❌

Normal view

AI-generated Drupal code that passes every test is what worries me most

https://menetray.com/en/blog/green-tests-arent-enough-thats-why-my-ai-goes-through-audit

Models often fall back on D7/D8-era patterns: \Drupal::service() instead of dependency injection, |raw in Twig, render arrays without cache metadata. Most of it works, and tests don't catch it.

So my agents now run the Audit module's Drush commands on whatever they touch (complexity, duplication, Twig, security, PHPStan, PHPCS), fix what comes up and run them again. Then I do the final review. Full disclosure, I maintain the Audit module.

What are you checking beyond tests in your AI workflow?

submitted by /u/rmenetray
[link] [comments]

AI-generated Drupal code that passes every test is what worries me most

https://menetray.com/en/blog/green-tests-arent-enough-thats-why-my-ai-goes-through-audit

Models often fall back on D7/D8-era patterns: \Drupal::service() instead of dependency injection, |raw in Twig, render arrays without cache metadata. Most of it works, and tests don't catch it.

So my agents now run the Audit module's Drush commands on whatever they touch (complexity, duplication, Twig, security, PHPStan, PHPCS), fix what comes up and run them again. Then I do the final review. Full disclosure, I maintain the Audit module.

What are you checking beyond tests in your AI workflow?

submitted by /u/rmenetray to r/drupal
[link] [comments]

Talked with Dries about whether we still need a CMS when AI agents build websites, and lots of other topics

Talked with Dries about whether we still need a CMS when AI agents build websites, and lots of other topics

I had a long conversation with Dries Buytaert. The parts I think Drupal folks will find most useful:

  • He separates "building pages" from "managing content". A five-page site, sure, vibe-code it. Ten editors and thousands of pages across a hundred sites is a different problem, and that one is growing.
  • Search engines sent visitors back to the sites that made the content. AI answers don't. He calls it breaking the social contract of the web.
  • Tool API and MCP: exposing Drupal's capabilities to agents while keeping permissions and workflows. He thinks agents will generate throwaway UIs for tasks that take 100 clicks today.
  • Makers and takers in the AI era, and the $3M/year the Drupal Association spends just on servers.
  • A story he hadn't told publicly: the document he had Acquia's early investors sign to protect Drupal.

Full video (71 min, chapters in the youtube video description): https://youtu.be/NiN5ufDJXuo

submitted by /u/Hopeful-Fly-5292
[link] [comments]

Talked with Dries about whether we still need a CMS when AI agents build websites, and lots of other topics

Talked with Dries about whether we still need a CMS when AI agents build websites, and lots of other topics

I had a long conversation with Dries Buytaert. The parts I think Drupal folks will find most useful:

  • He separates "building pages" from "managing content". A five-page site, sure, vibe-code it. Ten editors and thousands of pages across a hundred sites is a different problem, and that one is growing.
  • Search engines sent visitors back to the sites that made the content. AI answers don't. He calls it breaking the social contract of the web.
  • Tool API and MCP: exposing Drupal's capabilities to agents while keeping permissions and workflows. He thinks agents will generate throwaway UIs for tasks that take 100 clicks today.
  • Makers and takers in the AI era, and the $3M/year the Drupal Association spends just on servers.
  • A story he hadn't told publicly: the document he had Acquia's early investors sign to protect Drupal.

Full video (71 min, chapters in the youtube video description): https://youtu.be/NiN5ufDJXuo

submitted by /u/Hopeful-Fly-5292 to r/drupal
[link] [comments]

In the Open with Tiffany Farriss: Sustaining the Drupal commons | Drupal Association

In the Open with Tiffany Farriss: Sustaining the Drupal commons | Drupal Association

Drupal Association Interim CEO Tiffany Farriss on why Drupal’s commons is under pressure, how the Drupal Certified Partner program is evolving, and what it takes to keep free software running for the next 25 years.

In this episode:
• What the ecosystem and business surveys revealed
• Why the Drupal Certified Partner program is becoming the Drupal Certified program
• The $40 in donated services every Drupal site receives each year, and who shoulders that cost
• Making contribution visible, expected, and recognised

In the Open with Tiffany Farriss is a weekly series from the Drupal Association, the non-profit that maintains Drupal.org, coordinates Drupal security, and supports the global Drupal community. New episodes every week. Subscribe to follow along.

Produced with thanks to Stephen Cross of Second Signal Media.

submitted by /u/cmkn to r/drupal
[link] [comments]

In the Open with Tiffany Farriss: Sustaining the Drupal commons | Drupal Association

In the Open with Tiffany Farriss: Sustaining the Drupal commons | Drupal Association

Drupal Association Interim CEO Tiffany Farriss on why Drupal’s commons is under pressure, how the Drupal Certified Partner program is evolving, and what it takes to keep free software running for the next 25 years.

In this episode:
• What the ecosystem and business surveys revealed
• Why the Drupal Certified Partner program is becoming the Drupal Certified program
• The $40 in donated services every Drupal site receives each year, and who shoulders that cost
• Making contribution visible, expected, and recognised

In the Open with Tiffany Farriss is a weekly series from the Drupal Association, the non-profit that maintains Drupal.org, coordinates Drupal security, and supports the global Drupal community. New episodes every week. Subscribe to follow along.

Produced with thanks to Stephen Cross of Second Signal Media.

submitted by /u/cmkn
[link] [comments]

Navigating Drupal’s AI Contribution Policy: A View from the Review Queue · Zoom · Luma

Navigating Drupal’s AI Contribution Policy: A View from the Review Queue · Zoom · Luma

Contribution using LLMs, the policy, and etiquette around it is a topic that has come up in some recent posts here as well as in other places such as in the Drupal community Slack and the issue queue. So it’s quite serendipitous that a session touching on this is coming up soon, on Wednesday, November 4, 2026 at 2:00pm Eastern Standard Time.

Figured it’s worth sharing here for those who might be interested.

Whether it’s your employer, your clients, or your favorite open source project, we all have AI policies to navigate now. Drupal has one too, and it was written with a lot of care for both contributors and the people who review their work.

In this session, Stephen Mustgrave joins us to introduce the policy on the use of AI when contributing to Drupal. Stephen has led the Needs Review Queue Initiative for several years, checking in on Drupal core issues as they reach “needs review.” That gives him a front-row view of what helps an issue move forward and what slows it down.

We’ll start with the why. Committers are responsible for the codebase, and they need to understand every change they commit. Every contribution to an issue should help clarify the problem and the proposed solution. AI-generated summaries can add cognitive load for reviewers and, even when the contributor understands the change perfectly well, they don’t show it. The result is that the work of understanding shifts onto someone else.

Then we’ll get practical:

What the policy asks of contributors
- The updated issue summary templates, including the new section for AI output
- Why reviewers ask for summaries written in your own words, and what makes a good one
- How to ask AI to explain a solution so you understand it well enough to describe it yourself

We’re coming at this from a place of enthusiasm. AI tools have made it possible for more people to contribute to Drupal, and that energy is a good thing. Let’s talk about how to channel it into contributions that move issues forward and keep everyone in the chain, from contributor to reviewer to committer, on the same page.

Bring your questions and your own policies too. If you maintain contributed projects, we’d love to hear how you’re handling AI-assisted contributions.

submitted by /u/cmkn
[link] [comments]

Vibing Drupal: Using AI to switch between multiple versions of Drupal core

Vibing Drupal: Using AI to switch between multiple versions of Drupal core

With Drupal 12 on the horizon and Drupal 10 reaching end of life in December, I'm facing two challenges. First, I need to upgrade my current site from Drupal 10 to Drupal 11. Second, I need to update my contributed modules to support Drupal 12, while still supporting Drupal 10.

To address these challenges, I’m experimenting with an AI agent skill and a corresponding DDEV command, drupal-core-switcher, that toggles my application between the previous, current, and next versions of Drupal core and compatible contributed modules.

Are you facing similar challenges? Is having a drupal-core-switcher skill and command helpful? If you are procrastinating on upgrading to Drupal 11, would you use AI to help you do it?

submitted by /u/jrockowitz
[link] [comments]

Can't decide which Drupal issue to work on? Roll the dice. 🎲

Can't decide which Drupal issue to work on? Roll the dice. 🎲

Great news: Contrib Kanban is back thanks to Matt Glaman.

As a result you can get an overview of every issue with a given tag again. For example, everything that is tagged with "rosetta" from the DrupalCon Rotterdam DriesNote.

I liked the idea, but the project could use some visual polish and a dash of fun!

So here it is: an improved UI and an issue roulette.

Spin it, take the issue that stops under the marker, and get to work. You get three re-rolls.

What do you think and what needs to be improved?

---

Some stuff is still in a Github PR but here are the links.

Website: https://contribkanban.com/
Github repo: https://github.com/mglaman/contribkanban.com

submitted by /u/Fonucci to r/drupal
[link] [comments]

Can't decide which Drupal issue to work on? Roll the dice. 🎲

Can't decide which Drupal issue to work on? Roll the dice. 🎲

Great news: Contrib Kanban is back thanks to Matt Glaman.

As a result you can get an overview of every issue with a given tag again. For example, everything that is tagged with "rosetta" from the DrupalCon Rotterdam DriesNote.

I liked the idea, but the project could use some visual polish and a dash of fun!

So here it is: an improved UI and an issue roulette.

Spin it, take the issue that stops under the marker, and get to work. You get three re-rolls.

What do you think and what needs to be improved?

---

Some stuff is still in a Github PR but here are the links.

Website: https://contribkanban.com/
Github repo: https://github.com/mglaman/contribkanban.com

submitted by /u/Fonucci
[link] [comments]

Have your contributions decreased after AI?

For years my workflow to solve a problem in Drupal was as follows.

First I try to find someone else who had the same problem and if there is a patch available. If there is a patch I use it. If the patch doesn’t apply, I fix it for the module version I’m using and publish the updated version. If I’m the first with that problem I report it and try to find a solution. If the solution is generic enough, I share it with the community so more people can build on top of it.

These days things have changed. We use Claude Code to fix the issues now and sometimes it ends up patching stuff in core or in contrib modules. When I suggest my coworkers share the result with the community they refuse. They can ask Claude to fix future issues so there is no need to share. But I also think they don’t understand the code and that is why they don’t want to share it.

So I wonder. If everyone starts doing the same, who is going to contribute to Drupal? Do you know if the contributions have decreased this year due to AI?

submitted by /u/ff_1945
[link] [comments]

A big update to DruBOM module (Drupal Bill of Material)

Hello author here!

What is DruBOM: a Drupal module that lists every component a site uses, checks for known vulnerabilities and exports an SPDX 3.0.1 SBOM, requiring no third party libraries installation.

In this post I outline what the module does, how it has improved and how it was built; I hope you enjoy the post and the module, and feedback is welcome.

https://www.paolomainardi.com/posts/drubom-next-gen-drupal-supply-chain-security/

submitted by /u/paolomainardi
[link] [comments]

Drupal core: Field UI RCE and sanitization fixes. Update to the fixed release for your branch

If your site uses Field UI in drupal/core, this week's advisories include a remote code execution vulnerability in that module. It isn't directly exploitable with core alone, but I'd still check your installed version.

The fixes are in 10.6.19 / 11.3.19 / 11.4.10 / 12.0.0-beta2, depending on your branch. Those releases address all three core advisories:

  • drupal/core, Field UI: remote code execution, with the core-alone limitation noted above.
  • drupal/core, Link: insufficient sanitization of certain markup.
  • drupal/core, Navigation: insufficient attribute sanitization that can lead to cross-site scripting (XSS).

I read the new Composer advisories each week. For the week of 12 October 2026, these are the ones I'd check first on Drupal sites.

Full list with advisory links: https://patchclock.com/security-digest/2026-w42?utm_source=reddit

Disclosure: I build PatchClock, a CRA compliance tool for PHP vendors. The weekly list itself is free.

submitted by /u/joaoribeiro_dev
[link] [comments]

What companies out there rescue poor Drupal builds?

When I started my postion as a Drupal Web Developer I inherited a very poorly maintained Drupal site. It was on Drupal 9 when I started, a week before it went EOL. It took me a year to clean it up enough to make the jump to D10, and that was with a lot of help from my predecessor, who we had to bring in on a consulting fee, and while he was great and wicked smart, he was not a great teacher. I've been in my position for 3 years and have been so bogged down in front end content management that I haven't had time to do anything other than regular D10 patches. Now we're looking to jump to D11, since D10 is going EOL, and this new PHP nonesense is driving me up the wall trying to figure out how to fix all this without torching the site.

At this point I'm looking for a company who can come in and clean up all the wonky database mess we have, figure out what packages are being used, and basically clean up the back end of the site so I can have a clean build to work with. Who can I reach out to for a consultation and figure out how I can get this site back to a manageable build?

submitted by /u/OfficialCrossParker
[link] [comments]
❌