28 Jul 2026

feedDrupal.org aggregator

BloomIdea: Shipping with MRW from Drupal Commerce: no more copy-pasting into the carrier portal

Several of the e-commerce stores we build and run ship with MRW, one of the main carriers in Spain and Portugal. Until recently, shipping an order meant leaving the store: open MRW's customer portal, retype the customer's address, print the label, then copy the shipment number back into Drupal so the customer gets a tracking link. Multiply by every order, every day, and add returns, which meant doing the same dance with the addresses swapped.

We replaced that with a Drupal module. It now runs the daily expedition of the first of them, and we are releasing it to the community: Commerce MRW is available on drupal.org, with a 1.1.0 release.

What it does

Commerce MRW integrates Drupal Commerce with MRW through SAGEC, the carrier's SOAP webservice for creating and managing shipments (envíos). The whole expedition cycle happens on the shipment admin pages the team already uses:

  • Transmit shipments (TransmEnvio): one click creates the shipment on MRW's side and stores the returned shipment number as the Drupal shipment's tracking code, feeding the customer-facing tracking link.
  • Labels on demand (GetEtiquetaEnvio): the transport label PDF is streamed straight from SAGEC every time someone asks for it. Labels are never stored locally, so MRW stays the single source of truth and there is no stale-file problem.
  • Cancel (CancelarEnvio) transmitted shipments before the courier picks them up.
  • Return pickups: a request can carry a pickup address (DatosRecogida), so MRW collects the parcel at the customer's door and delivers it back to the store. Returns stop being a manual job in the carrier portal.
  • Tracking: a client for MRW's TrackingServices webservice queries the current status, or the full status history, of any shipment: by MRW number, by your own order reference, individually or in bulk.
  • "Transmit as": shipments whose shipping method is not MRW (say, a generic "Free shipping" flat rate) can still be shipped with MRW. The operator picks the executing method at transmit time and the choice is recorded on the shipment.

Service codes cover the SAGEC catalogue (Ecommerce, Urgente 19 Expedición, Urgente 13 and friends), and PRE (test) and PRO (production) environments are separate credential sets with a test-mode toggle, so you can validate the integration with your franchise before a single real parcel moves.

Small module, sharp edges

The SAGEC manual is short; reality is not. A few of the edges the module rounds off for you:

  • Postal codes are per-country folklore. Spain wants 5 digits with leading zeros, Portugal wants only the first 4 of its 7-digit codes, Andorra's letters become zeros, and Gibraltar is always 00010. The module normalizes all of it before SAGEC ever sees an address.
  • The tracking service hides behind a WCF quirk: it only accepts SOAP posts on its relative endpoint address, and answers 404 on the address the documentation leads you to. We found out so you do not have to.
  • No PHP SOAP extension required. Both clients build their envelopes by hand over Drupal's HTTP client, which also makes every request fully testable with mocked responses; the module ships with a kernel test suite that asserts the exact XML that goes over the wire.

Your store's rules stay yours

Carrier integrations die by hardcoding someone else's workflow, so Commerce MRW deliberately does not have one. Site-specific data travels through an event: subscribe to the TransmEnvio request event and fill whatever your store knows, the consignee's phone number, a NIF, delivery observations for the courier, or a full pickup address to turn a transmission into a return pickup. In one of our stores, three small subscribers do exactly that: one copies the customer's phone, one sends the backoffice's "carrier notes" field as delivery instructions, and one swaps the addresses when a shipment is flagged as a return.

Tracking follows the same philosophy. The module gives you the client and a documented integration recipe, but ships no polling and changes no shipment states: whether "delivered at destination" should transition your workflow, or just inform a human, is your call. That store runs an hourly cron that mirrors the last MRW status into the expedition dashboard, next to each tracking code; marking a shipment delivered stays a human decision, now an informed one.

Battle-tested, then released

Like our other contrib modules, this one shipped to drupal.org only after running a real store's daily expedition: real transmissions, real labels handed to the courier, and a tracking client validated against the production webservice before its release was tagged. The test suite (42 kernel tests at the time of writing) covers the SOAP envelopes, the postal code rules, the backoffice forms and the tracking parsing.

Get it

composer require drupal/commerce_mrw:^1.1

Requires Drupal 10.3+ or 11 and Commerce Shipping 3.x, plus SAGEC credentials from your MRW franchise (ask your franchise; ours enabled both the shipping webservice and the tracking service on request).

If you run a Drupal Commerce store shipping in Spain or Portugal, this is for you. The issue queue is open, and international shipments, ZPL labels and MRW delivery points are on the roadmap.

28 Jul 2026 2:00pm GMT

Specbee: Understanding Drupal's Service Container and Dependency Injection

Learn how Drupal's service container and dependency injection work, why they matter for testable code, and what Drupal 11 changes for your service classes.

28 Jul 2026 11:20am GMT

Salsa Digital: Drupal AI Context — beta 3 released

Beta 3 release of Drupal AI Context Beta 3 of Drupal AI Context , also known as Context Control Center (CCC), is now available. CCC helps Drupal sites provide governed, reusable context for AI workflows and agents, from brand voice and editorial standards to organisational knowledge and governance rules. This gives AI systems access to more structured and relevant information while allowing teams to manage that information centrally. Following the beta 2 release , beta 3 expands how context is authored, imported, selected and extended. It also introduces redesigned administration pages, more granular agent controls and broader integration options.

28 Jul 2026 8:05am GMT

27 Jul 2026

feedDrupal.org aggregator

The Drop Times: What It Takes to Sustain Drupal

Maintainers, Association leaders, developers, and community organisers faced versions of the same question this week: how should Drupal fund, govern, and sustain the work its users rely on? Reporting from 20-27 July 2026 followed that question across Association finances, security response, artificial intelligence, technical maintenance, and community participation. Read together, the stories show that shared infrastructure remains dependable only when responsibility for maintaining it is made visible.

The funding question became explicit in The DropTimes' written exchange with Tiffany Farriss, interim CEO of the Drupal Association. Farriss proposed programme-level cost accounting and the possible use of usage-based contributions for enterprise-facing utility and infrastructure services, while separating that work from digital-public-good programmes and ecosystem advocacy. The proposals are not approved policy, but they move the discussion beyond general appeals for support towards clearer questions about cost, value, and who benefits from Drupal's shared systems.

The same issue appeared in The DropTimes' 22 July coverage of Dries Buytaert's earlier distinction between "License-only Open Source" and "Stewarded Open Source", first published on 9 July, and in the week's contributed-project security advisories. A licence can grant access to code, but it cannot by itself guarantee maintenance, vulnerability response, governance, or long-term support. Reporting on AI governance, developer tooling, community events, and the July TDT Open Town Hall extended that principle into newer and more operational parts of the ecosystem. The major stories from the week follow.

Follow The DropTimes on LinkedIn, X, Bluesky, and Facebook, or join #thedroptimes on Drupal Slack.

This issue of Editor's Pick was written and curated by Allen Jason.

27 Jul 2026 4:30pm GMT

UI Suite Initiative website: UI Suite Monthly #37 — A new look for Display Builder, and an archaeology site digs in

Our 37th monthly UI Suite meeting (July 23, 2026) opened with a small piece of housekeeping: our sessions had quietly drifted from 30 minutes to a full hour, so Pierre asked the group to bring them back to half an hour - with anyone who wants to keep chatting free to stay on after the slide deck. It worked. Thirty minutes, three updates, two demos, and we still had time for questions.

27 Jul 2026 12:00pm GMT

DDEV Blog: Shopware on DDEV: notes from years of client projects

DDEV and Shopware logos joined by a plus sign

Are DDEV and Shopware a good fit? If you ask me, yes. Let me tell you why.

I first got to know DDEV a few years ago as a freelancer working on an agency Shopware project. Up until then, every time I switched to a different agency, it was a painful process: Would the development environment on my PC (Linux back then, macOS today) even work? What new ports and commands would I have to memorize? Would the environments for my previous projects break?

So I braced myself for the onboarding meeting. But the preparation turned out to be minimal-I already had Docker, and installing DDEV beforehand was just a script. And then it was a git clone (okay, I knew that one well) and a ddev start-that was new. And it was amazing: after what felt like five minutes (okay, let's say 20, including the database download and so on), I had the shop up and running on my machine. Wow!

I quickly switched to DDEV for all of my client projects. It was a game-changer. No more "port 8000 already in use" errors. A Shopware update needs a newer PHP version? A mismatched Node.js version? Easy-just edit .ddev/config.yaml and run ddev restart. Done.

From time to time I also work on WordPress, Shopware 5, or MediaWiki projects, and DDEV is a great fit for all of them: for me, it's one and the same setup, with the same look and feel. Even to write this blog post, I ran a ddev start to bring up the Astro-based backend.

Why I use DDEV for Shopware

Which features do I reach for again and again?

Project isolation

DDEV projects are isolated from each other, so you can work on several at once without any conflicts. While working on one project, another client calls in. Two clicks and the other project is up and running-and the first one stays up, ready to be picked up again whenever you are.

Xdebug

Xdebug used to be a pain to set up with "traditional" Docker environments. With DDEV, it's a breeze. Just run ddev xdebug on and don't forget to tell your IDE to listen on the relevant port.

Redis, RabbitMQ, and Elasticsearch at your fingertips

But back to Shopware-Shopware 6, to be precise. Since it's built on Symfony, it doesn't really need much for a local setup: Apache or nginx with PHP-FPM and a database (MySQL or MariaDB). Once you get to real-world use, though, things get more complex quickly. Two Redis servers (for cache and sessions), a RabbitMQ instance for the message queue, Elasticsearch. This is where the DDEV add-ons come in. Just run ddev add-on get ddev/ddev-redis-and you're set. In my experience, there's basically no system component that doesn't have an add-on.

Hooks

Hooks exist for all kinds of things-for example, a post-import hook for the ddev import-db command. I use it to make the necessary database adjustments, such as rewriting the sales channel domains or switching the mailer to Mailpit (which is, of course, integrated into DDEV).

Inter-project communication

Did I say DDEV projects are isolated? Well, only if you want them to be. Otherwise, your app in one DDEV project can communicate with other projects-DDEV supports direct HTTP/S calls between projects. It's a great feature for developing and testing a Shopware app server, for example. I've also used it to build and test the migration from Shopware 5 to Shopware 6 across two projects.

Mirroring the production or staging environment

A shop's media files can run to tens of gigabytes-so why copy them over at all? Most of my projects use nginx-fpm, which makes an nginx reverse proxy the easy answer. Add a .ddev/nginx/media.conf file with the following contents:

location @mediaserver {
    resolver 1.1.1.1;
    proxy_pass https://www.example.com$request_uri;
    # Uncomment if the remote environment is behind HTTP basic auth:
    # proxy_set_header Authorization "Basic <base64-of-user:password>";
}

location ^~ /media/ {
    access_log off;
    expires max;
    try_files $uri @mediaserver;
}

location ^~ /thumbnail/ {
    access_log off;
    expires max;
    try_files $uri @mediaserver;
}

Then run ddev restart. This not only mirrors (and caches) the media files from the production or staging environment, but also lets you upload new media files to your local environment for testing.

Shopware tooling

shopware-cli is increasingly being developed into a one-stop tool for development, and of course I want to use it in my projects too. No problem-there's an add-on for that: ddev add-on get vanwittlaer/ddev-shopware-cli. The add-on also lets you reach the storefront and admin watcher URLs directly and, more importantly, over HTTPS.

Project lifecycle support

DDEV has the concept of "providers" that you can use to load any remote resource into your local environment. Many projects have a provider that lets you download and import a sanitized production database, with a command like ddev pull sanitized (this would be a customized command, so its actual name may vary). In theory, this also works in the push direction, although I have never come across a use case for it so far.

AI tooling

At the time of writing, I use Claude Code for my debugging and development work. To keep it isolated from my local environment, I run it inside the DDEV container-yes, there's an add-on for that: ddev add-on get vanwittlaer/ddev-claude-code. Pair it with Playwright (also in the DDEV container, via ddev add-on get codingsasi/ddev-playwright) and watch Claude do interactive frontend development.

How to get started

If you haven't worked with DDEV or Docker before, start with the DDEV installation guide.

For your first project, you may want to follow DDEV's quickstart guide for Shopware.

I prefer to keep the Shopware part of my projects in a subfolder, e.g. shopware/, separate from the infrastructure around it, such as the .ddev and .github folders. That way any developer, even one who has never used DDEV, can tell at a glance which parts are Shopware and which are not.

My Less than 5 Minutes Install guide includes a script that sets this up with a shopware/ subfolder.

If you prefer to do it manually, there are just four steps:

cd <your project directory>
ddev config --project-type=shopware6 --docroot=shopware/public --web-environment="APP_ENV=dev" \
        --web-working-dir=/var/www/html/shopware --composer-root=shopware
ddev start
ddev composer create-project shopware/production
# When it asks whether to include Docker configuration from recipes, answer `x`-
# DDEV takes care of that part.
ddev exec bin/console system:install --basic-setup --shop-locale=en-GB

You will end up with a working Shopware 6 installation; the admin credentials are admin / shopware.

Conclusions-how good a fit is DDEV for Shopware?

Whether DDEV is a good fit for you depends less on Shopware itself than on the kind of Shopware work you do.

What I take from discussions with others in the Shopware community is that we bring in (at least) three perspectives:

Naturally, the requirements for a development environment and tooling differ for each. For a core developer, what matters most might be running the latest versions of every dependency. For a store plugin developer, it might be testing a plugin efficiently against every Shopware version and configuration out there. There are focused solutions for these requirements, such as devenv, Dockware, the Shopware-provided Docker setup, or the new shopware-cli features.

Client project development, however, is where I spend most of my working time, and there the Shopware version and the environment that mirrors the production setup are predefined and stable within a project. The day-to-day work is:

  1. debugging (core, third-party plugins, custom code);
  2. developing and testing new features (ERP integration, custom plugins, custom theme);
  3. installing and testing third-party plugins;
  4. implementing and testing Shopware and third-party plugin upgrades.

So what matters to me is an efficient setup for a given set of dependencies and versions, ease of use, integration with testing and dev tools (Xdebug, Claude Code, Playwright, the storefront and admin watchers), reliability, support (DDEV has a great Discord community), and-last but not least-not losing time when switching between client projects.

tl;dr: my answer to the question-how good a fit is DDEV for Shopware?-is a resounding yes.

27 Jul 2026 12:00am GMT

24 Jul 2026

feedDrupal.org aggregator

Drupal Association blog: Introducing the Drupal AI Security Initiative: The First Six Weeks

Drupal's volunteer Security Team has protected millions of sites for more than 20 years and its process is world-class. Bandwidth among the security engineers has always been the limiting constraint. This spring that constraint met a new kind of pressure: AI-assisted analysis is finding latent vulnerabilities at an accelerating pace.

The Drupal AI Security Initiative adds funded security capacity in response. It is funded through Alpha-Omega's Security-Engineer-in-Residence (SEIR) program, coordinated by the Drupal Association, and works alongside the volunteer Security Team, which continues its normal process throughout.

This post introduces the initiative and reports on our first six weeks. The short version: the funded fractional team model is working and has already evolved our understanding of where we want to focus next.

What changed: the economics of discovery

Drupal's attack surface is what it has always been. What has changed is the cost of finding bugs. AI-assisted analysis makes discovery dramatically cheaper. AI can produce security issue reports at a volume and can discover exploit details at a speed that any volunteer effort struggles to absorb. Our advisory data shows the rate of discovery accelerating (our next post will work through what the data suggests in detail).

Meet the Drupal AI Security Initiative Team

The initiative builds on the lessons of the Drupal 8 Accelerate Initiative, which showed that throughput efficiency depends on funding the whole contribution workflow, not just one part of it.

The Drupal security team needs fixes, not just findings of potential issues. As fixes are developed, they are collaboratively reviewed. An engineer cannot mark their own fix complete. Funding one full-time engineer would likely produce findings faster than volunteers could review them, and they would queue. So we're using the grant to fund a fractional team that covers the full path from discovery to merge on both the project and infrastructure side for Drupal:

  • Drew Weber (@mcdruid) is the Fixer. He applies AI-security expertise directly to Drupal's code: scanning, writing patches, building experimental tooling, and then submitting contribution-ready work across Drupal core and the contributed-project ecosystem.

  • Greg Knaddison (@greggles) and Michael Hess (@mlhess) are Reviewers: They triage submissions, review patches, advance issues, and provide the RTBC status a fixer cannot grant themselves. Both come from the existing Security Team, and the grant helps subsidize the work they would otherwise do on volunteer time.

  • Neil Drumm (@drumm) handles infrastructure, focusing on Drupal.org itself. The package distribution, build pipelines, and update mechanisms are a high-consequence, specialized surface on their own.

  • Tiffany Farriss (@farriss) and Tim Lehnen (@hestenet) provide program support and coordination for the Drupal Association.

Our current grant has two three-month phases: Clarity (understand the problem) and Attention (fix issues and harden the process).

Six weeks in: what we've done

We're using the funding and AI tooling to find, validate, triage, and resolve vulnerabilities faster than before, including proactively, across core, contrib, and our own infrastructure. In six weeks, the team has made contributions to more than 10 published advisories and CVEs and filed more than 30 issues. This work includes SA-CORE-2026-005, a critical PHP object-injection issue reachable via JSON:API that arrived as an external report and was coordinated to a fast release, alongside triage and remediation across dozens of findings and hundreds of inbound requests. The team also worked on rapid response/urgent issues off-hours; in one case, AI-assisted review helped find and fix a significant issue in Drupal.org code.

We're also building reusable tooling and automation prototypes that increase throughput and make our security archive searchable and actionable. That includes five Claude skills and a set of opengrep static-analysis rules, each targeting a vulnerability class, and local, open-weight tooling that processes about 40,000 historical security-mailbox emails to assign metadata like CWE mapping and flag duplicates (keeping sensitive data local). One key project outcome will be delivery of working tools the Security Team can continue to use after the initiative ends.

Drupal's grant is one of several parallel Alpha-Omega grants across open source ecosystems. Being part of this cohort has allowed us to compare notes and share tooling, successes and failures with other open source projects. So far we've collaborated most directly with Volker Dusch, who leads the equivalent effort at the PHP Foundation, and with colleagues at the Open Source Technology Improvement Fund (OSTIF), who shared their report-validator protocol for separating real findings from noise. That protocol feeds straight into our intake, and into the report standard we want to co-create next.

The counts are perhaps not the most interesting part. We've resolved more security issues (10) than the minimum number (8) our proposal had committed to over the entire six-month project. We had assumed the meat of the task would be finding and fixing vulnerabilities. It turns out that the more interesting challenge will be adapting Drupal's security process to the volume and nature of higher-quality-than-expected AI-generated and AI-assisted reports.

So far that adaptation has happened downstream, after an issue has been reported. Shepherding issues to a fix, filing CVEs, automating that filing, and automating the analysis of published advisories are important and help scale the response process. But it is all at the bottom of the funnel. The opportunity we would like to explore is higher up, at intake, where issues arrive.

We've started exploring what that might look like. In discussions with core maintainers, some design principles emerged: AI stays limited to a single triage activity per issue and no bot noise on every commit and merge request. Ideally, early intake tooling would pre-filter inbound security issue reports and run a gated check that confirms whether they include enough context and reproduction detail before they reach a human.

What's next

The next six weeks will build on what is working and push the intake question in two directions. The first is triage. The volume of incoming security issues is expected to keep growing and AI-assisted triage of that queue is an area to explore. We are interested in looking at how modern tooling can sort and deduplicate incoming issues so human attention can be focused where it's actually needed.

The second is the report itself. A clear issue report helps the Security Team and maintainer community move faster; a vague or bloated one slows everyone down. We want to explore and define what a useful AI-generated or AI-assisted security report should contain and draft a working standard, co-created with the Security Team and maintainers. If you are a maintainer or security reporter and have examples of good (or bad) AI-generated reports, please share them in Drupal Slack #security-discussion.

Six weeks of supplemental funding has already made a couple things clear. The roles the Drupal ecosystem depends on (security work as well as release management) need a durable, community-owned funding model, not one-time support. And we need to keep talking and collaborating across ecosystems like this.

Thanks

Huge thank you to Alpha-Omega for the support, funding and for access to AI tooling from Anthropic that enabled several of the findings above; to the Linux Foundation; and to the Drupal Association for coordination. And of course, none of this works without the two decades of effort from Drupal's amazing Security Team.

24 Jul 2026 11:55pm GMT

The Drop Times: Tiffany Farriss Proposes Cost Accounting and Usage-Based Enterprise Funding

Farriss says reserves are covering a gap in Drupal's wider stewardship work, prompting proposals to expose programme costs and connect enterprise use with ongoing support.

24 Jul 2026 4:53pm GMT

Dripyard Premium Drupal Themes: How Dripyard gave Tojio a fast foundation for Drupal CMS

When we started building Dripyard as a business, we had a clear objective: Drupal developers should be able to move fast without giving up the things that make it Drupal. Structured content, editorial control, accessibility, open-source ownership, and long-term maintainability should not be traded away just because a project has a tight timeline or limited budget.

24 Jul 2026 12:53pm GMT

The Drop Times: TDT Town Hall Links Newsroom Changes With Drupal’s Wider Future

Community participation moves beyond story leads as The DropTimes prepares an Editorial Working Group for Drupal contributors.

24 Jul 2026 10:37am GMT

Smartbees: Sumaris

Check out our B2B platform implementation for Sumaris - a company providing specialized solutions for industry.

24 Jul 2026 9:58am GMT

Talish Khan: Layout Builder Is Over-Applied: A Decision Framework for When It Actually Fits

The Pattern I Keep Seeing

A team starts a Drupal project. Someone asks how editors will build and arrange page content. Someone else says "Layout Builder," and that is the end of the conversation. Nobody asks what the editors actually need. Nobody asks what the content model demands. Layout Builder gets switched on because it is powerful, modern, and comes with core.

Six months later, one of two things has happened. Either the editors are happily composing layouts and everyone is glad, which is the good outcome. Or the editors are confused by a tool that gives them more power than they wanted, the developers are fighting to constrain a system designed to be open-ended, and the content is inconsistent because thirty editors made thirty different layout choices. That is the bad outcome, and it is more common than the Drupal community likes to admit.

The tool is not the problem. The reflexive selection of the tool without asking whether it fits is the problem.

The Four Options

Before the framework, a quick map of what you are actually choosing between when you decide how editors build pages in Drupal.

Layout Builder. Editors compose pages by placing blocks into regions of a layout, visually, per page or per content type. Maximum flexibility. Maximum editor power. The editor decides the structure.

Paragraphs. Editors add and arrange predefined content components in a field. Structured flexibility. The developer defines the components; the editor arranges them. The structure is constrained by what you built.

Custom templates. The developer defines the layout in Twig and the editor fills in fields. Zero layout flexibility for the editor. Maximum consistency and developer control.

Plain blocks and block layout. Content is placed in regions through the block system, configured by a site builder, largely static across pages. Good for site-wide furniture, weak for per-page composition.

Each of these is correct for some situations and wrong for others. The framework is about matching the tool to the situation.

The Framework: Four Questions

I run every "how should editors build pages" decision through these four questions, in order.

Question 1: Do editors actually need to compose layouts, or do they need to fill in content?

This is the question that settles most cases, and it is the one nobody asks.

If your editors are filling in structured content (an article has a title, a body, an author, a hero image, a set of related links), they do not need Layout Builder. They need well-designed content types with well-designed fields, rendered through templates the developer controls. Giving these editors Layout Builder hands them a layout composition tool for a job that has no layout composition in it. They will either ignore it or misuse it.

If your editors are genuinely composing pages (a marketing team building landing pages with varying structures, arranging components differently per campaign), then layout composition is a real need and Layout Builder or Paragraphs becomes relevant.

The test: watch an editor work, or ask them to describe their job. If the word "arrange" or "compose" or "build" comes up, layout tooling might fit. If they describe "entering" or "updating" or "filling in," it probably does not.

Question 2: How much layout variation do you actually need?

If the answer is "every page can look completely different," Layout Builder is designed for that.

If the answer is "editors combine a fixed set of components in different orders," Paragraphs is the better fit. It gives editors arrangement flexibility without giving them raw layout power they do not need and will misuse.

If the answer is "pages of this type all look the same," you do not need either. Custom templates with fields is the right call, and it will be faster, more consistent, and more maintainable than either flexible option.

Most projects need less layout variation than they think. The instinct is to build for maximum flexibility "just in case." That flexibility has a cost, paid in editorial inconsistency and developer maintenance, and the "just in case" scenario often never arrives.

Question 3: Who bears the cost of flexibility?

Every option shifts cost to a different party.

Layout Builder shifts cost to editors, who now have to make layout decisions on every page, and to developers, who have to constrain and style a system designed to be open. The flexibility is real but so is the ongoing cost of managing it.

Paragraphs shifts cost to developers upfront (building and styling the components) and keeps the editor experience constrained and predictable. Once built, it is low-cost for editors.

Custom templates put all the cost on developers upfront and give editors the simplest possible experience: fill in the fields, the layout is handled.

The question is not "which is most flexible." It is "who should bear the cost of flexibility on this project, and can they?" A marketing team that wants control can bear the Layout Builder cost. An editorial team of subject-matter experts who just want to publish articles cannot, and should not be asked to.

Question 4: How many people will use this, and how consistent does the output need to be?

Flexibility and consistency are in tension. The more freedom you give editors, the less consistent the output.

If three trained content designers are building marketing pages, Layout Builder's flexibility is a feature and the consistency risk is manageable because the team is small and skilled.

If thirty subject-matter experts across departments are publishing content, Layout Builder's flexibility is a liability. You will get thirty interpretations of what a page should look like, and your site will drift into visual chaos within a year. Constrained tools (Paragraphs with a limited component set, or custom templates) protect consistency at scale.

The larger and less design-trained your editorial pool, the more you should constrain their tooling.

The Framework in One Sentence Each

To compress it:

Notice that Layout Builder is the right answer for the narrowest set of conditions, not the widest. That is the inverse of how often it gets chosen.

Why Layout Builder Gets Over-Applied

Three reasons the reflex exists.

It is in core and it is visible. Paragraphs is contrib. Custom templates require writing code. Layout Builder is right there in core, promoted, documented, demoed. Visibility drives adoption regardless of fit.

It demos beautifully. The drag-and-drop layout composition is genuinely impressive in a demo. Stakeholders see it and want it. The demo does not show the editorial inconsistency that emerges at scale six months later.

It feels like the modern choice. Choosing custom templates can feel like you are not using Drupal's capabilities fully. There is a subtle pressure to use the powerful tool because it is there, even when the simpler option is correct. Resisting that pressure is a senior move.

Closing Thought

Layout Builder is a good tool. I am not arguing against it. I am arguing against choosing it reflexively, without asking whether the project actually needs page composition or just needs structured content entry.

The four questions above take ten minutes to run and save months of pain. Do editors compose or fill in? How much variation is really needed? Who bears the cost of flexibility? How many people, how consistent? Answer those honestly and the right tool usually selects itself.

The instinct to reach for the most powerful option is understandable and usually wrong. The senior move is to reach for the option that fits, which is frequently the more constrained one. A Drupal site where editors fill in well-designed fields through developer-controlled templates is not a less sophisticated site than one built on Layout Builder. Often it is the more sophisticated one, because someone made a deliberate choice instead of a reflexive one.

If you have shipped Layout Builder on a large multi-editor site and kept it consistent over years, I would be curious how you constrained it. That is the hard case, and the honest accounts of making it work at scale are rarer than the demos suggest.

24 Jul 2026 8:28am GMT

Morpht: Protecting PII in Drupal AI: An introduction to Guardrails

The Drupal AI module's Guardrails system runs configurable validation plugins both before a prompt is sent to an LLM and after a response is received. Guardrails can pass, block, or rewrite content, and can be combined into sets with a scoring threshold.

24 Jul 2026 7:20am GMT

The Drop Times: A "Humanizer" Should Not Become a House Style Manual

A developer I work with sent this skill over recently, asking whether it was worth adopting across the agency's client projects (an additional pass before publication under a client's name). That's a fair question to ask before rolling something out across multiple sites, so I read the source rather than taking the pitch at face value.

24 Jul 2026 7:09am GMT

MidCamp - Midwest Drupal Camp: Last Chance: MidCamp 2026 Call for Sessions Extended to March 13

We heard you... and we want to hear from more of you!

The MidCamp 2026 Call for Sessions has been extended. The new deadline is March 13, 2026.

If you had a session idea brewing but didn't quite get it across the finish line, now's your window. We extended the deadline because we want a lineup that reflects the full range of people who use, build, and care about Drupal - and we're not there yet without you.

What We're Looking For

MidCamp sessions are open to all skill levels and all corners of the Drupal ecosystem. Whether you're a developer with a deep technical dive, a project manager with hard-won lessons, a designer with a perspective the community needs, or an end user who figured something out the hard way - there is a place for your session at MidCamp.

We're especially interested in talks around:

Not sure if your idea fits? Submit it anyway. We'd rather review more proposals than miss a great talk.

How to Submit

Session submissions are open now through March 13, 2026.

👉 Submit your session here

Need help shaping your proposal? Join the #speakers channel on the MidCamp Slack - there are people there who will help you get it over the finish line.

Slack: https://mid.camp/slack

What Happens Next

After the submission window closes, our review team will evaluate proposals and notify selected speakers by April 9, 2026. Selected speakers will have until April 15 to confirm, and the full schedule will be published April 16.

MidCamp 2026 is May 12-14 in Chicago. We hope to see you on stage.

24 Jul 2026 1:40am GMT

MidCamp - Midwest Drupal Camp: Catch up on all the MidCamp you missed!

Watch the Dries fireside chat from 2025, or catch up on all of the sessions from last year on Drupal.tv.

Theres even more Drupal goodness to be had in our archives or Drupal.tv's.

The Archives: 2024 2023 2022 2021 2020 2019 2018 2017 2016 2015 2014

24 Jul 2026 1:40am GMT