10 Nov 2026
Drupal.org aggregator
The Drop Times: The Maintainers Behind Drupal’s Company Contribution Rankings
A company's contribution ranking can depend heavily on one maintainer. What else does the public record reveal?
10 Nov 2026 2:10pm GMT
Matt Glaman: Status codes your API is getting wrong
The HTTP method is half of your API's contract. The status code is the other half. Here are the codes that get misused most, and why it matters more now that AI agents are calling your API.
10 Nov 2026 2:00pm GMT
The Drop Times: From AI Coding to Smarter Design, NEDCamp 2026 Speakers Challenge Familiar Workflows
Five NEDCamp speakers examine how AI-assisted coding, native browser features, software review, reusable Drupal templates and user research are changing web development.
10 Nov 2026 1:38pm GMT
Jacob Rockowitz: Vibing Drupal: Using AI to build my presentation about using AI to build Drupal
I'm writing about my NedCamp presentation because I'm excited about my AI-generated slide deck. Ironically, the entire presentation is about using AI to explore, build, maintain, and secure Drupal, based on my previous blog posts. Yet this post is about using AI to generate the presentation's visual narrative. Before we go further, I should share some background information.
Background
My undergraduate degree is in fine arts, with a focus on painting and some sculpture. I don't make much art these days, but I appreciate the history, craft, and process behind making art, which helped me teach myself programming. With art and programming, AI is changing how works of art or programs are created. The reality is that AI isn't creating new things. It is generating code and images based on prior work and knowledge. Artists and developers can nudge or feed AI ideas that could generate something creative and new. I am starting to go down the rabbit hole of thoughts on AI and how I've integrated AI into my Drupal development workflow, which is the topic of my presentation. This post is about my presentation's slide deck.
Past presentations
I've been presenting at Drupal events and recording demos for over a decade on the Webform module and my other Drupal projects. I've become comfortable with public speaking and organizing my thoughts. My slide decks have been simple, with me speaking off the cuff, without a script but with extensive practice beforehand.
Several times, I felt my presentation had a theme or narrative I could see visually portrayed in the slides. Still, I didn't have the bandwidth or resources to take dozens of photographs, find illustrations, or pay someone to create the imagery.
If you've seen any of my Webform presentations, which use a free comic-based template called Read More
10 Nov 2026 1:21pm GMT
Drupal Association blog: In the Open: Why being together matters
In the Open is a weekly series from Drupal Association Interim CEO Tiffany Farriss, sharing what she is hearing across the Drupal community and where the Association is headed. In this episode: what the Drupal Association team took away from its first all-staff retreat in three years, how the Drupal certification program is evolving, and what's coming up with the Rosetta Sprint and DrupalCon Orlando 2027.
"There are some things and some conversations that can only seem to happen when we're all together."
The following is a transcript of Tiffany's remarks, lightly edited for readability.
Being in one room
I'm Tiffany Farriss, the Interim CEO of the Drupal Association, and this is In the Open, my regular update on what's happening at the Association as we navigate a year of change.
Top of mind for me is just how important and accelerating being together in person is. For the first time in three years, the entire Drupal Association staff was in one room. Drupal and the DA collaborate across global time zones every day. That's just how it works. But there are some things and some conversations that can only seem to happen when we're all together in the same place at the same time.
Why we exist
In our DA retreat, we spent a lot of time talking about why we exist. I know you know this, but a handful of companies now run most of the web, whether it's cloud or search or browsers, and increasingly AI. Whoever runs your infrastructure gets a say in whether or how you get to use it. Using open source and Drupal offers a different, more sovereign option, a different future, if you will.
Drupal is a registered digital public good that enterprises and governments, the UN, and humanitarian and academic organizations rely on. So all of us at the DA traced a piece of our work to someone that it helps specifically, and then we mapped it to how it serves, whether it's the makers who build Drupal, the advocates who share the message about what Drupal is and what it could do, or the patrons who fund it.
Every single role at the Drupal Association is essential to how we steward our open source project, how Drupal is actually able to manage the commons that we have. And a lot of that work is stuff that folks in the community may not ever really see or notice.
Evolving Drupal certification
This led us to our biggest strategic conversation of the week: the Drupal certification program.
I talked about this a little bit at Rotterdam. I feel like it's the only thing I talk about these days. But for the last 25 years of Drupal, a really small group, mostly agencies and individuals, have been buying the round for millions of people around the world who use and run Drupal. And we're super deeply grateful for that.
But as we all know, the agency landscape is changing, and it's time for everyone who benefits from Drupal to buy a round too. As a 501(c)(3) program, we need to make sure that our mission serves the public interest. We're not a trade association. We can't give advantage to anyone or even just a few companies.
Those are real guardrails that we talked a lot about at the DA. The revamped Drupal certification is not a partner program. It's not a trade association. We're evolving it to be a public registry about those who engage with the Drupal ecosystem in a net neutral or a net positive way, and we're going to build it on facts that we can verify about how organizations contribute.
By designing Drupal certification, it will include the entire ecosystem. Agencies, yes, of course. Hosting and platform providers, definitely, but also infrastructure providers, technology and third-party integrations, and global systems integrators. People who have been using Drupal, and we see them occasionally contributing in small ways, but we want to encourage them to be able to participate more.
AI has made code cheap, and what we've realized is that trust is precious. So you're going to hear more about this idea of trust and Drupal trust over the coming months.
How we work together
We also talked a lot about how we work. Individuals here at the DA have worked side by side, some of them for many, many years. What we're shifting to, though, is actually working together cross-functionally on things that relate to all of us.
So that's really exciting, and I think that just reminded me that the DA needs to get together regularly and think about what it does and how we serve the Drupal community. I'm coming out of that very energized, and I also know that we're not the only ones who need to get together regularly.
The Rosetta Sprint
Dries has proposed an in-person Rosetta Sprint for early January, and I think that's coming together now. The idea with Rosetta is that Drupal modules describe what they can do once, so that AI assistants, front ends, and workflow tools can all use that same description, with no custom integration work for each kind of task you might want to do.
So if you maintain a module, Dries' post explains how to start now, and I've put the link below.
DrupalCon Orlando 2027
Obviously, the biggest place we all come together as a Drupal community, and where that energy is really palpable, is DrupalCon. If you haven't yet, please check out our DrupalCon Orlando site. Registration is open now for 2027.
This will be the first time since the absolutely epic DrupalCon Australia, which I missed sadly, that we're going to be at a resort, an 1,100-acre resort, the Hyatt Regency Grand Cypress in Orlando, Florida. It's in the Disney Springs area, right near Disney.
So you won't want to miss it. Obviously, there will be sessions and contribution and the hallway track all in one place. But I do want to make sure that you know it is spring break week. So if staying on site with everyone really matters to you, I do encourage you to both register for DrupalCon and book your hotel now. We may be able to add more rooms, but not until the ones we already have are gone.
So you're not going to want to miss it. The local team is deep in planning amazing things, and I know that they've started to recruit for the new Drupal's Got Talent. So whatever your act is, we want to see it, so please do apply.
I'm putting links below to everything. So thank you to the DA team for a really great week together. Thank you to everyone who builds, champions, and funds Drupal, and I hope to see you in Orlando, if not before.
Follow the conversation
New episodes of In the Open publish each week. Subscribe on the Drupal Association YouTube channel to follow along.
With thanks to Stephen Cross of Second Signal Media for producing this series.
10 Nov 2026 10:13am GMT
Specbee: UX Research vs. UX Design vs. UX Audit: What each one actually delivers
UX research, UX design, and UX audits answer different questions. Read this blog to learn what each one delivers and which one your project needs.
10 Nov 2026 6:21am GMT
09 Nov 2026
Drupal.org aggregator
The Drop Times: The Cost of Control
Choosing open-source software can free an organisation from a vendor's restrictions. It cannot free that organisation from the responsibility of maintaining what it uses. The distinction became harder to ignore when the Drupal Security Team and core release managers announced a shorter security-support window for standard minor releases. Beginning in 2027, coverage will fall from twelve months to eight, leaving site owners roughly two months to upgrade after a new minor version arrives. The decision reduces the workload for maintainers, but also leaves organisations less time to complete their own testing and approvals.
The pressure behind that decision is substantial. Between June and October 2026, Drupal published 256 security advisories across core and contributed projects, exceeding the 250 published during the preceding thirty months. The Drupal Association links the surge in reports to the growing use of AI-assisted vulnerability discovery, while funding from Alpha-Omega has supported efforts to manage the increased volume. Core release management, however, faces a separate funding problem, with experienced maintainers reporting significant reductions in sponsored hours. The result is an uncomfortable imbalance: more vulnerabilities are being discovered, but the resources needed to maintain and distribute secure software remain uncertain.
Public institutions face a similar challenge when pursuing digital sovereignty. Following DrupalCon Rotterdam's Government Summit, Bert Boerland, chair of Stichting Drupal Nederland, argued that public procurement should reward contributions to the software communities supporting government services, rather than paying only for finished applications. Governments may have the legal freedom to modify or replace their software, yet remain dependent on suppliers for the expertise to maintain it. Europe's Digital Commons EDIC strategy, which includes a maintenance funding pilot, offers one possible response to that dependency. Whether such commitments produce lasting support will depend on their implementation.
What connects these developments is the growing distance between those who benefit from open-source infrastructure and those responsible for sustaining it. Drupal's security commitments rely on maintainers whose time and expertise are finite, while public institutions depend on software communities that their procurement systems may do little to support. Neither problem can be resolved simply by choosing an open-source licence. As governments and businesses place more essential services on shared software, the question becomes less about whether they have the freedom to control it and more about whether they are prepared to share the responsibility that makes such freedom possible.
Follow The DropTimes on LinkedIn and Bluesky, or join #thedroptimes on Drupal Slack.
Allen Jason wrote and curated this issue of Editor's Pick.
09 Nov 2026 4:55pm GMT
Très Bien Blog: Real-time Drupal with Drupack
Real-time Drupal with Drupack
One reason I want Drupal to standardize on FrankenPHP is so we can build on top of the built-in mercure server and unlock a whole new range of applications for Drupal. Of course we can do all this today, provided you maintain a separate server (most likely a nodejs server of some kind), write the integration code and make sure everything keeps working… I'm all about reducing the cost of ownership, it's not ideal to have to deal with that.
theodore
09 Nov 2026 4:43pm GMT
Droptica: Drupal AI alt text generation, metadata and summaries
Turn repetitive editorial work into reviewable drafts. Learn how to configure Drupal AI tasks, protect accepted content, control spending, and measure completed fields.
09 Nov 2026 4:04pm GMT
The Drop Times: Comparing Drupal Canvas's Five Official Headless Front-End Starters
Which Drupal Canvas starter includes Workbench, how do the adapters differ, and what can prevent draft previews? A tested Next.js setup provides a practical reference.
09 Nov 2026 2:11pm GMT
The Drop Times: Government Summit Speakers Call for Shared Investment in Open Source
A public contract can finance a new government website while leaving the software beneath it underfunded. That gap raises questions about who should pay for future fixes and improvements.
09 Nov 2026 9:45am GMT
Gspikes: School Website Design: What the 100 Largest US School Districts Get Right
School website design lessons from the 100 largest US districts: what their homepages ship, what most miss, and the April 2027 accessibility deadline.
09 Nov 2026 7:00am GMT
08 Nov 2026
Drupal.org aggregator
#! code: Drupal Paradigms
Drupal Paradigms
I've been using Drupal for a number of years now, and I've built up a set of paradigms (or heuristics) that help me with building Drupal sites. These are based around both using Drupal as well as developing and maintaining Drupal sites, and even web development in general.
When putting together content types or building Drupal modules I have these rules at the back of my mind, guiding my actions. They've even been used in more than one sales document where I talk about how we work.
In this article I will look into a set of Drupal paradigms, with some explanation about each one. I'll also add example where possible to illustrate my thoughts.
First, let's start with a classic.
Don't Hack Core
You've probably heard this one before, but I thought I'd start with it as it is just as important now as it ever was.
Back in the Drupal 6 + 7 days, when I first started using Drupal, it was quite difficult to update the site when a new version came out. It was mostly a case of copy/pasting from a download into the correct directories to override any existing code already in your site.
This was before composer was introduced to Drupal and whilst tools like Drush Make existed to automate this, they weren't widely used in the community. At least, I rarely saw them used outside of projects I was building.
Because updating code was so manual the phrase "don't hack core" became quickly adopted as it became quite difficult or time consuming to update the versions and make sure that your overrides were still in place. Altering Drupal core files (or even module files) also meant that the site could experience bugs that weren't in the original code base and that the maintainers couldn't possibly assist with.
philipnorton42
08 Nov 2026 6:55pm GMT
Droptica: The Drupal AI module ecosystem, mapped
This Drupal AI modules overview maps release maturity, dependencies, and run costs so your team can shortlist editorial, automation, search, and agent integrations.
08 Nov 2026 4:27pm GMT
BloomIdea: Search API Group Access for Drupal: search and AI answers that show each member only what Group lets them open
A member of two departments asks the intranet's assistant what the company has on SMTP. The vector database ranks the whole intranet, hands back the ten closest passages, and Drupal then throws away the ones she may not open. She gets whatever is left, fewer than she asked for and not the best she could have had. On the search page next door, the same thing shows up as a result count above a list shorter than the page, and a pager that runs past the last result she can open.
That is what happens on a site built with Group 3 as soon as the search goes through Search API. Group enforces access by altering SQL queries, so Views listings of nodes respect it. A Search API search goes to its backend, where Group never sees it. The Content access processor that ships with Search API indexes node grants, and Group 3 uses none.
Search API Group Access closes that gap where it opens, inside the search backend. It is free software under GPL-2.0-or-later, and 1.0.0, released on 8 November, is its first stable release. It plugs into Search API and Group, and works on any backend that supports condition groups and IN filters: the database backend, and AI Search on a vector database such as Qdrant.
What you can build with it
- A search page on an intranet or extranet whose result count, facets and pager agree with what each member sees, because the backend ranks and counts only that.
- An AI assistant that answers from your content and retrieves only from the groups the person belongs to, so asking for ten passages returns ten they can open.
- A new member who finds the group's documents on their very next search. Memberships, roles and permissions are read when the search runs, so changing them reindexes nothing.
- Comments found by whoever may see the entity they are attached to, and reindexed when that entity changes groups, owner or status.
- Paragraphs, or any other entity Group does not relate, that take on the access of their host through one event subscriber.
- A large index rolled out with no gap in service: index the access values with the filter off while searches keep working, then switch the filter on without reindexing.
The same answer as Group, or no answer
The rule the module is built to is parity with Group: for the "view" operation, a search returns an item if and only if an entity query that checks access would, as far as Group decides. Outsider, insider and individual permissions, "any" and "own", published and unpublished. The test suite runs both for a matrix of accounts and compares the results, and it runs on Drupal 10 and 11.
Where it cannot be exact, it errs towards hiding. An item that has not been indexed with the processor yet is returned to nobody. There is one known case where Group would show an item and the search does not, in an item that belongs to two groups when the insider role grants less than the outsider role, and the module accepts that false negative rather than risk a false positive. Groups themselves are not covered, and neither are operations other than "view".
Caching gets the same care. Turning the processor on or off saves the index's views again, so a results cache never serves one member's results to the next.
Where it came from
We built it for our own intranet, where an assistant answers questions from about 270,000 items stored in Qdrant through AI Search, and every one of its searches goes through the filter. The person who sees least of the intranet asks for ten passages and gets ten, all of them ones they may open.
Getting there taught the module two things it now does by itself. Values meant to be matched exactly are hashed to plain hexadecimal, because AI Search runs every text attribute through an HTML to Markdown converter that escaped the underscores in them. And the status report flags an AI Search index whose access fields are not set as filterable attributes, where every search would otherwise come back empty. On Qdrant, give those fields payload indexes: on an index of 190,000 points, a filtered search took 100 to 210 ms without them and 2 to 16 ms with them.
Get it
composer require drupal/search_api_group_access
drush en search_api_group_accessThen check Group access on your index's Processors tab and reindex. It requires Drupal 10.3 or 11, Group 3.3 or later and Search API 1.39 or later. Stable releases are covered by Drupal's security advisory policy.
The README covers the rollout on a large index, AI Search and Qdrant, and the events. If you also need entity reference fields to offer only the content of the group being edited, Group Entity Reference Filter does that. And if your site shares content out by group in a way the module does not cover yet, tell us in the issue queue.
08 Nov 2026 3:59pm GMT
06 Nov 2026
Drupal.org aggregator
Droptica: A Drupal pipeline for turning PDFs into structured content
Copying facts from PDFs into a website takes time that editors could spend checking the facts themselves. To extract data from PDF into Drupal reliably, you need more than a tool that reads documents. You need a pipeline that puts each value in the right field, catches problems, and gives a person enough context to approve the result.
06 Nov 2026 7:03pm GMT