The problem: Certain maintainer roles keep Drupal's lights on. Right now, there's a brownout.
Interim Drupal Association CEO Tiffany Farriss recently wrote about bringing to light "the work that just happens": the mostly invisible (but essential) services the Drupal Association provides to sustain the Drupal project and community. I love this description. If everything's going well, maybe you don't even know or notice. But on the other hand, maybe you should.
The Drupal Core Leadership Team has its own version of work that "just happens", a bit similar and a bit different. We're more likely to have our work celebrated, especially by other contributors. On the other hand, though, there's plenty more going on behind the scenes… and outside the core development bubble, what we do is mostly just summarized in one line as an external dependency for someone's contributed project, strategic initiative, or web application.
Certain Core Leadership roles (specifically those of the committer, release manager, and team facilitator) are even more like the work the DA infrastructure team does on your behalf. What we do isn't shiny, or sexy. It doesn't necessarily push the boundaries of what Drupal can do, and it probably won't help you win a bid unless your prospective client really "gets it". But every single Drupal project, every site, every initiative, every new feature depends on it. We keep the lights on.
Funding for essential roles is falling, when we need it more than ever.
Here's the hard truth: Funding for Drupal core's stability and security is at its lowest since 2012, while our needs (especially for core security) are at an all-time high.
Some quick facts:
- Core release management funding is currently at less than half its 2013-2023 levels.
- In 2022 and 2026, respectively, two organizations that had each sponsored a Drupal core release manager for a decade ended their respective sponsorships.
- Release timelines for Drupal 11.4, 11.5, and 12.0 have all slipped well past their planned schedules. This is the first time this has happened since Drupal 8 development in 2013-2015.
- Before 2026, the all-time maximum of Drupal core security advisories in a single year was 15. The Drupal Security Team has issued 16 already this year… and there will likely be more.
- In August, September, and October 2026 alone, we issued 198 contributed project security advisories. This is more advisories than any entire year before 2026… and there will absolutely be more.
I'm xjm. I help make core happen. But I can't do it alone.
I've been one of the folks funded to keep Drupal's lights on since 2013. I defined Drupal 8's release requirements, helped get its backlog under control, and organized the efforts of hundreds of volunteers to finally get it released in 2015. I've been involved in nearly every Drupal core security update since Drupal 8.0.0, and I've tagged far more core releases than anyone else in the project's 25-year history.
None of those things could have been done in volunteer hours, or even 20% time. None of it could have been done without my sponsors over the years: Acquia, Agileana, HeroDevs, Salsa Digital, Zoocha, and QED42.
Since May 2026, I've only had 8 funded hours per week for my release management responsibilities (down from 40 in 2022). Each time one of my contribution sponsorship contracts has ended, it's taken longer to find the next sponsor. First it was two weeks. Then it was two months. Then four months. This time, it's already been a full six months without enough funding.
I will hopefully be able to announce another sponsor soon for seven more hours per week, bringing me to 15 total. I still need at least another 12-16 hours per week of funding, both to have a sustainable income for myself, and to bring us closer to meeting core's current needs.
Meanwhile, I've already burned through most of my savings. I don't need additional funding on some future date; I need it now. And while some folks are good at context-switching between dedicated contribution time and billable client work, I'm not. Realistically speaking, if I don't secure more funding for 2027, the path forward for me is to give up on this funded OSS contribution thing and go back to school.
That means you won't even have 8 or 15 hours per week of me supporting your core security updates -- you'll have zero, and funding for critical Drupal maintenance roles will fall even further.
The solution: Ensure sustainable funding for critical roles. Starting right now. With you.
To inquire about sponsoring me, use my Drupal.org contact form or DM me on the Drupal community Slack (username @xjm).
The simplest way to sustainably fund Drupal core's release management is to have multiple sponsors for it. Ideally I'd have three to five sponsors at a time, each funding 8-16 hours per week. (For more information on how this works, read my sponsorship information page.) However, that level of commitment is not possible for all organizations, especially with the current financial disruptions to the ecosystem. If $3200/month is too much for your organization's marketing and resiliency budget at present, here are a couple other options.
Sponsor me for a fixed six-month term
If $1600/month or so might work for your organization, consider concentrating that investment in $3200/month for a six-month commitment instead. Your organization still earns Drupal services listing credits that last a full year, and it helps reduce overhead associated with your investment. Hat tip to QED42, who pioneered this idea.
Sponsor my security work for one day per month
My longtime sponsor Zoocha and I are collaborating on an offering for more organizations to support my Drupal security work. If you can afford $800/month, our goal is for Zoocha to act as a contractor for my services, and you'll be credited on a subset of the security advisories I contribute to.
Sponsor me on Patreon
If your budget for supporting Drupal core's stability and security is anywhere from $5 to $600 dollars per month, you can sponsor me on Patreon. You can learn a bit more about what goes into making Drupal core happen, and the higher tiers receive additional benefits.
This isn't charity.
Sponsoring my core and security contributions will help your lead generation. If you sponsor my time for one day every week for a full year as a Drupal Certified Partner, you'll likely end up on the first page of the Drupal.org services listing. If you're already on the first page, you'll probably make Top Tier. But that's not why you should do it. You should do it because you depend on Drupal, and Drupal depends on me.
