02 Nov 2026
Drupal.org aggregator
The Drop Times: The Next Test of Drupal’s Contribution Model
Drupal has long relied on organisations and individuals who contribute beyond their immediate needs. Yet that responsibility remains unevenly distributed. According to figures published by the Drupal Association in February 2025, just 219 of the 1,440 organisations active on Drupal.org accounted for 96% of recorded contributions in 2024. The challenge is not simply attracting more contributors, but making responsibility for Drupal's upkeep more widely shared.
Two proposals outlined by Drupal Association Interim CEO Tiffany Farriss on 28 October 2026 suggest how that might happen. A broader Drupal Certified programme could recognise makers, patrons and advocates, extending recognition beyond agencies. Alongside it, a dedicated maintainers fund could help organisations without development capacity financially support the people maintaining software they depend on.
Together, these proposals revisit Dries Buytaert's long-standing makers-and-takers argument. They also raise questions about what counts as a fair contribution. Financial support cannot automatically substitute for technical responsibility, and certification must recognise different capacities without favouring organisations that can afford to pay. How funding reaches maintainers, and how their work is valued, will matter as much as the proposed framework itself.
Neither proposal has been implemented. Their significance lies in an attempt to move from contribution as an expectation placed on a committed minority towards a responsibility shared across the ecosystem. Drupal will remain freely available, but sustaining that freedom requires continuing work. The real test is whether more beneficiaries can help support it without compromising the openness and independence that make Drupal worth maintaining.
Follow The DropTimes on LinkedIn and Bluesky, or join #thedroptimes on Drupal Slack.
Allen Jason wrote and curated this issue of Editor's Pick.
02 Nov 2026 3:01pm GMT
Omitsis: Agentic Web Census, the monthly census of websites ready for AI agents
A growing share of the visits a website gets are AI assistants that read the page to do something on someone's behalf, such as compare prices or fill in a form. We built Agentic Web Census to find out how ready the web is for them, and we publish it every month with open data. The Agentic Web Census home page, with the field to check a site. What Agentic Web Census is It is a free website that scores the whole web on how ready it is for AI agents. We call the score AWCS, short for Agentic Web Census Score, and it goes from 0 to 100%. We publish it for the web as a whole and...
02 Nov 2026 12:17pm GMT
Gspikes: Financial Services Website Design: What the 50 Biggest US Banks Ship, and Where Drupal Fits
Financial services website design from 50 big-bank homepages: 20 of 36 already show the new FDIC sign due April 2027. What to ship, and where Drupal fits.
02 Nov 2026 7:00am GMT
Gspikes: CMS for Publishers: What the 50 Biggest US News Sites Run, and Where Drupal Fits
We checked the CMS behind the 50 biggest US news sites and 27 Drupal publishing projects. What publishers run, and how to choose a CMS for yours.
02 Nov 2026 12:16am GMT
01 Nov 2026
Drupal.org aggregator
Gspikes: Migrate Redirect Map 1.0: Drupal Redirects for Every Old Drupal 7 URL
Migrate Redirect Map 1.0 builds the Drupal redirects a Drupal 7 to 10/11 migration needs and lists every old URL that would 404. Here is how it works.
01 Nov 2026 7:00am GMT
31 Oct 2026
Drupal.org aggregator
Drupal Core News: PHPStan level 3, constructor property promotion, and other disruptive commits this week in advance of Drupal 12.0.0-rc1
Drupal 12.0.0 and 11.5.0 are scheduled for the week of December 7, 2026. In preparation for these upcoming releases, our schedule targets release candidates for these versions for less than two weeks from now, the week of November 9.
Before we create our release candidates, we will commit several "beta target" changes that are likely to conflict with existing core merge requests. These include issues to increase Drupal's PHPStan rule level to 3 for improved testing of coding standards and static analysis, and specific large cleanups like adopting constructor property promotion and removing a legacy test annotation format. New PHPStan failures are also likely on existing merge requests.
These beta targets need to be committed in a certain order, and will conflict with each other as well as many other merge requests in the Drupal core issue queue. Commits that introduce merge conflicts with the beta targets may be reverted in order to ensure these large changesets can land smoothly without needing to be repeatedly regenerated.
Once the beta targets are completed, Drupal 12.0 and 11.5 will enter their release candidate phase, and all disruptive changes (aside from critical dependency updates and similar issues) will begin targeting Drupal 12.1.
31 Oct 2026 6:47pm GMT
Webpro Company blog: Developer work is changing. Where does experience fit?
I have watched work shrink for myself and other developers. At the same time, AI lets me try ideas I previously lacked the time or money to pursue. I write about this change from my own experience: what needs rethinking and where I want to focus as a developer. I do not yet know what the field of development will look like. In my experience, two things are happening at once: there is less demand for some familiar work, while some new ideas have become more affordable to build. Both need to be taken into account. I am trying to understand which problems benefit most from my experience and where new tools fit. It is a question I am exploring through my everyday work. When work becomes part of your identity When you have spent years learning, rescuing projects and tracking down difficult…
31 Oct 2026 6:00am GMT
30 Oct 2026
Drupal.org aggregator
Talking Drupal: Talking Drupal #576 - Inside & Outside Drupal AI
Today we are talking about AI, Drupal, and what's new with guests Dr. Christoph Breidert & Scott Falconer. We'll also cover Drupal AI Demo as our module of the week.
For show notes visit: https://www.talkingDrupal.com/576
Topics
- Inside vs Outside AI
- Agent Permissions and Scoping
- Drupal Org and GitLab Future
- Outside AI Examples Teaser
- Why CMS Still Matters
- Agent Swarms Expose Data
- Shadow IT And Liability
- CMS As Context Engine
- Content Governance At Scale
- Provenance And Regulation
- MCP And Client Integrations
- Rosetta Sprint Challenges
- Keeping Up With AI
Resources
Guests
Christoph Breidert - 1xINTERNET.com breidert Scott Falconer - managing-ai.com scott-falconer
Hosts
Nic Laflin - nLighteneddevelopment.com nicxvan John Picozzi - epam.com johnpicozzi
MOTW Correspondent
Martin Anderson-Clutz - mandclu.com mandclu
- Brief description:
- Have you ever wanted to try out all of Drupal's AI features on a realistic site, and then pop the hood to see exactly how they're configured? There's a demo for that.
- Module name/project name:
- Brief history
- How old: project created on Oct 4, 2026 by Christoph Breidert (breidert), a Drupal AI Product Lead, with support from 1xINTERNET, FreelyGive, and Foster Interactive. The demo itself was revealed in the Driesnote at DrupalCon Rotterdam
- The demo runs on Drupal CMS with the Drupal AI modules, running on Drupal 11.4
- Maintainership
- Looks to be actively maintained
- Documentation: the project has a README that is really clear about what you can try and who has access to what
- Number of open issues: 83, 2 of which are bugs
- Module features and usage
- The demo is a site for Northmoor University, a fictional coastal university, with realistic programs, news, events, people, and images
- You launch your own copy for free through Drupal Forge. No install, no config, no credit card, and AI credits are included, courtesy of amazee.ai. Each demo instance lasts 30 days
- Features include AI search with cited answers, page generation in Canvas, content review, auto-classification, translation, image validation, image generation and alt text, AI disclosure labels, observability, and an MCP server so tools like Claude can work with the site's content
- Each feature has a step-by-step explainer page in an "AI Features" section, right in the demo site
- The best part is you have full admin access, so every agent, prompt, index, and view is right there to inspect, tweak, or rebuild on your own site
- Lots of the features are public recipes you can use today, like AI Answers, AI Image Alt Text, AI Content Classification, and AI SEO Optimizer
- The big caveat: the ai_demo project is really a placeholder. It's the README plus the issue queue. The actual build (content, theme, demo-specific recipes, deployment) lives in a private GitLab repo for Drupal AI Partners
- So the project's real job is feedback: issue templates for bugs, feature requests, feature-page fixes, and plans, each tagged by demo component. Fixes show up the next time you launch a new copy
- The build was a big community effort: from August to late September, more than 100 contributors, 1,442 commits across 54 projects, and 616 merged MRs, adding roughly 596,000 lines of code
- Back in episode #529 we covered the AI Ecosystem Recipe, and both are about getting the Drupal AI stack in front of you fast. The difference is mechanism: the recipe applies the AI modules to your own site for you to configure, while the demo is a fully-baked, hosted instance with content and prompts already tuned, so you can not only try out but also reverse-engineer a working setup
30 Oct 2026 6:00pm GMT
Dynamosys Insights: Drupal 11 Upgrade Blocked? How to Find and Fix Composer Conflicts
A blocked Drupal 11 upgrade usually comes down to a specific package, version constraint, or environment requirement. This guide explains how to identify the blocker, resolve it safely, and verify your site before deployment.
30 Oct 2026 2:34pm GMT
The Drop Times: Open Source is Essential for Tomorrow's Digital Government
The Netherlands has committed to greater open-source collaboration. But what will it take to turn that commitment into shared digital services that governments can develop and maintain together?
30 Oct 2026 1:28pm GMT
Omitsis: Drupal 7 to Drupal 10 or 11 migration: steps, risks and cost
Why it is a migration, not an upgrade Drupal 10 or Drupal 11? The steps of a Drupal 7 migration The risks to keep under control What makes a migration cost more or less What if I don't migrate yet? Drupal migrations with Omitsis Drupal 7 reached its end of life on 5 January 2025. Since then it gets no security fixes from the community, and every month there are more abandoned modules, more incompatibilities with new PHP versions and more risk. If your website still runs on Drupal 7, the question is no longer whether to migrate, but how to do it without losing content, Google...
30 Oct 2026 10:08am GMT
29 Oct 2026
Drupal.org aggregator
Centarro: Update Drupal Commerce sites for an exploit observed in the wild
This post is being published in consultation with the Drupal Security Team.
As the maintainers of Drupal Commerce, we are advising users to upgrade immediately to the recently published releases of Commerce Core to protect against a vulnerability that may have financial impact.
We received two reports of attempts by malicious users to place fraudulent orders using a vulnerability patched in Commerce Core 3.3.13 and 8.x-2.41 (SA-CONTRIB-2026-254). Centarro and the Drupal Security Team looked for broader abuse of this issue. As of now we do not believe it was scripted or exploited beyond the initial sites.
We analyzed the issue in private with the Drupal Security Team, who coordinated the testing, packaging, and release of the module updates on October 28, 2026.
Attempted exploits have been observed on live sites
Those who reported the issue were merchants who observed suspicious activity on live sites, not merely security researchers evaluating the platform for vulnerabilities. Given that merchants observed this behavior, we highly recommend every user evaluate recent orders to determine whether or not any were fraudulently placed.
This vulnerability impacts both full-stack and headless sites, with attack vectors that differ based on the site's architecture.
Identifying potential exploits
To determine if any of your recent orders were fraudulently placed or otherwise manipulated, evaluate them according to the following rubric organized according to exploits of increasing sophistication. Every Drupal Commerce site is unique, so you should evaluate the results of each item based on your knowledge of the legitimate behaviors your site supports.
29 Oct 2026 10:31pm GMT
Dynamosys Insights: Drupal Commerce Security Alert: Update Your Store and Check Your Orders
An actively exploited Drupal Commerce vulnerability could financially affect online stores. Security updates are available, and store owners should also review their orders for inconsistencies.
29 Oct 2026 4:20pm GMT
Drupal AI Initiative: Turning AI's Promise Into Practical Results at Drupal AI Summit Paris 2026
Turning AI's Promise Into Practical Results at Drupal AI Summit Paris 2026
For most organizations, the question is no longer whether AI matters, but how AI fits into their own work, on what terms, and at what cost.
On December 1, 2026, the Drupal AI Summit Paris will bring together experts and organizations that have already worked through those questions, including EU institutions and medical researchers, to share what they learned.
Your summit ticket also gets you all three days of the Future of Software Technologies (FOST) conference, December 1-3, with over 300 sessions to choose from.
Marketing and Content Teams Moving Faster Without Losing Their Voice
For marketing and content teams, trustworthy content is essential. It has to sound like their brand and get published without weeks of waiting. That's the promise of Drupal AI.
When pages drift off-brand and don't keep up with the brand, they lose their importance and credibility. They lose what sets them apart.
AI working as the editor, not the author, is the focus of this session. Bruno Bruno from 1xINTERNET will show how AI can review content against an organization's own standards and suggest fixes, keeping hundreds of pages consistent. All while people still write the content and decide what gets published.
Landing pages are often the centerpiece of a campaign. The summit will also feature Canvas AI, showing how you can build a complete, brand-compliant landing page from a text prompt or by drag and drop, and then route it to the right people for approval. That way, the page goes live on time and in the right voice.
Marketing teams also have to make changes across many pages at once. Fabian Franz from Tag1 will demonstrate how AI can make a change across an entire university site in a separate workspace, so nothing reaches the live site until a person reviews and publishes it.
Preparing for a Changing Search Landscape
The way people discover information online is changing. Increasingly, potential customers are turning to AI assistants and answer engines to research products, services, and organizations.
For website owners and marketing teams, this raises an important concern: content that performs well in traditional search may not necessarily be discoverable or cited by AI systems.
Two sessions at the summit tackle this question: one focused on what's changing and the other on how to respond.
Martin Anderson-Clutz from Acquia will look at how AI is changing the role of websites, from how content is discovered to how organizations approach personalization and digital marketing.
Christoph Breidert from 1xINTERNET picks up from there with a practical approach to Answer Engine Optimization (AEO), building on one of last year's most popular discussions about AI search visibility. His session will explore how organizations can with S1xSignals assess their content for citation readiness, query alignment, content structure, authority and trust, semantic clarity, and technical accessibility.
Content structure, metadata, and schema are at the heart of these signals, and Drupal does these well.
Learning From Organizations Already Putting AI to Work
There is a considerable difference between showing what AI can do and making it work in an organization with established systems, responsibilities, and regulatory requirements.
Tens of thousands of candidates turn to the European Personnel Selection Office (EPSO) for information about careers with the European Union institutions. Working with Dropsolid, EPSO implemented an AI-powered answer engine to help them find what they need in all 24 official EU languages.
It uses EPSO's own documentation rather than general AI information, cites the source behind every answer, and runs on European-sovereign infrastructure with governance and auditability built in. At the summit, Dominique De Cooman, Founder and CEO of Dropsolid AI, will explain how Drupal's structured content and API-first architecture make all of that possible.
Not every use of AI faces the public. At the Clinical Practice Research Datalink (CPRD), it works inside the review process. CPRD provides anonymized clinical data to researchers around the world, and every application to use that data goes through a careful, multi-stage human review. CPRD added an AI reviewer that checks each application against its own rules on data use, while people still make the decisions. At the summit, Vijay Mani from Reading Room will share how they made it work in a highly regulated environment.
On top of EPSO and CPRD, Dan Lemon from amazee.io will present more examples of Drupal AI in production, including content classification, accessible content rewriting, and improved search experiences, all supported by private AI infrastructure. Some of these organizations went from not using AI to making it an integral part of their work cycle.
Moving Forward With AI While Maintaining Control
For many European organizations, responsible AI and data sovereignty are central to technology choices. Decision-makers need straightforward information to make clear, well-thought-out plans.
Of course, they also have to follow the GDPR, and the fines for getting it wrong can be large. So they need to know where their data is processed, which providers can access it, and who reviews what AI produces. Open source lets them make those choices for themselves, and Drupal AI supports multiple models and providers, including locally hosted options, so each organization can choose what fits best.
Two sessions pick up from there: Jamie Abrahams from FreelyGive will look at how subscriptions, the fear of lock-in, and the push for national AI sovereignty are leading people, companies, and governments toward open source. Wolfgang Ziegler from drunomics will show how people and AI agents can combine efforts while always allowing for approval to rest with people.
Both point to the same idea: adopting AI shouldn't mean giving up control of an organization's data, content, or decisions.
One Summit, Hundreds of Opportunities to Learn
The Drupal AI Summit opens the Future of Software Technologies (FOST) conference, December 1-3, 2026, at CNIT Forest in Paris. More than 5,000 people are expected across the three days.
If you make decisions about AI, run a website, or work in marketing, it's a chance to see how AI can improve what you already do, and what may shape your next decisions.
Friends of the Drupal Community can get a summit ticket for €149, which covers all of FOST. The regular FOST pass is €499, so it's a remarkable value, especially with everything else that's included.
Last year's event sold out, and we expect the same this time, so if you're thinking about coming, get your ticket now.
Frequently Asked Questions
When and where is the Drupal AI Summit Paris 2026?
On 1 December 2026, at CNIT Forest in Paris. It opens the Future of Software Technologies (FOST) conference, which runs 1 to 3 December.
How much does a ticket cost?
For Friends of the Drupal Community, a summit ticket is €149, and it covers all of FOST. The regular FOST pass is €499.
What does a summit ticket include?
All three days of FOST, with more than 25 conferences and over 300 sessions.
Who should attend?
Marketing and content teams, IT and compliance teams, and business leaders who want to see how AI can fit into their own work, on their own terms.
29 Oct 2026 3:04pm GMT
The Drop Times: How to Use AI Coding Agents on Drupal Projects with AGENTS.md, Tests and MCP
AI-generated Drupal code can look correct while using outdated APIs, invented fields or incomplete cache metadata. Project instructions and repeatable checks help developers identify those mistakes before committing changes.
29 Oct 2026 11:32am GMT
The Drop Times: X to Drupal: QED42 Migrates 646 Pages From Webflow to Drupal 11
QED42's website looked correct after an early AI-assisted migration, but its Drupal backend told a different story. Souvik Pal explains how that finding changed the framework.
29 Oct 2026 10:34am GMT