Hi everyone. While exploring the excellent new Canvas page builder, I realised the need for some components that provide layouts I can use in my landing pages. I build my themes from scratch, so using components from an existing theme didn't seem like a good fit.

Because I couldn't find any modules that provide the components I wanted, I made one 😄

The module includes the following components: Columns, Row, Grid, Container, Sized container, Expander, Tabs. Each one is explained on the module page. They utilise various props and slots of Canvas components, so they feel fully native to Drupal.

I've made them as nicely responsive as possible, so for example, a 4-column layout becomes 2 columns on smallish screens (e.g. iPads) and 1 column on small screens (phones).

I rarely use AI, and I really wanted these to be super simple and lightweight, so I coded them myself. They're almost entirely just twig (HTML) and CSS, and only 1 of the 7 layouts actually even ships any JavaScript (Tabs; and it's minimal).

It turns out that single-directory components (SDCs) like these can be used in more than just Canvas; they can be used directly in the theme without a page builder (e.g. by referencing them from the traditional twig templates), and the upcoming version 4 of the Gutenberg module will has first-class support for SDCs. For now they don't work with Layout Builder, but I'm not sure how much demand there is for it any more...

Oh and the each component is completely independent, so if you want to use just one, you can just copy it straight into your theme without even installing the module; that's the beauty of open source.

Let me know what you think, and if you have any requests 😊

Hi everyone. While exploring the excellent new Canvas page builder, I realised the need for some components that provide layouts I can use in my landing pages. I build my themes from scratch, so using components from an existing theme didn't seem like a good fit.

Because I couldn't find any modules that provide the components I wanted, I made one 😄

The module includes the following components: Columns, Row, Grid, Container, Sized container, Expander, Tabs. Each one is explained on the module page. They utilise various props and slots of Canvas components, so they feel fully native to Drupal.

I've made them as nicely responsive as possible, so for example, a 4-column layout becomes 2 columns on smallish screens (e.g. iPads) and 1 column on small screens (phones).

I rarely use AI, and I really wanted these to be super simple and lightweight, so I coded them myself. They're almost entirely just twig (HTML) and CSS, and only 1 of the 7 layouts actually even ships any JavaScript (Tabs; and it's minimal).

It turns out that single-directory components (SDCs) like these can be used in more than just Canvas; they can be used directly in the theme without a page builder (e.g. by referencing them from the traditional twig templates), and the upcoming version 4 of the Gutenberg module will has first-class support for SDCs. For now they don't work with Layout Builder, but I'm not sure how much demand there is for it any more...

Oh and the each component is completely independent, so if you want to use just one, you can just copy it straight into your theme without even installing the module; that's the beauty of open source.

Let me know what you think, and if you have any requests 😊

This blog post details the circumstances of the recent SA, explains how to review recent orders for fraudulent activity (including SQL queries to aid in searching), and reviews operational best practices for all Drupal Commerce users. Big thanks to the Drupal Security Team and Marcus Johansson for their assistance.

This blog post details the circumstances of the recent SA, explains how to review recent orders for fraudulent activity (including SQL queries to aid in searching), and reviews operational best practices for all Drupal Commerce users. Big thanks to the Drupal Security Team and Marcus Johansson for their assistance.

Yesterday's batch (SA-CONTRIB-2026-254 to 292) included a Highly critical Commerce Core issue that's already being exploited, eight advisories for the AI module and three projects marked unsupported.

Contrib advisories have more than doubled this year, and with AI speeding up both discovery and exploitation, the window between an advisory and a working exploit is basically gone.

https://preview.redd.it/lsqgggvu6dyh1.png?width=1500&format=png&auto=webp&s=aba7d9d7012c92ddf49f74d9bdae277b4d1c75c1

https://preview.redd.it/0hu0t8mv6dyh1.png?width=1500&format=png&auto=webp&s=6cd765f74cf72a35b25459439a15d2c46daedb21

I wrote up the numbers and how I'm changing my maintenance routine because of it: https://menetray.com/en/blog/every-wednesday-drupalgeddon-and-were-getting-used-it

Curious how others are handling this. Are you applying critical patches the same day?

Yesterday's batch (SA-CONTRIB-2026-254 to 292) included a Highly critical Commerce Core issue that's already being exploited, eight advisories for the AI module and three projects marked unsupported.

Contrib advisories have more than doubled this year, and with AI speeding up both discovery and exploitation, the window between an advisory and a working exploit is basically gone.

https://preview.redd.it/lsqgggvu6dyh1.png?width=1500&format=png&auto=webp&s=aba7d9d7012c92ddf49f74d9bdae277b4d1c75c1

https://preview.redd.it/0hu0t8mv6dyh1.png?width=1500&format=png&auto=webp&s=6cd765f74cf72a35b25459439a15d2c46daedb21

I wrote up the numbers and how I'm changing my maintenance routine because of it: https://menetray.com/en/blog/every-wednesday-drupalgeddon-and-were-getting-used-it

Curious how others are handling this. Are you applying critical patches the same day?

I had a long conversation with Dries Buytaert. The parts I think Drupal folks will find most useful:

• He separates "building pages" from "managing content". A five-page site, sure, vibe-code it. Ten editors and thousands of pages across a hundred sites is a different problem, and that one is growing.
• Search engines sent visitors back to the sites that made the content. AI answers don't. He calls it breaking the social contract of the web.
• Tool API and MCP: exposing Drupal's capabilities to agents while keeping permissions and workflows. He thinks agents will generate throwaway UIs for tasks that take 100 clicks today.
• Makers and takers in the AI era, and the $3M/year the Drupal Association spends just on servers.
• A story he hadn't told publicly: the document he had Acquia's early investors sign to protect Drupal.

Full video (71 min, chapters in the youtube video description): https://youtu.be/NiN5ufDJXuo

I had a long conversation with Dries Buytaert. The parts I think Drupal folks will find most useful:

• He separates "building pages" from "managing content". A five-page site, sure, vibe-code it. Ten editors and thousands of pages across a hundred sites is a different problem, and that one is growing.
• Search engines sent visitors back to the sites that made the content. AI answers don't. He calls it breaking the social contract of the web.
• Tool API and MCP: exposing Drupal's capabilities to agents while keeping permissions and workflows. He thinks agents will generate throwaway UIs for tasks that take 100 clicks today.
• Makers and takers in the AI era, and the $3M/year the Drupal Association spends just on servers.
• A story he hadn't told publicly: the document he had Acquia's early investors sign to protect Drupal.

Full video (71 min, chapters in the youtube video description): https://youtu.be/NiN5ufDJXuo

Drupal Association Interim CEO Tiffany Farriss on why Drupal’s commons is under pressure, how the Drupal Certified Partner program is evolving, and what it takes to keep free software running for the next 25 years.

In this episode:
• What the ecosystem and business surveys revealed
• Why the Drupal Certified Partner program is becoming the Drupal Certified program
• The $40 in donated services every Drupal site receives each year, and who shoulders that cost
• Making contribution visible, expected, and recognised

In the Open with Tiffany Farriss is a weekly series from the Drupal Association, the non-profit that maintains Drupal.org, coordinates Drupal security, and supports the global Drupal community. New episodes every week. Subscribe to follow along.

Produced with thanks to Stephen Cross of Second Signal Media.

Drupal Association Interim CEO Tiffany Farriss on why Drupal’s commons is under pressure, how the Drupal Certified Partner program is evolving, and what it takes to keep free software running for the next 25 years.

In this episode:
• What the ecosystem and business surveys revealed
• Why the Drupal Certified Partner program is becoming the Drupal Certified program
• The $40 in donated services every Drupal site receives each year, and who shoulders that cost
• Making contribution visible, expected, and recognised

In the Open with Tiffany Farriss is a weekly series from the Drupal Association, the non-profit that maintains Drupal.org, coordinates Drupal security, and supports the global Drupal community. New episodes every week. Subscribe to follow along.

Produced with thanks to Stephen Cross of Second Signal Media.