fidzu : Drupal

Drupal is now in the OSV database, see some examples.

One of the key parts of keeping a website secure is making sure you have updated to incorporate security updates. Today, we're excited to share that Drupal's security information will be available in a new channel that has some benefits compared to existing tools. This is another large step forward in making it easier for Drupal sites to stay secure.

How can people get security data today?

Since 2005 people have been able to subscribe to emails or an RSS feed with security announcements. More recently those feeds were mirrored on social media sites as well. However, these feeds include a lot of "noise" - news about releases for software that are not installed on a specific site.

Since 2007, Drupal has provided a built-in mechanism for site maintainers to check if their site was out of date. Sites using the Update module could check if they needed updates and email that report to the site owner or show it inside the system or via a "drush" command on the command line. This report is focused on what the site needs: the administrator only learns about updates to the software running on the site, but it requires knowing a Drupal-specific tool.

Modern versions of Drupal leverage the composer package manager. Drupal has supported the composer audit command which was introduced in 2022. However, again, this is a tool that is mostly used in the php community and doesn't provide security data about other package types.

Drupal sites often include npm packages and other 3rd party libraries that might have their own update monitoring mechanism.

Staying aware of available releases is a subjective and personal question. What works well for one organization might not work well for another. Knowing these options and their shortcomings, can we make it easier for site owners to monitor their sites?

How is the OSV format better?

The OSV format and database provide several advantages. Perhaps the biggest one for Drupal sites is they provide support for a wide variety of packages. Publishing Drupal's security advisories in OSV.dev will enable the OSV-scanner automated scanning tool to create accurate reports for Drupal sites making it easier for organizations to adopt Drupal and help ensure it is up to date. It will also make it easier for other projects to support Drupal if they incorporate OSV.dev data.

Who made this happen?

For OSV.dev support, there was a collaboration across several teams and timezones: folks at Google, Ackama, the Drupal Association, and members of the Drupal Security Team have collaborated to automate osv support. In particular, Gold, Gareth Jones, Greg Knaddison, Dave Long, Peter Wolanin, and Neil Drumm worked to help get it launched or will help maintain it. The result will hopefully provide greater awareness, easier support, and minimal additional manual work to support this new channel.

Also, we should recognize efforts in this field that provided a great foundation. Derek Wright (dww) did a ton of work to help Drupal's infrastructure related to the Update module for many years. The integration of data that gets into osv.dev relies on an API from drupal.org that is provided with a lot of work from the Drupal Association. The content of the feed, of course, comes from project maintainers and the Drupal Security Team.

Guest Blog Post by Luke McCormick

BADCamp, the Bay Area Drupal Camp, has been a Drupal gathering in the Bay Area most years since 2007. This year's BADCamp had a particular focus on artificial intelligence. There were many exciting things to see and hear about AI, and the overall programme reflected a blend of practical tooling, architecture, and community direction.

Drupal Core UX Manager Emma Horrell set the stage with the opening keynote, Turning Feelings into Features - Why UX Is an Innovation Catalyst for Drupal (video). While not framed as an AI talk specifically, the keynote grounded much of what followed. Emma emphasized UX as an active, user-centred practice rooted in trust, language, and real-world workflows, principles that are especially critical for the effective use of AI tools. Her keynote flowed directly into the next session in the same room, underscoring how closely UX and AI strategy are now intertwined in Drupal.

Immediately following the keynote, Drupal AI Initiative lead Kristen Pol presented Accelerating Innovation: The Drupal AI Initiative (video), outlining the current state and direction of Drupal's AI efforts. Kristen described how the initiative is moving beyond isolated experiments toward coordinated work across providers, UX research, contributor experience, and shared infrastructure. Shortly thereafter, André Angelantoni's Drupal CMS Late 2025 Update (video) highlighted how AI capabilities are becoming part of Drupal CMS planning itself, signalling a shift from AI as an add-on toward AI as expected infrastructure.

Building Drupal Sites with AI

The AI momentum continued with a wide range of additional sessions devoted to artificial intelligence at BADCamp. Several talks focused on hands-on, builder-friendly uses of AI in Drupal. J. Matthew Saunders led Getting Hands-On with Drupal AI: Build Smarter Sites with Zero Code (video), while Sal Lakhani presented 3 Ways to Use AI in Drupal (video), covering practical patterns such as chatbots, search, and code generation. Sal also delivered a second session, The #1 Drupal AI Demo, Development, and Learning Platform (DrupalForge) (video), demonstrating how hands-on experimentation and learning can be supported in a structured way.

Jordan Koplowicz explored the easy way and the hard way to create AI Chatbots in Drupal. The "easy" way requires no code, which he explains in Creating an AI Chatbot in Drupal: The Easy Way (video), which he followed up the next day with the "hard" way in AI on Headless Drupal (video), where he showed how to create a headless AI chatbot. Meta's Prabhakar Singh rounded out this group with Building Smart Content Moderation for Drupal: AI-Powered Spam Detection and Community Safety (video), illustrating how AI can be used to increase trust, safety, and community health.

BADCamp also featured sessions that took a more strategic and forward-looking view of AI. Steve Carlson presented Preparing for the Future: AI, the Changing Consumption Landscape, and Combating AI Threats (video), focusing on how organizations must adapt to shifts in how content is created and consumed. Alongside this, James Sansbury presented Preparing Your Pipeline for the AI Revolution (video), addressing organizational readiness, governance, and workflow implications. Satish Kumar Nagireddy presented AI-Powered Content Intelligence: Multi-Modal Analysis for Drupal Media Management (video), demonstrating how AI can analyze and enrich media across formats while remaining compatible with Drupal's content and editorial models.

Drupal Coding with AI

Developers were well represented in the AI programming as well. Mark Ferree's session, AI Dev Tools: How Not to Get Lost in the Chaos (video), surveyed the rapidly evolving landscape of AI-assisted development tools from the perspective of someone with extensive engineering experience. In contrast, Luke McCormick focused on pragmatic techniques that can be used even by people who do not consider themselves full-time Drupal coders in Quick and Easy Migrations and Upgrades Using AI (video), which demonstrated how to use AI-enabled editors like Cursor to speed up common Drupal development, upgrade, and feature-building tasks.

The BADCamp AI Summit

Beyond individual sessions, BADCamp 2025 featured its first dedicated AI Summit, a deeper-dive gathering focused specifically on AI in Drupal. The summit brought together speakers and organizers from across the conference and included a live remote discussion with Jamie Abrahams, who joined from the UK to share an update on the broader Drupal AI landscape. Jamie emphasized that Drupal AI has moved beyond theory and proof-of-concept demos into the stage where real-world use cases and case studies are the next critical need. Rather than flashy demonstrations, the focus is now on reliable, high-value applications that build on Drupal's strengths in UX, governance, trust, and longevity.

Taken together, the sessions and the AI Summit showed a Drupal community that has moved past speculation and into execution. The conversations at BADCamp reflected a shared understanding that AI's impact will be shaped not just by what is technically possible, but by how thoughtfully it is designed, integrated, and governed. Across sessions, summits, and hallway conversations alike, the message was consistent: this is work the whole community can and should engage in, and BADCamp 2025 demonstrated that Drupal is actively rising to that challenge.