TheDropTimes: The Next Test of Drupal’s Contribution Model

The Next Test of Drupal’s Contribution Model

Editor's Pick | Vol. 4 | Issue. 45

Drupal has long relied on organisations and individuals who contribute beyond their immediate needs. Yet that responsibility remains unevenly distributed. According to figures published by the Drupal Association in February 2025, just 219 of the 1,440 organisations active on Drupal.org accounted for 96% of recorded contributions in 2024. The challenge is not simply attracting more contributors, but making responsibility for Drupal's upkeep more widely shared.

Two proposals outlined by Drupal Association Interim CEO Tiffany Farriss on 28 October 2026 suggest how that might happen. A broader Drupal Certified programme could recognise makers, patrons and advocates, extending recognition beyond agencies. Alongside it, a dedicated maintainers fund could help organisations without development capacity financially support the people maintaining software they depend on.

Together, these proposals revisit Dries Buytaert's long-standing makers-and-takers argument. They also raise questions about what counts as a fair contribution. Financial support cannot automatically substitute for technical responsibility, and certification must recognise different capacities without favouring organisations that can afford to pay. How funding reaches maintainers, and how their work is valued, will matter as much as the proposed framework itself.

Neither proposal has been implemented. Their significance lies in an attempt to move from contribution as an expectation placed on a committed minority towards a responsibility shared across the ecosystem. Drupal will remain freely available, but sustaining that freedom requires continuing work. The real test is whether more beneficiaries can help support it without compromising the openness and independence that make Drupal worth maintaining.

Follow The DropTimes on LinkedIn and Bluesky, or join #thedroptimes on Drupal Slack.
Allen Jason wrote and curated this issue of Editor’s Pick.

Drupal Association Proposes Broader Certification and Maintainers Fund

Drupal Association interim CEO Tiffany Farriss has outlined plans to broaden the Drupal Certified Partner programme. The proposal would recognise makers, patrons and advocates while introducing shared maintenance expectations and a funding route for maintainers. The changes could allow more organisations to demonstrate their support for Drupal, although the new requirements and funding arrangements have not been finalised.

Drupal Triples Core Security Credits and Expands Sponsorship Recognition

The Drupal Association announced changes to its contribution credit system on 21 October 2026. Core issues now carry 15 credits and core security advisories 150, while additional maintainer roles qualify for sponsorship recognition. The changes affect how contributing organisations are recognised in the Drupal Marketplace and assessed for partner status.

Drupal Commerce Access Bypass Actively Exploited as Drupal Issues 39 Advisories

The Drupal Security Team published 39 contributed-project security advisories on 28 October 2026, including an actively exploited vulnerability in Drupal Commerce. The disclosures also identify payment, authentication, content import and access-control weaknesses, alongside incomplete earlier fixes. Affected Drupal site operators need to update supported modules, investigate possible consequences and remove projects that no longer receive security fixes.

Centarro Publishes Order-Audit Checks After Drupal Commerce Exploit Reports

Centarro has published order-audit guidance after receiving two reports of attempted fraudulent orders on live Drupal Commerce sites. The maintainer identified four database checks and said the underlying vulnerability may have been exploitable in certain configurations since 2020. Merchants are advised to update affected installations and investigate suspicious transactions, including orders with inconsistent payment records or altered prices.

What Drupal's AI Contribution Policy Requires from Contributors

Drupal.org's AI contribution policy requires contributors to review their submissions, take responsibility for the results and disclose significant AI assistance. Repeated low-quality submissions can lead to temporary or permanent bans, while separate instructions for AI coding agents are being evaluated in Drupal core. Contributors must understand what their tools produce, verify their work and remain engaged with maintainers.

How to Use AI Coding Agents on Drupal Projects with AGENTS.md, Tests and MCP

AI coding agents can generate outdated Drupal code or overlook important requirements when they lack project-specific context. A practical workflow combines repository instructions, Drupal-specific skills, automated checks and tools for inspecting a local site. Developers can use these safeguards to reduce avoidable errors while retaining responsibility for reviewing and understanding every change.

Drupal AI Modules by Use Case: What to Install and How Mature Each Is

Drupal's AI ecosystem has grown to hundreds of contributed modules built around the AI module, which more than 24,000 sites report using. This tracker groups the maintained projects by the job they do, such as alt text, site search with cited answers, AI agents, connections for outside assistants, workflows and cost tracking, and lists one module for each job. Each entry shows reported installs, the newest release and whether Drupal's security advisories cover it, as checked on Drupal.org.

X to Drupal: QED42 Migrates 646 Pages From Webflow to Drupal 11

QED42 has introduced X to Drupal, an AI-assisted framework tested through the migration of its own 646-page Webflow website to Drupal 11. Senior backend engineer Souvik Pal describes the content modelling failures, verification problems and security decisions uncovered during development. The experience offers Drupal teams practical lessons about automated migration and the work that still requires human oversight.

WordPal Converts WordPress Block Themes for Drupal Canvas and Display Builder

Drupal core committer Théodore Biadala has developed WordPal to convert WordPress block themes into Drupal themes and page structures for Canvas and Display Builder. Its public gallery reports thousands of completed conversions, but visual similarity does not guarantee fully editable components or production readiness. Biadala explains the WordPress Playground-based process, conversion limits, update challenges and the security review still needed before wider deployment.

Dashi Brings Umami's Food Magazine Demo to Drupal CMS

Gábor Hojtsy has released Dashi, a Drupal CMS site template that carries forward the Umami food magazine demo. It includes English and Spanish content, editable Canvas pages and translation tools, although the first release has two known compatibility problems. Drupal users can try Dashi through simplytest.me or install it locally using documented workarounds.

Vale 1.0 Adds Server-Side Style Checks to Drupal Publishing

Stuart Clark released the first stable version of the Vale module for Drupal on 28 October 2026. It checks selected text fields against editorial style rules when content is validated through forms or application interfaces. Drupal publishing teams can apply shared rules across editing workflows, but enforcement depends on configuration and how content is saved.

Can Governments Reduce Microsoft 365 Dependency Without Replacing It?

Six contributors to DrupalCon Rotterdam's Government Summit have assessed Switzerland's decision to introduce an open-source workplace alongside Microsoft 365. Their responses examine migration risks, costs, staff adoption and the dependencies that can survive a change in software. The discussion connects government technology choices with open standards, public procurement and collaborative Drupal projects.

Open Source is Essential for Tomorrow's Digital Government

Dutch government bodies and SURF signed an agreement on 1 October 2026 to make open source a permanent part of their operations. Jan ten Hoor of iO discusses the company's Drupal for Government platform and its move towards broader open-source collaboration. His perspective raises practical questions about shared development, governance and long-term maintenance of Drupal-based public services.

3 Tips for Incorporating Colour Psychology in Website Design

Colour psychology is not a universal formula. Anne Stefanyk of Kanopi Studios shares three practical approaches to audience research, consistent colour choices in Drupal and accessible contrast for better website design.

Outer-Core Beta Revives Drupal Space Game, With New Universe Planned

Alessandro Feijó has revived the Beta of Outer-Core, a persistent browser-based space strategy game first developed in 2008. The game continues to operate on Drupal 6, while its separate public portal uses Drupal 11. The project offers Drupal developers a case study in maintaining complex application behaviour while planning a major platform migration.

The DropTimes October Townhall Details Editorial Shift and Community Plans

The DropTimes reviewed its editorial direction and September activities during its Open Townhall on 28 October 2026. The team discussed a move towards fewer, more thoroughly researched stories, alongside publishing results and progress on the Editorial Working Group. Drupal contributors were invited to help identify overlooked topics, support event reporting and participate in future editorial planning.