Yale University challenged itself to change the game in how it creates, manages, and publishes content. The result was YaleSites: a user-friendly, accessible, and highly customizable digital platform designed for the Yale community. Built on Drupal and open-source tools like Emulsify, YaleSites revolutionizes the digital landscape for the Yale community while giving them more flexibility and control over their content.
Here’s how Yale, through a strategic partnership with Four Kitchens, uses open-source solutions like Drupal to redefine digital collaboration and brand unity across its community.
The first feature release of Drupal 11 improves the recipe system, introduces support for hooks written as classes, makes Workspaces more flexible and enhances performance.
The Recipe system allows packages to be configured with dependencies in a repeatable way. Drupal 11.1 now allows recipes to take user input (for example, API keys for remote services). Recipes can now also use configuration actions to add new blocks, enable layout builder for content types, clone configuration entities, and so on.
Drupal's unique hook system allows modifying forms, data updates, site processes, render structures, and even the ordering of other hooks. After long-running efforts by many contributors, it is now possible to also define hooks and hook implementations with object-oriented techniques that are more in line with modern PHP code design practices. This will also make Drupal's code easier to understand for PHP developers familiar with other projects. All runtime core hooks have been converted to object-oriented implementations.
With this new functionality, magic global functions like the following will no longer be needed:
function hook_entity_insert(EntityInterface $entity) {
// DO STUFF
}
Instead, developers can use the new Hook attribute on methods:
class ExampleHooks {
#[Hook('entity_insert')]
public function entityInsert(EntityInterface $entity): void {
// DO STUFF
}
}
A dedicated API has been added to allow modules and themes to define icon packs. Within each pack is a series of icons each with a unique identifier that the system can then use. Modules and themes can alter icon packs.
As part of a larger plan to use workspaces for content moderation, the user interface of the Workspaces module was moved to a separate Workspaces UI module. For new sites, if you want to enable Workspaces with the user interface, you now need to install this module.
We revisited Drupal core's default configuration to better reflect most user's needs. In this release, date formats were made easier to read. The user registration process also now defaults to administrator-created accounts, in order to avoid new sites being flooded with spam accounts in the moderation queue. When creating a new node type, Drupal core will no longer automatically add a body field, allowing site builders to choose their own content model without having to delete defaults they don't want first and reducing potential conflicts for platforms built on Drupal core such as Drupal CMS and the upcoming Experience Builder.
A new generic entity reference views filter has been added, which makes it possible to render exposed views filters as a select list or autocomplete of available entities. This may now be used by contributed modules and will be enabled for core entity types in future releases.
Forms built with form API can now opt-in to render caching, improving page loading performance in a variety of situations. We will be gradually opting forms into Drupal core into render caching, and may opt-in all forms to render caching by default in a future major release.
Drupal's asset aggregation algorithm has been improved to reduce variation in CSS and JavaScript aggregates. Differences between pages which may have produced different but similar aggregates in the past, for example because libraries were requested in a different order, will now result in a single file instead. This improves CDN cache hit rates and reduces the amount of JavaScript and CSS that visitors will download when visiting multiple pages on a site. This builds on several previous recent improvements to Drupal core's asset aggregation since Drupal 10.1 and also unblocks further improvements which are planned for future minor releases.
The PHP team is doing a fantastic job of improving the language and performance of PHP. PHP 8.4 was released in November, and Drupal 11.1 fully supports it.
Drupal 11.1 will be the basis of Drupal CMS 1.0, which will be released on January 15 on Drupal's 24th birthday. Many of the underlying improvements introduced in Drupal core will help compose an improved user experience in Drupal CMS. The first release candidate of Drupal CMS was already based on Drupal 11.1 RC. Stay tuned!
The next Long-Term Support (LTS) release of Drupal 10 will be released this week. Drupal 10 will be supported until the release of Drupal 12 in mid- to late 2026. Long-Term Support for Drupal 10 is managed with a new maintenance minor release every 6 months that receives twelve months of support. This allows the maintenance minor to adapt to evolving dependencies. And it gives more flexibility for sites to move to Drupal 11 when they are ready.
The same will happen when Drupal 10 is end-of-life and Drupal 12 is released: Drupal 11 will transition to Long-Term Support, with its own maintenance minors every six months. This release schedule allows sites to move from one LTS version to the next if that is the best strategy for their needs..
Since Drupal 11.0, Adam Hoenich has stepped down from being a Migrate subsystem maintainer as he moved on to be a key committer for Drupal CMS. We thank Adam for his contributions!
If you are looking to make the leap from Drupal user to Drupal contributor, or you want to share resources with your team as part of their professional development, there are many opportunitzies to deepen your Drupal skill set and give back to the community. Check out the Drupal contributor guide. You are more than welcome to join us at DrupalCon Atlanta in March 2025 to attend sessions, network, and enjoy mentorship for your first contributions.
Recently ranked as the nation’s No. 1 large airport for customer satisfaction according to J.D. Power, Tampa International Airport (TPA) has built a reputation as a traveler- and community-friendly destination. While TPA hosts 21 million passengers annually, its website serves not only travelers but also employees, businesses, partners, airlines, and more.
Given the airport’s traveler-friendly reputation, TPA hoped to mirror its user-focused and easy-to-navigate airport experience via a redesigned website. Additionally, stakeholders wanted to not only drive concessions pre-ordering and parking revenue but also ensure they understood and then met the needs of the airport’s myriad user groups.
Aten launched the project with an in-depth discovery phase meant to identify the needs of multiple user groups and craft a clear reference point to drive decision-making. Using the resulting insights, we devised an intuitive and easy-to-navigate Drupal 10 website hosted on Acquia. We put diverse user needs top of mind, baked revenue drivers into the navigation, and featured the same bright and open aesthetic that greets TPA visitors every day.
DIGITAL TRANSFORMATION IN ECOMMERCE
Hampered by an ineffective user experience, Concept2 needed a new website to
Improve user experience with a modern, responsive design and clear conversion paths.
Minimize admin effort and overhead by using streamlined processes and newer technologies.
Maintain stability and security by migrating to an up-to-date, modern, supported platform.
Concept2's new technical infrastructure is composable, and its flexible decoupled nature is future-ready and scalable, allowing them to adapt to their evolving needs.
Concept2 has been the global leader in the innovation and production of rowing oars since 1976. Their oars won 98% of rowing medals at the Tokyo Olympics.
In addition to the Concept2 RowErg, which has become a fixture in rowing clubs, homes, gyms, CrossFit boxes, and schools around the world, the company's range of sports-based ergometers now includes the SkiErg and the BikeErg.
The pandemic significantly changed the fitness equipment market, shutting gyms and driving more people to purchase in-home fitness equipment to reach their goals.
With retail stores and their distributor network affected by quarantine closures, it became apparent that having an updated and integrated online sales channel for their B2B and D2C customers would make a substantial difference in a changing marketplace.
Concept2's new website would provide comprehensive information and support, reflect the company’s position as the market leader, and allow it to promote new offerings, such as ErgData, their free app for iOS and Android. Connecting these services and products through their website enhances customer experience and improves brand consistency.
When Concept2 examined its website closely, it admitted that its current infrastructure must be updated to improve scalability and promote growth. The limitation of their current setup had the potential to impact their bottom line significantly:
Not mobile-friendly—According to Forbes, mobile commerce sales, or sales made from a smartphone, are expected to account for 62% of all retail sales by 2027. Without a mobile-friendly and responsive site, Concept2 was leaving a lot of sales on the table for competitors to snap up.
Limited content management capabilities—The cornerstone of marketing is sending the right message to the right audience at the right time. Concept2's marketing team was handcuffed because it could not easily edit or add new content and had restricted content and visual storytelling options.
Unrefined user experience—Their current site navigation was not user-friendly, lending to a clunky shopping experience. With today’s sophisticated online shoppers and Concept2’s premium brand, upgrading the user experience is influential in maintaining their elite brand awareness.
Restricted functionality and system security—The inability to link replacement parts to machines, the lack of centralized content or codebase for subsidiary sites, and the susceptibility to server overload mean that manual labour to maintain content and the site is a constant resource issue.
In addition to these hurdles, Concept2 has subsidiaries in the UK, Australia, Germany, Austria, Switzerland, and Benelux. Each subsidiary would need its own version of the site, which it could customize according to its market. Thus, they needed a multi-site experience that works globally.
Concept2 decided the new site should be built on Drupal 10 using Drupal Commerce to achieve this. Without in-house development resources, Concept2 needed a partner agency that could handle the scope of the build and bring it to life in a quick turnaround time.
Using our decoupled accelerator, Gesso, and our agile development process, we established a communication and development cadence with Concept2’s internal team and stakeholders, ensuring full Acro Commerce support from discovery through development to launch, starting with their US site, which launched in June 2024.
Advantages of a decoupled accelerator
Optimized reducing development time.
Control of brand across multiple sites.
Swap platforms without impacting customer experience
Reduced time-to-market for future development
The dual-core setup of Drupal Commerce and Drupal CMS is a powerful combination that empowers Concept2’s non-technical resources, such as marketers and administrators, to build and maintain an unrivalled customer experience, propelling their online presence and maintaining leadership in their industry.
The third and final feature release of Drupal 10 ships with a new experimental Navigation user interface, stable Workspaces functionality, stable Single-Directory Components support, simplified menu editing, taxonomy moderation support, new recipe and access policy APIs and more.
The new Navigation module provides a redesigned collapsible, vertical navigation sidebar for the administrative user interface. Sub-menus open on a full height drawer that can accommodate deeper navigation levels. On smaller viewports, the toolbar is placed on top of the content, and opens with an overlay.
The Navigation module allows multiple types of customization, like adding new custom menus or changing the default Drupal logo provided. It also uses the Layout Builder module, so that site builders can easily add or reorder these menu blocks.
The Navigation module includes a new content creation and management menu, which allows quick access to content-related tasks to increase usability for content users.
The Workspaces module allows Drupal sites to have multiple work environments, enabling site owners to stage multiple content changes to be published all at once. It has long been available in Drupal core as an experimental module. Following the module's use in production sites, the remaining stable blocking issues have been resolved, so now it is available to all!
Workspaces are sets of content changes that are prepared and reviewed together. This is a differentiating feature for Drupal that is important for many large organizations' websites. An organization might use Workspaces to ensure all relevant content goes live simultaneously for a new product launch, or with the outcomes of sporting or election events.
Single-Directory Components (SDCs) are Drupal core’s implementation of a user interface components system. Within SDC, all files necessary to render the user interface component are grouped together in a single directory. This includes Twig, YAML, and optional CSS and JavaScript. SDC support was added to Drupal core in 10.1 as an experimental module. The solution has been very well-received and is now part of the base system. No need to enable a module to use this feature.
Menu item editing is now simplified. Advanced options are displayed in a sidebar to help content editors focus on what is most important for the menu item. Taxonomy terms also now have both a dedicated user interface to edit earlier revisions and content moderation support.
Drupal recipes allow the automation of Drupal module installation and configuration. Drupal recipes are easy to share, and can be composed from other Drupal recipes. For example, Drupal 10.3 includes a Standard recipe providing the same functionality as the Standard install profile. It is a combination of 16 component recipes that can be reused in other recipes.
Recipes provide similar functionality to install profiles but are more flexible. With install profiles only one can be installed on a site. With recipes, multiple recipes can be applied after each other.
Install profiles/distributions | Recipes | |
---|---|---|
Lock-in | Not possible to uninstall (until Drupal 10.3) | No lock-in |
Inheritance | Cannot extend other profiles or distributions | Can be based on other recipes |
Composability | Cannot install multiple profiles or distributions | Multiple recipes can be applied on the site and be the basis of another recipe |
The recently announced Starshot Initiative will rely heavily on recipes to provide composable features.
The added APIs include Configuration Actions, Configuration Checkpoints and Default Content.
Additionally, it is now possible to install Drupal without an install profile, or to uninstall an install profile after Drupal is already set up.
The new Access Policy API supports the implementation of access management solutions that go beyond permissions and user roles. Other conditions and contexts may be taken into account, like whether the user used two-factor authentication, or whether they reached a rate limit of an activity. Drupal's existing permission- and role-based access control has been converted to the new API, and custom or contributed projects can add more access policies.
Drupal 10.3 is the final feature release of Drupal 10. Drupal 11 is scheduled to be released the week of July 29th. With that, Drupal 10 goes into long-term support. While more minor releases will be made available of Drupal 10, they will not contain new features, only functionality backported to support security and a smoother upgrade to Drupal 11. Drupal 10's future minor releases will be supported until mid- to late 2026, when Drupal 12 is released and Drupal 11 enters long-term support.
Cristina Chumillas (at Lullabot), Sally Young (also at Lullabot) and Théodore Biadala (at Très Bien Tech) were all promoted from provisional to full Drupal Core Frontend Framework Managers.
Alex Pott (at Acro Commerce and Thunder), Adam Globus-Hoenich (at Acquia) and Jim Birch (at Kanopi Studios) are the maintainers of the new Default Content and Recipes subsystems.
Andrei Mateescu (at Tag1 Consulting) is the maintainer of the newly stable Workspaces module.
Ivan Berdinsky (at Skilld) became a co-maintainer of the Umami demo.
Daniel Veza (at PreviousNext) is a new co-maintainer of Layout Builder.
Mateu Aguiló Bosch (at Lullabot) and Pierre Dureau are new co-maintainers of the Theme API, focusing on Single-Directory Components.
If you are looking to make the leap from Drupal user to Drupal contributor, or you want to share resources with your team as part of their professional development, there are many opportunities to deepen your Drupal skill set and give back to the community. Check out the Drupal contributor guide, or join us at DrupalCon Barcelona and attend sessions, network, and enjoy mentorship for your first contributions.
2023 has been an eventful year, full of ideas, discussions and plans regarding innovation, where Drupal is heading, and, in our case, how the Drupal Association can best support. On top of that, you may have already heard, but innovation is a key goal for the Drupal Association.
Drupal is nothing but a big, decentralized, community. And before we can even think of how we can innovate, we need to understand how contribution actually happens and evolves in our ecosystem. And one of the things we agreed early on was that, without numbers, we don’t even know where we are going.
For that reason in 2024 we want to introduce you to part of the work we’ve been doing during the last part of 2023 to make sure that we know where we are coming from, we understand where we are going and how the changes we are doing are affecting (or not) the whole contribution ecosystem. I want to introduce you to the Contribution Health Dashboards (CHD).
The CH dashboards should help identify what stops or blocks people from contributing, uncover any friction, and if any problems are found, help to investigate and apply adequate remedies while we can as well measure those changes.
One thing to note is that the numbers we are showing next are based on the contribution credit system. The credit system has been very successful in standardizing and measuring contributions to Drupal. It also provides incentives to contribute to Drupal, and has raised interest from individuals and organizations.
Using the credit system to evaluate the contribution is not 100% perfect, and it could show some flaws and imperfections, but we are committed to review and improve those indicators regularly, and we think it’s the most accurate way to measure the way contribution happens in Drupal.
It must be noted as well that the data is hidden, deep, in the Drupal.org database. Extracting that data has proved a tedious task, and there are numbers and statistics that we would love to extract in the near future to validate further the steps we are taking. Again, future reviews of the work will happen during the next months while we continue helping contributors to continue innovating.
You can find the dashboards here, in the Contribution Health Dashboards, but keep reading next to understand the numbers better.
Jumping to what matters here, the numbers, one of the most important metrics to understand in the Drupal ecosystem is the number of contributions of both individuals and organisations.
As you can see, the number of individuals has stayed relatively stable, while their contribution has been more and more significant over the years (except for a slide in the first year of the pandemic). In a way this is telling us that once a user becomes a contributor, they stay for the long run. And, in my opinion, the numbers say that they stay actually very committed.
The number of organisations on the other hand displays a growing healthy trend. This shows that organisations are an important partner for Drupal and the Drupal Association, bringing a lot of value in the form of (but not just) contributors.
It definitely means that we need to continue supporting and listening to them. It’s actually a symbiotic relationship. These companies support and help moving forward, not just Drupal, but the whole concept of the Open Web. And their involvement doesn’t end up there, as their daily role in expanding the reach, the number of instances and customers of every size using Drupal is as well key.
In practical terms in 2023 we have been meeting different companies and organisations, and the plan is to continue listening and finding new ways to help their needs in 2024 and beyond. One of the things we are releasing soon is the list of priorities and strategic initiatives where your contributions, as individuals as well as organisations, are most meaningful. This is something I have been consistently asked for when meeting with those individuals and organisations, and I think it’s going to make a big difference unleashing innovation in Drupal. I recommend you to have a look at the blog post about the bounty program.
The next value we should be tracking is how first time users are interacting with our ecosystem.
While the previous numbers are encouraging, we have a healthy ecosystem of companies and a crowd of loyal individuals contributing to the project, making sure that we onboard and we make it easier and attractive for new generations to contribute to the project is the only possible way to ensure that this continues to be the case for many years to come.
That’s why we are looking at first time contributions, or said differently, how many users make a first contribution in their first 12 months from joining the project. During 2024 I would like to look deeper into this data, reveal contribution data further on time, like after 24 and 36 months. For now this will be a good lighthouse that we can use to improve the contribution process.
Although last year's numbers give us a nice feeling of success, we want to be cautious about them, and try to make sure that the trend of previous years of a slight decline does not continue.
That is the reason why my first priority during the first months of 2024 is to review the registration process and the next step for new users on their contribution journey. From the form they are presented, to the documentation we are facilitating, to the messages we are sending them in the weeks and months after.
The changes we make should be guided as well by the next important graph, which is the Time To First Contribution. In other words, the amount of time a new user has taken to make their first contribution to Drupal.
You’ll see that the Contribution Health Dashboards includes other data that I have not mentioned in this post. It does not mean that it is not equally important, but given the Drupal Association has a finite amount of resources, we consider that this is the data that we need to track closely to get a grasp of the health of our contribution system.
For now, have a look at the Contribution Health Dashboards to get a grasp of the rest of the information that we have collected. If you are curious about the numbers and maybe would like to give us a hand, please do not hesitate to send me a message at alex.moreno@association.drupal.org
As part of my role in the Drupal Association, we are trying to find new ways to unleash innovation. Innovation as it happens is a key goal for the Drupal Association. What surprised me when I started with the Drupal Association was to meet companies that were contributors, (some of them known for being long-time contributors) or that are very interested in contributing, but then not knowing how they could maximize their contributions or even where they should be contributing to.
I don’t think that these are a few isolated cases, as it’s not the first time I've seen this trend. Back when I was working for a 100+ developer consultancy firm there was a big corporate push to increase our contribution to open source. And contribute we did. We started “Pizza Fridays”, which meant we were spending Fridays contributing, doing presentations between us, and having pizza for lunch. We had fun, but we lacked structure, purpose, and higher goals (and a healthy diet on Fridays). Our plan was not aligned with anything other than our own appetite to experiment or learn something.
If we had a structure that aligned us to the project we were contributing to, our contributions would have been more impactful, business would have benefited in a more meaningful way, and the whole team would have probably been allowed to contribute even further and longer in time. We did amazing things, don’t get me wrong, but the impact of those could have been much bigger.
That’s why, today, we are introducing the credit bounty program. The idea is to do an initial experiment, and if it has an impact on Drupal moving forward, we’ll tweak it if needed and continue with new iterations.
I expect that the issues and projects that we are promoting will change over time, so we’ll share soon how you can get updated information.
If you are a maintainer and you would like us to include your issues in this pilot program, that may be a possibility as well, so please send me an email: tim@association.drupal.org. Depending on how this first phase goes, we may start promoting contributed module issues as well based on the popularity of the modules, usage on sites, complexity, how innovative they are, etc, etc
For now, this is the list of issues where (core for now) maintainers need your help. The reward will be a boost to marketplace rank equivalent to 5 times the normal amount for these issues. Sounds good?
Maintainers will grant credit as normal on these issues, and the contributing organizations that the maintainers credit will receive the full bounty
Make sure to read Drupal Core's Issue Etiquette for core contribution, and the Contributor Guide.
Have questions or ideas? Please ping Tim Lehnen(hestenet): tim@association.drupal.org
The second feature release of Drupal 10 improves content modeling, block management, menu and taxonomy organization, and permission administration. New options to sanitize file names make it possible to clean up the names of uploaded files, and media item revisions now have a dedicated user interface.
10.2 improves the user experience for managing several types of content:
A user interface has been added to show or hide each block based on the HTTP response status, so that specific blocks can be added or removed when the page is not found (404) or access is denied (403).
The functionality of one of the most popular contributed modules is now included in core! Replace whitespace in file names, transliterate text, convert to lowercase, and more.
The permissions page now comes with a filter on the top to make it easy to find the permission you planned to adjust.
Drupal 10.2 includes numerous performance improvements for content rendering and HTTP responses, as well as improved caching APIs.
PHP 8.3 was released three weeks ago, and Drupal 10.2 is already compatible with it.
Drupal core has started adopting PHP attributes, a modern PHP language feature, to provide better developer experience for plugin annotations. Contributed and custom code can begin adopting this improved API for their plugins, and Block and Action plugins can all be converted to the new API.
To help keep you up to date with project news, the Announcements Feed module became stable and is now installed by default with the standard profile.
The experimental Help topics module is now marked as deprecated and all functionality has been integrated into the core Help module.
Drupal 10.2 comes with a number of developer experience improvements:
PerformanceTestBase
was added to support automated testing of performance metrics with support to send OpenTelemetry traces to an open telemetry endpoint.DeprecationHelper::backwardsCompatibleCall()
method is available that helps write Drupal extensions that are compatible with multiple major versions at once.Drupal is built by an open source community of collaborators across geographies and organizations. Maintainers assess the work of the community and decide when it's ready to commit to Drupal core. After a period as a provisional committer, Dave Long (at Full Fat Things) was promoted to a full release manager. Kristiaan Van den Eynde (at Factorial) and Adam Bramley (at PreviousNext) have also become core subsystem maintainers. Thanks for stepping up!
If you are looking to make the leap from Drupal user to Drupal contributor, or you want to share resources with your team as part of their professional development, there are many opportunities to deepen your Drupal skill set and give back to the community. Check out the Drupal contributor guide, or join us at DrupalCon Portland and attend sessions, network, and enjoy mentorship for your first contributions.
Beginning with Drupal 10, a new Drupal major version will be released every two years in even years (2022, 2024, etc.). Each major version will receive active support for about two years, followed by maintenance support and security coverage for about two more years. Each is supported until two more major versions have been released.
This is an example. The exact schedule varies, and will be published on the Drupal core release schedule.
Drupal 11 will be released sometime in 2024. Like Drupal 9.0 and 10.0, Drupal 11.0 has three potential release windows, in June, August, and December. The window used will depend on when the beta requirements are complete. For more information, refer to the Drupal core release schedule.
Following the release of 10.2.0-beta1, changes to 11.x that diverge from Drupal 10 under the continuous upgrade path will begin. Anyone can get involved in completing the requirements for Drupal 11. Join the #d11readiness
channel in the Drupal community Slack.
Following the release of Drupal 11.0.0 in 2024, a long-term support phase for Drupal 10 begins, and it will include a new maintenance minor every six months. Each maintenance minor will contain a limited set of changes backported from Drupal 11. For more information, refer to the Drupal core release process overview.
Maintenance minor releases for Drupal 10 will keep adding support for newer PHP versions as they are released. The minimum supported PHP version for Drupal core follows the PHP core team's support cycle. (Reference: What does it mean for a PHP version to be supported?)
Site owners wishing to take advantage of Drupal 10's long-term support phase should ensure their platforms always use PHP versions supported by the PHP maintainers.
Announcement written in collaboration by Dave Long, Jess (xjm), Nathaniel Catchpole and Victoria Spagnolo.
Drupal 9 relies on several other software projects, including Symfony, CKEditor, and Twig. With Symfony 4's end of life, CKEditor 4's end of life, and Twig 2's end of life all coming up soon, Drupal 9 went end of life on November 1st, 2023. There will be no further releases of Drupal 9.
Two changes for Drupal contributed projects will occur before the end of January 2024. One is that the automated testing platform DrupalCI support for Drupal 9 will stop. The other is that release branches of contributed projects that only support Drupal 9 will be marked unsupported (see the tracking issue for details).
Thanks to everyone who helped create and maintain Drupal 9.
Check the documentation on updating a site to Drupal 10.
If a contributed project is not yet compatible with Drupal 10, now is a good time to update it. Check for existing Drupal 10 compatibility issues relevant for your projects.
If your project is already compatible with Drupal 10 but does not yet have a stable release, please tag a release, once you are confident in your project's stability. Where possible, tag a minor release supporting both Drupal 9 and 10 to ensure users have a smooth upgrade path.
The Drupal Association is saying goodbye to three board members and welcoming four new members who will join the Drupal Association Board.
First off, the Drupal Association extends a sincere thank you to Mike Herchel, Ryan Szrama, and Board Chair Baddý Sonja Breidert for their service and dedication not only to Drupal but to the Drupal community. Thank you for everything you have done while on the Drupal Association Board! Your time spent on the board made such a difference to the future of the Drupal project, and we thank you all for participating with grace, thoughtfulness, and insightful contributions.
We are also excited to announce that Baddý will continue as a non-voting Immediate Past Chair on the Executive Committee for one year.
The Drupal Association would now like to congratulate our newest board members, officially announced during the recent public board meeting at DrupalCon Lille:
An additional congratulations to Fei Lauren for winning the community-elected seat during our 2023 At-Large Board Election! We cannot wait to see what amazing things Fei will accomplish while on the Drupal Association Board. We invite you to get to know Fei and learn more about their background in our ‘Meet Fei Lauren’ blog post.
I am deeply honoured to have the support of so many brilliant people - and I can’t wait to see what we can accomplish together." - Fei Lauren
We extend our gratitude to all the candidates who participated in the 2023 election. On behalf of all the staff and board of the Drupal Association, a heartfelt Drupal Thanks to all of you who stood for the election this year. It truly is a big commitment to contribution, the Drupal Association, and to the community, and we are so grateful for all of your voices. Thank you for your willingness to serve, and we hope you’ll consider participating again in 2023!
There were 10 candidates in this year’s At-Large board member election.
477 voters cast their ballots out of a pool of 2,873 eligible voters.
Under Approval Voting, each voter can give a vote to one or more candidates. The final total of votes was as follows:
Candidate | Votes |
Fei Lauren | 156 |
Matthew Saunders | 144 |
Mark Dorison | 126 |
Vladimir Roudakov | 113 |
John Doyle | 107 |
Ashraf Abed | 104 |
Carlos Ospina | 101 |
Esaya Jokonya | 86 |
Stephen Mustgrave | 85 |
Brad Jones | 77 |
The Drupal project has announced that Drupal 7 will officially reach its End of Life on 5 January 2025. This date marks the 14-year anniversary since Drupal 7 was released on 5 January 2011. This will be the final extension of support for Drupal 7, meaning that after this date, if your site still runs on Drupal 7 it may become more susceptible to security vulnerabilities if no action is taken. Thus, it is recommended to migrate your site as soon as possible.
In order to assist Drupal 7 site owners in migrating their sites, we have established a resource center and encourages all site owners, support teams, and contractors to visit the site to learn about transition options. We’re here to support you in your Drupal 7 site migration!
The Drupal Association is working to get the word out to Drupal 7 site owners that support will be ending and to provide them with reliable information to make plans to transition their sites,” commented Tim Doyle, CEO of the Drupal Association, “Drupal 7 site owners have options, from graduating to Drupal 10 or looking at other open source CMS that might be more appropriate given their goals for their site.
If you are still maintaining a Drupal 7 site – now is the time to begin your migration plan from Drupal 7! The Drupal 7 End of Life page will be continuously updated with new resources as End of Life approaches, such as how to migrate and a list of migration partners.
For more technical information, refer to the Drupal 7 Security Advisory post.
Ongoing assistance is achievable due to the dedicated efforts of Drupal core maintainers, the Drupal Security Team, as well as the contributions from organizations and volunteers addressing Drupal 7 concerns. You can support the work of the Drupal Security Team by donating on their Security Team Donations page. Your support is valuable!
Stay tuned for even more resources that will help you during your migration process. We are confident that this resource page will make your Drupal 7 migration experience a breeze! Begin your migration journey now.
The Drupal Association is working to certify migration partners to help Drupal 7 site owners.
Certified Migration Partners will be promoted on Drupal.org, alongside a migration resource library, to any end users looking for help. Learn more about the Drupal 7 Certified Migration Partners program.
Follow us on Twitter, LinkedIn, and Instagram to also stay up to date on the latest Drupal 7 End of Life news.
Dries talked about our vision and strategy for Drupal 11 in DrupalCon Portland 2022. The vision Dries laid out was that we want to make Drupal the tool of choice for ambitious site builders on the open web. In order for us to accomplish this goal, we believe that Drupal needs to provide:
New features will be built in the current major version of Drupal. This means that components of this plan will be released gradually in Drupal core minor releases, not in a big bang with Drupal 11.
We have several ongoing initiatives, but we are doubling down our efforts on these three tracks:
Drupal is the most powerful digital experience platform when it is well-configured. We want more people to be able to leverage the power of Drupal. Therefore, our goal is to reduce the time and steps it takes to realize the full potential of Drupal.
We are working on:
Our goal is to make it easier for site builders to meet the requirements of content editors, who are accustomed to using flexible and easy-to-navigate tools. We will also evolve Drupal into the top choice for ambitious site builders and content creators who need advanced layout or landing page building features.
We are working on:
Keeping Drupal 10 sites up-to-date can be labor-intensive and require specialized knowledge to assess security releases and potential regressions caused by updates. Our commitment is to make the upkeep of Drupal and its modules less complex, risk-free, and affordable.
We are working on:
Moreover, we recognize that a significant number of Drupal sites are still on Drupal 7. The upgrade to Drupal 10 can be labor-intensive and requires specialized expertise.
We are working on:
We are excited about the road ahead as we are making Drupal the tool of choice for ambitious site builders on the open web. We invite you to join us on this journey, where your expertise, insights, and contributions are invaluable in shaping the future of Drupal.
Thank you to Gábor Hojtsy, catch, xjm, yoroy, Dries, and effulgentsia for their feedback on this post.
Did you miss our announcement at DrupalCon Pittsburgh? GitLab CI is now available for every project on Drupal.org. If you maintain a project you can now configure GitLab CI for all of your testing needs.
The Drupal Association and community contributors have created a default testing template that will help you get started, and should be automatically kept up to date with new versions of Drupal Core and its system requirements. But if you're a CI power user, you can customize the testing in any way you please.
In the short term, DrupalCI is still available so you can use the systems in parallel to make sure your GitLabCI setup is working for your project. But once it is working, we ask you to disable DrupalCI testing on your project to save testing resources.
Please read the documentation for getting started with GitLab CI.
The Drupal Association spends more than $10,000/month on testing infrastructure alone. If you would like to support our work you can donate, become a member, or become a partner.
This first feature release of Drupal 10 is packed with amazing improvements! It makes customizing the look of your site easier, adds support for decoupled navigation, improves content modeling and editing, block management, performance and many more.
Creating UI components with Drupal is easier and more enjoyable with the new experimental Single Directory Components module. The module bundles template, style, and JavaScript files together as components.
Twig template debugging and render caching settings are now exposed on an easy to use admin page. Plus the new add_class and set_attribute Twig filters were introduced to make markup manipulation easier.
Drupal is widely used as a building block in fully integrated decoupled applications. To make this even easier Drupal 10.1.0 has new APIs for retrieving menus configured in Drupal using the Linkset standard. This makes it easy for developers to provide non-developers the option to manage their menus!
Drupal 10.1 comes with various CKEditor improvements including an autoformat feature that recognizes when you are typing a list or a header and automatically formats it accordingly.
CKEditor 5 automatic formatting
For source code examples, the available language options are now customizable in the editor configuration.
Drupal 10.1 revamps the user interface to reuse existing fields to help site builders with making informed decisions when creating content models. When reusing an existing field, the field settings are now copied from the pre-existing field settings.
Improved field reuse experience
Text fields can now enforce a specific text format, making the user interface for content editors simpler.
Bulk operation forms now use a floating action bar to reduce the amount of space used when not needed, while still enabling an easy application of actions on multiple selected content items without the need to scroll.
New floating bulk operations bar at the bottom
A unified entity revision editing experience was added. This makes prior versions of content easier to manage regardless of whether they are in content blocks or nodes or other entities. This also makes it easy for developers to provide an experience that is inline with Drupal core for managing revisions in custom entity types.
From Drupal 10.1, you can now create custom blocks directly under Structure in the administrative interface. More granular permissions allow granting block management per type and revisions to block content can be reviewed and rolled back.
Adding administrative listings is now easier with a new option in Views to allow creating pages that use the administration theme regardless of their path.
BigPipe is a feature in Drupal that allows browsers to load some dynamic parts of the page after an initial page is loaded, which helps users receive information faster. From Drupal 10.1 BigPipe supports serving interface previews for delayed content, which makes the user experience much smoother with less page reflows.
BigPipe with a comment placeholder element reduces page reflows
Responsive images can now be lazy loaded with properly set width and height values for accuracy and oEmbed content can also be configured to be lazy loaded, not holding up the initial page load.
HTML pages and AJAX responses can now be served before dynamically processed JavaScript and CSS assets have been generated, leading to faster time to first byte on cache misses. JavaScript is minified on the fly out of the box reducing file sizes significantly, something which used to require build steps or contributed modules.
The request type used for making AJAX requests can be configured allowing certain dynamic requests to be cached using render and edge caching capabilities, enabling faster response times. Views AJAX pagers and filters are now utilizing this feature out of the box.
An elapsed time formatter was added that calculates the duration on the frontend and can be fully cached, significantly improving accuracy for end users as well as cache hit rates.
A new experimental Announcements module was added to Drupal core. This allows site administrators to get important announcements from the Drupal project on their Drupal site.
Drupal Nightwatch tests now include Axe Core accessibility scans. These scans check common pages and forms to help make sure core does not regress our accessibility achievements.
Since the release of Drupal 10.0, many changes have happened in the core committer team. While we said goodbye to product manager Angela Byron from the team, Lauri Eskola became a new product manager. Ben Mullins was promoted to full frontend framework manager and full accessibility topic maintainer. Theodore Biadala and Sally Young became full JavaScript package committers and provisional frontend framework managers. Victoria Spagnolo was promoted to full release manager.
Drupal 10.1 is also the first feature release since Drupal was approved as a Digital Public Good (DPG) by the Digital Public Good Alliance (DPGA). The goal of the DPGA is to promote Digital Public Goods in order to create a more equitable world and help attain the United Nation’s Sustainable Development Goals. DPGs represent an opportunity to enable countries to access cutting edge features, drive their own digital transformation processes, and grow their local ecosystems. As open source solutions, DPGs can be the basis for community building, knowledge sharing, and joint approaches.
For those updating to Drupal 10.1, further technical information is available in the release notes.
The Drupal Community Working Group (CWG) is excited to announce the release of an updated Code of Conduct for the Drupal community. It will take effect on July 1, 2023.
This new version is designed to reflect the growth of the Drupal community since the original Code of Conduct was adopted in 2010 and to help foster a safer, more inclusive, and harassment-free environment for everyone. While it retains the same basic structure as the previous document, much of the text was rewritten to make it easier to read. It also includes new elements inspired by other widely-used open source codes of conduct.
Some of the highlights of the updated Code of Conduct include:
The process of updating the Code of Conduct began in earnest in the summer of 2022, building upon community feedback gathered by the CWG since 2017. It was spearheaded by a subgroup of the CWG’s Community Health Team, who gathered feedback and shared drafts with a diverse group of stakeholders across our global community. A draft was then shared publicly with the community for additional feedback and revision. Finally, the document was reviewed and approved by the CWG’s Conflict Resolution Team and Review Panel. Additional details about the process was shared at the “How We Updated the Drupal Code of Conduct” session at the DrupalCon Pittsburgh Community Summit.
We would like to express our gratitude to everyone who contributed to the development of the updated Code of Conduct. Your input and dedication have been invaluable in creating a more inclusive and welcoming environment for all community members.
We encourage all community members to read and familiarize themselves with the updated Code of Conduct. Drupal.org users will also be alerted to the new language when it goes into effect July 1.
If you have any questions or concerns, please do not hesitate to file an issue in the CWG’s issue queue. If you would prefer to reach out privately, you can also send an email to drupal-cwg@drupal.org. Your feedback is always welcome as we continue to improve and adapt our Code of Conduct to the evolving needs of our community.
Thank you for being a part of the Drupal community, and for your commitment to making it a welcoming and inclusive place for everyone.
Thanks to 2129 contributors from 616 organizations resolving 4083 issues in the past two and a half years, Drupal 10.0.0 is available today! This new version sets Drupal up for continued stability and security for the longer term. All new features will be added to Drupal 10 going forward.
The new Olivero theme provides a modern look and feel. Olivero includes built-in support for multi-level menus and listings in responsive grids. The new administration theme, Claro, provides an accessible, clean interface for site management. The prior default themes Bartik and Seven are available as contributed projects if you wish to use them.
With CKEditor 4 reaching end of life at the end of 2023, it was time to upgrade. Thanks to a fantastic collaboration with its developers, Drupal 10 comes with CKEditor 5 built-in. The new version brings a modern editing experience with in-place controls and support for arbitrary input and output formats. Optional premium features are also available, such as live collaborative editing. An upgrade path is provided to move editor settings over and developer tools are available to help port any custom integrations. Read more in CKSource's very extensive blog post.
For now, CKEditor 4 is also available as a contributed project, so you can continue using that for Drupal 10 for now until its end of support.
Microsoft has ended support for Internet Explorer and so has Drupal. This allows Drupal themes to use modern solutions for user facing problems.
Views now supports a responsive grid display format. Instead of specifying the number of columns, and screen widths, users specify the maximum number of columns, the minimum grid cell width and the gutter spacing. When the grid cells resize to a point where they’re below the minimum width, the grid will reflow to have less columns. Alternatively, the grid will expand to fit in as many columns as permitted, while keeping the grid width above the minimum value. Dropping Internet Explorer 11 support enabled the addition of this feature.
Drupal 10 introduces a new command line tool to generate a standalone theme from a compatible base theme. We recommend using the tool to prevent breaking a sub-theme when the base theme changes. Runtime theme extension is still supported, but only advised if you have full control of the base theme (e.g. by creating it with the starterkit command).
Drupal 10.0 depends on the Symfony 6.2 framework, and later Drupal 10 minor versions will be updated to future minor versions of Symfony 6. This sets Drupal up with the latest version of the underlying platform.
As PHP 7 reached end of life on November 28, 2022, it was clear Drupal 10 must require at least PHP 8. Symfony 6.2 requires PHP 8.1 and choosing that version provides the best support timeline for Drupal 10 itself as well. PHP 8.2 is also fully supported.
The Quick Edit, Aggregator, HAL, RDF, and Color modules have been removed from core. They are available as contributed projects. This allows Drupal 10 to focus on the core strengths of the system.
Drupal 10.0.0 includes all of the features that were added to Drupal since 9.0, such as lazy image loading support for better frontend performance, WebP support in image styles, a dedicated Content Editor user role, "Manage permissions" tabs for entity bundles, and bundle classes on the PHP level for better code encapsulation, among many other improvements.
Thanks to the diligent work of the Drupal community on automated code update tools, porting events and dedicated work on key projects over the past two and a half years, Drupal 10 launches with almost three thousand compatible extensions, 26% more than how many Drupal 9 launched with.
All new features will be added to only Drupal 10 going forward. Several key improvements are already in the works as contributed projects. The Project Browser contributed project is now in beta and includes a Composer-based user interface to install contributed projects with all their dependencies. The Automatic Updates contributed project is already stable, allowing you to apply patch-level core updates to your site. (Experimental support is included for minor version updates and contributed project updates). The Recipes initiative is less far along but already has early versions of automation functionality to ship composable bundles of Drupal modules and configuration.
All of these are planned to be added to Drupal 10 core in the future and will help users find, keep up with and combine all the fantastic contributed projects the Drupal community is famous for.
Read the release notes for more information about platform requirements, removed modules and themes, dependency changes, etc.
Drupal 9 will reach end-of-life alongside two of its key components (Symfony 4 and CKEditor 4 on November 1, 2023). There is a small chance that a final security release of Drupal 9 could be issued between November 1 and November 30, 2023 if one of these dependencies chooses to do so as well.
Upgrades to Drupal 10 are supported from Drupal 9.4 and 9.5. However, Drupal 9.4 will no longer receive normal bugfixes. For continued bugfix support, Drupal 9 users should update to Drupal 9.5 now.
Drupal 9.4 and 9.5 will both receive security fixes until the release of 10.1 on June 21, 2023. After that date, Drupal 9.5 will be the only Drupal 9 version to receive security fixes until the November 2023 end-of-life.
Drupal 8 is end of life as of November 17, 2021. There is no direct upgrade path to Drupal 10 from Drupal 8, so you will need to first upgrade from Drupal 8 to Drupal 9. There are disclosed security issues with Drupal core that are not fixed in any Drupal 8 version, so if you have not yet upgraded to Drupal 9, do so as soon as possible.
Drupal 7 support was extended until January 5, 2025, and it will continue to receive limited bug and security fixes until that date. The migration path for Drupal 7 sites to Drupal 10 is stable. Choose which Drupal major version to update to based on your project timeline. Read more about the migration to Drupal 10.
Drupal 10 removes deprecated APIs. Use Upgrade Status on Drupal 9 to check your custom modules and themes for the changes needed. Upgrade Status will also give suggestions on automating the fixes.
Translators should check localize.drupal.org for any untranslated strings.
The fifth and final feature release of Drupal 9 brings a stable CKEditor 5 module, a command line theme generator and helps prepare for your update to Drupal 10. Bugfixes will be provided for Drupal 9.5 until June 2023 and security fixes will be provided until November 2023.
Drupal 9.5.0 is the only feature release of Drupal that includes both a stable CKEditor 4 integration (labeled as the "CKEditor" module) and stable CKEditor 5 integration (exposed as a separate "CKEditor 5" module). CKEditor 4 has been removed from Drupal 10 and moved to a contributed project. The support overlap in Drupal 9.5.0 allows users to move to CKEditor 5 ahead of their Drupal 10 upgrade. (Sites may also install the CKEditor contributed project before upgrading to Drupal 10, but should take note that its security support will still likely end in November 2023.)
The Starterkit theme is used as a basis to generate new standalone themes with the theme generator command line tool, rather than being extended at runtime like the Classy core base theme. Currently, the markup provided by the Starterkit theme is the same as Classy's, but its markup will be improved in future minor releases (whereas Classy's can't).
Drupal 9.5 deprecates numerous themes and modules that will no longer be a part of Drupal 10 core. Altogether the Bartik, Seven, Classy, and Stable themes have been deprecated, and the Aggregator, CKEditor (4), Color, HAL, Quick Edit, and RDF modules are all deprecated. (Some of these were initially deprecated in 9.4.)
It is safe to use the Drupal 9 core versions of these modules and themes for as long as a site is on Drupal 9. Before upgrading to Drupal 10, review the recommendations for deprecated modules and themes. Determine whether you actually need these modules or themes, or whether you can replace them with other solutions. Drupal 10 compatible versions are available as contributed projects. Drupal's Extend list, Appearance page, and Status report pages will all highlight these extensions if they are used. Upgrade Status will also notify you if you are using any deprecated extensions and helps to make a choice about whether you need them going forward.
Drupal 9 will reach end-of-life alongside two of its key components (Symfony 4 and CKEditor 4 on November 1, 2023. (There is a small chance that a final security release of Drupal 9 could be issued between November 1 and November 30, 2023 if one of these dependencies chooses to do so as well.)
Upgrades to Drupal 10 are supported from Drupal 9.4 and 9.5. However, Drupal 9.4 will no longer receive normal bugfixes. For continued bugfix support, Drupal 9 users should update to Drupal 9.5 now.
Drupal 9.4 and 9.5 will both receive security fixes until the release of 10.1 on June 21, 2023. After that date, Drupal 9.5 will be the only Drupal 9 version to receive security fixes until the November 2023 end-of-life.
Drupal 8 is end of life as of November 17, 2021. There is no direct upgrade path to Drupal 10 from Drupal 8, so you will need to first upgrade from Drupal 8 to Drupal 9. There are disclosed security issues with Drupal core that are not fixed in any Drupal 8 version, so if you have not yet upgraded to Drupal 9, do so as soon as possible.
Drupal 7 support was extended until November 1, 2023, and it will continue to receive bug and security fixes throughout this time. The migration path for Drupal 7 sites to Drupal 10 is stable. Choose which Drupal major version to update to based on your project timeline. Read more about the migration to Drupal 10.
Drupal 9.5.0 includes backward-compatible API additions for developers as well as new features.
Since minor releases are backward-compatible, modules, themes, and translations that supported Drupal 9.4.x and earlier will be compatible with 9.5.x as well. However, the new version does include some changes to strings, user interfaces, internal APIs and API deprecations. This means that some small updates may be required for your translations, modules and themes. Read the 9.5.0 release notes for a full list of changes that may affect your modules and themes.
Thank you to everyone who contributed to Drupal 9.5.0!
The client provides continuing education courses in civil, electrical geotechnical, mechanical, and structural engineering. Their goal is to provide quality continuing education courses at a great price. The client has approached us to migrate their outdated Drupal ecommerce site from Drupal 6.x version to Drupal 7.x.
Migrating a website from one platform to another can be a stressful and uncertain time if it is not carefully planned and well-executed. A good roadmap is necessary for upgrading the latest version within the CMS (Content Management System), for a smooth transition and minimal downtime. The goal was to deliver just the minimum viable project to meet scope/quality, concrete deliverables, deadline, and budget.
More than a decade after its first release, Drupal 7 is still widely used across the web. It can be found powering civic engagement in government installations; managing vast amounts of content for faculty, students, and staff in educational institutions; and providing the digital backbone for many businesses and non-profit organizations. Drupal 9 is well-maintained, secure, stable, and feature-rich, but many organizations still rely on Drupal 7.
The teams that built and still maintain these legacy Drupal installations, and the end users they serve, are important constituents of the Drupal community. Although these users should still plan their upgrade to a newer version of Drupal, if they are unable to upgrade before the currently announced end-of-life, it would not be responsible of us to leave them vulnerable.
Therefore, we are announcing that moving forward, the scheduled Drupal 7 End-of-Life date will be re-evaluated annually. As of today, we are extending the end-of-life by one year to November 1, 2023.
The Drupal project lead, Dries Buytaert, the Drupal Association, and the Drupal Security Working Group have been monitoring the Drupal 7 ecosystem since the previous end-of-life extension. As a majority of all sites in the Drupal project are still on Drupal 7, we have decided that there is a clear need to provide additional support to the members of our community still using this version. At the end of the day, we have a moral imperative to keep as many of those sites secure as we can.
We will announce by July 2023 whether we will extend Drupal 7 community support an additional year. Factors that we will consider are community support, Drupal 7 usage, and active Drupal 7 maintainers. Current support is made possible thanks to the many Drupal 7 maintainers and companies that are paying to support Drupal 7.
You can donate to the Drupal Security Team on our Donations page.
For press contacts, please email security-press@drupal.org.
The following people contributed to this public service announcement.
Michael Hess
Tim Lehnen
Greg Knaddison
Dries Buytaert
xjm
Gábor Hojtsy
Madison Atkins
If you’ve never been to a Drupal event before, you might not realize what all the fuss is about. But attending an event that gathers the community together to talk about Drupal for a few days is a priceless experience. And the thing is, it’s going to be better if you’re there!
My favorite part of Drupal events is the little interactions with people who have a common interest in Drupal but might use it in a completely different context and come from a completely different background. The Drupal community comprises designers, project managers, developers, translators, content and accessibility experts, and folks with other roles or who do Drupal as one of their many responsibilities. And all of you are welcome at DrupalCon!
You should especially come to Drupal if you’re new to the community. It might feel like a leap to go from trying a piece of software to attending a conference all about it. But if you count up all the hours you spend doing research, trying to find the right video to watch, and poking around at different modules, you’re guaranteed to get a much richer experience and a better understanding of Drupal’s open source ethos if you attend DrupalCon.
We especially want you to attend if you’re new! I attended my first DrupalCon as a new user, and while it was a lot of information to absorb, it shaped my understanding of the Drupal way and made me realize first-hand the benefits of an open source project that I would come to depend on in my professional life. Don’t worry, there are conference sessions, training, and social events designed specifically for newcomers to help break the ice and get you started.
If you’re trying to decide if DrupalCon is for you, I think DrupalCon is especially relevant for:
Here are some things to do before you go to DrupalCon to help you get the most out of the experience.
Install Drupal - If it’s your first DrupalCon and you’re relatively new to Drupal, I would recommend installing a sandbox Drupal before heading to DrupalCon. I spent my first DrupalCon jotting down modules to try out, and techniques to explore, and having a sandbox ready-to-go will make that experimentation much easier!
Join the Drupal Slack - If you’re already using Slack daily, this will give you a gateway to lots of conversations and expertise. And while you’re at DrupalCon, ask people which channels they belong to so you can continue those interesting conversations you start at the event!
Review the schedule - There’s so much great content at DrupalCon! Take a look at the sessions on offer in advance so you can scout out the most intriguing topics. Don’t ignore the “Birds of a Feather” more informal sessions. And keep in mind that great conversations are just as valuable as presentations.
Consider Contribution - If you’ve always been curious about the open source project, DrupalCon is a great way to see it in action. You can attend contribution events at the conference to get involved and see how you can help improve Drupal itself. Note that everyone is welcome to contribute, and I guarantee you that your skills are needed!
In conclusion, don’t feel intimidated if it’s your first DrupalCon. If you’re new to the Drupal community, we cannot wait to welcome you with open arms, and I hope to see you at DrupalCon Portland this year! Learn more and register now.
The third feature release of Drupal 9 introduces experimental support for CKEditor 5, makes the Olivero theme stable and introduces various content editor and developer improvements.
The new Olivero frontend theme was added in Drupal 9.1.0 and thanks to various contributors since then is now stable. A modern and clear theme, Olivero is planned to become the new default Drupal theme later (replacing Bartik). Subtheming Olivero is currently not supported, but formal support may be included in the future.
The theme is named after Rachel Olivero (1982-2019). She was the head of the organizational technology group at the National Federation of the Blind, a well-known accessibility expert, a Drupal community contributor, and a friend to many.
A new beta experimental CKEditor 5 module is included with Drupal 9.3.0. Version 5 of CKEditor is an entirely new editor with visual and architectural improvements. While building the integration, the team worked hard with CKSource to implement functionality crucial for Drupal sites, such as General HTML Support and ways to dynamically load CKEditor plugins, so the visual web based setup of the editor is still available in Drupal. Also special care was given to providing a fluid upgrade path from CKEditor 4 configurations.
Drupal extensions that integrate with CKEditor 4 still need to be updated for CKEditor 5, however the plan is to remove CKEditor 4 support in Drupal 10, so we encourage everyone to try the new module on non-production environments.
A new dedicated Content Editor role was added to the standard profile with content editing, media management, translation, content workflow and revision handling permissions enabled by default.
Entity bundles can now declare their own class, encapsulating the required business logic. A bundle class must be a subclass of the base entity class, such as \Drupal\node\Entity\Node
. Encapsulating all the required logic for each bundle into its own subclass opens up many possibilities for making more clear, simple, maintainable, and testable code.
Each user role now depends on the modules that provide the role's permissions, which means that permissions will be automatically cleaned up when a module is uninstalled.
PHP 8.1.0 was recently released and Drupal 9.3.0 comes with full support for the new version. The recommended PHP version to install Drupal 9.3.0 is PHP 8, but PHP 7.3+ support is kept.
Read the 9.3.0 release notes for more information on developer improvements and changes.
Update to 9.3.0 to continue receiving bug fixes and prepare for 10.0.0 (or 9.4.0). The next bug-fix release (9.3.1) is scheduled for January 5, 2022. (See the release schedule overview for more information.) As of this release, sites on Drupal 9.1 will no longer receive security coverage. (Drupal 9.2 will continue receiving security fixes until June 15, 2022.)
Updating your site from 9.2.10 to 9.3.0 with update.php
is exactly the same as updating from 9.2.9 to 9.2.10. Drupal 9.3.0 also has updates to several dependencies. Modules, themes, and translations may need updates for these and other changes in this minor release, so test the update carefully before updating your production site. Read the 9.3.0 release notes for a full list of changes that may affect your site.
Drupal 8 is end of life as of November 17, 2021. To continue receving security coverage upgrade from Drupal 8 to Drupal 9.2x at least as soon as possible to continue receiving security coverage. Upgrading is supported directly from 8.8.x and 8.9.x. 99% of the top 1000 most used drupal.org projects are updated for Drupal 9, so the modules and themes you rely on are most likely compatible.
Drupal 7 is supported until November 28, 2022, and will continue to receive bug and security fixes throughout this time. From November 2022 until at least November 2025, the Drupal 7 Vendor Extended Support program will be offered by vendors.
On the other hand, the migration path for Drupal 7 sites to Drupal 9 is stable. Read more about the migration to Drupal 9.
Minor releases like Drupal 9.3.0 include backwards-compatible API additions for developers as well as new features.
Since minor releases are backwards-compatible, modules, themes, and translations that supported Drupal 9.2.x and earlier will be compatible with 9.3.x as well. However, the new version does include some changes to strings, user interfaces, internal APIs and API deprecations. This means that some small updates may be required for your translations, modules, and themes. Read the 9.3.0 release notes for a full list of changes that may affect your modules and themes.
This release has further advanced the Drupal project and represents the efforts of hundreds of volunteers and contributors from various organizations. Thank you to everyone who contributed to Drupal 9.3.0!
As of November 17, 2021, the Drupal core version 8 series has reached end-of-life. This means that all releases of Drupal 8 core (with 8.y.x version numbers) and Drupal contributed project releases that are compatible with only Drupal 8 will be marked unsupported as they no longer have security team support.
Drupal 8.0.0 was first released on November 9, 2015. The last version was released on November 17, 2021.
All Drupal 8 site owners must upgrade to Drupal 9 to receive security updates and bug fixes. The Drupal Association will also disable testing with unsupported versions of Drupal.
Security issues that only affect Drupal 8 (and not Drupal 9 or Drupal 7) will be made public and sites are at risk of having these issues exploited if they do not upgrade.
Contributed projects like themes and modules will still receive security advisories if they are compatible with either Drupal 7 or 9 and have opted in to security coverage.
Drupal 7's end-of-life is currently scheduled for November of 2022, and it will receive security updates until then. Drupal 9's end-of-life is scheduled for November of 2023. For more information on release schedules, see the core release cycle overview.
The second feature release of Drupal 9 helps keep your site even more secure, and comes with increased visitor privacy protection, improved migration tools from Drupal 7, enhancements to the Olivero frontend theme and early support for the WebP image format.
Critical security advisories and public service announcements will now be displayed on the status report page and certain administration pages for the site's administrators. This helps prepare site owners to apply security fixes in a timely manner. For increased privacy protection of your site visitors, Drupal 9.2.0 now blocks Google Federated Learning of Cohorts (FLoC) cookie-less user tracking by default.
The Olivero theme, soon to be Drupal's new default frontend theme, has dozens of major improvements in this release, including a new form design and various accessibility fixes. The built-in Umami demo is now also more flexible with a built-in editor role and more versatile Layout Builder demonstration.
In preparation for Drupal 10, all Symfony 5 and and several Symfony 6 compatibility issues have been resolved. As part of modernizing the frontend of Drupal 9, core's Tour feature now uses ShepherdJS instead of jQuery Joyride. This significantly improves accessibility of tours and removes one more reliance on jQuery.
The already stable migration path from Drupal 7 is now expanded with migrations for user settings, node/user reference fields and other previously missing pieces.
Drupal's GD toolkit integration, and, therefore image styles, can now manage WebP images. There is more to do for complete WebP support. Stay tuned for improvements in future releases.
The upcoming core CKEditor 5 upgrade is being worked on in a contributed project. Progress has been made on various aspects of the roadmap, and the project is near to completing all issues identified as requirements for tagging a beta release. Core inclusion is expected in Drupal 9.3.0, but contributed projects are requested to build compatibility ahead of that.
The Automated Updates Initiative has been very active in the repositories under https://github.com/php-tuf building a PHP implementation of The Update Framework (TUF) with Typo3 and Joomla developers to provide signing and verification for secure PHP application updates. Results will be included with later Drupal releases.
Check out the initiative keynotes from DrupalCon North America 2021 on what else is in the works.
Drupal 9.0.x is now out of security coverage. Update at least to 9.1.x to continue to receive security support.
Update to at least 8.9.x to continue receiving bug fixes until Drupal 8's end of life in November 2021. The next bug-fix release (8.9.17) is scheduled for July 7, 2021. (See the release schedule overview for more information.) Versions of Drupal 8 before 8.9.x no longer receive security coverage.
With only five months left until the end of life of Drupal 8, we suggest that you upgrade from Drupal 8 to Drupal 9 as soon as possible. Upgrading is supported directly from 8.8.x and 8.9.x. Of the top 1000 most used drupal.org projects, 94% are updated for Drupal 9, so the modules and themes you rely on are most likely compatible.
Drupal 7 is supported until November 28, 2022, and will continue to receive bug and security fixes throughout this time. From November 2022 until at least November 2025, the Drupal 7 Vendor Extended Support program will be offered by vendors.
On the other hand, the migration path for Drupal 7 sites to Drupal 9 is stable. Read more about the migration to Drupal 9.
Minor releases like Drupal 9.2.0 include backwards-compatible API additions for developers as well as new features.
Since minor releases are backwards-compatible, modules, themes, and translations that supported Drupal 9.1.x and earlier will be compatible with 9.2.x as well. However, the new version does include some changes to strings, user interfaces, internal APIs and API deprecations. This means that some small updates may be required for your translations, modules, and themes. Read the 9.2.0 release notes for a full list of changes that may affect your modules and themes.
This release has further advanced the Drupal project and represents the efforts of hundreds of volunteers and contributors from various organizations. Thank you to everyone who contributed to Drupal 9.2.0!
This year’s DrupalCon North America 2021 keynotes highlight the power of the global Drupal community to make a difference in some of the most crucial issues of our time and the future of digital experiences. Register today.
The Drupal Association is planning a blockbuster event for DrupalCon North America, the most widely attended Drupal event, 12-16 April from 11:00 - 15:00 EDT daily. This year’s all-virtual event brings together Drupal experts, enthusiasts, end users, and the broader open source software community to connect, collaborate, and contribute to advancing Drupal - the world’s leading open source digital experience platform (DXP).
Heather Rocker, executive director of the Drupal Association states, “Our global community of developers, marketers, and business leaders come to DrupalCon to connect, learn about the experiences of their peers, and share their own expertise. DrupalCon participants also benefit from the opportunity to learn from our keynote and featured speakers. This year, those topics include the role of open source in schools to close the digital divide, the importance of allyship in developing diversity and inclusion, building successful mentorship for people of color in tech, and understanding digital rights as human rights.”
Sheree Atcheson, Global Diversity, Equity & Inclusion Leader
Allyship—the key to unlocking the power of diversity
Monday, 12 April 12:10-12:40 EDT
Atcheson, an industry-leading voice on diversity and inclusion in tech, will talk about the importance of intersectional allyship in creating inclusive environments and technology. She’ll offer tips on how everyone in any role can actively consider, champion, and advocate for others in their work and be more inclusive in their day-to-day lives.
Atcheson has been named one of the UK’s Most Influential Women in Tech and has received multiple international awards for her work to advance diversity and inclusion in the tech industry.
Dries Buytaert, Founder, Drupal
Driesnote
Wednesday, 14 April 12:30-13:50 EDT
A much-anticipated highlight of DrupalCon, Buytaert, Drupal’s founder, will deliver his annual talk celebrating Drupal successes over the past year, outlining the state of the Drupal project now, and offering his thoughts on what’s next.
Buytaert is the original creator and project lead for Drupal, an open source platform used around the world to build websites and digital experiences, as well as co-founder and chief technology officer of Acquia, a venture-backed technology company.
Stuart Keroff, Social Studies and Technology Teacher, Aspen Academy
School needs open source, now more than ever
Friday, 16 April 14:20-14:50 EDT
Technology educator Stuart Keroff, founder of the first two middle school Linux clubs in Minnesota, has spent the last 10 years guiding middle school students to use open source as a tool to close the digital divide in education. He and his students will share how they used open source software to recycle computers for their fellow students during COVID-19 school closures.
To date, he and his students have provided over 600 Linux computers, helping students learn while also saving money for their schools.
Decoupled Menus
Tuesday, 13 April
This initiative is focused on developing an easy-to-integrate solution for JavaScript front ends to consume configurable menus managed in Drupal—a key enhancement for developers. This is the first step in standardizing best practices for Decoupled Drupal.
Easy Out of the Box
Wednesday, 14 April
This initiative is designed to refine improvements introduced in the Drupal 9 release and enable new features that can make Drupal even easier to use.
Automated Updates
Thursday 15 April
This initiative is all about implementing a secure system for automatically deploying safe, secure updates for Drupal sites—a crucial enhancement for Drupal service providers and end users.
Drupal 10 Readiness
Friday, 16 April
This initiative is our effort to update and enhance the platform to enable a smooth, secure transition to Drupal 10, which launches in 2022.
Invest in your career, register today
The global pandemic has increased pressures around work-life integration, so DrupalCon 2021 is built with flexibility in mind. Each day is streamlined with 4 hours of live content, and the virtual setting allows easy participation in the featured keynotes, small group discussions, and interactive skill-building sessions most relevant to you.
Tickets are $245 per attendee and include access to all DrupalCon events, premiere access to the session recordings, as well as admission into the industry summits of your choice (higher education, healthcare, nonprofit, and government) held throughout April. Registration details, as well as additional speaker and session information, are available at https://events.drupal.org/northamerica2021
DrupalCon is brought to you by the Drupal Association in collaboration with a team of dedicated contributors and sponsors, including Diamond Sponsors Acquia, Pantheon, and Platform.sh.
On November 18th, 2020, the Drupal security team released security advisory SA-CORE-2020-012, a critical remote code execution vulnerability being patched in Drupal 7, 8, and 9. If you haven't read up on this issue, or the contrib advisories from the same day, I suggest you pause here and go take a look (and of course update your site(s)).
As always, the Drupal Security Team demonstrated their commitment and professionalism in helping all of us keep our Drupal sites more secure. But this post is not just to praise the security team, but also to report back on our first trial activation of the Drupal Steward program with a real security vulnerability.
As a reminder, the Drupal Steward program is operated jointly by the Drupal Association and the Drupal Security team, to offer protection for highly critical and mass exploitable vulnerabilities in the form of a web application firewall. This protection is offered directly by the Drupal Association to end-users, and also through our Founding Platform Partners: Acquia and Pantheon.
Drupal Steward doesn't change the site owner's responsibility to update their site. It does, however, provide a greater safety window and more flexibility for their team when scheduling the update.
In coordination with the Drupal Security Team, as well as our partners, we decided to use SA-CORE-2020-012 as our first live case for implementing this protection. This core issue was neither 'highly-critical' nor 'mass-exploitable' as the program is generally designed to protect, but because it was still a critical issue, it made a good test case.
We made a deliberate choice not to pre-advertise the protection for this first activation, because we wanted to thoroughly vet the process from end-to-end, before telling Steward customers to breathe easy when scheduling their update.
For future activations we will include a section in the PSA or SA published on Drupal.org, marked by the Drupal Steward logo, which indicates whether an upcoming security release will have this Drupal Steward coverage - giving all Drupal Steward customers the warning they need so they can responsibly schedule their site updates.
We're very pleased to say that this first program activation went very smoothly. Our coordination with Founding Partners, and our implementation of the firewall rules for the community tier went quickly and easily - and despite the short turn-around time, we were able to have protection coordinated in time for the disclosure of the issue.
If you follow Drupal security issues closely, you'll know that another Drupal security release occurred only about a week later. SA-CORE-2020-013 was released to mitigate a vulnerability in a third-party dependency of Drupal. This issue was not eligible for Drupal Steward coverage because it was a zero-day, that is, the vulnerability was already public and so there was no time to implement a preventative mitigation strategy.
You can learn more about Drupal Steward here and you can ask questions or set up a consultation here. Cost is usage-based, and we've tried to subsidize the cost as much as possible for our community site owners. For most small to medium-sized sites, coverage costs less than $200/year. Proceeds are allocated to support Drupal Association and Drupal Security Team programs.
PORTLAND, Ore. June 3, 2020—Drupal, the most powerful enterprise open source content management system, is launching the latest—and most comprehensive—upgrade to its popular software today.
Drupal 9 comes with even more of the cutting-edge features that Drupal developers and users love. One out of every 30 websites in the world including Lufthansa, the CDC National Prevention Information Network, the European Commission, Médecins Sans Frontières/Doctors Without Borders, NASA, GRAMMYs/Recording Academy and Stanford University trust Drupal as the platform for their ambitious digital experiences.
The updated version delivers powerful new features and an enhanced user experience. These features empower Drupal’s vision for the next generation of the web and include:
One of the key reasons Drupal has been successful is we have always made big, forward-looking changes,” says Dries Buytaert, founder and project lead of Drupal. “As a result, Drupal is one of very few CMS platforms that has stayed relevant for 20 years."
One of Drupal’s key users says they depend on Drupal’s easy-to-use interface to keep their content up-to-date—even when their developers aren’t immediately available.
In a case study about how the ACLU uses Drupal, the ACLU team says, "With Drupal's new capabilities to create and administer content, including robust media support ...[and] full layout control, without the aid of developers, ... [Drupal] empowered the ACLU to be more dynamic and responsive to external events."
While this new version makes it easier for non-developers to contribute to dynamic web platforms, it also continues to advance the underlying technology at the forefront of digital experiences—enabling developers to build the next generation of the web.
"Drupal's API-first architecture puts it years ahead of competitors as a decoupled or headless framework,” says Tim Lehnen, chief technology officer for the Drupal Association. “Drupal can serve as the content hub for rich experiences built with the latest technologies, including modern javascript frameworks like React, Angular, or Vue, or even with emerging channels like digital assistants and AR/VR applications."
Buytaert says a key focus was making the process of upgrading as easy as possible for its users.
"Drupal's innovation has only accelerated since the release of Drupal 8 four years ago,” says Buytaert. “Historically, major upgrades have been costly. With Drupal 9 we wanted to innovate quickly and provide an easy upgrade path from Drupal 8. We did exactly that! The upgrade from Drupal 8 to Drupal 9 is the easiest major upgrade in the last 10-plus years."
Drupal is a true open source project, leveraging the expertise of tens of thousands of developers around the world. Drupal has earned a reputation for security, performance, accessibility and scalability that is unparalleled in the CMS ecosystem. Drupal's core strength has always been its ability to manage structured data—written once, and reused anywhere—and the Drupal community has doubled down on this with Drupal 9.
If you’re ready to experience Drupal, discover how easy it is to build or integrate your digital portfolio by visiting drupal.org/9.
Need some help onboarding with Drupal or building a digital experience from scratch? There are many agencies in the Drupal community that would be happy to help.
Drupal is the open source content management software used by millions of people and organizations around the world, made possible by a community of 100,000-plus contributors and enabling more than 1.3 million users on Drupal.org. The Drupal Association is the non-profit organization dedicated to accelerating the Drupal software project, fostering the community, and supporting its growth.
###
For more information contact Heather Rocker, heather@association.drupal.org
FOR IMMEDIATE RELEASE
PORTLAND, Ore., May 11, 2020—The CDC, NIH, and Medecins Sans Frontieres/Doctors Without Borders—among many others—depend on the power of Drupal, the largest independent open source content management system, to keep their websites dynamic and secure. But the cancellation of the Drupal Association’s annual keystone fundraising event—originally scheduled for May 2020—put the nonprofit’s finances in jeopardy.
COVID-19 has delivered a particularly hard economic hit to non-profits, and the Drupal Association (DA) is no exception,” says Heather Rocker, executive director of the DA. “When we made the decision to cancel DrupalCon North America 2020 for the safety of our attendees, the next question was how to recover those funds so we could continue operations for our community of millions around the world.”
Enter #DrupalCares, a global fundraiser conceived with the hopes of bridging the significant funding gap left as a result of the pandemic. While the campaign had a strong start, what really put the fundraising into overdrive was the #DrupalCares match challenge, a $100,000 matching grant for individual contributions funded by Drupal creator Dries Buytaert and his wife Vanessa. Then a coalition of Drupal businesses came together to match those contributions again—bringing the potential impact up to $300,000. These contributions, together with the contributions from Drupal service providers and end-users, accelerated the campaign dramatically.
As of today, May 11, 2020, #DrupalCares has raised $500,000, meeting its 60-day goal in just over 30 days. Nearly 150 businesses and organizations, along with over 2,000 individual donors and members donated, to reach the goal in record time.
"I'm in awe of how quickly the Drupal community rallied to raise funds for the Drupal Association,” said Dries Buytaert, founder of Drupal. “With this fundraising campaign behind us, the Drupal Association can refocus on key initiatives such as the Drupal 9 launch next month.
“DrupalCon has been an important reason for Drupal's success,” said Buytaert. “Even though we'll be gathering virtually this summer, I'm very excited that DrupalCon will live on. I'd like to thank everyone who helped us reach our goals—the Drupal community is stronger than ever."
While the nonprofit Drupal Association was impacted by COVID-19, the Drupal ecosystem remains strong. As Buytaert wrote in March, open source software seems to be recession-proof.
“Open Source has grown to be more secure, more flexible, and more stable than ever before,” said Buytaert. “Today, the benefits of Open Source are even more compelling than during past recessions.”
Open source contribution also provides an excellent opportunity for individuals to expand their skills—or even re-skill—during this time of record unemployment. Drupal has demonstrated once again that the power of community and the open source model make projects like Drupal the best possible investment in uncertain times.
In addition to the #DrupalCares campaign, the majority of original DrupalCon 2020 sponsors allowed the Association to retain their sponsorship dollars as the event prepares to shift to its first-ever virtual DrupalCon Global 2020.
“Like so many organizations, we had to pivot quickly on a major keystone event, but we also had to pivot quickly on a product launch, as we were planning to introduce Drupal 9, our first major software upgrade in almost five years, at DrupalCon,” says Rocker. “DrupalCon was originally scheduled to host approximately 3,000 attendees in May 2020 in Minneapolis, so we didn’t have time for a ‘wait and see’ approach. I’m grateful to a solid, creative Association staff and the extended leadership of our Drupal community who are willing to do whatever it takes to make this event a success.”
“Additionally, Drupal 9 is scheduled to launch on schedule in early June, which is a testament to how dedicated this community is to continuing to be trailblazers—even now, when a delay caused by these world events would have been no surprise,” said Rocker.
The #DrupalCares fundraising campaign remains active through May 31, 2020. To learn more about Drupal or make a donation, visit www.Drupal.org.
About Drupal and the Drupal Association
Drupal is the open source content management software behind millions of websites and applications, boasting a community of 46,000-plus developers and more than 1.3 million users on Drupal.org. The Drupal Association is the non-profit organization dedicated to accelerating the Drupal software project, fostering the community, and supporting its growth.
###
For more information contact Heather Rocker, heather@association.drupal.org
Pekens Antoine (pekens, pictured here) was doing research on content management systems while running a digital marketing agency, and was exploring Drupal, which he viewed as a “well-thought-out system being developed by a lot of smart people,” and with that he “wasn’t sure if a contribution from myself could make a difference.”
But Drupal and its community held his interest, and in 2018, he attended his first Drupal event—DrupalCon Nashville. He went on to participate in two Drupal Camps as well thus far. It’s been these in-person experiences that left a lasting impression.
“It’s a great feeling to walk up to the maintainer of a project you use every single day and ask them a question,” he says.
This feeling was amplified at the New Jersey Drupal Camp afterparty earlier this year, when he met people and they all spontaneously opened up their computers and worked on a Drupal Core issue that had come up in conversation.
“I realized that I could probably learn a lot about Drupal from the people at the table,” [who he offers a ‘shout out’ to: @traviscarden, @bnjmnm, @tedbow, and @jrockowitz], “and I wanted to do more than build sites with Drupal—I wanted to help build Drupal. They were kind enough to show me their process.
Travis Carden notes: “What I thought was particularly compelling about his story was the fact that he didn't previously view himself as a potential Drupal contributor. He said, ‘I would like to someday be able to contribute.’ But he was eagerly received by the group of us.”
Their conversation continued on Slack:
Travis Carden I don't know if you already saw it or not, but your Drupal core patch got committed the same night: https://www.drupal.org/project/drupal/issues/3110525 It now appears on your profile: https://www.drupal.org/u/pekens Congratulations, and welcome to the ranks of Core contributors! 😀
Pekens Antoine Thanks Travis! It feels good, even if I’m just a typo fixer for now 😆. Gotta start somewhere. I really appreciated you guys taking the time to share some knowledge! 🙏
Carden said the whole process happened quickly: “He went from zero to contributor in about half an hour with commit credit the same day.”
Now Antoine has plans to continue his contribution, keeping those like himself in mind. “Using Drupal on a daily basis allows me to have some insight that new Drupal users may not have. I often forget that. There’s always something that you can teach or share, even if you only know a little bit. I’ll be keeping an eye out for opportunities to share and collaborate more on Drupal projects in the future.”
Antoine reflects on the overall meaning of both choosing Drupal and becoming a Drupal contributor: “Trying to understand every single piece of code for any project its size is impossible to do overnight. The Drupal community understands this. We’re able to grow individually and collectively by sharing and collaborating on the pieces we do understand.”
Today, we're launching a membership drive. You can help by sharing our message and showing your support.
Help grow membership by visiting our campaign page and sharing with your network. We're supporting the global Drupal project and community with your help! Together, we make the open source community stronger.
Active members can download a personalized certificate now, and one way to contribute to this membership drive is to print out your certificate (or display it on a screen) and share your selfie with us. Tag with #joinDrupalAssoc #OpenSource, #supportOpenSource to show you care.
Our heartfelt thanks to you—members and supporters—for contributing and participating as individuals and organizations.
Ready to help? Share a post like this or craft your own.