webjoke.de

Volha Tsimaliak from Attico shares a deep dive into building scalable design systems for Drupal projects. With strategies tailored for multibrand ecosystems and real-world implementation tips, this guide covers everything from atomic design and token systems to integrating Tailwind, Figma, and Drupal. Learn how to bring structure, speed, and consistency to your web platforms.

Extend Search API Typesense with RAG (Retrieval-Augmented Generation)

Roughly three months have passed since AI 1.1.0 was released and we are getting ready for the next step in the history of Drupal AI.

This means that we will have an upgrade path before the next RC release, all major features are developed and any known security or critical bug is fixed. As a developer you can trust that the API’s are set.

One important upgrade path is that we are moving out the AI ECA module, to https://www.drupal.org/project/ai_integration_eca so that can develop in a more rapid tempo then the release cycles of the AI module.

As a developer you can trust that the API’s are set.

If nothing unexpected happens, the plan is to have a RC 30th of September and a production release 7th of October.

What does it bring?

The feature list of changes since the 1.1.0 release of the AI and AI Agents is too long to list and a lot has been written already in the alpha releases. But it includes:

Field Widget Actions

The field widget actions module lets you place as many buttons as you like on any form element for fields in Drupal to trigger AI Agents, AI Automators, ECA workflows or you custom integrations.

This means that you can have buttons to pick categories based on specific criterias, have title suggestions and thousands of other solutions.

Prompt Library

With the release of 1.2.0, we make it possible to ship prompts as general reusable configurations and categorize them where they belong.

New Automator Types

In 1.2.0 you will be able to use the Automator to contextualize using Views, create alt texts, rewrite filenames and fill out the summary on the Text with Summary field.

Prompt Replay provider

For testing reasons we usually have the problem that we do not want to send requests to an expensive AI provider just to try a piece of code over and over. We have solved that by having a proxy provider that can record requests and then replay them over and over, including in functional and kernel tests.

Agent improvements

The agents are getting more controllable and usable, including being able to create artifacts to pass over, output structured schemas, controlling descriptions of tools, status polling services, getting recursive tool results, being able to be triggered in CKEditor and more.

New chatbot Assistant styling

Because the assistant is designed primarily for website editors and administrators, the chatbot should reflect that focus. Starting with version 1.2.0, a new default styling will be introduced that integrates more seamlessly with the overall CMS design. The current style are still available of course.

Please try it out!

Whilst we wouldn’t recommend deploying to production systems yet, you can definitely start developing with the new features and try them out.

We are eager for any feedback!
 

Whether you like it or not, search has evolved. It is going beyond just keywords, but what remains constant is intent. Learn how Drupal can be your strongest ally in building search-friendly, intent-driven websites with these 10 essential SEO tips for 2025.

Enhanced Bot Protection with Cloudflare jenna Mon, 09/29/2025 - 14:19 Security Drupal WordPress

In today's digital landscape, bot attacks are becoming more sophisticated and more frequent. Website owners face an ongoing challenge in mitigating malicious traffic, preventing fraud, and ensuring smooth user experiences. While traditional methods like blocking individual IP addresses or using basic security modules may offer some level of protection, they often fall short in effectiveness and scalability. We often recommend Cloudflare to our clients: a comprehensive, cloud-based security solution that offers robust bot mitigation features -  even on its free plan.

Why Traditional Website Security Methods Fall ShortBlocking Individual IP Addresses is Ineffective

Many website administrators attempt to combat bots by manually blocking suspicious IPs. However, this approach has limitations:

• Bots constantly change IP addresses (using proxies, VPNs, or botnets).
• It’s labor-intensive to maintain an up-to-date blocklist.
• There is a risk of blocking legitimate users due to shared IPs or false positives.

Basic Security Modules Lack Advanced Intelligence

Some website owners rely on security plugins or server-side modules like Fail2Ban. While these can help with basic rate-limiting and brute-force prevention, they lack:

• Machine learning-based threat detection to distinguish between good and bad bots.
• Global threat intelligence, as they operate in isolation rather than leveraging data from a vast network.
• Real-time adaptability to evolving attack patterns. 

Why CMS-Based Solutions Are Not Enough

Whether your website is built on Drupal, WordPress, or another content management system, you’ve likely explored plugins or modules to help manage bot traffic. While these tools offer some protection, they come with significant limitations:

• IP Blocking Modules/Plugins (e.g., Ban, Advanced Ban): Useful for blocking known threats, but largely ineffective against bots that rotate IPs, use proxies, or operate across global botnets.
• robots.txt Modifications: While intended to guide search engine crawlers, these directives are often ignored by malicious bots entirely.
• Security Plugins and Firewalls: Many CMS-level tools rely on local detection rules and lack the ability to identify evolving threats across the web. They often require ongoing manual configuration and don't provide adaptive protection.

Cloudflare complements these platforms by sitting outside the CMS, offering network-level defense at the edge—blocking malicious traffic before it reaches your application. With global threat intelligence and automatic updates, Cloudflare protects your site regardless of the CMS you're using.

How Cloudflare Provides Superior Protection Against Bots

Cloudflare outperforms traditional security methods in several ways. The best part? Many of its bot-fighting capabilities are available for free.

Global Threat Intelligence

Cloudflare protects millions of websites, analyzing traffic patterns to identify and block bots before they even reach your site. Unlike IP blocking, Cloudflare uses its vast network to detect and mitigate threats in real-time.

Bot Management with Free Tools and Scalable Upgrades

Many bot protection services charge hefty fees, but Cloudflare provides a free level of security that outperforms many paid solutions. As threats evolve, you can seamlessly upgrade to Cloudflare Pro, Business, or Enterprise for advanced bot detection and machine learning-based security. 

With Cloudflare’s free plan, you gain access to essential security features:

• Bot Fight Mode: Automatically blocks bad bots while allowing legitimate traffic.
• Rate Limiting Rules: Prevents bots from overwhelming your site with excessive requests.
• JS Challenge & CAPTCHA: Forces suspicious traffic to prove they are human before accessing content.
• Growing AI-driven bot activity: With the rise of AI tools and platforms, the volume of bots scraping websites to train their AI is increasing rapidly—making automated protection more important than ever.

Effortless Implementation

Switching to Cloudflare requires no complex configuration. It acts as a reverse proxy, filtering traffic before it reaches your server. Compared to constantly updating IP blocklists, Cloudflare provides automated, always-on protection.

Performance Boost Alongside Security

Unlike security modules that add server load, Cloudflare improves website speed while blocking bots:

• CDN caching reduces bandwidth usage.
• DDoS mitigation ensures uptime during traffic surges.
• Smart routing enhances page load speeds for real users.

Client Use Case

Recently, an Aten client’s website became unresponsive due to an unexpected surge in traffic. After investigating the issue with the hosting provider, we realized we needed better visibility into the nature of the incoming requests. We decided to route DNS through Cloudflare, which explained that the majority of traffic was originating from a single country. 

Using Cloudflare’s challenge feature, we were able to verify that requests from that region were legitimate. Within just a few hours, Cloudflare had automatically blocked over 3.7 million malicious or suspicious requests, helping restore site stability and performance.

Conclusion: Cloudflare is Our Recommendation for Website Security

If you’re still relying on manual IP blocking or outdated security modules, you’re fighting an uphill battle against bot attacks. Cloudflare’s free security features provide a smarter, automated, and more effective way to combat bots while improving website performance.

Jon Bowman

Today we are talking about the New Contribution Records System, how it’s changed, and what you may need to do differently with guests Fran Garcia-Linares & Tim Lehnen. We’ll also cover Config Notify as our module of the week.

This episode is sponsored by Amazee.ai

For show notes visit: https://www.talkingDrupal.com/522

Topics

• Understanding the Contribution Record System
• Recent Changes and Migration Challenges
• Assigning and Displaying Contribution Credits
• Future Enhancements and Broader Contributions
• Collaborating on Commit Message Format
• GitLab Migration and Contribution Records
• Integration Challenges with GitLab
• Testing and Feedback on New System
• Future Plans and Community Involvement
• API Endpoints and Data Querying
• Gamification and Broader Adoption

Resources

• Millions of data talk
  • Slides (in Spanish)
  • Video not available yet
• Gitlab issue for feature request for contribution
• Contribution records module
• https://www.drupal.org/project/contribution_records
• New available endpoints:
  • https://new.drupal.org
  • https://git.drupalcode.org/project/contribution_records/-/blob/1.0.x/README.md?ref_type=heads#endpoints-to-query-data
• Issue to track issue migration
  • https://www.drupal.org/project/drupalorg/issues/3295357

Guests

Fran Garcia-Linares - fjgarlin Tim Lehnen - drupal.org/association/staff hestenet

Hosts

Nic Laflin - nLighteneddevelopment.com nicxvan Martin Anderson-Clutz - mandclu.com mandclu Hayden Baillio - hgbaillio

MOTW Correspondent

Martin Anderson-Clutz - mandclu.com mandclu

• Brief description:
  • Have you ever needed to maintain a site where a site owner had access to update site configuration, and wanted to be notified whenever they did so? There’s a module for that
• Module name/project name:
  • Config Notify
• Brief history
  • How old: created in Feb 2020 by Fran Garcia-Linares (fjgarlin), one of today’s guests
  • Versions available: 8.x-1.11, which supports Drupal 8.8 and newer
• Maintainership
  • Actively maintained
  • Security coverage
• Number of open issues: 2 open issues, neither of which are bugs
• Usage stats:
  • 194 sites
• Module features and usage
  • Just like it sounds, this module lets you trigger notifications when the configuration deviates from the config management code in production.
  • You can choose for the notifications to be sent immediately, or via cron, with an option for a daily digest. The notifications can be sent by email, or via Slack, using the slack module (if enabled).
  • This should be an easy-to-implement solution if you support a site where users may be updating the site configuration in production. A different approach was discussed back in episode #236 Top Down Configuration

Part 3: Rendering an Unmanaged File in a Block

In Part 2, we built a service that can locate unmanaged files and return one at random. In this part, we’ll expose that functionality as a block plugin.

Hello everyone,

There's a lot of talk in tech about "10x engineers", people who are believed to be ten times more productive than others. The idea goes back to a 1968 study that showed big differences between the fastest and slowest programmers. Over the years, the term has taken on new meanings: sometimes it refers to coding speed, sometimes to problem-solving skills, and more recently to how well someone can navigate complex systems. But in real teams, this idea often doesn't hold up the way people imagine.

In a recent LinkedIn Pulse article, Iztok Smolic shared his experience working with more than a hundred developers at Agiledrop. He explained that chasing so-called "rockstar" engineers can create problems, from delays to poor team culture. Brilliant individuals sometimes over-engineer solutions or disrupt team dynamics. In contrast, dependable contributors who write clean code and deliver on time often have a bigger positive impact over the long run.

This lesson applies well to open-source communities like Drupal. The platform grows through the steady contributions of many people, who code, review changes, fix bugs, and support one another. It's not about one star performer but about consistent, collective effort. That steady rhythm is what keeps Drupal strong and moving forward.

Recognition in Drupal can come in different forms. Agencies that make substantial contributions—whether financial or technical—naturally gain visibility across the ecosystem. Yet, the time, skills, and dedication of individual developers remain just as vital, ensuring that Drupal’s progress is never driven by resources alone but by the balance of community effort and shared commitment. With that in mind, let us focus on the stories we published last week. 

Interview

• How Drupal Plans to Beat Commercial CMS Platforms with AI-First Approach

Discover Drupal

• 17 Drupal Modules to Power AI-Driven Search and Discovery
• Drupal AI 1.2.0 Adds Agent Progress Tracking, PDF Ingestion, and Streaming Tool Calls
• Nichebench Released to Benchmark AI Models on Drupal 10/11 Code and Knowledge
• CKEditor 5 Enhances Drupal Modules with Merge Fields, Email Export, and Source Editing Updates
• Node Temporary Module for Drupal 11 Automates Expiring Test Content

Tutorials

• Unmanaged Files in Drupal: Rendering an Unmanaged File in a Block (Part 3)
• Use Drupal’s Config Actions API to Spice Up Your Recipes

Event

• DrupalCamp Scotland 2025 Session Proposals Open
• Become a Mentor at DrupalCon Vienna 2025 and Support New Contributors

Organization News

• Platform.sh Rebrands as Upsun, Expands Cloud Platform with AI Capabilities
• QED42 Integrates Writer AI into ADA’s Drupal Platform for Accessibility and Content Automation
• Drupal Association Welcomes Molly Shenberger as Chief Revenue Officer
• Nextide Releases Maestro Template Builder v2.0 with Enhanced Workflow Editing Features

We acknowledge that there are more stories to share. However, due to selection constraints, we must pause further exploration for now. To get timely updates, follow us on LinkedIn, Twitter, Bluesky, and Facebook. You can also join us on Drupal Slack at #thedroptimes.

Thank you.

Sincerely,

Kazima Abbas,
Sub-editor, The DropTimes.

We are thrilled to welcome back Baddý Sonja Breidert to the Drupal Association Board of Directors, with her new term beginning 1 November 2025. She is not only returning to the board but will also be serving as Chair for the coming term.

Baddý has been actively shaping the Drupal community for more than a decade. She co-founded 1xINTERNET in 2013 and has since become one of Europe’s leading voices in open source and digital business. She has served on the Drupal Association Board since 2017, including as Treasurer, then as Board Chair, and most recently in an advisory capacity as Immediate Past Chair.

Her contributions extend far beyond governance. Baddý has organised Drupal camps and major events such as Drupal Europe 2018 and DrupalCon Amsterdam 2019, co-founded the Drupal Business Deutschland Association, and represented Drupal at conferences across Europe, including the Web Summit in Lisbon. In 2020, she was honoured with the Aaron Winborn Award for her outstanding commitment to the Drupal community.

Her long-standing dedication to open source, community building, and supporting the Makers of Drupal has made her a trusted and respected leader in the project.

We are thrilled to have Baddý bring this perspective to the Board once again. Here are her reflections as she continues her journey with the Drupal Association:

What are you most excited about when it comes to joining the Drupal Association Board?
After completing my six-year term on the Board, as per the bylaws, I had the unique opportunity to continue my work with the executive team as past chair. Now, I am really excited to officially rejoin as a board member and chair. I am eager to build on the progress we have made and continue working with the Drupal Association staff and the Drupal community to push the Drupal project forward. This is a unique chance to keep that momentum going and ensure we are serving the community's needs effectively.

What do you hope to accomplish during your time on the board?
My main goal is to continue making the Drupal Association sustainable, not just financially, but in how we support our community. This means ensuring our programs and initiatives have a lasting impact. I also want to double down on our work with the Makers of Drupal, the developers, designers, company leaders, and organizers who are the heart of this project. By ensuring they have the resources and support they need, we can empower them to innovate and keep the Drupal project vibrant for years to come.

What specific skill or perspective do you contribute to the board?
My time on the Board since 2018 has given me a deep understanding of the Drupal Association's journey. I have seen our challenges, our victories, and how we have grown. This long-term perspective allows me to bring our history to the table. I can help us make sure we are building on what we have learned, not just repeating past conversations. It is about using that knowledge to stay focused and move forward effectively.

How has Drupal impacted your life or career?
Drupal has had a major impact on my career, opening doors and shaping my professional journey in ways I never could have imagined. But the most significant impact is not about technology or job titles; it is about the people. The Drupal community has taught me the power of collaboration and the incredible things that can be built when people from all over the world come together.

Tell us something that the Drupal community might not know about you.
I have two teenagers who know more about Drupal than many other teenagers in the world. When I am not spending time with them and my husband Christoph, I love playing golf. My goal this year is to play at least 52 rounds. I am halfway there, so I need to focus on playing more in the next few weeks.

Share a favorite quote or piece of advice that has inspired you.
"I have missed more than 9,000 shots in my career. I have lost almost 300 games. Twenty-six times I have been trusted to take the game-winning shot and missed. I have failed over and over and over again in my life. And that is why I succeed." — Michael Jordan

We look forward to the contributions Baddy will make during her time on the Drupal Association Board. Thank you, Baddy, for sharing your time and expertise with the Drupal community. You can connect with Baddy on LinkedIn.

About the Drupal Association Board of Directors

The Drupal Association Board of Directors comprises 13 members with nine nominated for staggered three-year terms, two elected by Drupal Association members, and one seat is reserved for the Drupal Project Founder, Dries Buytaert, while another is reserved for the immediate past chair (non-voting). Terms start on 1 November of each year.

The Board meets twice in person for weekend retreat and about 5 times virtually each year. The Board provides strategic guidance to the Drupal Association and oversight of the Association’s management, policy development, management, budget, and fundraising efforts.

Fons Vandamme, a long-time Drupal developer and agency co-founder, created Webhaven—a pre-configured starter kit designed to simplify and speed up Drupal project development. In this interview, he shares why he built it, how it works, and what it means for developers, agencies, and the Drupal community.

Single Directory Components (SDC) consist of a directory of files that go together to create a small component on a Drupal website. The component contains all the templates, styles, script, and images needed to display some content in a consistent way.

Different SDC can be nested together, which means that a site can be built up from different components working together to generate the content.

The power of SDC comes from their ability to be self contained. If you have the need to build a complex component that displays data in a widget then building it as a SDC means that you can ensure that it looks and functions in the same way every time you include it.

Storybook is a JavaScript application that provides a front end workshop for component development. This means that we can develop and preview our components before they are used on the stie. By using a module we can build components in our Drupal theme and then preview them in Storybook before every needing to inject them into the Drupal templates.

In this article we will look at creating a SDC in Drupal and then using Storybook to create and preview that component.

First, let's make a SDC that we can use as an example with this application.

Creating A Single Directory Component

To preview a SDC in Storybook we first need to create one, this will be used as an example thoughtout the rest of the article. It is assumed that you have a custom theme that you can build a SDC in.

Read more

Peer code reviews are a cornerstone of any successful web development team. I've always thought of peer code review as a way to learn from others. How many times while reviewing someone else's code have you thought to yourself: "I didn't know you could do that!", or, "That's a nice trick, I'll try it next time!".

Disclaimer: This blog post was inspired by a post by Lullabot about AI and code reviews. My take however, is different as I share my personal experience with these tools.

Why Use AI to Review Your Code?

Automating tasks to boost productivity and efficiency is nothing new in web development. We already rely on tools to lint, format, and test our code. AI-powered code reviews add another layer of scrutiny, helping improve code quality by catching issues that might slip through the cracks during manual review.

When working on personal projects as a solo developer, AI becomes an invaluable second set of eyes offering feedback I wouldn’t otherwise receive. For personal use, many AI tools offer a free tier plan that may lack the advanced bells and whistles, but provides a basic level of functionality that could still be helpful.

Should AI Replace Peer Code Reviews?

No. While AI can be incredibly helpful, it lacks the full context behind your code decisions. Sometimes, code needs to be written a certain way due to business logic, legacy constraints, or specific architecture choices. AI might flag these as issues, whereas a peer reviewer—familiar with the context—can validate the approach and focus in ensuring your code doesn’t introduce regressions.

Which AI Tool Is Best for Code Reviews?

Short answer: The one that works best for you.

Choosing an AI tool is like selecting a framework or plugin, it depends on your workflow, preferences, and project needs. The best approach is to try a few and see which one delivers the most value and best user experience. Recently I have tried GitHub Copilot, Google Gemini Code Assistant, and CodeRabbit.

In most cases, the decision of selecting one tool boils down to cost and your specific environment. The good thing is that these tools are relatively easy to integrate and test before deciding on the one you feel works the best for you.

Should You Trust AI to Make the Right Choices?

It’s wise to remain skeptical of any code changes or recommendations made by AI. But the beauty of code is that it either works or it doesn’t. Testing and validating AI-suggested changes against your standards is the best way to determine their effectiveness.

My Experience with AI Code Review Tools

I use GitHub Copilot within my IDE (VS Code), and it has been helpful at times when I needed a hand with code validation or bugs. I like it because is directly integrated with my editor and the feedback it provides is in context with the code as I write it.
I briefly tried CodeRabbit, but I don’t think I gave it a fair shot—planning to revisit it soon. The tool I’ve recently enjoyed using is Google Gemini Code Assistant (yes, it’s a mouthful).

The integration with my personal GitHub repo was straightforward—I was up and running in minutes. It reviews my code when I create a PR and provides a very detailed summary of the changes I'm introducing along with excellent recommendations for improvements or fixes.

A Real-World Example

I created a pull request with legacy Twig code that clearly needed improvement. Here's what the code does:

1. It embeds images using a media component which provides a set of image dimensions options for editors to choose.
2. Based on the user-selected option, a CSS class is passed through Drupal’s attributes (e.g., medium-landscape, small-portrait).
3. Each CSS class is mapped to a Media view mode which in turn is configured with s specific image style.
   1 It provides a default view mode if no size is selected.
4. Displays a validation message if no image is added to the component.

While the code was relatively simple, the AI helped me refactor it into something cleaner, more efficient, and easier to maintain. I'll use this technique again whenever I get the chance.

Original code{% if mid %} {% if 'small-portrait' in attributes.class %} {% set image %} {{ drupal_entity('media', mid, 'small_portrait') }} {% endset %} {% elseif 'small-rectangular' in attributes.class %} {% set image %} {{ drupal_entity('media', mid, 'small_rectangular') }} {% endset %} {% elseif 'small-rectangular-tall' in attributes.class %} {% set image %} {{ drupal_entity('media', mid, 'small_rectangular_tall') }} {% endset %} {% elseif 'small-square' in attributes.class %} {% set image %} {{ drupal_entity('media', mid, 'small_square') }} {% endset %} {% elseif 'medium-portrait' in attributes.class %} {% set image %} {{ drupal_entity('media', mid, 'medium_portrait') }} {% endset %} {% elseif 'medium-rectangular' in attributes.class %} {% set image %} {{ drupal_entity('media', mid, 'medium_rectangular') }} {% endset %} {% elseif 'medium-rectangular-tall' in attributes.class %} {% set image %} {{ drupal_entity('media', mid, 'medium_rectangular_tall') }} {% endset %} {% elseif 'medium-rectangular-wide' in attributes.class %} {% set image %} {{ drupal_entity('media', mid, 'medium_rectangular_wide') }} {% endset %} {% elseif 'medium-square' in attributes.class %} {% set image %} {{ drupal_entity('media', mid, 'medium_square') }} {% endset %} {% elseif 'large-rectangular' in attributes.class %} {% set image %} {{ drupal_entity('media', mid, 'large_rectangular') }} {% endset %} {% elseif 'large-rectangular-tall' in attributes.class %} {% set image %} {{ drupal_entity('media', mid, 'large_rectangular_tall') }} {% endset %} {% elseif 'large-rectangular-wide' in attributes.class %} {% set image %} {{ drupal_entity('media', mid, 'large_rectangular_wide') }} {% endset %} {% elseif 'large-square' in attributes.class %} {% set image %} {{ drupal_entity('media', mid, 'large_square') }} {% endset %} {% else %} {% set image %} {{ drupal_entity('media', mid, 'large_rectangular') }} {% endset %} {% endif %} <figure class="image-embed{{- attributes ? ' ' ~ attributes.class -}}" {{- attributes ? attributes|without(class) -}}> {{ image }} </figure> {% else %} <div class="image-embed{{- attributes ? ' ' ~ attributes.class -}}" {{- attributes ? attributes|without(class) -}}> <span>No media exists, please update or delete this component.</span> </div> {% endif %}

After creating a PR which included the code above, Gemini Code Assistant recommended an update to the logic by using a cleaner and concised approach. Take a look:

Final code{# A twig map to centralize the mapping of view_modes based on CSS classes. #} {% set view_mode_map = { 'small-landscape': 'small_landscape', 'small-landscape-wide': 'small_landscape_wide', 'small-portrait': 'small_portrait', 'small-square': 'small_square', 'medium-landscape': 'medium_landscape', 'medium-landscape-wide': 'medium_landscape_wide', 'medium-portrait': 'medium_portrait', 'medium-square': 'medium_square', 'large-landscape': 'large_landscape', 'large-landscape-wide': 'large_landscape_wide', 'large-portrait': 'large_portrait', 'large-square': 'large_square' } %} {% set view_mode = 'medium_landscape' %} {# Default view mode #} {% for class, mode in view_mode_map %} {% if class in attributes.class %} {% set view_mode = mode %} {% endif %} {% endfor %} {# Using the twig_tweak module to set the media entity as the value of `image`. #} {% set image = drupal_entity('media', mid, view_mode) %} {% if image %} <figure class="image-embed{{ attributes ? ' ' ~ attributes.class }}" {{ attributes ? attributes|without('class') }}> {{ image }} </figure> {% else %} <div class="image-embed{{ attributes ? ' ' ~ attributes.class }}" {{ attributes ? attributes|without('class') }}> <div class="image-embed__empty"> <span>No media exists, please update or delete this component.</span> </div> </div> {% endif %}

Again, the code is pretty trivial and this is not a ground-breaking situation, but the potential for improving my code using a system like this is definitely a bonus even when working alone in a projects.

In closing

It's an exciting time in web development and although there is a lot of uncertainty about AI, there are areas that are relatively safe to experiment with while still being cautious for unexpected results. Happy Coding!

Container Security in Production: Best Practices and Tools manager2 Fri, 09/26/2025 - 20:20

Container security best practices in production are a hot topic. They have changed the whole approach to web development. They make the process faster, more predictable, and easier to scale. But convenience does not eliminate risks. In a production environment where every failure can cost money, time, reputation, and security issues come to the fore. So, ignoring them means taking risks.

The top problems are well-known and include dangerous dependencies in images, weak access policies, and a lack of basic monitoring. And now add to this the human factor, and even a well-configured cluster can become vulnerable. Many people think that installing Docker and Kubernetes is enough. But attacks don`t wait for someone to finish reading the documentation.

In Part 3 of the Unmanaged Files in Drupal series, you’ll learn how to expose unmanaged file handling through a block plugin. By extending BlockBase and using dependency injection, developers can turn a custom file service into a reusable block that site builders can place anywhere. This tutorial walks through the plugin definition, constructor, factory method, and build process—complete with code examples—and shows how to enable the block in Drupal’s layout system.

Artificial intelligence is revolutionizing the way we manage content in CMS systems. Drupal is not lagging behind and offers more and more AI modules to automate editorial processes. In this article, I will present four of the latest AI-powered solutions for Drupal that can significantly improve content work and project management. This post is based on my video from the Modern Drupal channel. 

In preparation for the minor release, Drupal 11.3.x will enter the alpha phase the week of October 27, 2025. Core developers should plan to complete changes that are only allowed in minor releases prior to the alpha release.

The 11.3.0-alpha1 deadline for most core patches is October 29, 2025.

• Developers and site owners can begin testing the alpha after its release.

• Future feature and API additions will continue to be targeted against the main development branch, 11.x.

• Before 11.3.0-alpha1 is tagged, alpha experimental modules will be removed from the 11.3.x code base. Their development will continue in 11.x only.

• Following the release of Drupal 11.3.x and 10.6.x, only security issues will be fixed in Drupal 11.2.x and 10.5.x. Additionally, Drupal 11.1.x and 10.4.x will become end-of-life (EOL).

• During the alpha phase, core issues will be committed according to the following policy:

  1. Most issues that are allowed for patch releases will be committed to 11.3.x and 10.6.x. Such issues may also be committed to 11.2.x and 10.5.x until the final normal bugfix releases of 11.2.x and 10.5.x on December 10, 2025.
  2. Most issues that are only allowed in minor releases will be committed to 11.x only. (Such issues may be released in 11.4 or another future minor.). A few strategic issues may be backported to 11.3.x, but only at committer discretion after the issue is fixed in 11.x and before the beta deadline. For these issues, leave them set to 11.x unless you are a committer.
  3. Most issues that are allowed in maintenance minor releases will be committed to 11.x and 10.6.x only. A few strategic issues may be backported to 11.3.x and 10.5.x but only at committer discretion and before the beta deadline. For these issues, leave them set to 11.x unless you are a committer.

Roughly two weeks after the alpha release, the first beta release will be created. All the restrictions of the alpha release apply to beta releases as well. The release of the first beta is a firm deadline for all feature and API additions. Once the beta commit freeze begins, issues in the Reviewed & Tested by the Community (RTBC) queue will be committed to the next minor release only.

The release candidate phase will begin the week of November 26.

Security support of Drupal 10 and 11 Drupal 10.4.x and 11.1.x Security releases will be provided until December 10, 2025. Drupal 10.5.x and 11.2.x Security releases will be provided until June 15, 2026.

See the Drupal core release process overview, the Drupal core release schedule, allowed changes during the Drupal 10 and 11 release cycles, and Drupal 10 and 11 backwards compatibility and internal API policy for more information.

In July 2025, we conducted a comprehensive survey of over 200 marketing decision-makers and agency specialists to pinpoint the AI capabilities they value most.

Our analysis uncovers the key areas where organizations are concentrating their AI investments and identifies the features they consider essential for achieving long-term success. This report offers decision makers data-driven insights to help them prioritize their investments and maximize their strategic outcomes.

Download your copy today!

Key Trends from the Global AI Survey 2025 AI is no longer an experiment

Out of 216 respondents representing 199 different organizations, a significant majority indicated that their organization is already using AI. 

For the organizations that are already using AI, the applications are diverse, with a strong emphasis on general business support, marketing and content creation.

Rather than relying on staff to pick their own tools, organisations are increasingly embedding AI into established systems for example, CMS, CRM, marketing automation platforms.

Download The Global AI Report 2025

AI is a tool for automation and efficiency

Respondents were most enthusiastic about AI features that promise automation and efficiency. The most highly valued features address clear pain points and offer tangible benefits. 

Ability to deliver a market advantage is seen as significant

AI-assisted landing page builders are regarded as potential "killer apps" for their ability to shorten campaign launch times by streamlining or removing need for development skills.

A Focus on Trust and Human Control

While there is excitement about AI's potential, the survey also highlights a crucial need for features that enhance, but do not fully replace, human oversight. The report emphasizes that a focus on trust, accuracy, and the preservation of human control is paramount.

There is a clear desire for AI features that enhance human oversight – not replace it.

Respondents caution against AI taking over critical functions like permissions or autonomous actions. Many believe that certain responsibilities should remain under human oversight to prevent unintended consequences.

What stops organizations from using AI?

For the organizations that are not yet using AI, the main deterrents are varied but predominantly revolve around a lack of clear use cases, resource constraints, or concerns.

The primary reasons organizations are not using AI include concerns about data privacy and security, the ethical implications of AI, and the potential for AI to produce inaccurate or biased information.

Download the research

Equip your organisation with the knowledge to make informed AI investment decisions and stay ahead in a rapidly evolving digital landscape. Download your copy of The Global AI Report 2025 today and access the evidence-based guidance your team needs to prioritise initiatives and drive meaningful results.

Webinar recording: Key Insights from Global AI Survey and Roadmap Reveal

Our recent webinar summarised the report key findings. A recording is available to watch on The Drupal Association Youtube.

The Drop Times features a technical deep dive by Kelly Jacobs, Web Developer at Kalamuna, on Drupal’s new Config Actions API. The article explains how to use existing actions, build custom plugins or methods, and integrate them into recipes for predictable, reusable site-building workflows.

As the countdown continues for DrupalCon Vienna 2025, the global Drupal community is buzzing. This conference isn’t just another gathering, it’s shaping up to be one of the most technically rich, collaborative, and forward-looking Drupal events to date. Whether you build, design, strategize, or contribute, there are new incentives this year to make sure you’re part of it.

When & Where

DrupalCon Vienna 2025 runs from 14-17 October 2025, hosted at the Austria Center Vienna. This modern facility is well-equipped for large technical sessions, labs, workshops, and contributions, and Vienna’s efficient transit and infrastructure make it easy to get around and stay connected.

Vienna

Vienna is more than a beautiful and historic European capital. It’s also an international hub for tech innovation, design, standards, and open source culture. Attendees will be inspired not just by the sessions, but by the surroundings: cafés, museums, architectural landmarks, and a city layout that promotes walking, meeting, and exploring. There’s an energy in Vienna that pairs well with deep technical work quiet in the sessions, vibrant in the coffee-break ideas. The cosmopolitan and safe nature of the city also means it’s comfortable for international visitors.

Here, Sebastian Leu, Software Engineer, explores how AI supported his improvements to Drupal's autosave_form module. AI can accelerate test-driven development (TDD), making test-writing more practical within real project constraints.

sebastianleu@t… Wed, 09/24/2025 - 06:07