If you ever translated Drupal software, you used the Translation Template Extractor (potx) at least indirectly, even if you never heard of it. It reads the source code of Drupal core and contributed projects, and collects the translatable strings. Every string translated on localize.drupal.org was extracted by potx. Developers and translators also use it to extract strings of their own modules and themes, on a web UI or with Drush.
Gábor Hojtsy Wed, 10/14/2026 - 10:17An editor copies a link from an email, adds it to a page, and publishes. The link text looks right. The destination opens. Nothing about the normal authoring workflow suggests a problem.
But the saved URL may not be the destination the editor intended to publish. Microsoft Safe Links can wrap an address in a long, encoded URL that sends visitors through a security-checking redirect service.
On of our client’s websites, a custom Editoria11y check helps editors recognize these links and replace them with the original destination. It adds site-specific guidance to a tool already used for accessibility feedback.
A Content Problem Worth FlaggingMicrosoft Safe Links is a legitimate security feature, not evidence that a link is spam or malicious. The problem here was context: a URL copied from an email was becoming a public website link.
A simplified example looks like this:
<https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fexample.com%2Fmeeting>The intended destination is https://example.com/meeting. Publishing the wrapper makes that destination harder to inspect and introduces dependence on another redirect service. The addresses can also be difficult to read and maintain.
Those are good reasons for an editorial warning. They are not proof that every Safe Link violates WCAG or cannot be used with a screen reader.
The useful question was narrower: could the website identify this recurring content pattern and give editors a practical next step?
Discovering an Existing Extension PointEditoria11y brings accessibility feedback into the page context. Its custom-test capability lets developers add checks beyond the standard set without building a separate reporting interface.
Princeton's documentation includes an example for email-obfuscated URLs, providing a starting point for both detection and integration. The extension builds on that existing capability rather than introducing a separate checking system.
A Small Drupal IntegrationThe custom module, custom_editoria11y, handles the Drupal integration. Its metadata declares a dependency on Editoria11y. A library definition registers the custom JavaScript and depends on the contrib module's library.
The PHP attachment hook checks for the view editoria11y checker permission before attaching that library. This keeps the extra script scoped to users authorized to use the checker rather than delivering it to public visitors.
JavaScript handles detection and feedback. Although we might informally call this a custom rule or plugin, it is not a Drupal PHP Plugin API class. It is an event-driven JavaScript test delivered through a Drupal module.
That division keeps the implementation small: Drupal controls availability, the custom script identifies the content pattern, and Editoria11y provides the warning interface.
How the Custom Test RunsEditoria11y's custom-test lifecycle has four steps: register the expected callbacks, listen for ed11yRunCustomTests, add results, and dispatch ed11yResume when finished.
Our script increments options.customTests through the Drupal integration's options override. That tells the checker to wait for one additional completion event before drawing its tooltips.
The count represents completing test callbacks, not matching links. A callback that finds ten links still sends one completion event. A callback that finds none must finish too.
The rule searches for anchors using a[href*="safelinks.protection.outlook.com"]. This catches different Safe Links subdomains without maintaining a list of regional prefixes. It is substring matching, however, not comprehensive URL-host validation; the same text elsewhere in an address could also match.
The following excerpt shows the site's v3 integration. It assumes the options override and tooltip helper are already defined:
document.addEventListener('ed11yRunCustomTests', function () { Drupal.Ed11y.findElements( 'customSafeLinks', 'a[href*="safelinks.protection.outlook.com"]' ); Drupal.Ed11y.elements.customSafeLinks?.forEach(function (element) { Drupal.Ed11y.State.results.push({ element, test: 'customSafeLink', type: 'warning', content: customSafeLinkContent(element.getAttribute('href')), position: 'beforebegin', dismiss: false, }); }); document.dispatchEvent(new CustomEvent('ed11yResume')); });Using findElements keeps the search within the configured content roots and respects selector-based exclusions. Results enter the existing checker workflow rather than a separate alert system.
The tooltip names the issue, displays the encoded address, and asks the editor to replace it with the original URL. When available, new URL(href).searchParams.get('url') extracts the destination as an additional hint. If parsing fails or the parameter is missing, that hint is omitted.
Displayed URL strings are sanitized with Drupal.Ed11y.sanitizeHTML. In this v3 implementation, tooltip content is a DOM element, with a .title child supplying its heading.
The rule does not rewrite content or block publication. The editor remains responsible for checking and replacing the link.
Maintaining the Rule Through an UpgradeAn upgrade from Editoria11y 2.2.6 to 3.0.2 required migrating the custom module to the v3 API.
The migration changed more than a version constraint. The custom code moved from older Ed11y references to Drupal.Ed11y, changed the sanitization helper, and pushed results into Drupal.Ed11y.State.results. Tooltip construction moved from the older message-registration approach and HTML strings to DOM-element content. Result properties also changed, including explicit warning severity and the dismissal setting.
The lesson is practical: extending a supported tool avoids owning an entire checker, but the extension still has an API contract. Major upgrades require reviewing that contract and testing the custom feedback, not just confirming that the base module loads.
Testing and Extending ThoughtfullyFor ongoing maintenance, a focused regression checklist should cover matching and ordinary links, missing destination parameters, configured exclusions, permission boundaries, safe tooltip rendering, and completion events when no matches exist.
Additional checks could flag obsolete internal domains or temporary campaign URLs. Those are possibilities, not features delivered in this project. Each proposed rule should have a recognizable problem, a clear correction, and a manageable risk of false positives.
Multiple extensions also need to coordinate the shared options override rather than replace one another's callbacks. The expected completion count must stay aligned with the listeners actually running.
Princeton's custom-test documentation is a useful starting point. Check examples against the installed version, especially when maintaining an older integration.
Give Editors an Actionable Next StepThe value of this extension is specific feedback at the point where someone can act on it. Instead of asking editors to remember every problematic URL pattern, the website identifies one and explains what to change.
Custom tests can support content standards alongside accessibility checks. They do not replace human review or establish accessibility compliance. They make the existing editorial workflow more useful, one well-defined problem at a time.
Philip StierCommenting in Drupal hasn't noticeably changed in 15 years. That changes now.
Dev CornerI’ve watched a lot of Driesnotes. A lot. Goodness me, I don’t even know how many.
Over the last few years, and I promise to find out exactly how many, Dries has had a lot of help with the design of them from an awesome designer at Acquia who I just have to shout about - ASH.
(yes, absolutely go give the shout outs!!)
Rachel Tue, 10/13/2026 - 11:49 TagsThere will be a Drupal core security release for all supported branches on October 14, 2026 between 16:00 and 21:00 UTC. (To see this in your local timezone, refer to the Drupal Core Calendar.) Based on our analysis this vulnerability rates at 19/25 on our risk calculator.
The Drupal Security Team urges you to reserve time for core updates at that time because exploits might be developed within hours or days.
We recommend updating to the latest supported patch (bugfix) release for your site's version of Drupal before October 14, so that you can address any other upgrade issues before the security window.
This issue is being protected by Drupal Steward. Sites that use Drupal Steward are already protected from some known attack vectors, but the protection offered will not cover all possible exploits. Sites should upgrade in the near future in case additional attack vectors are discovered.
Affected versionsAll currently supported versions of Drupal core are affected, including:
Drupal 12.0.0-beta1 is also affected. New beta releases will be provided following the security updates for the supported branches.
All versions of Drupal prior to 10.6.x, as well as all versions of Drupal 11 prior to 11.3.x, are end-of-life and no longer supported. Sites on those versions should update as soon as possible to avoid this and other publicly disclosed vulnerabilities.
Disclosure policyNeither the Security Team nor any other party is able to release any more information about this vulnerability until the announcement is made. Security release announcements will appear on the Drupal.org security advisory page, which has RSS feeds. The announcement will also be made public on:
Questions about the pace of advanced artificial intelligence are no longer confined to the research teams building it. Former OpenAI safety leader David Robinson described his decision to leave the company in a 3 October essay for The Atlantic, challenging the assumption that developers can release increasingly capable systems and address risks as they emerge. Former Anthropic researcher Jacob Coxon had raised concerns about competition between AI laboratories in a September interview with WIRED. Their warnings point to a conflict between the speed of development and the time required to evaluate its consequences. Neither departure demonstrates that the industry has actually slowed down.
That tension has reached public hearings and internal disputes. At a 5 October hearing, New York City Council members questioned representatives of major AI companies and heard testimony from former researchers at Anthropic, OpenAI and Google DeepMind. Three other former OpenAI safety researchers, Jasmine Wang, Tomek Korbak and Mikita Balesni, subsequently disputed the company's stated grounds for their dismissal. They warned that uncertainty over acceptable contact with external evaluators could discourage scrutiny. OpenAI rejected the suggestion that they had been dismissed for raising safety concerns and said its policies on sensitive information had been breached. The underlying dispute remains unresolved.
Public oversight offers a possible route beyond those competing accounts, but proposals must be distinguished from protections already in force. New York City lawmakers have discussed third-party validation, reporting and protections for people who flag risks. These measures would need to be enacted and implemented before their practical effect could be assessed. Independent evaluation also raises a harder question than whether a company publishes safety reports: who receives the findings, who can challenge the evidence and who has the authority to require a change before deployment? A review process may identify dangers without having the power to alter a release decision.
These questions extend beyond arguments about catastrophic AI scenarios. Organisations that develop or operate software routinely face uncertainty, conflicting incentives and decisions that affect people outside their own teams. Open-source communities confront some of those problems through public issue histories, reviews and shared maintenance, although those processes are not substitutes for the legal and institutional oversight proposed for advanced AI. What matters is whether concerns can move from warnings to decisions, with clear accountability when evidence is contested. The question is not only whether someone is willing to say that development should slow, but whether anyone outside the organisation can make that warning count.
Follow The DropTimes on LinkedIn, X, Bluesky, and Facebook, or join #thedroptimes on Drupal Slack.
Kazima Abbas wrote and curated this issue of Editor’s Pick.
Running with scissors: Using AI to explore, build, maintain, contribute, and secure Drupal" is the title of my DrupalCon Orlando session proposal. I've been using and writing about AI as a Drupal developer for the past year, and I look forward to sharing my experience with fellow Drupalers at the conference. There is so much discussion about AI and Drupal, and I'd like your help with my DrupalCon session proposal.
We should assume most session proposals will focus on AI inside and outside Drupal from the perspective of site owners and builders. Meanwhile, if we want to encourage people to try Drupal, we also need to sell it to developers. My goal is to sell "using AI to explore, build, maintain, contribute, and secure Drupal" to developers and vibe coders, while acknowledging the challenges and risks by comparing how fast we've had to adopt AI to "running with scissors."
Running with scissors
I first heard the expression "Running with scissors" in the title of Augusten Burroughs' memoir. I enjoyed reading that book, and now I am listening to the audiobook while working on this blog post. A subtle takeaway from the memoir is that sometimes you may find yourself "running with scissors' involuntarily (or voluntarily), and you have to decide how to handle that scenario.
Related to AI, "running with scissors" captures the extremely fast, collectively exceptional pace we're in: a remarkably massive societal shift, comparable to the Industrial Revolution, is unfolding. The Industrial Revolution took decades to unfold, whereas the AI Revolution is unfolding in a few years, especially among software developers.
The AI Revolution is probably the right term, and it could foreshadow AI winning the revolution, leading to humankind's demise. BTW, this won't be the focus of my session...Read More
With version 1.0.0-beta1, released on 12 October 2026, AI Disclosure, the module I created on drupal.org within the Drupal AI Initiative, labels images, video and audio as well as text. Here I start from the image, the most common case: what it carries when it comes out of a generator, what is left of it when a Drupal site publishes it, and how the beta1 follows it from upload all the way to the person looking at it. When a label is mandatory is explained in the article on Article 50(4) of the AI Act in Drupal. A synthetic image can carry up to four provenance signals, and whoever built the generator adds them at the moment the file is created. The first is an invisible watermark, hidden in the pixels: the eye misses it, the provider's detector recognises it.
Importing content with the Default Content module is really useful when populating a site with content. There's an increasing number of recipes and modules that can be used to populate a site with content either for setup or demonstration purposes.
Default content is really useful when figuring out how a system works as it can show relationships between content types that are not always simple to discern through the site itself. It also has a place when deploying content between sites as you can package up some default content and include that in a deployment step.
Occasionally, you'll want to tweak the content that is imported for different situations; with the reasons why you would want to do this being numerous. It might just be that you have a demo site and you wanted to tweak the content imported to better tailor it for the user. You could have a single recipe that contains the content and want to alter that for a specific demo.
I needed to do this selected default content import on a recent site as I was installing. A contributed module was used to populate the site with content to create a collection of examples. Although the content was good, I didn't want to import it all as some of it didn't make sense for a couple of scenario that I was looking at. That lead me to seeing if I could alter the content automatically as it was imported into the site, rather than manually delete content after the fact.
In this article we will look at some of the actions I tried to prevent content from being imported, before moving onto what the actual solution was. If you are following along at home, it is assumed that you already have a default content process setup and are just looking for change what content is imported without altering the source files.
This is a cross-post of a blog by Nathaniel Catchpole, Senior Performance Engineer and Technical Lead at Tag1
At DrupalCon Vienna, Tim Lehnen presented on the main costs for running Drupal.org. Around 50% of the total cost of running drupal.org, or approximately $1.5m, is infrastructure costs. A significant slice of infrastructure costs comes from drupal.org's self-hosted GitLab, and in turn much of that cost is due to GitLab CI for Drupal core and contributed modules.
Figure 1: Drupal Engineering activities compared to the various funding sources
Drupal core is the single biggest project in terms of CI minutes, both due to the sheer number of tests as well as the level of activity in Drupal core issues, with hundreds of commits per month and activity on thousands of issues and Merge Requests ("MRs").
Figure 2: Drupal CI minutes by project, July 2026, core issue forks are treated as separate projects
Since Drupal originally moved to Gitlab CI from our previous Jenkins-based CI infrastructure in 2023, we've been working on reducing the time taken for Drupal core test runs.
The primary end goal of this work was to reduce the wall time for pipelines on MRs. These started at around 55 minutes when we originally moved to Gitlab CI (approximately the same as they were on Drupal CI), and now generally finish in 5-7 minutes. The 55 minute runtimes already relied on previous known optimizations like using a ramdisk for both the database and filesystem, applied to GitLab runners. GitLab does not support this out of the box.
Five minute turnaround times on pipelines have made a huge difference to Drupal core velocity. Whereas core contributors used to push to a branch, then go and eat lunch or dinner while waiting for the pipeline to finish, there's now barely enough time to make a cup of coffee, let alone drink it.
Figure 3: Contributors recognizing and commenting on the time improvement of waiting for the pipeline to finish
However, the bulk of the initial gains we made to core CI pipeline performance was in wall time, with much less impact on CPU minutes. This is now starting to change, as we're finding ways to reduce the CPU minutes while also keeping wall times as short as possible.
Reducing Pipeline Wall TimesWe reduced pipeline wall times via the following approaches.
Concurrent Test Running and Parallel CI JobsDrupal's run-tests.sh has supported running tests concurrently for a long time. We added support for Gitlab's parallel test runs, splitting test groups with thousands of tests into smaller groups so that they can be run on multiple test runners at once. For example Drupal's functional test group is executed in 8 parallel jobs, at 15 concurrency, with a CPU request of 10 per job. This runs 150 test classes at a time on 100 CPUs. By running smaller sized individual jobs, there is also a higher chance of them fitting into test runners that become available rather than requiring a new AWS instance to be spun up.
Slowest Tests Run FirstTests are always run slowest first. Drupal's test runner has supported a #slow group for a long time, so that very slow tests can be run first. We now also order tests by the number of methods, so that tests with more methods, which overall tend to be slower, run first too. This is critical for other optimizations to be effective. If a single class takes three minutes to run, starting it at the beginning when the rest of the tests can also be completed in three minutes means the entire test run can be finished in three minutes. But if that job started last, the job could take six minutes, with just that one test being run for half the time, leading to slower wall times and idle CPUs.
Optimize or Split Up the Very Slowest TestsIn some cases we have had individual test classes that took more than 10 minutes to run. For these very slow running tests, we've split them into smaller test classes so that they can be run in parallel, and/or optimized the test set-up requirements so that no individual test takes longer than a full run.
Reducing CPU Time for Test PipelinesWith these techniques, we've been able to balance CPU requests and concurrency across the various core test types, so that every job finishes within approximately 3-4 minutes. This has given us a solid framework for keeping pipeline wall times to a minimum while allowing us to adjust CPU requests and concurrency for individual test types to match the scope of core's overall test coverage. As far as we know there are no longer obvious optimizations to make via tweaking concurrency and test running order.
While we've been working on optimizing the tests themselves, in recent months focus is increasingly shifting in that direction as the best way to further optimize test runtimes, but more importantly, reduce CI minutes and the resulting infrastructure cost for the Drupal Association overall.
Test TypesDrupal core started with only one type of test: SimpleTest 'functional tests' that require a full Drupal install into a separate site that the tests are then run against. Over time with the adoption of PHPUnit, we've added unit tests, 'kernel tests' which include a full dependency injection container but don't do a full install, functional JavaScript tests which use a real browser, and build tests which allow creation of a completely separate code base in its own directory. There is an ongoing effort to convert functional tests to kernel and unit tests where this can be done without losing test coverage, with the recent addition of http request testing to kernel tests making many more tests eligible. Converting a functional test to a kernel test can reduce the time it takes by 3/4, so for the tests where this is possible it's one of the most effective ways to make gains, although the conversions have to happen test by test across dozens or hundreds of test classes.
Over the past couple of years there has been a concerted effort to improve Drupal core performance. Many runtime performance improvements don't necessarily make a lot of difference to test runtimes as a whole. But because functional and functional JavaScript tests install a full Drupal site and request real pages, anything which improves installer or cold cache performance tends to have an outsized effect on test runs. Installer performance generally doesn't affect production sites (because they're already installed!) and cold cache performance is often not a priority for production sites because it tends to affect a low percentage of overall requests, however as well as CI times, it can also make huge differences to the user experience for new users as well as improving responsiveness after deployments and cache clears.
Installer Improvements for Functional TestsIn 11.2.0, we changed module install to support installing multiple modules at once without a separate dependency injection container rebuild between each module. Instead of doing 50 or 60 container rebuilds during an install, we do more like 11 or 12. This took tens of seconds off Drupal installs, whether via the UI, Drush, or during test runs.
Figure 4: Installing multiple modules in Drupal 11.2
Source: Figure 4: Installing multiple modules in Drupal 11.2.
In Drupal 11.4, we made container rebuilds during the installer more conditional, reducing container rebuilds during a functional test from 11 to 8.
Recently, I've been looking at whether it would be possible to reduce the 8 remaining container rebuilds further, without necessarily an expectation that there would be much room for improvement, and found some. With all of those changes, some of which are not committed yet, we should be able to get down to an absolute minimum of 2 container rebuilds in tests. While some of the optimizations are test-specific, a real-life Drupal install of the minimal profile takes less than 2 seconds.
This investigation also uncovered further possible performance improvements in the installer.
While the combination of these changes probably saves only around 5 seconds at most from an install during a test run, this saving is multiplied by every install that occurs, with thousands of Drupal installs on every test run, this adds up to several minutes of CI time.
This has already allowed us to reduce the total CPU request for functional tests from 128 to 80 with no increase in wall time. We expect to be able to reduce the CPU request for both functional and functional JavaScript tests further once more optimizations land.
Kernel Test Performance ImprovementsKernel tests in general run much faster than functional tests, however there is still a per-method overhead which is a lot higher than unit tests. We are looking at adding an option to kernel tests to share the database state between test methods which will remove a lot of that overhead. This in turn will allow us to re-use the dependency injection container between methods. As we move functional tests to kernel tests, this should increase the impact of that change on resource usage even more.
Re-Evaluating On-Commit PipelinesDrupal core has daily, weekly, and on-commit jobs on its branches, as well as those that run on individual MRs. In looking at the information we get from those jobs, we realised that the on-commit jobs, which on average run several times per day, and run the full test suite against multiple different database types (Mysql, MariaDB, SQlite, PostgreSQL) don't necessarily give us information that we can't otherwise get from MR, daily and weekly runs. For release branches, we need immediate post-commit feedback in case something is unexpectedly broken, which sometimes happens when two independent commits are fine individually, don't have merge conflicts, but break when combined anyway. However, we're in the process of trialling running our development branches without on-commit pipelines whatsoever. This should reduce CI minutes for core purely via running pipelines less often, on top of the in-pipeline optimizations above.
Reducing Wall Time for Contrib CI RunsWhile individual contrib projects are not the biggest user of CI minutes, there are thousands of contributed projects. Several of the performance optimizations for the installer, functional tests, and kernel tests will apply to contributed module tests too, since those have to install core the same way as core tests do.
Additionally, there has been recent work to switch contrib's gitlab_templates shared pipeline definitions to running concurrent tests by default. Contrib tests previously used raw phpunit which runs each test sequentially with an option to switch to concurrent test running via run-tests.sh; the default flipped to run-tests.sh by default in September 2026. Because contrib tests should also benefit from core's 'slowest test first' strategy, this should compress pipeline times in contrib and it may have a positive impact in reducing CI minutes overall if runners are able to complete jobs in a shorter time with the same CPU request.
Effect on the Drupal Association's Hosting CostsTaken together, these changes lower the cost of running core's CI run by run, through shorter wall times, fewer CPU minutes, and fewer pipelines overall. As Figure 2 shows, core is the single biggest consumer of CI minutes on drupal.org, so that work is aimed at the largest single driver of the GitLab CI costs behind the Drupal Association's infrastructure bill.
What that adds up to on the bill itself is a separate measurement, and will take longer to validate. Total cost depends not only on the cost per run but on how many runs happen, and core activity (commits, issues, and merge requests) is holding steady or rising. So the effect on the DA's hosting costs has to be read from same-month comparisons year over year, or averages across several months, rather than any single snapshot. We’ll be keeping a close eye on this as the latest round of changes are committed.
