DrupalCon Vienna 2025 wrap-up

Ondřej Mirtes (PHPStan), Sachiko Muto (OpenForum Europe), Derick Rethans (Xdebug) and Sebastian Bergmann (PHPUnit) · Watch

The counterweight to the Driesnote. Three maintainers and a policy researcher argued that open source needs funding from the businesses that depend on it, and a seat where EU law is turned into standards (funding and sovereignty (4:22–6:43)). Standards drift to the biggest players (Gmail and Outlook now set email's rules), and single-page apps reimplement the browser badly (standards erosion (23:48–30:00)). Two panellists were openly critical of generative AI's training data, its effect on the junior-developer pipeline and the risk of model collapse (the AI critique (47:49–50:48)), a very different tone from the main stage.

Neurodiversity: an underrated superpower in business

Vera, organisational-development consultant at Zühlke · Watch

An argument that neurodivergent colleagues (she put it at 15–20% of people, with loosely sourced figures) are an early-warning system and a check on groupthink (dissent as a benefit (37:09–41:42)). The practical asks were awareness, flexible hours, quiet spaces, and "working with me" profiles that make needs explicit without requiring a diagnosis (three levels of practice (50:35–56:28)). It set up a strong community track on burnout, shame, dyslexia and care.

Opening, Splash Awards and wrap-up

Opening · Splash Awards · Wrap-up

The opening put a number on the Association's problem: about $10 per active modern Drupal site per year, of which roughly $3 comes from revenue, $4.50 from in-kind support and $2.50 is unfunded (what you get for ten euros (27:10–30:18)). It announced DrupalCon Japan in November, Chicago in March, and Rotterdam for Europe 2026 (40:51–42:12). At the Splash Awards Dries argued that people adopt Drupal because organisations they admire use it, so end-user stories matter as much as features (why stories (4:56–7:33)). The wrap-up added that drupal.org projects can now opt in to GitLab issues and that Project Browser shipped its first stable release during the week (GitLab issues and Project Browser (5:50–8:30)).

The tone the keynotes set. Optimistic, with dates attached. The project lead framed AI as both the threat and the way through it, and committed publicly to Canvas 1.0 and Drupal CMS 2.0. The panel keynote supplied the scepticism. Through the week the open question was whether a project funded by volunteers and sponsors could pay for, secure and support everything that had been promised.

A new front door: Drupal CMS 2.0, site templates and the marketplace

The Drupal CMS team explained why version 2.0 starts from site templates. A generic product can't be useful: Drupal CMS 1.0 had to ship the same content type twice under different names, so 2.0 begins with near-complete starting points for a specific use case, "making easy things less hard" (why site templates (4:34–7:00)). Recipes now wrap whole integrations, such as a Mailchimp signup or a Stripe donation form, prompting for credentials and building the form (integration recipes (9:37–15:00)). Two problems remain unsolved: cheap shared hosting, where Package Manager's copying of about 50,000 files can look like malware, and automatic updates beyond patch releases (hosting and updates (35:16–39:02)).

The mechanics turned out to be simple. A site template is a recipe for a 95%-finished site, chosen once and then thrown away, with no update path (what a template is (1:31–6:34)). Build the site you want, then export config and content with one Drush command (the live export (18:25–22:19)). Mediacurrent's Mercury design system abandoned sector themes (education, government) for look-and-feel archetypes (the pivot (5:18–6:28)), and is meant to be forked rather than sub-themed, because component props are tied to the content model (fork, don't subtheme (27:53–30:32)). 1xINTERNET showed the agency version: an empty install profile, every paragraph type as an isolated recipe, and a private Project Browser fed from GitLab (nested recipes (21:15–24:22), private Project Browser (31:25–36:42)). Project Browser itself reached a stable release, and an allow-list source removes most reasons to write a custom one (the recommended source (8:16–11:23)).

The marketplace was the governance story. Tiffany Farriss explained how a 14-week participatory process, with 500+ inputs and saturation as the stopping signal, got the board to a decision, and why the pilot is funded in stages behind a feasibility gate (the process (6:51–9:36), progressive commitment (16:58–18:32)). The commercial reality check came from Centarro. Its $1,000 template bundle was too much and not enough for a small merchant comparing it with free tools and AI site builders, and consultative requests ate about 20 hours of calls (the failed sale (13:27–17:26)). The next attempt will be a fixed, hands-off product (lessons (17:26–20:07)). UX research is shaping all of this: even advanced Drupal users disagreed on core terms in a 418-response quiz, and testers read "Marketplace" as "paid" (terminology (10:20–13:24), Extend versus Marketplace (24:10–28:14)).

So what: Drupal CMS 2.0 makes Drupal far easier to start with, but templates are one-off starting points, not maintained products. For agencies they pay off in faster demos and starts, not yet as a product to sell.

Canvas arrives, and the front end changes with it

Canvas reframes how a Drupal build starts. Traditionally the content model comes first because markup is back-end-led; Canvas starts from components that connect to content later (the inversion (2:26–5:25)). Single Directory Components (SDCs), blocks and in-browser React "code components" all look the same to editors (a code component built live (16:02–19:01)), with Tailwind compiled in the browser and a CLI that syncs with Storybook (in-browser compilation (4:01–6:19)). The editor showcase put Canvas beside Blökkli and Gutenberg: Canvas favours page building over inline text editing, Blökkli's mutation stack gives reliable undo, and Gutenberg suits long-form writers (the Canvas demo (3:02–7:35), why inline editing is limited (20:34–23:11)).

For developers, the engineering sessions set expectations. Every Canvas-ready SDC prop needs a known schema shape, titles and examples, and blocks need fully validatable config (component requirements (6:36–11:28)). Component instances store a version hash so outdated ones can be found and upgraded later (versioned components (21:54–25:37)), and a new iframe-based extensions API is the most stable surface (extensions (25:37–28:18)). Mike Herchel showed how to write one SDC that works in both classic theming and Canvas. Images are the hard part (unifying image data (21:28–25:41)), and component descriptions double as instructions to Canvas AI (descriptions as prompts (35:59–38:34)). His advice: build landing pages in Canvas today and keep structured content in templates (what to build now (45:39–48:44)).

Adoption advice was consistent: pilot with new content, run Canvas alongside Layout Builder or Paragraphs, and recreate landing pages by hand as a chance to redesign them (staged adoption (33:58–38:27), adoption strategy (9:18–15:36)). The risks are real: Canvas creates a new entity type, so node-only modules such as Scheduler won't work, and contrib field types need bridging (risks (15:36–20:14)). Multilingual support has its plumbing but no interface yet (multilingual status (42:40–45:05)), which a Montessori network said blocks European adoption (the multilingual wait (34:01–38:28)). Further out, declarative Shadow DOM, broadly supported in browsers from early 2027, could let SDCs become server-rendered web components and retire Drupal behaviours (SDC with Shadow DOM (34:31–38:38)). The BEM-versus-Tailwind debate ended with the room keeping both, but Mercury and Canvas point to Tailwind (the final vote (35:10–39:25)).

So what: start writing Canvas-ready SDCs now and pilot Canvas on new landing pages. Wait on multilingual sites and on migrating Layout Builder or Paragraphs content.

Drupal AI moves to agents, and meets the security bill

The AI initiative has grown from five founding companies to almost 20, with AI module 1.2 carrying about 1,000 commits from 130 authors (The AI Agent Swarm). Agencies reported that clients want automation and AI-powered search first, while hyper-personalisation and chat rank low (the AI survey (20:15–23:40)), and that features ship best as recipes (demo recipes (37:42–41:51)). The most useful patterns keep the model on a short lead: map a question to existing facets (AI to facets (7:18–10:03)); call the LLM once to design a content model, then migrate many pages without it (AI content migration (13:18–16:00)); let AI write SQL but never see the data (AI as SQL translator (24:06–28:26)); and chain automators to turn a URL into structured fields (chained automators (1:06:05–1:11:23)).

The agent sessions were the most candid of the week. The AI tech lead's rule is to use deterministic workflows (ECA, automators) whenever the task is predictable, because agents are less reliable (workflows versus agents (1:06–3:21)). His live injection exploit made the case for least privilege, and how to give agents their own permissions is still open (agent roles (36:15–37:48)). Jamie Abrahams of Freely Give, the AI initiative lead, explained why an unreleased "any content" tool was shelved after it could create admin accounts, and why the Tools API must be bound to Drupal permissions (secure by design (28:24–31:20)). A hands-on workshop showed an agent inventing a date and time when given only a year (hallucinated dates (33:55–37:45)). Dropsolid framed MCP as "the new REST", letting Drupal use and expose tools without vendor-specific code, with security caveats still unanswered (MCP (39:41–44:32)). Where orchestration should live is unsettled. Dries pitched external orchestration with Activepieces, while the AI initiative lead weighed small, medium and large options and argued deterministic flows are needed (orchestration options (32:52–35:58)).

Production evidence came from Yale. Each unit runs a chatbot over its own curated content with its own persona, and the health-benefits bot needed about nine months of review by pharmacy staff (Yale's AI engine (26:02–30:16), AI quality assurance (43:12–45:52)). The tech is simple; the content is hard.

So what: Drupal's AI stack is ready for bounded, reviewed tasks such as alt text, translation, migration helpers and search. Treat agents with write access as a security design problem first.

The web without clicks: bots, AI search and traffic

The Driesnote's "zero-click" warning showed up in the numbers. Maggi.de, a Splash Award winner, lost 15–20% of its traffic to AI overviews and has put new features on hold to restructure content (losing traffic to AI overviews (17:17–20:11)). At the same time, AI crawlers are hammering sites. One freelancer's NGO clients saw faceted search pages taken down by bots generating endless facet combinations, and caching results only grew a database from 2 GB to 18 GB. Her five approaches that did not work (what didn't work (7:45–11:55)) were followed by what did: cap facet depth on the server (facet limits (15:53–18:34)), serve results from rendered HTML stored in Solr (Solr-rendered results (20:02–23:48)), and move to form-based facets. CrowdSec presented a Drupal module that shares attack signals for a community blocklist, though it can only answer with a 403 so far (roadmap and crawler trends (14:33–19:31)).

On being found, an SEO specialist argued the fundamentals still hold: structure, schema served in plain HTML, internal links and citable authority, written in 150–300-word question-led blocks that AI can lift (fundamentals and GEO blocks (4:46–8:54)). His own audience called that content-farm tactics, and he admitted AI visibility tools are only estimates (measuring AI visibility (14:42–18:57)). llms.txt was recommended by one agency as an easy install and doubted by others.

So what: every public Drupal site now needs a bot policy (which crawlers to serve, which to throttle) and search pages that bots can't explode. Structured content is the best hedge against falling click-through.

Core engineering: faster pages and modern PHP

Drupal core got measurably faster, and the reason is testing. Performance tests count queries, cache gets and assets rather than timing them (the test design (6:07–8:22)), which made it safe to land a placeholder strategy that removes BigPipe from warm-cache pages (placeholders (15:42–18:28)) and a fiber loop that batches entity and path-alias loads (fibers as a data loader (22:44–25:51)). In a performance audit of London.gov.uk, the same approach took a cold-cache request from 75,000 queries to 10,000. A core contributor laid out how async could come next: PHP fibers avoid rewriting 20 years of code (the async sandwich (8:10–12:02)), but services must become stateless first (task-focused Drupal (40:07–42:52)).

Day-to-day code is getting cleaner. Hooks are now attributed class methods that can be injected, ordered, removed and unit-tested without a Drupal container (reordering and removing hooks (10:07–12:50)). Autowiring shrinks service definitions to a class name (aliases and autowire (18:00–25:28)), and Drush 14 moves to plain Symfony Console commands so core could adopt them as its own CLI (a core CLI (16:23–19:01)). The PHP tool authors gave masterclasses: custom PHPStan rules for your own repeated review comments (why custom rules (4:17–7:24)), PHPUnit's targeted test selection (covers and uses (18:56–22:38)), and Xdebug attaching to an already-running queue worker (control sockets (31:02–36:20)). Case studies showed what scales: one custom entity type with bundles and base fields serving 1.5M customers headlessly (one entity, many flows (34:33–40:46)), and Search API reused for logging, content deployment and menus (content deploy via Search API (12:25–26:06)).

So what: upgrading to 11.3 is a free performance win, and the modern patterns (OO hooks, autowiring, PHPStan rules) cut boilerplate and review time now.

Shipping safely: supply chain, CI and hardening

Supply-chain security moved from theory to plan. The Automatic Updates team explained The Update Framework (TUF): signed metadata that defeats tampered packages and "freeze" attacks (attack types (2:21–5:20)). It is not yet live for drupal.org packages and currently makes Composer noticeably slower (the cost (24:43–25:50)). Morpht co-founder Marji Cemak showed the same discipline at project level. Containerised tools such as BackstopJS run identically locally and in CI, even on hosting where the pipeline can't be changed (BackstopJS as a Docker alias (8:11–12:04)). npm audits found critical vulnerabilities in theme dependencies (the npm worm response (15:44–18:52)). Cypress runs against a throwaway site with a pre-baked database image (Cypress and DB images (29:52–34:12)), and third-party Actions are pinned because CI is itself an attack surface (securing the pipeline (34:12–38:43)).

A Brisbane security engineer's 20-task baseline started from real incidents: an insurer refusing an $18M claim because MFA wasn't everywhere, and scam phone numbers seeded into public PDFs (authentication and APIs (20:10–23:17), uploads and production checks (23:17–30:32)). She proposed packaging the baseline as a recipe. Testing talks agreed on installing from config plus default content rather than copying production (don't mirror production (5:20–9:45)), and Acquia's support lead traced most Composer pain to mismatched PHP versions and stray vendor directories (the hidden vendor trap (6:55–11:21)).

So what: make the security baseline repeatable as a recipe plus CI checks, pin your CI dependencies, and expect signed packages to arrive within the next few releases.

Public sector, sovereignty and the economics of open source

Government talks were among the most useful of the week. The UK's £16m Local Digital Fund produced some adopted outcomes and many unadopted ones: risk-averse finance teams wouldn't move core systems even when the software was free (four case studies (6:08–13:50)). LocalGov Drupal survived the end of funding through a co-operative of councils and suppliers (the co-op model (13:50–18:00)). Southwark is building shared capabilities to bring each of its 500 services within reach (service definitions into Drupal and CRM (23:58–26:56)), and a Greek agency is adapting LocalGov Drupal for 300 municipalities (LocalGov as a model (13:59–15:30)). Denmark's public-library platform shows the hard version, 100+ independently owned sites on one codebase, where custom code must behave like contrib (webmaster sites (3:34–6:09)).

Sovereignty was the European subtext. Open Strategy Partners cited Danish library-software price hikes and remote kill switches (the convenience trap (5:58–9:44)), and proposed agencies sell sovereignty audits and migration roadmaps as a business case rather than a moral one (the agency playbook (31:04–35:16)). In the Netherlands, a public energy-sector tender awarded points for Drupal Association partner level and drupal.org contributions (contribution in tenders (19:14–25:35)). EASA's emissions-reporting portals on Drupal now feed flight emissions labels to Google Flights (distribution to Google Flights (10:34–11:49)).

So what: for public buyers, funding and procurement rules matter more than code. Requiring contribution and shared platforms is what keeps open source alive after the grant ends.

The business of Drupal: agencies, funding and governance

The Drupal Business Survey set the mood: falling pipelines, AI pushing prices down, and agencies stuck at the end of the value chain answering technical questions (the challenges (9:12–12:55)). Its prescriptions were AI at the centre of operations and a clear choice to go all-in or all-out on Drupal CMS (recommendations (26:48–28:10)). It also suggested fixed prices for updates, because clients value a predictable budget (value pricing (36:53–41:11)). A sales masterclass told agencies to position earlier in the buyer's process and build ROI cases from the client's own numbers (ROI business cases (17:13–23:14)). Pronovix argued that Drupal's constraints make it a safe "cage" for AI-built applications, and that generalist agencies will be commoditised unless they specialise (constraints as cages (13:56–18:35), specialise or be commoditised (35:09–39:48)).

The Association's finances got unusual airtime. The public board meeting covered net losses, staff cuts and a plan built on partner growth, 10% revenue shares and services (financial history (13:56–18:14)). The engineering panel explained the $10-per-site model, with about a quarter unfunded (the funding model (14:48–19:01)), and opened GitLab issue migration (GitLab issues (32:56–36:04)). George DeMet asked whether heavy users of drupal.org should pay (tiered access (34:08–36:58)) and proposed federated associations with signed package mirrors (federation (42:14–44:45)). European associations are already drafting that federation as a Belgian non-profit, partly to reach EU funding (why a federation (6:08–11:17)). Marketing remains the weak side: one panel argued for selling outcomes and verticals rather than initiatives (sell the car, not the tyres (19:48–22:25)).

So what: the platform's maintenance is underfunded and agencies' margins are under pressure at the same time. Contribution, certified partnership and specialisation are becoming commercial necessities, not goodwill.

Content, accessibility and sustainability

The European Accessibility Act has applied since 28 June 2025, and the talks were practical about it. AI can help designers, developers, testers and editors, but it confidently suggested alt text for decorative images, so an expert must check its output (AI's drawbacks (15:11–17:57)). A UK agency moved about 50 clients forward with free automated scans turned into estimated tickets and monthly service reviews (measure (4:07–7:05)). Good alt text depends on context, and Drupal's reusable media shares one alt text across every use, a gap with no clean fix yet (context changes alt text (34:45–36:56)).

Design systems are taking on governance. Nestlé Nutrition restricted each of 100+ brands to one font and one colour, generated accessible palettes from them, and reported WCAG AA adherence rising from about 30% to over 90% (lock the function, free the form (15:13–18:13), results (26:24–32:07)). The University of Edinburgh capped image uploads at 1 MB with automatic WebP conversion across its network, making sustainability a platform policy (the Edinburgh case (46:19–58:43)). A UX speaker called generative AI "the next plastic": convenient now, costly later (AI as plastic (6:05–9:28)). For content modelling, Zoocha argued for a living content-architecture document that begins in UX and catches designs the model can't support (the design checkpoint (10:05–13:02)).

So what: build accessibility and page-weight limits into components and upload rules, so editors can't get them wrong, and keep a human reviewing anything AI writes.

People: talent, wellbeing and contribution

Drupal is vanishing from university courses and its developer base is ageing. The Open University initiative wants agencies to teach in universities and hire graduates (why juniors (3:09–6:56)), with student final projects turned toward the issue queue (students on the issue queue (40:35–43:03)). Dropsolid hires juniors for soft skills using a Lego exercise (the Lego assessment (13:57–16:35)). On contribution, maintainers learned to write small, well-scoped issues and let others write the code (issues people pick up (15:41–18:50)), to break bike-shedding with follow-up issues (follow-ups (28:04–30:27)), and to tell designers when to expect feedback (feedback as success (15:51–18:49)).

The wellbeing track was unusually strong. A panel reframed early warning signs as "project fatigue" so they can be named without stigma (project fatigue (6:08–8:18)). Others proposed a code of care alongside the codes of conduct and ethics (the care pathway (5:52–10:28)), and gave writers simple ways to help dyslexic readers, such as a TL;DR, short chunks and visuals (practical advice (14:20–17:12)).

So what: the project's capacity problem is also a people problem. Junior pipelines, smaller issues and care for volunteers are as important as funding.

Technologies and tools

Sorted by attention received. The signal is a read for a typical Drupal team: adopt now, watch (promising, gaps remain), or hype (claims ahead of evidence).

Tensions and open questions

• Whose page builder? Canvas is the community's future page builder, yet about 45 of 56 listed contributors are Acquia-linked, core inclusion is undecided, and a theming lead said its future depends on continued funding.
• Stage versus session. “One of the most AI ready frameworks” was asserted without comparison. On stage the AI demos were curated videos; in the sessions a live AI-generated component had errors and a live agent leaked a secret.
• Agents are easy to demo, hard to secure. Prompt injection has no prompt-level fix, an unreleased tool could create admin accounts, and how agents should get permissions is still an open design question.
• Where orchestration lives. Dries promoted external orchestration with Activepieces, a company he has invested in; the AI initiative is building in-Drupal flows; others reach for n8n.
• Who Drupal CMS is for. Drupal CMS targets marketers and smaller sites; a Swiss agency says this leaves enterprise without a story; the business survey tells agencies to go all-in or all-out.
• Templates as a business. The marketplace is funded, but the first agency to sell a template sold none, templates have no update path, and Pronovix argued templates are “the door” to a product, not the product.
• Openness versus paying the bills. The Association spends more than it earns, and $2.50 per site is unfunded. The fixes on the table (charging heavy users, partner revenue shares, an EU federation) each test open-source values.
• Embrace AI or doubt it. Agencies were told to put AI at the centre; the keynote panel criticised its training data and effect on juniors; a UX talk called it “the next plastic”.
• Block bots or be found. Sites are being knocked over by crawlers and losing traffic to AI overviews, while SEO advice says let AI bots in and write content for them.

Talk index

Not included: a second upload of the Driesnote, a duplicate upload of the OSS designers talk, and the conference aftermovie. Some speaker names are uncertain in the captions.

Key takeaways

Evaluators of Drupal

• Real now: structured content, permissions, revisions and config management. An agency that tried headless SaaS came back for exactly these.
• Arriving early 2026: Drupal CMS 2.0 with the Canvas page builder and ready-made site templates.
• Not ready yet: multilingual Canvas pages, stable Canvas APIs and the template marketplace.
• Ask any vendor: how they keep AI agents to least privilege, and where a person approves changes.

Editors

• Canvas brings drag-and-drop pages, with workspaces to review changes before publishing.
• AI will draft and suggest; you stay the reviewer, especially for alt text.
• Alt text depends on context: describe what the image means here.

Marketers

• Plan for fewer, higher-intent clicks as AI overviews answer more searches.
• A context control center will hold brand voice and key facts for every AI feature; get yours written down now.
• Sell outcomes and stories, not features: Drupal's end users are its best marketing.

Site owners

• Put a bot policy in place: AI crawlers can knock over faceted search.
• The European Accessibility Act applies now; start with free scans and fix in phases.
• Upgrade to 11.3 for free performance gains, and budget for maintenance, which Drupal itself struggles to fund.

Developers

• Adopt OO hooks, autowiring and custom PHPStan rules; they cut boilerplate and review time.
• Build AI tools with typed inputs, permission checks and least privilege; prefer workflows to agents.
• Pin CI dependencies, audit npm, and test against config plus default content.

Site builders

• Build a site, then export it as a template with one Drush command.
• Recipes are applied once; reapplying one can overwrite your changes.
• ECA is the no-code glue, and its new interface is coming.

Themers

• Write SDCs that work in classic themes and Canvas; images need a wrapper component.
• Component and slot descriptions now instruct the Canvas AI.
• Tailwind is where Mercury and Canvas are heading; fork Mercury rather than sub-theming it.

The Drupal community

• The Association spends about $10 per site a year and $2.50 of it is unfunded; contribution and partnership pay for the commons.
• Write small issues, credit generously, and teach in universities to grow juniors.
• Look after each other: name project fatigue early and offer care, not just a code of conduct.
• Rotterdam is next; Canvas 1.0 and Drupal CMS 2.0 are the commitments to hold the project to.

AI-generated. Sources: the DrupalCon Vienna 2025 session playlist and the Driesnote on YouTube.