TheDropTimes: Stewarded Open Source in an Age of AI-Built Alternatives

Stewarded Open Source in an Age of AI-Built Alternatives

Editor's Pick | Vol. 4 | Issue. 43

Working with AI, developer Brandon Thomas says he has recreated seven Adobe applications as open-source alternatives through ArtCraft. His pitch promises familiar tools without subscriptions, with code people can inspect, modify and keep. For users frustrated by proprietary terms, the attraction is a credible alternative they can make their own.

Credibility takes time to establish. PhotoCraft’s documentation describes an early alpha that is not yet a Photoshop replacement for daily professional work. Its future usefulness will depend on continuing improvements, compatibility and support, alongside the freedom its licence provides.

Drupal founder Dries Buytaert explains that distinction in his essay on licence-only and stewarded open source. Both are open source, but stewardship adds an ongoing commitment to the software and the people who depend on it. Maintainers fix failures, coordinate releases and respond to security issues, while organisations help fund the infrastructure and continuity that adoption requires.

Drupal illustrates why that continuing care matters. Its community and supporting organisations sustain a shared platform that users can retain while choosing different providers to host, extend or support it. The opportunity for new AI-built alternatives is to develop comparable continuity around their code. Established projects, including Drupal, must keep demonstrating that their stewardship delivers dependable software and meaningful choice.

A plausible outcome is more freely available alternatives, with lasting adoption concentrated around projects that sustain that care. Proprietary vendors may respond through better services or greater dependence on hosted features, while open projects can offer independence backed by accountable maintenance. Funding security, compatibility, documentation and long-term support would help make those alternatives viable. The strongest challenge to proprietary control could come from communities that give people both the freedom to leave and confidence in what comes next.

Follow The DropTimes on LinkedIn and Bluesky, or join #thedroptimes on Drupal Slack.

Allen Jason wrote and curated this issue of Editor’s Pick.

EU Cyber Resilience Act: What Drupal Suppliers Must Assess

The European Union's Cyber Resilience Act has introduced security reporting duties for manufacturers of covered digital products. Drupal has received public investment in package signing, security audits and developer infrastructure, while compliance guidance helps suppliers assess their responsibilities. Organisations distributing Drupal-based software must determine whether their products fall within the law and what evidence they need to maintain.

LocalGov Drupal Recognised as a Digital Public Good

LocalGov Drupal received Digital Public Good recognition on 8 September 2026 and announced it on 9 October. The assessment examined open licensing, ownership, documentation, privacy and safeguards against harmful content. The designation gives public-sector organisations an independently reviewed reference when evaluating shared open-source website software.

Six Banks Fund OSERA's Shared Open-Source Security Fixes

European Digital Sovereignty Push Faces Open-Source Governance Gaps

Drupal Fixes Two Critical Remote Code Execution Flaws and Three XSS Vulnerabilities

The Drupal Security Team published five security advisories on 14 October 2026, including two Critical remote code execution vulnerabilities. The flaws affect Drupal core, the Entity List module, and the Gin administration theme, with some known attack paths requiring no authentication. Administrators should install the relevant core and contributed-project security releases to protect affected sites.

DruBOM Beta2 Adds Dependency Mapping to Drupal Security Inventory

DruBOM beta2 adds dependency mapping to help Drupal teams trace packages in a software inventory. Creator Paolo Mainardi also describes a broader rewrite with optional vulnerability checks, VEX decisions and SPDX exports. The module remains in beta, and its security findings still require review by site teams.

Tag1 Guide Explains Human-Controlled AI Code Reviews

Jeremy Andrews of Tag1 Consulting describes a workflow for staging AI-generated code review comments before publication. GitHub pending reviews and GitLab draft notes let developers inspect and edit the findings under their own accounts. The guide includes a GitLab example applicable to DrupalCode merge requests.

Accessibility Climbs State CIO Agenda as Operational Gaps Persist

Digital accessibility has risen to sixth place on NASCIO’s 2026 State CIO priority list. A survey of 36 state accessibility officers reports major gaps in document remediation, staffing and funding despite progress on statewide policies. Iowa’s Drupal publishing guidance illustrates how accessibility checks can become part of everyday content work.

CIBASS WordPress-to-Drupal CMS Migration Rebuilds a 13-Year Archive

Christian López Espínola documents the migration of CIBASS from WordPress to Drupal CMS. The project rebuilt content types, media embeds and redirects using 24 migrations and 12 body-transformation rules. Its experience also exposes the limits of recovering analytics and mailing-list data held by third parties.

Drupal Developer Explains DevDeck's Design as Windows Beta Arrives

Drupal developer Alexander Shumenko has released a Windows beta and Azure DevOps support for DevDeck, his desktop tool for tracking development work. The application sorts pull requests, notifications and local projects by urgency, and can share that status with coding agents on the same computer. Drupal developers can manage DDEV sites alongside their review queues, though the tool's licence restricts redistribution and modified versions.

Drupal AI 1.5.0 Moves Five Submodules Into Standalone Projects

Drupal AI 1.5.0, released on 25 September 2026, separates five features into standalone projects. The release also deprecates AI Search and AI CKEditor while expanding chat processing, guardrails and automation capabilities. Site administrators need to review package changes and prepare for the planned removals in version 1.6.

Drupal 12 Release Team Plans to Bundle Disruptive Code Changes Ahead of RC1

Drupal contributors have moved three core maintenance targets to November 2026. The work covers stricter PHP code analysis, removal of outdated test annotations and simpler constructor code. Coordinating these changes is intended to reduce interruptions to ongoing Drupal development.

Drupal Translation Extractor 3 Alpha Fixes Longstanding String Extraction Gaps

Translation Template Extractor 3 has reached its first alpha release. The update replaces the module's architecture and corrects problems in how translatable strings are identified. The changes prepare an important part of Drupal's translation infrastructure for its next upgrade.

Drupal Core Resolves 14-Year Kernel Testing Issue With ShareEnvironment

Drupal core contributors have resolved a testing issue opened in 2012. Compatible kernel tests can share database state across methods while keeping separate PHP processes. The change could shorten test runs for core and contributed modules.

Two Drupal Contributors to Speak on AI Governance and Provenance at AI Week 2026

Two Drupal contributors will speak at Digital Leaders' AI Week 2026. Zoocha founder Will Huggins will discuss organisational AI governance and ISO/IEC 42001, while Drupal UX research lead Emma Horrell will examine how provenance information can help people assess AI-generated answers. Their talks take place online on 16 and 15 October respectively.

PNW Drupal Summit Speakers Take on Live Chat, Accessibility and HTMX

The Pacific Northwest Drupal Summit takes place in Vancouver on 17 and 18 October 2026. Speakers have shared their plans for sessions covering accessible design systems, Matrix integration, HTMX and local code quality tools. The presentations will explore practical approaches to building and maintaining Drupal websites.