Drupal is now in the OSV database, see some examples.

One of the key parts of keeping a website secure is making sure you have updated to incorporate security updates. Today, we're excited to share that Drupal's security information will be available in a new channel that has some benefits compared to existing tools. This is another large step forward in making it easier for Drupal sites to stay secure.

How can people get security data today?

Since 2005 people have been able to subscribe to emails or an RSS feed with security announcements. More recently those feeds were mirrored on social media sites as well. However, these feeds include a lot of "noise" - news about releases for software that are not installed on a specific site.

Since 2007, Drupal has provided a built-in mechanism for site maintainers to check if their site was out of date. Sites using the Update module could check if they needed updates and email that report to the site owner or show it inside the system or via a "drush" command on the command line. This report is focused on what the site needs: the administrator only learns about updates to the software running on the site, but it requires knowing a Drupal-specific tool.

Modern versions of Drupal leverage the composer package manager. Drupal has supported the composer audit command which was introduced in 2022. However, again, this is a tool that is mostly used in the php community and doesn't provide security data about other package types.

Drupal sites often include npm packages and other 3rd party libraries that might have their own update monitoring mechanism.

Staying aware of available releases is a subjective and personal question. What works well for one organization might not work well for another. Knowing these options and their shortcomings, can we make it easier for site owners to monitor their sites?

How is the OSV format better?

The OSV format and database provide several advantages. Perhaps the biggest one for Drupal sites is they provide support for a wide variety of packages. Publishing Drupal's security advisories in OSV.dev will enable the OSV-scanner automated scanning tool to create accurate reports for Drupal sites making it easier for organizations to adopt Drupal and help ensure it is up to date. It will also make it easier for other projects to support Drupal if they incorporate OSV.dev data.

Who made this happen?

For OSV.dev support, there was a collaboration across several teams and timezones: folks at Google, Ackama, the Drupal Association, and members of the Drupal Security Team have collaborated to automate osv support. In particular, Gold, Gareth Jones, Greg Knaddison, Dave Long, Peter Wolanin, and Neil Drumm worked to help get it launched or will help maintain it. The result will hopefully provide greater awareness, easier support, and minimal additional manual work to support this new channel.

Also, we should recognize efforts in this field that provided a great foundation. Derek Wright (dww) did a ton of work to help Drupal's infrastructure related to the Update module for many years. The integration of data that gets into osv.dev relies on an API from drupal.org that is provided with a lot of work from the Drupal Association. The content of the feed, of course, comes from project maintainers and the Drupal Security Team.

Publishing Whole Site Sections with Drupal Workspaces

Ever had to publish a new section for a website (with multiple pages, menu items, etc) and all needed to go live at the same time? Drupal Workspaces has you covered.

markconroy 11th Dec 2025

Day 11 - Orientation and Reflow Dec 11, 2025 0

Picture someone with a tablet mounted on their wheelchair in landscape orientation. They navigate to your site, but it forces portrait mode, making it impossible to use without physically rotating their mounted device - something they can't easily do. Or imagine someone with low vision zooming their browser to 400%, only to find they now have to scroll horizontally to read every single line of text.

Read More

Imagine your website as a large library with lots of books on shelves. Of course, you, just like your staff and your visitors, will appreciate it if all the items are sorted in the most consistent way. 

In this idyllic picture, all books are situated on the right shelves and conveniently labeled, they are easy to find and manage, and different categories of users have access to certain archives. You might call this the “perfect order” and that’s what can be created on your website.

ECA Use Case: Modifying Forms Jürgen Haas Thu 11 Dec 2025 - 13:48

This article explains how ECA (Event Condition Action) can be used to modify Drupal forms without writing custom PHP code — historically the most common reason for creating custom Drupal modules. While ECA currently allows users to alter form elements, validation, and submission processing through a visual model stored as configuration, there are pain points like a blank-canvas starting experience and the need for Drupal knowledge. The article envisions a future UI improvement where users can trigger ECA directly from the form they're editing, with pre-configured events and context-aware options that eliminate most current friction points.

Advent Calendar day 11 – Drupal Canvas unleashed: The future of Drupal is here james Thu, 12/11/2025 - 09:00

Today we are looking at Drupal Canvas, an exciting new way to build pages and theme sites in Drupal.

In this talk, from DrupalCon Vienna, Lauri Timmanee and Bálint Kléri of Acquia demonstrate many of the features of Canvas.

Some things Cancas can do:

• Component based visual site building tool
• Uses conventional Drupal blocks, Single Directory Components, and code components that can be built in the front end
• Create and build multiple pages before publication
• Multi-step undo

Their talk dove into the main functionality of Canvas, but they only had a few slides. The majority of it was a demo of building a…

Tags

• Canvas
• Components
• Single Directory Components
• Experience Builder

Guest Blog Post by Luke McCormick

BADCamp, the Bay Area Drupal Camp, has been a Drupal gathering in the Bay Area most years since 2007. This year’s BADCamp had a particular focus on artificial intelligence. There were many exciting things to see and hear about AI, and the overall programme reflected a blend of practical tooling, architecture, and community direction.

Drupal Core UX Manager Emma Horrell set the stage with the opening keynote, Turning Feelings into Features – Why UX Is an Innovation Catalyst for Drupal (video). While not framed as an AI talk specifically, the keynote grounded much of what followed. Emma emphasized UX as an active, user-centred practice rooted in trust, language, and real-world workflows, principles that are especially critical for the effective use of AI tools. Her keynote flowed directly into the next session in the same room, underscoring how closely UX and AI strategy are now intertwined in Drupal.

Immediately following the keynote, Drupal AI Initiative lead Kristen Pol presented Accelerating Innovation: The Drupal AI Initiative (video), outlining the current state and direction of Drupal’s AI efforts. Kristen described how the initiative is moving beyond isolated experiments toward coordinated work across providers, UX research, contributor experience, and shared infrastructure. Shortly thereafter, André Angelantoni’s Drupal CMS Late 2025 Update (video) highlighted how AI capabilities are becoming part of Drupal CMS planning itself, signalling a shift from AI as an add-on toward AI as expected infrastructure.

Building Drupal Sites with AI

The AI momentum continued with a wide range of additional sessions devoted to artificial intelligence at BADCamp. Several talks focused on hands-on, builder-friendly uses of AI in Drupal. J. Matthew Saunders led Getting Hands-On with Drupal AI: Build Smarter Sites with Zero Code (video), while Sal Lakhani presented 3 Ways to Use AI in Drupal (video), covering practical patterns such as chatbots, search, and code generation. Sal also delivered a second session, The #1 Drupal AI Demo, Development, and Learning Platform (DrupalForge) (video), demonstrating how hands-on experimentation and learning can be supported in a structured way.

Jordan Koplowicz explored the easy way and the hard way to create AI Chatbots in Drupal. The “easy” way requires no code, which he explains in Creating an AI Chatbot in Drupal: The Easy Way (video), which he followed up the next day with the “hard” way in AI on Headless Drupal (video), where he showed how to create a headless AI chatbot. Meta’s Prabhakar Singh rounded out this group with Building Smart Content Moderation for Drupal: AI-Powered Spam Detection and Community Safety (video), illustrating how AI can be used to increase trust, safety, and community health.

BADCamp also featured sessions that took a more strategic and forward-looking view of AI. Steve Carlson presented Preparing for the Future: AI, the Changing Consumption Landscape, and Combating AI Threats (video), focusing on how organizations must adapt to shifts in how content is created and consumed. Alongside this, James Sansbury presented Preparing Your Pipeline for the AI Revolution (video), addressing organizational readiness, governance, and workflow implications. Satish Kumar Nagireddy presented AI-Powered Content Intelligence: Multi-Modal Analysis for Drupal Media Management (video), demonstrating how AI can analyze and enrich media across formats while remaining compatible with Drupal’s content and editorial models.

Drupal Coding with AI

Developers were well represented in the AI programming as well. Mark Ferree’s session, AI Dev Tools: How Not to Get Lost in the Chaos (video), surveyed the rapidly evolving landscape of AI-assisted development tools from the perspective of someone with extensive engineering experience. In contrast, Luke McCormick focused on pragmatic techniques that can be used even by people who do not consider themselves full-time Drupal coders in Quick and Easy Migrations and Upgrades Using AI (video), which demonstrated how to use AI-enabled editors like Cursor to speed up common Drupal development, upgrade, and feature-building tasks.

The BADCamp AI Summit

Beyond individual sessions, BADCamp 2025 featured its first dedicated AI Summit, a deeper-dive gathering focused specifically on AI in Drupal. The summit brought together speakers and organizers from across the conference and included a live remote discussion with Jamie Abrahams, who joined from the UK to share an update on the broader Drupal AI landscape. Jamie emphasized that Drupal AI has moved beyond theory and proof-of-concept demos into the stage where real-world use cases and case studies are the next critical need. Rather than flashy demonstrations, the focus is now on reliable, high-value applications that build on Drupal’s strengths in UX, governance, trust, and longevity.

Taken together, the sessions and the AI Summit showed a Drupal community that has moved past speculation and into execution. The conversations at BADCamp reflected a shared understanding that AI’s impact will be shaped not just by what is technically possible, but by how thoughtfully it is designed, integrated, and governed. Across sessions, summits, and hallway conversations alike, the message was consistent: this is work the whole community can and should engage in, and BADCamp 2025 demonstrated that Drupal is actively rising to that challenge.

File attachments:  badcamp-2025-sal.jpeg badcamp-2025-jamie.jpeg

Day 10 - Non-text Content Dec 10, 2025 0

If you know anything about web accessibility, you probably know about alt text. It's the most widely recognized accessibility technique - that little text description you add to images so screen readers can announce what the image shows. But there's more to non-text content accessibility than just slapping some alt text on every image and calling it done.

Let's dig into what you might not know about making images, icons, charts, and other non-text content accessible.

Read More

ECA brings great value to Drupal CMS, and still has to improve Jürgen Haas Wed 10 Dec 2025 - 16:36

ECA (Event-Condition-Action) is a powerful no-code automation tool included in Drupal CMS that provides features like content duplication, customizable login/logout redirects, form alterations, privacy protections, and automatic configuration for integrations like Mailchimp. Beyond user-facing features, ECA also handles behind-the-scenes tasks such as dynamic breakpoints, automatic sitemap configuration for new content types, and SEO meta tag defaults. While ECA offers significant flexibility without requiring additional modules or code, the user interface needs improvement to make it more intuitive for users who want to customize or create their own automation models.

Advent Calendar day 10 – EditTogether: Real-Time Collaborative Editing Comes to Drupal james Wed, 12/10/2025 - 09:00

Today we hand over to AmyJune Hineline to tell us about the presentation behind today’s door…

EditTogether brings real-time collaborative editing, the familiar experience many people know from Google Docs, directly into Drupal while keeping full control of content in the hands of site owners.

I saw the session, Collaborative Editing in Drupal with EditTogether, at Florida DrupalCamp in 2025, where Alex Jones and Ken Rickard introduced the project and walked through its purpose, technology, features, and future. Their session offered a clear look at how Drupal content creation could evolve with…

Tags

• Advent Calendar 2025
• collaboration
• collaborative editing
• EditTogether

I have spent twenty years working on open source sustainability, so watching a fight ignite between Ruby on Rails creator David Heinemeier Hansson and WordPress founding developer Matt Mullenweg this week felt uncomfortably familiar in a way I wish it didn't.

David Heinemeier Hansson (also known as DHH) released a new kanban tool, Fizzy, this week and called it open source.

People quickly pointed out that the O'Saasy license that Fizzy is released under blocks others from offering a competing SaaS version, which violates the Open Source Initiative's definition. When challenged, he brushed it off on X and said, "You know this is just some shit people made up, right?". He followed with "Open source is when the source is open. Simple as that".

This morning, Matt Mullenweg rightly pushed back. He argued that you can't ignore the Open Source Initiative definition. He compared it to North Korea calling itself a democracy. A clumsy analogy, but the point stands.

Look, the term "open source" has a specific, shared meaning. It is not a loose idea and not something you can repurpose for marketing. Thousands of people shaped that definition over decades. Ignoring that work means benefiting from the community while setting aside its rules.

This whole debate becomes spicier knowing that DHH was on Lex Fridman's podcast only a few months ago, appealing to the spirit and ethics of open source to criticize Matt's handling of the WP Engine dispute. If the definition is just "shit people made up", what spirit was Matt violating?

The definition debate matters, but the bigger issue here is sustainability. DHH's choice of license reacts to a real pressure in open source: many companies make real money from open source software while leaving the hard work of building and maintaining it to others.

This tension also played a role in Matt's fight with WP Engine, so he and DHH share some common ground, even if they handle it differently. We see the same thing in Drupal, where the biggest companies do not always contribute at the same level.

DHH can experiment because Fizzy is new. He can choose a different license and see how it works. Matt can't as WordPress has been under the GPL for more than twenty years. Changing that now is virtually impossible.

Both conversations are important, but watching two of the most influential people in open source argue about definitions while we all wrestle with free riders feels a bit like firefighters arguing about hose lengths during a fire.

The definition debate matters because open source only works when we agree on what the term means. But sustainability decides whether projects like Drupal, WordPress, and Ruby on Rails keep thriving for decades to come. That is the conversation we need to have.

In Drupal, we are experimenting with contribution credits and with guiding work toward companies that support the project. These ideas have helped, but also have not solved the imbalance.

Six years ago I wrote in my Makers and Takers blog post that I would love to see new licenses that "encourage software free riding", but "discourage customer free riding". O'Saasy is exactly that kind of experiment.

A more accurate framing would be that Fizzy is source available. You can read it, run it, and modify it. But DHH's company is keeping the SaaS rights because they want to be able to build a sustainable business. That is defensible and generous, but it is not open source.

I still do not have the full answer to the open source sustainability problem. I have been wrestling with it for more than twenty years. But I do know the solution is not renaming the problem.

Some questions are worth asking, and answering:

• How do we distinguish between companies that can't contribute and those that won't?
• What actually changes corporate behavior: shame, self-interest, punitive action, exclusive benefits, or regulation?

If this latest fight nudges us away from word games and toward these questions, some good may come from it.

Day 9 - Content on Hover or Focus Dec 09, 2025 0

You hover over an icon to see what it does, and a helpful tooltip appears. But before you finish reading it, you accidentally move your mouse slightly and the tooltip vanishes. Or you're using a screen magnifier and the tooltip appears, but it's positioned right under your mouse pointer, making it impossible to read the magnified version. Or you're navigating with a keyboard, the tooltip appears when you tab to a button, but you can't move your mouse over the tooltip text to select and copy it.

Read More

Advent Calendar day 9 – How to Land an EPIC Contribution in Drupal (Without Losing Your Mind) james Tue, 12/09/2025 - 09:00

At DrupalCon Vienna Matt Glaman of Acquia and Mike Herchel of Dripyard talked about how to get contributions from the initial idea stage, and bring them to fruition.

The best contributions often start from finding something that annoys you, and asking “why is it like this?”

Matt and Mike talk about finding things that can be fixed, pitching to stakeholders, assembling a team, actually doing the work, communicating your needs, and getting your idea over the finish line.

One important thing I took from it was that you don’t have to work alone, which is something I tend to do a lot.

I liked the way…

Tags

• Advent Calendar 2025
• Contribution

Marketers feel the pain of inefficient CMS integrations more than anyone. Agree? We’ve answered some of the most popular questions about CMS integrations and even give you the clarity you need to get your systems talking. Check it out!

For many years, installation profiles have been the main way to set up a Drupal site. They define which modules are enabled, what configuration is applied, and often include demo content to help teams get started quickly. Well-known distributions have relied on this approach to deliver ready-made solutions for specific use cases. That approach made sense when most Drupal projects started from scratch. But that isn’t always the case today. Many teams are working with existing sites that are live and need changes. These might be new features, performance improvements, or updated design elements. Installation profiles are not built for that kind of workflow. Once they are applied during setup, they can’t be reused later.

What if building pages in Drupal felt as effortless as sketching ideas on a digital canvas — yet powerful enough to satisfy a developer’s need for precision and control? That’s the promise of Drupal Canvas: a new visual builder that merges the best of what Drupal has offered so far with today’s most modern approaches and best practices.

 

Today we are talking about Drupal for Applications, Types of Applications Drupal can build, and How we change our thinking of Drupal with guests Alexander Varwijk (far-vag) & Jürgen Haas. We'll also cover Drupal Remote Dashboard as our module of the week.

For show notes visit: https://www.talkingDrupal.com/531

Topics

• Drupal as an Application Framework
• Challenges with Drupal for Real-Time Applications
• Exciting Prospects with AI and Drupal
• Showcasing Successful Drupal Implementations
• Batch Processing and Worker Improvements
• Orchestration and Integration with External Platforms
• Future of Drupal as an Application Framework

Resources

• Drupal Advent Calendar
• Proposal: Restructuring Drupal Internals by Alexander Varwijk
• Introducing Symfony/Runtime in Drupal
• Maestro

Guests

Alexander Varwijk - alexandervarwijk.com/ Kingdutch Jürgen Haas - lakedrops.com jurgenhaas

Hosts

Nic Laflin - nLighteneddevelopment.com nicxvan John Picozzi - epam.com johnpicozzi Fei Lauren - feilauren

MOTW Correspondent

Martin Anderson-Clutz - mandclu.com mandclu

• Brief description:
  • Have you ever wanted to manage and monitor a portfolio of Drupal sites from a single interface? There's a module for that.
• Module name/project name:
  • Drupal Remote Dashboard (DRD)
• Brief history
  • How old: created in Jan 2010 by Jürgen Haas (jurgenhaas) of LakeDrops
  • Versions available: 4.1.7 which works with Drupal 10 and 11
• Maintainership
  • Actively maintained
  • Security coverage
  • Full Documentation Guide
  • Number of open issues: 22 open issues, 3 of which are bugs against the current branch
• Usage stats:
  • 126 sites
• Module features and usage
  • With the module enabled, for each monitored site you'll be able to review information like the version of core, modules, and themes, as well as the status report. Note that the dashboard and monitored sites do NOT need to be on the same major version of core.
  • You can also collect any block from a remote site to include on your dashboard, or access the error logs to review them in the dashboard
  • You can execute maintenance tasks like taking sites in or out of maintenance mode, running cron or update.php, as well as flushing cache
  • The dashboard will also allow you to rebuild job schedulers, update translations from drupal.org, change user credentials, or execute arbitrary PHP code, so you'll definitely want to be selective about who will have access
  • From the collected status information you can show a status widget for each domain to display grouped traffic light status levels for security, health, tuning, seo and others. You can also create aggregate status widgets, for example to show the composite health of all sites in a multisite installation.
  • Internally DRD is built around a number of entities, and the documentation includes an architecture page with an Entity Relationship Diagram, while the glossary page includes a description for each of the entities and what Drupal site information they map to. Obviously security for this kind of setup is paramount, and there's a documentation page that details the encryption and authentication methods that are supported
  • Sites that you want to monitor will need to have the DRD Agent module installed, which provides a simple wrapper to receive, route, handle and respond to requests from authorised Drupal Remote Dashboards. It's worth pointing out that the RDR Agent module is in use by 3,152 sites according to drupal.org, so there may be a small number of sites acting as dashboards, but on average each of them is monitoring 25 sites.

Day 8 - Error Prevention Dec 08, 2025 0

Imagine clicking "Submit" on a legal contract, only to realize you meant to click "Save Draft." Or transferring $1,000 to the wrong account with no confirmation step. Or deleting your entire photo library with a single misclick. These aren't hypothetical scenarios - they happen every day when websites don't implement proper error prevention.

Read More

Drupal Canvas 1.0 arrives with the quiet confidence of a system finally deciding to make itself easier to work with. Drupal has always been capable—sometimes overwhelmingly so—and often assumed its users were ready to meet it on its own terms. Canvas doesn't change Drupal's nature, but it does make the day-to-day experience less like operating heavy machinery and more like arranging things in a room you actually use.

In the official announcement, product lead Lauri Timmanee explains how organisations have long had to choose between settling for something generic or diving into complex code. Canvas sits between those extremes with a component-based visual builder that allows layout adjustments while preserving developer-level control. It’s not a shortcut—just a clearer path through familiar terrain.

Dries Buytaert, in his post, frames Canvas 1.0 as a way to meet modern expectations without compromising Drupal’s foundations—structured content, permissions, and scalability. The biggest change lies in workflow: fewer dependencies on developers for routine tasks, and a more intuitive rhythm for teams shaping pages.

Early community feedback helps contextualize the release. Aaron McHale, Technical Lead at The University of Edinburgh, says Canvas positions Drupal more clearly within the low-code space without reducing flexibility. Jillian Chueka, Product Design Lead, expressed appreciation for the project’s long development journey and its successful execution.

As Canvas 1.0 marks a notable shift in Drupal’s editorial experience, it’s just one of several updates shaping the ecosystem this week. Below are more highlights from across the Drupal community, from AI innovation to upcoming events and module releases.

DISCOVER DRUPAL

• Drupal Announces Canvas 1.0: Visual Page Builder Nears Stable Release
• Community Survey Invites Feedback on Drupal CMS Use
• Commerce PayPay Module Adds QR Payment Support for Drupal Commerce
• Drupal 11.3 Prepares for PHP 8.5 Support with Updated CI Testing for Contributed Modules
• Tanay Sai Builds AI-Powered CKEditor Plugin for Drupal Using Chrome’s Native APIs
• Audit Export Module Gains Full Tool API Integration, Enables AI‑Ready Reporting for Drupal

ACCESSIBILITY

Green UX in the Age of AI: Digital Products for a Sustainable Future

EVENT

• Drupal AI Summit 2025: What Speakers Will Address on AI, Governance and Drupal’s Future
• Mayor of Nara Embraced Global Drupal Community at DrupalCon Asia 2025
• Dripyard to Showcase Drupal Canvas Page Builder in Live Webinar on December 11
• IO Claims Three Trophies at 2025 Splash Awards for Drupal Excellence
• Alexandra Bell to Address AI and Global Risk in Keynote at DrupalCon 2026 Chicago

DRUPAL COMMUNITY

Call for Designers: 2026 Aaron Winborn Award Seeks Creative Maker

ORGANIZATION NEWS

• Nextide Adds Activepieces Integration to Maestro for Streamlined App Connectivity
• DICTU Web Team Wins Two Categories at Splash Awards 2025

BOOKS

Matt Glaman Finalizing Drupal Caching Guide with Drupal 10.2 Updates Ahead of Release

We acknowledge that there are more stories to share. However, due to selection constraints, we must pause further exploration for now. To get timely updates, follow us on LinkedIn, Twitter, Bluesky, and Facebook. You can also join us on Drupal Slack at #thedroptimes.

Thank you.

Sincerely,
Kazima Abbas
Sub-editor
The DropTimes