webjoke.de

Drupal 12 and the End of Legacy Debt: A Forced Modernization for Enterprise Engineering bhavinhjoshi Tue, 10/06/2026 - 14:02

Just last month, a prospective client came to Joshi Consultancy Services asking for a cheap cron script to fix a runaway disk usage issue. The reality? They were bleeding money on a deep architectural flaw in their Drupal ingestion pipeline. We see this constantly. For years, the enterprise software industry tolerated a quietly expensive habit: carrying technical debt forward.

Historically, major CMS upgrades were treated as little more than UI refreshes. Agencies seamlessly dragged deprecated code, outdated PHP environments, and fragile database structures from one major version to the next. The result? Senior engineers stuck acting as caretakers for legacy code, while CXOs bled budget on endless maintenance retainers just to keep the lights on.

With the December rollout of Drupal 12, that loophole permanently closes.

The platform is fundamentally altering the rules of engagement. Instead of merely suggesting best practices, Drupal 12 enforces strict architectural modernization right at the server level. Here is why this shift is a massive win for both engineering teams and business leadership.

The Eradication of Deprecated APIs

Spaghetti code. We all hate it. But until now, deprecated code could linger in a system for years, propped up by complex workarounds.

Drupal 12 changes this by aggressively stripping out all deprecated core APIs. The system physically rejects structural laziness. If an agency attempts to stack new logic on top of a legacy foundation, the application simply will not run. You build within clean, modern boundaries from day one. Period.

Enforcing Modern Infrastructure Floors

Previously, organizations delayed server upgrades to save short-term costs, forcing modern applications to run on aging environments.

No longer. Drupal 12 introduces non-negotiable infrastructure floors: a PHP 8.5 minimum runtime alongside raised database requirements (MySQL 8.0 / PostgreSQL 18). This isn't just backend housekeeping. By enforcing these modern tiers, the core framework guarantees a baseline of performance that cannot be compromised by budget-saving shortcuts.

Security as a Structural Guarantee

Enterprise security is too often treated as an expensive, opt-in audit layer applied long after development is complete.

By making Argon2id the default for password hashing, Drupal 12 integrates military-grade resistance against GPU-driven brute-force attacks directly into the core blueprint. For the C-suite, this is an immediate reduction in liability. Security transitions from an ongoing maintenance headache to a baseline structural guarantee.

The Business Outcome: Eliminating the Maintenance Drain

The most profound impact lands directly on the balance sheet.

For CXOs, these forced architectural boundaries solve the most expensive problem in enterprise software: unpredictability. When the core framework refuses to execute legacy PHP and automatically enforces top-tier security standards, the financial drain of technical debt is cut off at the source. Organizations can finally stop paying agency retainers to manage bloated, unmaintainable code.

Drupal 12 is not just a feature upgrade. It is a forced modernization of your engineering culture.

If your organization treats this version bump as a standard IT afterthought, you are actively funding your own future liability. Stop paying for temporary bug fixes. Engineer the blueprint first.

Are your servers, and your budgets, ready for the rollout?

Drupal Drupal 12 Security Drupal Planet Drupal migration Share this Copied to clipboard Add new comment

The National Center for Family Philanthropy worked with DevCollaborative to reimagine their website, CRM, and other communications channels to effectively manage and scale their network of over 500 philanthropic families representing more than 3,000 individuals.

The tools around Drupal have become simpler, complementing Drupal.  Read our take on how Canvas, components, Drupal CMS, and AI are changing Drupal work.

AI is becoming part of almost every software platform, and content management systems are no exception. Drupal is no different. But there is an important question that often gets lost in the excitement around AI: if Drupal already manages content so well, what exactly does AI add?

TL;DR

macOS Docker provider performance has improved significantly over the years, and now all the providers seem to be performing about equivalently. So OrbStack, Docker Desktop, Lima, Colima, and Rancher Desktop are fast and working well.

Introduction

Back in November 2023 we published a hand-run comparison of macOS Docker providers. It was a snapshot: one laptop, one afternoon, one set of versions, and a Google Sheet. It answered the question people were asking, and then it started going stale the moment it was published.

That post is gone now, and this one replaces it, because the way we answer the question has changed. DDEV now runs the same benchmark battery every night, unattended, on every platform and Docker provider we support, and publishes the accumulated history.

Table of Contents Where to see the numbers

The nightly results live at the DDEV performance history dashboard.

The easiest way to find it (and everything else the DDEV GitHub organization publishes) is to start at github.com/ddev/ddev.github.io and follow the "Performance History" link. That repo's README is the index of DDEV's GitHub Pages sites — bookmark it and you don't have to remember any of the other URLs.

The dashboard has two views. Trend over time plots one line per leg so you can see regressions and improvements as they land. Compare environments (latest) gives you a sorted bar chart of each environment's recent median, which is the view that most directly replaces the 2023 post's charts.

Which metric to compare

The harness collects six metrics per run. The one that lines up with the 2023 post is drupal_install_s: Puppeteer drives the Drupal web install wizard end-to-end, in a real browser, through the DDEV router, the web server, and PHP-FPM.

I think it's important that it uses a web-intensive install process for studying web server performance. The interactive installer deliberately breaks each batch step into its own HTTP request and page reload, so every one of those round trips exercises exactly the layer where Docker provider differences show up — bind mount vs. Mutagen, gRPC-FUSE vs. virtiofs, and so on. It's the closest thing in the suite to "what does it feel like to actually use this."

The companion metric drush_install_s runs the same install non-interactively via ddev drush si, which never touches the router or web server at all. If the two track together, filesystem I/O dominates; if they diverge, the gap isolates router/web server overhead. The perf/README.md describes all six metrics and why each one is there.

macOS results

Medians of the nightly runs from 2026-08-31 through 2026-09-30, drupal_install_s in seconds, fastest first. All legs are Apple Silicon (ARM64), all with Mutagen enabled except where noted.

Docker provider drupal_install_s drush_install_s ddev_start_cold_s Rancher Desktop 12.0 9.8 16.5 Lima 12.1 9.9 15.8 Podman (rootless) 12.3 9.9 46.0 Colima (vz) 12.6 10.0 14.4 OrbStack 13.4 10.4 12.2 Docker Desktop 16.7 13.4 21.0 OrbStack, no Mutagen 16.8 11.2 9.2

The headline is how boring this table is. Five of the six Mutagen-enabled macOS providers land within 1.4 seconds of each other on the flagship metric, and their drush_install_s numbers are within 0.6 seconds. On macOS with Mutagen, your choice of Docker provider is mostly not a performance decision anymore. Pick based on licensing, maintenance, and how the tool fits your workflow.

That is a significant change from 2023, when OrbStack was clearly ahead and Colima and Rancher Desktop looked sluggish. Those gaps have largely closed (all are now using VZ/VirtioFS).

Compared with the 2023 numbers

The 2023 test did a Drupal 10 web install with Mutagen and got OrbStack 20s, Docker Desktop 22s, Rancher Desktop 22s, Colima QEMU 33s, and Colima VZ 35s. The fastest then (OrbStack, 20s) compares with 12.0s for the fastest now (Rancher Desktop), and with 13.4s for OrbStack. The slowest providers gained the most: Rancher Desktop went from 22s to 12.0s and Colima VZ from 35s to 12.6s. The spread between providers went from 15 seconds to about 1.4 (excluding Docker Desktop).

Treat these as a rough comparison, not a like-for-like benchmark. The 2023 numbers came from one MacBook Air M1 (2020) on a single afternoon, with DDEV v1.22.5, Drupal 10.1.6, and PHP 8.1. The nightly runs use CI runner machines, and newer DDEV, Drupal, and PHP versions. Both tests drive the demo_umami install through Puppeteer. Each Docker provider has also shipped many releases since 2023, and the Colima leg now uses VZ where one of the 2023 legs used QEMU with sshfs. Some of the improvement comes from the hardware, and some from the software.

When DDEV was young, a web install with Docker Desktop took SEVEN MINUTES. You'd just watch it poke along at each section. Now you don't even see those as they flash by. Now it takes 12-17 seconds. That's progress!

Mutagen is still doing the work

The most interesting row is the last one. OrbStack with Mutagen finishes the browser install in 13.4s; the same provider without Mutagen takes 16.8s — about 25% slower. Note that the no-Mutagen leg is faster on ddev_start_cold_s (9.2s vs. 12.2s), because there's no sync session to establish, and closer on drush_install_s (11.2s vs. 10.4s), because Drush never goes through the web server. The penalty concentrates in exactly the browser-driven path, which is what you use all day.

Mutagen is on by default on macOS for this reason, and these numbers say to leave it on.

However, plenty of people are perfectly happy with turning off Mutagen. Some folks don't like the additional complexity and don't want the speed trade-off. ddev config global --performance-mode=none turns it off. (Mutagen has more benefits than just performance though; with Mutagen, the web server in the container is dealing with a Linux filesystem, more like the real deployment environment, instead of a Docker bind-mount, which is more like a network filesystem.)

:::warning[Read the hardware caveat before comparing rows] The Docker Desktop leg runs on older M1 test runner machines that have dedicated hardware. OrbStack, Rancher Desktop, Colima, Lima, and Podman share a pool of newer machines. Some of the Docker Desktop gap in the table above is that hardware difference, not the provider. We didn't normalize it — the dashboard deliberately doesn't either — so treat Docker Desktop's row as "somewhat pessimistic" rather than as a clean like-for-like comparison. :::

The other platforms, and why you shouldn't rank them against macOS

The dashboard also carries Linux, WSL2, and traditional Windows legs. They're useful for spotting regressions within a leg over time, but the cross-platform bar chart is misleading if you read it as a platform ranking:

• The Linux leg runs on ephemeral GitHub-hosted runner VMs. It provisions the Drupal codebase from scratch every night and starts with cold image, Composer, and OS page caches. Every macOS and Windows leg reuses a persistent codebase and warm caches.
• The Windows and WSL2 legs run on entirely different physical hardware from the macOS test runners.

Trends within a leg: meaningful. Bar-chart comparisons across legs: only meaningful when the machines are comparable, which across platforms they aren't.

Getting the raw data

Every chart on the dashboard has a Download CSV button that exports exactly the rows behind whatever is currently displayed — after your leg and metric selections, not the whole dataset. That's the quickest path to your own analysis.

If you want everything, the underlying dataset is one JSON object per line at history.ndjson, with one line per (commit, leg) benchmark run:

curl -sL https://ddev.github.io/ddev/perf/history.ndjson | jq -r 'select(.os=="darwin") | [.timestamp, .docker_provider, .metrics.drupal_install_s] | @tsv' Running it on your own machine

The harness that replaced the old ddev-puppeteer script lives in the DDEV repository and runs locally against a standard DDEV Drupal project:

./perf/run-benchmark.sh \ --project-dir ~/workspace/d11 \ --site-url https://d11.ddev.site/ \ > result.json

It needs jq and Node.js on your PATH in addition to the usual DDEV prerequisites. If your numbers look very different from the nightly legs, we'd like to hear about it.

Summary

Three years ago the answer to "which Docker provider is fastest on macOS?" was worth a blog post with charts. Today the simple answer is that, with Mutagen on, they're close enough that the question is mostly settled, and any lingering differences are small next to the hardware you're running on.

What's better than a fresh answer is a standing one. The nightly harness means the next time performance shifts — a provider regression, a Mutagen improvement, a DDEV build-layer mistake — it shows up on the dashboard within a day, instead of waiting for somebody to run the numbers by hand and write another post.

Have questions, or numbers that look different from the dashboard? Join the conversation in our Discord, open an issue, or reach out via email.

Follow our blog, Bluesky, LinkedIn, Mastodon, and join us on Discord. Sign up for the monthly newsletter.

This article was edited and refined with assistance from Claude Code.

Beyond Bigger Servers: Keeping Websites Online Under Bot Attacks John Locke Mon, 10/05/2026 - 15:00 How layered caching, verified crawlers, and adaptive Anubis protection kept a WordPress publishing site available for readers and editors. Dev Corner

• Read more about Beyond Bigger Servers: Keeping Websites Online Under Bot Attacks
• Add new comment

WordPal: Theme Drupal with WordPress block themes

One of the difficulty with starting a Drupal website is the lack of diversity in available themes. There has always been more choice in the WordPress world for themes. Maybe, just maybe, Drupal could use WordPress themes and get the best of both worlds? 

theodore October 5, 2026

After Rotterdam, one part of Drupal's AI story is no longer theoretical. The Northmoor University demo brought AI search, content review, translation, editing and externally connected assistants together on the same Drupal site. That made a collection of modules feel closer to a product experience, but it also exposed the next question: whether organisations can depend on the path between those pieces in production.

The stack does not yet sit at one level of maturity. Drupal AI 1.5 and Canvas are stable and covered by Drupal's security advisory policy. Context Control Center is a release candidate, while Tool API and MCP Server remain in beta. Rotterdam showed that these parts can work together. Production teams now have to decide which combinations are mature enough to trust, govern and support.

Permissions, human review and traceability are central to that decision. The demo drafts changes rather than publishing them, leaving a person to review what the AI proposes. Tool API brings access checking into executable capabilities, while MCP can expose Drupal tools to assistants outside the site. Context Control Center moves instructions and organisational knowledge toward managed, reviewed material. Taken together, those pieces point toward a production requirement that goes beyond capability: teams need to know what an agent may read, what it may change, which tools it may invoke, what context it received and who remains accountable for the result.

Provider choice and the connection between Tool API, MCP and Canvas make the remaining maturity gap visible. Drupal's provider abstraction supports different commercial and locally operated models, but workflows still need to remain testable as model behaviour, tool calling and context limits change. The Drupal AI Initiative's follow-up also draws a clear line between what Rotterdam demonstrated and what is available today: the simplified MCP approach shown on stage remains a prototype. Canvas Tools, which lets agents manipulate Canvas through Tool API, is likewise still beta and is not covered by the security advisory policy.

That does not make Drupal AI simply ready or not ready for production. Different parts of the stack already support different kinds of real use, with different levels of risk. Rotterdam instead changes what Drupal AI now has to prove: that permissions remain enforceable, context can be governed, costs and activity can be traced, providers can change without losing control, and interfaces can survive upgrades. Productisation does not mean closing the ecosystem or putting everything inside one package. It means reaching the point where an organisation can understand what an AI system will be allowed to do before deployment, and explain what it actually did afterwards.

Follow The DropTimes on LinkedIn, X, Bluesky, and Facebook, or join #thedroptimes on Drupal Slack.

Allen Jason wrote and curated this issue of Editor’s Pick.

A handwritten board at DrupalCon Rotterdam carried more than vacancy notices. Attendees could also recommend community members actively looking for their next Drupal role.

Drupal AI Context first release candidate The first release candidate (RC 1) of Drupal AI Context , also known as Context Control Center (CCC), is now available. This is a major milestone for the project. After five beta releases and months of community testing, refinement and expansion, RC 1 marks the final stage before the first stable 1.0 release. We’re currently planning to release CCC 1.0 in about a month, subject to what we learn from testing the release candidate. There may also be an RC 2 release prior to 1.0. CCC helps Drupal sites provide governed, reusable context to AI-powered features, from brand voice and editorial standards to organisational knowledge, governance rules and other information that AI systems need to work effectively.

FlashFloodBreaker partner meeting in Metz: 1xINTERNET shares digital and regional resilience insights to help improve Europe’s response to extreme flash floods.

Prevent the AI skills gap from becoming an expanse The rapid pace of updates, new versions and new Drupal core and contrib module functionality of the past 5 years almost feels like a crawl compared to the “high-velocity production model” guiding The Drupal AI initiative . It has screamed past beta versions and into an enterprise ecosystem boasting more than 15,000 installs, funding totaling in the $millions (USD,) as well as dedicated product streams like Inside AI and Outside AI; all in just over a year of its official launch. In addition, the community has about made it beyond the debate of if , and are now comfortably addressing the reality of how to best, (and importantly,) responsibly employ Drupal AI so that it contributes to not just efficiencies, but to improved workflows, outcomes and ultimately the bottom line; both Inside and Out . That, after all, is the measurement used in the viability of any new product or process. Astutely, the effort is grounded in the mission: “ …to

The migration launched and traffic is falling. The eight causes in the order to check them, what Search Console tells you, how long recovery takes, and when to roll back.

An Estonian service page changes its delivery time from five days to ten. The English and Finnish pages still promise five. AI can translate the new sentence quickly, but someone must notice the change and decide when the other languages should go live. Start with service pages WebPro recommends testing AI translation on one content type first: perhaps ten service pages in Estonian, English and Finnish. Use them to check the complete journey from a source edit to a published translation. Translating a thousand pages at once says little about whether next week's changes will reach the right places. Drupal's AI capabilities received renewed attention in Rotterdam in late September. The Drupal AI initiative's updates discuss translation alongside other editorial tools. For a business, the…

Japan's Drupal community now has a new voluntary association with a formal NPO application under review. Its first work begins before legal incorporation is complete.

Author: Will Huggins

In enterprise digital experience, the conversation around generative AI has shifted dramatically. Digital leaders are no longer asking whether AI can write a paragraph or spin up a page. They are asking: 

• Can our AI deliver seamless customer journeys?
• Can it scale without diluting our brand voice?
• Will our IT and compliance teams actually approve it?

The release of Drupal AI 1.5 directly answers those questions.

Driven by 63 active contributors across 31 global organisations, Drupal AI 1.5 shifts the platform from one-shot text generation into an interactive, governed, and brand-safe digital experience engine.

For CMOs, Heads of Digital, and website owners, this release is not about backend developer plumbing - it is about practical marketing velocity, measurable ROI, and total brand sovereignty.

Here is a breakdown of what Drupal AI 1.5 unlocks for your digital roadmap.

1. Digital Assistants That Actually Remember the Customer Journey

Early AI chatbots suffered from digital amnesia: the second a visitor navigated to a new page or refreshed their session, their context vanished. For high-consideration purchases or complex self-service portals, this creates friction and frustrates users.

Drupal AI 1.5 introduces persistent, stateful conversation memory:

• Seamless Multi Page Engagement: Conversational assistants now securely remember previous interactions across a user’s entire browsing session. If a prospect asks about product specifications on a solutions page and later opens the chat on your pricing calculator, the assistant retains the context.
• Enterprise Privacy by Default: Conversation threads are sandboxed per user session. Visitors enjoy a personalised journey, while your data protection officers can rest easy knowing customer history is never exposed across sessions or leaked externally.
• Grounded in Your Content: Rather than relying on generic model knowledge, chatbots can now be plugged directly into your site’s verified content repository (Retrieval-Augmented Generation / RAG), ensuring every answer is accurate, factual, and backed by your brand’s single source of truth.

The Strategic Win: You transform your website from a static brochure into an intelligent, conversational destination that guides prospects smoothly through the conversion funnel.

2. Real-Time Streaming Guardrails: Zero-Risk Brand Safety

For any marketing leader, the greatest fear with public-facing AI is reputational damage: a model hallucinating incorrect pricing, generating off-brand language, or leaking sensitive corporate information.

While traditional safety filters only check text after the entire response is completed—slowing down user experiences—Drupal AI 1.5 introduces active streaming guardrails:

• Live Stream Filtering: Guardrails now monitor the AI’s output token-by-token in real time. If an external model attempts to output confidential identifiers, internal instructions, or unvetted claims, the filter suppresses and replaces the content before a single character renders in the visitor’s browser.
• Semantic Topic Guardrails: Restricting an AI to approved topics used to be brittle. If a model said "coastal vacation" instead of "beach holiday," strict keyword filters would break. Version 1.5 uses intelligent semantic matching: the assistant understands intent, synonyms, and localised phrasing while remaining firmly inside your brand boundaries.
• Cost-Effective Compliance: User prompts can now be routed through dedicated, cost-free moderation channels instead of burning expensive generation tokens, protecting both your brand standards and your marketing budget

The Strategic Win: Complete brand safety. Your legal, compliance, and IT teams get auditable, proactive safeguards built into the core publishing architecture.

3. From "One-Click Prompts" to Interactive Editorial Copilots

Early CMS AI automations were rigid: an editor clicked an AI button, waited, and was forced to accept or discard whatever came back.

Drupal AI 1.5 turns AI Automators into an interactive creative partner inside the editing workspace:

• Interactive Refinement in the Edit Form: When generating campaign copy, headlines, or summaries, editors can now open an interactive refinement window. With plain-language prompts like "make this more urgent," "tighten to 30 words," or "adapt for our enterprise persona," the copy updates dynamically—while automatically preserving your overarching brand voice rules.
• Multi-Step Content Pipelines in One Click: Marketing teams can trigger automated workflows directly from a field. A single click can research a topic, draft copy, pull relevant taxonomies, and format the output—without leaving the edit screen or waiting on developer intervention.
• Vision-Aware Content Intelligence: The CMS can now "see" the imagery embedded in your articles. Multimodal vision models analyse uploaded graphics to automatically draft descriptive alt-text, optimise summaries, and ensure full accessibility compliance without manual overhead.

The Strategic Win: High-velocity content operations. AI handles the first 80% of drafting and repetitive formatting, leaving your team with complete creative control over the final 20%.

4. On-Site Search That Understands Customer Intent

If visitors cannot find the right product, resource, or service within seconds, they bounce. Traditional on-site search engines rely on exact keyword matches, frequently failing when visitors search using colloquial questions or conversational language.

Drupal AI 1.5 upgrades search into a semantic relevance engine:

• Intelligent Result Re-Ranking: Integrated directly with your site’s search architecture, the AI analyzes user queries semantically and re-orders results based on actual intent, not just raw word frequency.
• Instant Answers: New question-answering capabilities can pinpoint the exact passage answering a user's question, displaying direct snippets alongside high-confidence relevance scores.
• The Strategic Win: Higher digital engagement and increased conversion rates by eliminating the "dead-end" search experience across your digital properties.

5. Total Financial & Operational Governance

One of the fastest ways to lose executive support for AI initiatives is unpredictability—unexpected API bills or black-box operations that IT cannot audit.

Drupal AI 1.5 builds transparency directly into the dashboard:

• Real-Time Token & Cost Tracking: Product owners can monitor exact token consumption (input, output, and cached reasoning) alongside live provider rate limits. You know precisely what each campaign or automated workflow costs.
• Enterprise Observability: All AI actions emit standardized monitoring metrics compatible with leading enterprise platforms (such as OpenTelemetry, Datadog, or New Relic), ensuring full auditability for platform architects.

Move Fast, Stay in Control, Own Your Destination

Proprietary digital experience platforms lock your organization into their single, closed-ecosystem AI model—charging heavy licensing premiums while limiting your flexibility. Lightweight headless tools offer AI writing widgets, but leave you without enterprise governance, multilingual depth, or data sovereignty.

Drupal AI 1.5 delivers the best of both worlds: model-agnostic freedom to choose the best AI for the job, visual campaign acceleration for marketing teams, and bulletproof architectural security.

Experience Drupal AI Today

Reading about capabilities is one thing; seeing them transform your digital operations is another.

Explore our live interactive environments to test chatbots with memory, stream-level guardrails, and interactive content workflows: