Drupal CMS News Digest
developments tricks, articles and reviews from Drupal specialists
MidCamp - Midwest Drupal Camp: Catch up on all the MidCamp you missed!
Watch the Dries fireside chat from 2025, or catch up on all of the sessions from last year on Drupal.tv.Theres even more Drupal goodness to be had in our archives or Drupal.tv's. The Archives: 2024 2023 2022 2021 2020 2019 2018 2017 2016 2015 2014
https://www.midcamp.org/events
MidCamp - Midwest Drupal Camp: MidCamp Chicago 2026 call for sessions open through Feb 26
We're excited to celebrate you -- our future speakers! If you've got an idea for a session, now's the time to get involved in MidCamp 2026, happening May 12-14 in Chicago.Call for SpeakersSince 2014, MidCamp has hosted over 300 amazing sessions, and we're ready to add your talk to that legacy. We're seeking presentations for all skill levels, from Drupal beginners to advanced users to end users and business professionals!For full submission details and guidelines, visit: midcamp.org/events/2026/how-submit-sessionKey DatesCall for Proposals Opened: February 10, 2026Proposal Deadline: February 26, 2026Speakers Notified: Week of April 2026MidCamp Sessions: May 12-13, 2026Sponsor MidCampLooking to connect with the Drupal community? Sponsoring MidCamp is the way to do it! Whether you're recruiting talent, growing your brand, or simply supporting the Drupal ecosystem, MidCamp sponsorship offers great value. Act early to maximize your exposure!Stay in the LoopJoin us on MidCamp Slack to chat and get updates.Follow us on Bluesky and Mastodon for announcements and news.Subscribe to our newsletter for updates on the venue, travel options, social events, and speaker announcements.Ready to submit your session? Click away and let's make MidCamp 2026 unforgettable!
https://www.midcamp.org/events
Dries Buytaert: Helping agents discover my site search with Agentic Resource Discovery
Yesterday I blogged about the API catalog that announces my site's search API to agents. In response, someone pointed me to the ARD specification, a draft announced last month by a working group that includes Google, Microsoft, GitHub, Hugging Face, Cisco, Nvidia, and Salesforce.
What ARD adds to yesterday's API catalog is discovery. If an agent has never heard of you, it does not know to look for your API catalog. Ask an agent what people have written about the future of Drupal, for example, and it will probably search Google. It may not think to check dri.es or drupal.org directly.
The web solved discovery decades ago. Search engines find the right site, so you do not have to know where the answer lives.
ARD provides the building blocks for search engines for AI agents. Sites publish catalogs, crawlers discover them, and registries index them. An agent can then ask a registry a plain-language question, such as "Who can answer questions about the future of Drupal?". The registry returns a ranked list of relevant resources, perhaps pointing the agent to my site's search API.
You opt in by publishing a manifest at /.well-known/ai-catalog.json. Yes, that is almost the same path as my existing /.well-known/api-catalog.
Here is what my /.well-known/ai-catalog.json currently returns:
{ "specVersion": "1.0", "host": { "displayName...
https://dri.es/helping-agents-
Helping agents discover my site search with Agentic Resource Discovery
Yesterday I blogged about the API catalog that announces my site's search API to agents. In response, someone pointed me to the ARD specification, a draft announced last month by a working group that includes Google, Microsoft, GitHub, Hugging Face, Cisco, Nvidia, and Salesforce.
What ARD adds to yesterday's API catalog is discovery. If an agent has never heard of you, it does not know to look for your API catalog. Ask an agent what people have written about the future of Drupal, for example, and it will probably search Google. It may not think to check dri.es or drupal.org directly.
The web solved discovery decades ago. Search engines find the right site, so you do not have to know where the answer lives.
ARD brings search-engine-style discovery to AI agents. ARD registries crawl the web for catalogs published by sites and add their resources to a searchable index. An agent can then ask a registry a plain-language question, such as "Who can answer questions about the future of Drupal?". The registry returns a ranked list of relevant resources, perhaps pointing the agent to my site's search API.
You opt in by publishing a manifest at /.well-known/ai-catalog.json. Here is what my mine currently returns:
{ "specVersion": "1.0", "host": { "displayName": "Dries Buytaert" }, "entries": [ {...
https://dri.es/helping-agents-
Talking Drupal: Talking Drupal #562 - Acquia Fair Trade Initiative
Today we are talking about Supporting Open Source, Acquia, and The Acquia Fair Trade Initiative with guest James Sims. We'll also cover Image Effects as our module of the week. For show notes visit: https://www.talkingDrupal.com/562 Topics Fair Trade Initiative Explained How the Program Started Why Fair Trade Matters Adoption and Open Framework Agency and Freelancer Benefits Partner Funded Giving Who Can Be Makers Tracking Participation Tax Deduction Questions Community Shaped Program Money Counts Too Early Challenges Timeline And Launch Sustainability Built In How To Get Involved Defining Success Origins Of Fair Trade Resources Acquia Fair Trade Initiative Taste of chicago Giordanos Recommended by John Lou's pizza Five For The Future Image Convolution Playground Guests James Sims - rcjmselp85 Hosts Nic Laflin - nLighteneddevelopment.com nicxvan John Picozzi - epam.com johnpicozzi Avi Schwab - froboy.org froboy MOTW Correspondent Avi Schwab - froboy.org froboy Brief description: Have you ever gone to edit an image style in Drupal, looked at the list of filters, and said "give me more! I want more!". Have you said "I'd like to mirror, filter, and convolute an image in Drupal - all at the same time". If so, you're in luck. Let me introduce you to our module of the week: Module name/project name: Image Effects Brief history How old: Created by Drupal user mondrake...
https://sacstudio.libsyn.com/t
Drupal AI Initiative: Outside AI - The State of Agent Experience in Drupal.
By Scott Falconer, Product Lead, Outside AI
Where Drupal really stands with AI agents, where it has a right to win, and what we need to do next.
AI agents can build with almost anything. That is both great news and a problem for Drupal.
A person can ask an agent to recommend a platform, rebuild an existing site, create a content model, configure permissions, or change a running system. The agent then has to decide whether Drupal is a good path, reach it, understand it, act on it, and verify the result.
When that experience fails, we usually do not get a bug report. The agent works around Drupal, produces something that only looks finished, or quietly chooses another stack.
That makes agent experience a growth problem for Drupal, not just a developer-experience problem.
Drupal does not need to be the fastest way to generate any page. Drupal should be the safest, clearest way to a governed, inspectable, long-lived site - and agents should be able to use it effectively.
By governed, we mean the controls that make a site safe to run and hand off - a real content model, scoped roles and permissions, review and audit, safe rollback - not just quick to generate.
This is the purpose of Outside AI, the workstream the Drupal AI Initiative launched: making Drupal legible, callable, safe, and verifiable for agents and builder tools operating from the outside.
The distinction from Inside...
https://www.drupal.org/about/a
Drupal AI Initiative: Inside AI is building what our partners asked for
By Christoph Breidert, Product Lead, Inside AI
A year into the Drupal AI Initiative, AI inside of Drupal has a clear goal for the months ahead. At DrupalCon Rotterdam at the end of September, we want to show a single Drupal site where AI Search, an AI chatbot, AI content review, and AI translation all work together on real, multilingual content, with observability and security running underneath. The idea is simple: rather than describe these features one by one, let people see them working together on one site.
This post is about how we plan to get there, what our partners told us to build, and the team we are putting together to build it.
Two streams, working side by side
If you are new to the split, the Drupal AI Initiative now runs in two streams. “Inside AI” is AI inside Drupal, for the people using it. “Outside AI” is AI outside Drupal, acting on it through external agents. The simplest way to hold them apart is this: with Inside AI a person uses Drupal and Drupal uses AI to help; with Outside AI a person uses an agent and the agent uses Drupal. We introduced the two streams in an earlier post, and the distributed leadership structure behind them shortly after. This post is about the AI functionality we are building inside Drupal. Outside AI, led by Scott Falconer, will get its own update, and Dries Buytaert has already written about why that stream matters.
We asked the...
https://www.drupal.org/about/a
Security public service announcements: Security advisory coverage removed - QA Accounts - PSA-2026-07-22
Date: 2026-July-22Description: QA Accounts enables you to login to a Drupal site using a well known username/password combination. When 1.0 was released, it also was marked for security coverage. The module prioritizes ease of use rather than security and is only intended to be used on sites that are not accessible on the internet (e.g. behind firewall or other protection). The maintainers are choosing to remove security coverage.Solution: Ensure qa_accounts is not enabled on any publicly available site.Reported By:
Jordan Barnes (j-barnes)
Fixed By:
Jakob P (japerry)
https://www.drupal.org/psa-202
Centarro: Minimizing Downtime During eCommerce Migrations
Some downtime during a platform migration is inevitable. Data, sometimes huge amounts of data, has to be transferred. Domain records need to be updated. The final checklist before launching is extensive. However, any reputable agency will minimize this inevitable downtime, because every hour an eCommerce site is offline costs money. A migration that drags on for days is unacceptable, causing a direct hit to revenue and customer trust.We've migrated eCommerce operations ranging from several thousand orders to several million, with product catalogs spanning a few hundred to several hundred thousand SKUs and customer records well into the hundreds of thousands. Through that work, we've developed a set of practices that consistently keep actual site downtime to a few hours, even on the most complex projects.Here’s how to minimize your downtime.Start migration planning as soon as the architecture is setWhen do you start thinking about data migration? As soon as the architecture is nailed down. As soon as entities and fields are defined, old data stores can be mapped to the new database.
Read more
https://www.centarro.io/blog/m
Dries Buytaert: Helping agents discover my site search with an API Catalog
I kept running into the same small frustration. My site has its own search, but when I ask an AI agent whether I have written about a topic before, it searches Google instead of using my site's search directly. As a result, it often misses relevant posts that Google has not indexed.
At the same time, the web is gaining a new audience. In addition to people visiting pages, AI agents increasingly access a site's knowledge and tools directly.
That combination led me to add support for /.well-known/api-catalog to my site. A request to https://dri.es/.well-known/api-catalog currently returns:
{ "linkset": [ { "anchor": "https://dri.es/search/json", "service-desc": [ { "href": "https://dri.es/openapi.json", "type": "application/openapi+json" } ] } ]
}
RFC 9727, an IETF Proposed Standard, defines /.well-known/api-catalog as a predictable location for discovering a site's public APIs.
The catalog is a small JSON document written in the Linkset format. It advertises my search endpoint and, in turn, links to an OpenAPI document that tells software how to use it.
The JSON endpoint at /search/json predates the catalog and powers my site's search. However, it was not documented or easy for software to discover. The catalog now makes it explicit...
https://dri.es/helping-agents-
Helping agents discover my site search with an API Catalog
I kept running into the same small frustration. My site has its own search, but when I ask an AI agent whether I have written about a topic before, it searches Google instead of using my site's search directly. As a result, it often misses relevant posts that Google has not indexed.
At the same time, the web is gaining a new audience. In addition to people visiting pages, AI agents increasingly access a site's knowledge and tools directly.
That combination led me to add support for /.well-known/api-catalog to my site. A request to https://dri.es/.well-known/api-catalog currently returns:
{ "linkset": [ { "anchor": "https://dri.es/search/json", "service-desc": [ { "href": "https://dri.es/openapi.json", "type": "application/openapi+json" } ] } ]
}
RFC 9727, an IETF Proposed Standard, defines /.well-known/api-catalog as a predictable location for discovering a site's public APIs.
The catalog is a small JSON document written in the Linkset format. It advertises my search endpoint and, in turn, links to an OpenAPI document that tells software how to use it.
The JSON endpoint at /search/json predates the catalog and powers my site's search. However, it was not documented or easy for software to discover. The catalog now makes it explicit...
https://dri.es/helping-agents-
The Drop Times: Matthew Saunders Makes Community Trust a Focus of Board Candidacy
Matthew Saunders links his board candidacy to a question now facing Drupal: how the Association can earn community trust through measurable listening, accessible participation, and public accountability.
https://www.thedroptimes.com/i
Drupal Association blog: How Drupal Has Protected Millions of Sites
The Drupal project runs one of the most disciplined coordinated-disclosure programs in open source, and it has done so through volunteer effort for more than two decades. Millions of sites, many operated by governments, universities, and enterprises, depend on it.
This post is the first in a series stemming from the Drupal AI Security Initiative. Before I dive into how it's organized and what we've found, I wanted to share a post about how Drupal Security Team already works, because the initiative is built to supplement that foundation, not to repair or replace it. Note: this post assumes you are familiar with coordinated disclosure, CVEs, and severity scoring in general and focuses on what Drupal specifically does.
Coordinated disclosure, on a fixed cadence
Reports arrive in a private queue. A Security Team member takes triage duty on a two-week rotation, confirming whether a report is a real, in-scope vulnerability. Once validated, the affected project's maintainer and the original reporter collaborate in the confidential issue where the fix is written, reviewed, and scheduled. All of this stays out of public view until the fix and security advisory are ready on a release day.
Drupal has a predictable release cadence: advisories publish on Wednesdays, with a Public Service Announcement the Monday before on the very rare occasion a highly critical release warrants advance...
https://www.drupal.org/associa
Tag1 Insights: Ten Minutes, Not an Hour: What Efficient AI-Assisted Development Actually Looks Like
Take Away Marcin Grabias, Senior Drupal Engineer and maintainer of the Drupal LMS module, used Claude Code to merge two near-duplicate activity plugins into a single configurable one in roughly ten minutes of work that would have taken an hour by hand.
The Drupal LMS module lets site builders define quiz-style "activities": question types a learner answers as part of a course. For a while, LMS shipped two separate plugins for selection-based questions: one for single-choice answers, one for multiple-choice. They did almost the same thing internally. The only real difference was the configuration toggle that didn't need to live in two separate classes once Activity - Answer plugins became configurable.
Issue #3546362 merges the two plugins into a single configurable one, writes an update hook so existing sites migrate their configuration automatically without breaking, and updates the QA fixtures and functional tests that reference the old plugin pair. None of this is conceptually hard. Every long-lived module accumulates this kind of work, where touching four or five files consistently is non-negotiable and a missed reference breaks an update path for every site running the module.
That combination, low conceptual difficulty, high mechanical thoroughness, turns out to be exactly...
https://www.tag1.com/blog/what
Drupal Association blog: Serving the Drupal project, and evolving how we fund it
I've stepped into the role of interim CEO of the Drupal Association for a limited period, expected to last six to twelve months. My job in that time is to help put the Association on a durable footing. As I undertake that task, I want to start by being direct about where we are and where I'd like to see us go next.
The Drupal stewardship the Association provides costs more every year. That includes running Drupal.org, providing the project infrastructure and putting on DrupalCon. For a long time our events paid for most of it. That stopped being enough several years ago, and we have been covering the gap from our reserves. That is not sustainable, and pretending otherwise would not serve anyone. The Drupal Association releases its financials and 990s every year. (The 2025 audit is expected to be released by the board soon.) An analysis of even just the last few years of publicly available financials tells this story plainly.
And that is only the part we actually fund. Some of the most critical work of all, like responding to security issues and managing releases, still runs entirely on donated volunteer time or corporate underwriting rather than from an ongoing operating budget.
The answer is not to ask more of the volunteers, agencies and contributors who have carried this project for two decades. The community’s generosity is the heart of Drupal, and it always will be. The...
https://www.drupal.org/associa
the floating-point divide: Inserting boilerplate text into CKEditor in Drupal
Inserting boilerplate text into CKEditor in Drupal Drupal Drupal 11.x Planet Drupal
jstrecker
2026.07.21 @ 14:38 Don’t Repeat Yourself. It’s a rule that we learn for writing code. And guess what: it applies just as well to writing content. If you copy and paste the same thing in lots of places, it’s going to be a real hassle if you need to go back and change it later.
I’m building a Drupal website to share info about food pantries in my area. As I began entering data about pantries, I realized that I was copying and pasting text across nodes more than I wanted to. Read more about Inserting boilerplate text into CKEditor in DrupalAdd new comment
https://fdiv.net/2026/07/21/in
