is behind HTTP basic auth:
# proxy_set_header Authorization "Basic <base64-of-user:password>";
}
location ^~ /media/ {
access_log off;
expires max;
try_files $uri @mediaserver;
}
location ^~ /thumbnail/ {
access_log off;
expires max;
try_files $uri @mediaserver;
}
Then run ddev restart. This not only mirrors (and caches) the media files from the production or staging environment, but also lets you upload new media files to your local environment for testing.
Shopware tooling
shopware-cli is increasingly being developed into a one-stop tool for development, and of course I want to use it in my projects too. No problem-there's an add-on for that: ddev add-on get vanwittlaer/ddev-shopware-cli. The add-on also lets you reach the storefront and admin watcher URLs directly and, more importantly, over HTTPS.
Project lifecycle support
DDEV has the concept of "providers" that you can use to load any remote resource into your local environment. Many projects have a provider that lets you download and import a sanitized production database, with a command like ddev pull sanitized (this would be a customized command, so its actual name may vary). In theory, this also works in the push direction, although I have never come across a use case for it so far.
AI tooling
At the time of writing, I use Claude Code for my debugging and development work. To keep it isolated from my local environment, I run it inside the DDEV container-yes, there's an add-on for that: ddev add-on get vanwittlaer/ddev-claude-code. Pair it with Playwright (also in the DDEV container, via ddev add-on get codingsasi/ddev-playwright) and watch Claude do interactive frontend development.
How to get started
If you haven't worked with DDEV or Docker before, start with the DDEV installation guide.
For your first project, you may want to follow DDEV's quickstart guide for Shopware.
I prefer to keep the Shopware part of my projects in a subfolder, e.g. shopware/, separate from the infrastructure around it, such as the .ddev and .github folders. That way any developer, even one who has never used DDEV, can tell at a glance which parts are Shopware and which are not.
My Less than 5 Minutes Install guide includes a script that sets this up with a shopware/ subfolder.
If you prefer to do it manually, there are just four steps:
cd <your project directory>
ddev config --project-type=shopware6 --docroot=shopware/public --web-environment="APP_ENV=dev" \
--web-working-dir=/var/www/html/shopware --composer-root=shopware
ddev start
ddev composer create-project shopware/production
# When it asks whether to include Docker configuration from recipes, answer `x`-
# DDEV takes care of that part.
ddev exec bin/console system:install --basic-setup --shop-locale=en-GB
You will end up with a working Shopware 6 installation; the admin credentials are admin / shopware.
Conclusions-how good a fit is DDEV for Shopware?
Whether DDEV is a good fit for you depends less on Shopware itself than on the kind of Shopware work you do.
What I take from discussions with others in the Shopware community is that we bring in (at least) three perspectives:
- Shopware core development
- Store plugin development
- Client project development
Naturally, the requirements for a development environment and tooling differ for each. For a core developer, what matters most might be running the latest versions of every dependency. For a store plugin developer, it might be testing a plugin efficiently against every Shopware version and configuration out there. There are focused solutions for these requirements, such as devenv, Dockware, the Shopware-provided Docker setup, or the new shopware-cli features.
Client project development, however, is where I spend most of my working time, and there the Shopware version and the environment that mirrors the production setup are predefined and stable within a project. The day-to-day work is:
- debugging (core, third-party plugins, custom code);
- developing and testing new features (ERP integration, custom plugins, custom theme);
- installing and testing third-party plugins;
- implementing and testing Shopware and third-party plugin upgrades.
So what matters to me is an efficient setup for a given set of dependencies and versions, ease of use, integration with testing and dev tools (Xdebug, Claude Code, Playwright, the storefront and admin watchers), reliability, support (DDEV has a great Discord community), and-last but not least-not losing time when switching between client projects.
tl;dr: my answer to the question-how good a fit is DDEV for Shopware?-is a resounding yes.
27 Jul 2026 12:00am GMT
24 Jul 2026
Drupal.org aggregator
Drupal Association blog: Introducing the Drupal AI Security Initiative: The First Six Weeks
Drupal's volunteer Security Team has protected millions of sites for more than 20 years and its process is world-class. Bandwidth among the security engineers has always been the limiting constraint. This spring that constraint met a new kind of pressure: AI-assisted analysis is finding latent vulnerabilities at an accelerating pace.
The Drupal AI Security Initiative adds funded security capacity in response. It is funded through Alpha-Omega's Security-Engineer-in-Residence (SEIR) program, coordinated by the Drupal Association, and works alongside the volunteer Security Team, which continues its normal process throughout.
This post introduces the initiative and reports on our first six weeks. The short version: the funded fractional team model is working and has already evolved our understanding of where we want to focus next.
What changed: the economics of discovery
Drupal's attack surface is what it has always been. What has changed is the cost of finding bugs. AI-assisted analysis makes discovery dramatically cheaper. AI can produce security issue reports at a volume and can discover exploit details at a speed that any volunteer effort struggles to absorb. Our advisory data shows the rate of discovery accelerating (our next post will work through what the data suggests in detail).
Meet the Drupal AI Security Initiative Team
The initiative builds on the lessons of the Drupal 8 Accelerate Initiative, which showed that throughput efficiency depends on funding the whole contribution workflow, not just one part of it.
The Drupal security team needs fixes, not just findings of potential issues. As fixes are developed, they are collaboratively reviewed. An engineer cannot mark their own fix complete. Funding one full-time engineer would likely produce findings faster than volunteers could review them, and they would queue. So we're using the grant to fund a fractional team that covers the full path from discovery to merge on both the project and infrastructure side for Drupal:
-
Drew Weber (@mcdruid) is the Fixer. He applies AI-security expertise directly to Drupal's code: scanning, writing patches, building experimental tooling, and then submitting contribution-ready work across Drupal core and the contributed-project ecosystem.
-
Greg Knaddison (@greggles) and Michael Hess (@mlhess) are Reviewers: They triage submissions, review patches, advance issues, and provide the RTBC status a fixer cannot grant themselves. Both come from the existing Security Team, and the grant helps subsidize the work they would otherwise do on volunteer time.
-
Neil Drumm (@drumm) handles infrastructure, focusing on Drupal.org itself. The package distribution, build pipelines, and update mechanisms are a high-consequence, specialized surface on their own.
-
Tiffany Farriss (@farriss) and Tim Lehnen (@hestenet) provide program support and coordination for the Drupal Association.
Our current grant has two three-month phases: Clarity (understand the problem) and Attention (fix issues and harden the process).
Six weeks in: what we've done
We're using the funding and AI tooling to find, validate, triage, and resolve vulnerabilities faster than before, including proactively, across core, contrib, and our own infrastructure. In six weeks, the team has made contributions to more than 10 published advisories and CVEs and filed more than 30 issues. This work includes SA-CORE-2026-005, a critical PHP object-injection issue reachable via JSON:API that arrived as an external report and was coordinated to a fast release, alongside triage and remediation across dozens of findings and hundreds of inbound requests. The team also worked on rapid response/urgent issues off-hours; in one case, AI-assisted review helped find and fix a significant issue in Drupal.org code.
We're also building reusable tooling and automation prototypes that increase throughput and make our security archive searchable and actionable. That includes five Claude skills and a set of opengrep static-analysis rules, each targeting a vulnerability class, and local, open-weight tooling that processes about 40,000 historical security-mailbox emails to assign metadata like CWE mapping and flag duplicates (keeping sensitive data local). One key project outcome will be delivery of working tools the Security Team can continue to use after the initiative ends.
Drupal's grant is one of several parallel Alpha-Omega grants across open source ecosystems. Being part of this cohort has allowed us to compare notes and share tooling, successes and failures with other open source projects. So far we've collaborated most directly with Volker Dusch, who leads the equivalent effort at the PHP Foundation, and with colleagues at the Open Source Technology Improvement Fund (OSTIF), who shared their report-validator protocol for separating real findings from noise. That protocol feeds straight into our intake, and into the report standard we want to co-create next.
The counts are perhaps not the most interesting part. We've resolved more security issues (10) than the minimum number (8) our proposal had committed to over the entire six-month project. We had assumed the meat of the task would be finding and fixing vulnerabilities. It turns out that the more interesting challenge will be adapting Drupal's security process to the volume and nature of higher-quality-than-expected AI-generated and AI-assisted reports.
So far that adaptation has happened downstream, after an issue has been reported. Shepherding issues to a fix, filing CVEs, automating that filing, and automating the analysis of published advisories are important and help scale the response process. But it is all at the bottom of the funnel. The opportunity we would like to explore is higher up, at intake, where issues arrive.
We've started exploring what that might look like. In discussions with core maintainers, some design principles emerged: AI stays limited to a single triage activity per issue and no bot noise on every commit and merge request. Ideally, early intake tooling would pre-filter inbound security issue reports and run a gated check that confirms whether they include enough context and reproduction detail before they reach a human.
What's next
The next six weeks will build on what is working and push the intake question in two directions. The first is triage. The volume of incoming security issues is expected to keep growing and AI-assisted triage of that queue is an area to explore. We are interested in looking at how modern tooling can sort and deduplicate incoming issues so human attention can be focused where it's actually needed.
The second is the report itself. A clear issue report helps the Security Team and maintainer community move faster; a vague or bloated one slows everyone down. We want to explore and define what a useful AI-generated or AI-assisted security report should contain and draft a working standard, co-created with the Security Team and maintainers. If you are a maintainer or security reporter and have examples of good (or bad) AI-generated reports, please share them in Drupal Slack #security-discussion.
Six weeks of supplemental funding has already made a couple things clear. The roles the Drupal ecosystem depends on (security work as well as release management) need a durable, community-owned funding model, not one-time support. And we need to keep talking and collaborating across ecosystems like this.
Thanks
Huge thank you to Alpha-Omega for the support, funding and for access to AI tooling from Anthropic that enabled several of the findings above; to the Linux Foundation; and to the Drupal Association for coordination. And of course, none of this works without the two decades of effort from Drupal's amazing Security Team.
24 Jul 2026 11:55pm GMT
The Drop Times: Tiffany Farriss Proposes Cost Accounting and Usage-Based Enterprise Funding
Farriss says reserves are covering a gap in Drupal's wider stewardship work, prompting proposals to expose programme costs and connect enterprise use with ongoing support.
24 Jul 2026 4:53pm GMT
Dripyard Premium Drupal Themes: How Dripyard gave Tojio a fast foundation for Drupal CMS
When we started building Dripyard as a business, we had a clear objective: Drupal developers should be able to move fast without giving up the things that make it Drupal. Structured content, editorial control, accessibility, open-source ownership, and long-term maintainability should not be traded away just because a project has a tight timeline or limited budget.
24 Jul 2026 12:53pm GMT
The Drop Times: TDT Town Hall Links Newsroom Changes With Drupal’s Wider Future
Community participation moves beyond story leads as The DropTimes prepares an Editorial Working Group for Drupal contributors.
24 Jul 2026 10:37am GMT
Smartbees: Sumaris
Check out our B2B platform implementation for Sumaris - a company providing specialized solutions for industry.
24 Jul 2026 9:58am GMT
Talish Khan: Layout Builder Is Over-Applied: A Decision Framework for When It Actually Fits
The Pattern I Keep Seeing
A team starts a Drupal project. Someone asks how editors will build and arrange page content. Someone else says "Layout Builder," and that is the end of the conversation. Nobody asks what the editors actually need. Nobody asks what the content model demands. Layout Builder gets switched on because it is powerful, modern, and comes with core.
Six months later, one of two things has happened. Either the editors are happily composing layouts and everyone is glad, which is the good outcome. Or the editors are confused by a tool that gives them more power than they wanted, the developers are fighting to constrain a system designed to be open-ended, and the content is inconsistent because thirty editors made thirty different layout choices. That is the bad outcome, and it is more common than the Drupal community likes to admit.
The tool is not the problem. The reflexive selection of the tool without asking whether it fits is the problem.
The Four Options
Before the framework, a quick map of what you are actually choosing between when you decide how editors build pages in Drupal.
Layout Builder. Editors compose pages by placing blocks into regions of a layout, visually, per page or per content type. Maximum flexibility. Maximum editor power. The editor decides the structure.
Paragraphs. Editors add and arrange predefined content components in a field. Structured flexibility. The developer defines the components; the editor arranges them. The structure is constrained by what you built.
Custom templates. The developer defines the layout in Twig and the editor fills in fields. Zero layout flexibility for the editor. Maximum consistency and developer control.
Plain blocks and block layout. Content is placed in regions through the block system, configured by a site builder, largely static across pages. Good for site-wide furniture, weak for per-page composition.
Each of these is correct for some situations and wrong for others. The framework is about matching the tool to the situation.
The Framework: Four Questions
I run every "how should editors build pages" decision through these four questions, in order.
Question 1: Do editors actually need to compose layouts, or do they need to fill in content?
This is the question that settles most cases, and it is the one nobody asks.
If your editors are filling in structured content (an article has a title, a body, an author, a hero image, a set of related links), they do not need Layout Builder. They need well-designed content types with well-designed fields, rendered through templates the developer controls. Giving these editors Layout Builder hands them a layout composition tool for a job that has no layout composition in it. They will either ignore it or misuse it.
If your editors are genuinely composing pages (a marketing team building landing pages with varying structures, arranging components differently per campaign), then layout composition is a real need and Layout Builder or Paragraphs becomes relevant.
The test: watch an editor work, or ask them to describe their job. If the word "arrange" or "compose" or "build" comes up, layout tooling might fit. If they describe "entering" or "updating" or "filling in," it probably does not.
Question 2: How much layout variation do you actually need?
If the answer is "every page can look completely different," Layout Builder is designed for that.
If the answer is "editors combine a fixed set of components in different orders," Paragraphs is the better fit. It gives editors arrangement flexibility without giving them raw layout power they do not need and will misuse.
If the answer is "pages of this type all look the same," you do not need either. Custom templates with fields is the right call, and it will be faster, more consistent, and more maintainable than either flexible option.
Most projects need less layout variation than they think. The instinct is to build for maximum flexibility "just in case." That flexibility has a cost, paid in editorial inconsistency and developer maintenance, and the "just in case" scenario often never arrives.
Question 3: Who bears the cost of flexibility?
Every option shifts cost to a different party.
Layout Builder shifts cost to editors, who now have to make layout decisions on every page, and to developers, who have to constrain and style a system designed to be open. The flexibility is real but so is the ongoing cost of managing it.
Paragraphs shifts cost to developers upfront (building and styling the components) and keeps the editor experience constrained and predictable. Once built, it is low-cost for editors.
Custom templates put all the cost on developers upfront and give editors the simplest possible experience: fill in the fields, the layout is handled.
The question is not "which is most flexible." It is "who should bear the cost of flexibility on this project, and can they?" A marketing team that wants control can bear the Layout Builder cost. An editorial team of subject-matter experts who just want to publish articles cannot, and should not be asked to.
Question 4: How many people will use this, and how consistent does the output need to be?
Flexibility and consistency are in tension. The more freedom you give editors, the less consistent the output.
If three trained content designers are building marketing pages, Layout Builder's flexibility is a feature and the consistency risk is manageable because the team is small and skilled.
If thirty subject-matter experts across departments are publishing content, Layout Builder's flexibility is a liability. You will get thirty interpretations of what a page should look like, and your site will drift into visual chaos within a year. Constrained tools (Paragraphs with a limited component set, or custom templates) protect consistency at scale.
The larger and less design-trained your editorial pool, the more you should constrain their tooling.
The Framework in One Sentence Each
To compress it:
- Custom templates when pages of a type look the same and editors fill in fields.
- Paragraphs when editors arrange a fixed set of components in varying orders.
- Layout Builder when editors genuinely compose free-form layouts and the team is small and skilled enough to manage the flexibility.
- Plain blocks for site-wide furniture, not per-page composition.
Notice that Layout Builder is the right answer for the narrowest set of conditions, not the widest. That is the inverse of how often it gets chosen.
Why Layout Builder Gets Over-Applied
Three reasons the reflex exists.
It is in core and it is visible. Paragraphs is contrib. Custom templates require writing code. Layout Builder is right there in core, promoted, documented, demoed. Visibility drives adoption regardless of fit.
It demos beautifully. The drag-and-drop layout composition is genuinely impressive in a demo. Stakeholders see it and want it. The demo does not show the editorial inconsistency that emerges at scale six months later.
It feels like the modern choice. Choosing custom templates can feel like you are not using Drupal's capabilities fully. There is a subtle pressure to use the powerful tool because it is there, even when the simpler option is correct. Resisting that pressure is a senior move.
Closing Thought
Layout Builder is a good tool. I am not arguing against it. I am arguing against choosing it reflexively, without asking whether the project actually needs page composition or just needs structured content entry.
The four questions above take ten minutes to run and save months of pain. Do editors compose or fill in? How much variation is really needed? Who bears the cost of flexibility? How many people, how consistent? Answer those honestly and the right tool usually selects itself.
The instinct to reach for the most powerful option is understandable and usually wrong. The senior move is to reach for the option that fits, which is frequently the more constrained one. A Drupal site where editors fill in well-designed fields through developer-controlled templates is not a less sophisticated site than one built on Layout Builder. Often it is the more sophisticated one, because someone made a deliberate choice instead of a reflexive one.
If you have shipped Layout Builder on a large multi-editor site and kept it consistent over years, I would be curious how you constrained it. That is the hard case, and the honest accounts of making it work at scale are rarer than the demos suggest.
24 Jul 2026 8:28am GMT
Morpht: Protecting PII in Drupal AI: An introduction to Guardrails
The Drupal AI module's Guardrails system runs configurable validation plugins both before a prompt is sent to an LLM and after a response is received. Guardrails can pass, block, or rewrite content, and can be combined into sets with a scoring threshold.
24 Jul 2026 7:20am GMT
The Drop Times: A "Humanizer" Should Not Become a House Style Manual
A developer I work with sent this skill over recently, asking whether it was worth adopting across the agency's client projects (an additional pass before publication under a client's name). That's a fair question to ask before rolling something out across multiple sites, so I read the source rather than taking the pitch at face value.
24 Jul 2026 7:09am GMT
MidCamp - Midwest Drupal Camp: MidCamp Chicago 2026 call for sessions open through Feb 26
We're excited to celebrate you -- our future speakers! If you've got an idea for a session, now's the time to get involved in MidCamp 2026, happening May 12-14 in Chicago.
Call for Speakers
Since 2014, MidCamp has hosted over 300 amazing sessions, and we're ready to add your talk to that legacy. We're seeking presentations for all skill levels, from Drupal beginners to advanced users to end users and business professionals!
For full submission details and guidelines, visit: midcamp.org/events/2026/how-submit-session
Key Dates
- Call for Proposals Opened: February 10, 2026
- Proposal Deadline: February 26, 2026
- Speakers Notified: Week of April 2026
- MidCamp Sessions: May 12-13, 2026
Sponsor MidCamp
Looking to connect with the Drupal community? Sponsoring MidCamp is the way to do it! Whether you're recruiting talent, growing your brand, or simply supporting the Drupal ecosystem, MidCamp sponsorship offers great value. Act early to maximize your exposure!
Stay in the Loop
- Join us on MidCamp Slack to chat and get updates.
- Follow us on Bluesky and Mastodon for announcements and news.
- Subscribe to our newsletter for updates on the venue, travel options, social events, and speaker announcements.
Ready to submit your session? Click away and let's make MidCamp 2026 unforgettable!
24 Jul 2026 1:40am GMT
MidCamp - Midwest Drupal Camp: Last Chance: MidCamp 2026 Call for Sessions Extended to March 13
We heard you... and we want to hear from more of you!
The MidCamp 2026 Call for Sessions has been extended. The new deadline is March 13, 2026.
If you had a session idea brewing but didn't quite get it across the finish line, now's your window. We extended the deadline because we want a lineup that reflects the full range of people who use, build, and care about Drupal - and we're not there yet without you.
What We're Looking For
MidCamp sessions are open to all skill levels and all corners of the Drupal ecosystem. Whether you're a developer with a deep technical dive, a project manager with hard-won lessons, a designer with a perspective the community needs, or an end user who figured something out the hard way - there is a place for your session at MidCamp.
We're especially interested in talks around:
- Drupal AI - practical applications, integrations, and what's actually working in the field
- Drupal CMS / Canvas - building with and extending Drupal's newest tools
- Decoupled and headless implementations - real-world lessons from the front lines
- Accessibility, equity, and inclusion - building a better, more accessible web
- Community and contribution - how we grow the ecosystem together
Not sure if your idea fits? Submit it anyway. We'd rather review more proposals than miss a great talk.
How to Submit
Session submissions are open now through March 13, 2026.
Need help shaping your proposal? Join the #speakers channel on the MidCamp Slack - there are people there who will help you get it over the finish line.
Slack: https://mid.camp/slack
What Happens Next
After the submission window closes, our review team will evaluate proposals and notify selected speakers by April 9, 2026. Selected speakers will have until April 15 to confirm, and the full schedule will be published April 16.
MidCamp 2026 is May 12-14 in Chicago. We hope to see you on stage.
24 Jul 2026 1:40am GMT
MidCamp - Midwest Drupal Camp: Catch up on all the MidCamp you missed!
Watch the Dries fireside chat from 2025, or catch up on all of the sessions from last year on Drupal.tv.
Theres even more Drupal goodness to be had in our archives or Drupal.tv's.
The Archives: 2024 2023 2022 2021 2020 2019 2018 2017 2016 2015 2014
24 Jul 2026 1:40am GMT
23 Jul 2026
Drupal.org aggregator
Dries Buytaert: Helping agents discover my site search with Agentic Resource Discovery
Yesterday I blogged about the API catalog that announces my site's search API to agents. In response, someone pointed me to the ARD specification, a draft announced last month by a working group that includes Google, Microsoft, GitHub, Hugging Face, Cisco, Nvidia, and Salesforce.
What ARD adds to yesterday's API catalog is discovery. If an agent has never heard of you, it does not know to look for your API catalog. Ask an agent what people have written about the future of Drupal, for example, and it will probably search Google. It may not think to check dri.es or drupal.org directly.
The web solved discovery decades ago. Search engines find the right site, so you do not have to know where the answer lives.
ARD provides the building blocks for search engines for AI agents. Sites publish catalogs, crawlers discover them, and registries index them. An agent can then ask a registry a plain-language question, such as "Who can answer questions about the future of Drupal?". The registry returns a ranked list of relevant resources, perhaps pointing the agent to my site's search API.
You opt in by publishing a manifest at /.well-known/ai-catalog.json. Yes, that is almost the same path as my existing /.well-known/api-catalog.
Here is what my /.well-known/ai-catalog.json currently returns:
{
"specVersion": "1.0",
"host": {
"displayName": "Dries Buytaert"
},
"entries": [
{
"identifier": "urn:air:dri.es:search",
"displayName": "Site search",
"type": "application/openapi+json",
"url": "https://dri.es/openapi.json",
"description": "Full-text search across the site's content, ranked by relevance.",
"representativeQueries": [
"Find posts about the future of Drupal",
"What has been written about open source sustainability?",
"Find writing about digital sovereignty",
"How is AI changing how we build websites?",
"Search Dries Buytaert's blog and notes"
]
}
]
}
Each entry describes a resource an agent can use. ARD deliberately defines "resource" broadly: it can be an API, an MCP server, another agent, a skill, or even a nested catalog containing more resources.
My site offers just one resource: a simple search API. The whole thing took less than an hour to implement because the entry simply points to the existing OpenAPI document I wrote about yesterday. It advertises the same OpenAPI document, https://dri.es/openapi.json, through a second discovery mechanism.
The representativeQueries field is the interesting part. It lists example questions registries use to match an agent's intent. Mine are first guesses that I will revise once I can see how they get used.
Of the eleven companies listed as contributors, Hugging Face is the only one whose catalog I could find on its primary domain. It also runs an early registry. So I queried Hugging Face's registry directly at https://huggingface-hf-discover.hf.space/search. It responded correctly using the protocol defined by the specification, but for my query, it returned only skills hosted by Hugging Face.
Broad adoption will depend on whether major agents begin searching ARD registries. Microsoft, Google, and GitHub are in the working group, but OpenAI and Anthropic are not. Time will tell if this gets adopted, but Google stated its Agent Platform will connect to ARD registries in the coming months.
Does my blog need this? Probably not. Other sites have more to gain. An online store could announce its product search and checkout APIs, a restaurant its reservation system, and a city its appointment system for renewing a permit.
Many of these sites run on a content management system. A CMS that made its capabilities discoverable through ARD by default could therefore be interesting. Experiments like this help me understand whether Drupal should be that CMS.
23 Jul 2026 7:25pm GMT