fidzu : web

Choosing open-source software can free an organisation from a vendor's restrictions. It cannot free that organisation from the responsibility of maintaining what it uses. The distinction became harder to ignore when the Drupal Security Team and core release managers announced a shorter security-support window for standard minor releases. Beginning in 2027, coverage will fall from twelve months to eight, leaving site owners roughly two months to upgrade after a new minor version arrives. The decision reduces the workload for maintainers, but also leaves organisations less time to complete their own testing and approvals.

The pressure behind that decision is substantial. Between June and October 2026, Drupal published 256 security advisories across core and contributed projects, exceeding the 250 published during the preceding thirty months. The Drupal Association links the surge in reports to the growing use of AI-assisted vulnerability discovery, while funding from Alpha-Omega has supported efforts to manage the increased volume. Core release management, however, faces a separate funding problem, with experienced maintainers reporting significant reductions in sponsored hours. The result is an uncomfortable imbalance: more vulnerabilities are being discovered, but the resources needed to maintain and distribute secure software remain uncertain.

Public institutions face a similar challenge when pursuing digital sovereignty. Following DrupalCon Rotterdam's Government Summit, Bert Boerland, chair of Stichting Drupal Nederland, argued that public procurement should reward contributions to the software communities supporting government services, rather than paying only for finished applications. Governments may have the legal freedom to modify or replace their software, yet remain dependent on suppliers for the expertise to maintain it. Europe's Digital Commons EDIC strategy, which includes a maintenance funding pilot, offers one possible response to that dependency. Whether such commitments produce lasting support will depend on their implementation.

What connects these developments is the growing distance between those who benefit from open-source infrastructure and those responsible for sustaining it. Drupal's security commitments rely on maintainers whose time and expertise are finite, while public institutions depend on software communities that their procurement systems may do little to support. Neither problem can be resolved simply by choosing an open-source licence. As governments and businesses place more essential services on shared software, the question becomes less about whether they have the freedom to control it and more about whether they are prepared to share the responsibility that makes such freedom possible.

Follow The DropTimes on LinkedIn and Bluesky, or join #thedroptimes on Drupal Slack.

Allen Jason wrote and curated this issue of Editor's Pick.

09 Nov 2026 4:55pm GMT

Real-time Drupal with Drupack

theodore November 9, 2026

09 Nov 2026 4:43pm GMT

Turn repetitive editorial work into reviewable drafts. Learn how to configure Drupal AI tasks, protect accepted content, control spending, and measure completed fields.

09 Nov 2026 4:04pm GMT

W3C President and Interim CEO Dominique Hazaël-Massieux shares timely and notable highlights and information selected from the busy and prolific work last month at W3C such as TPAC 2026, AI @ W3C, progress on Identity and Credentials, further improvements to W3C infrastructure for standardization and more.

05 Nov 2026 10:57am GMT

W3C's archives of the www-talk mailing list are now complete, back to its creation in October 1991. This post lists some of the more interesting messages in the early development of the Web.

28 Oct 2026 2:07pm GMT

In this blog post, Ian Jacobs, Strategy Team, introduces the second pilot of the W3C Open Source program: a polyfill for the WebMCP API. WebMCP is a new JavaScript interface that allows web developers to expose their web application functionality as "tools".

27 Oct 2026 11:50am GMT

On January 14, 2006, John Resig introduced a JavaScript library called jQuery at BarCamp in New York City. Now, 20 years later, the jQuery team is happy to announce the final release of jQuery 4.0.0. After a long development cycle and several pre-releases, jQuery 4.0.0 brings many improvements and modernizations. It is the first major … Continue reading →

18 Jan 2026 12:29am GMT

It's here! Almost. jQuery 4.0.0-rc.1 is now available. It's our way of saying, "we think this is ready; now poke it with many sticks". If nothing is found that requires a second release candidate, jQuery 4.0.0 final will follow. Please try out this release and let us know if you encounter any issues. A 4.0 … Continue reading →

11 Aug 2025 5:35pm GMT

Last February, we released the first beta of jQuery 4.0.0. We're now ready to release a second, and we expect a release candidate to come soon™. This release comes with a major rewrite to jQuery's testing infrastructure, which removed all deprecated or under-supported dependencies. But the main change that warranted a second beta was a … Continue reading →

17 Jul 2024 2:03pm GMT

When it comes to crafting an article, the headline is crucial for grabbing the reader's attention and enticing them to read further. In this post, I'll explore the 7 types of article headlines and provide examples for each using the subjects of product management, user experience design, and search engine optimization. 1. The Know-it-All The […]

The post 7 Types of Article Headlines: Craft the Perfect Title Every Time first appeared on Smiley Cat.

29 May 2023 10:20pm GMT

Product management is one of the most exciting and rewarding careers in the tech world. But it's also one of the most misunderstood and misrepresented. There are many myths and misconceptions that cloud the reality of what product managers do, how they do it, and what skills they need to succeed. In this blog post, […]

The post 5 Product Management Myths You Need to Stop Believing first appeared on Smiley Cat.

09 Apr 2023 5:28pm GMT

The role of a product manager is crucial to the success of any product. They are responsible for managing the entire product life cycle, from conceptualization to launch and beyond. A product manager must possess a unique blend of skills and qualities to be effective in their role. Strong strategic thinking A product manager must […]

The post The Key Strengths of the Best Product Managers first appeared on Smiley Cat.

11 Dec 2022 4:43pm GMT