DrupalSouth Wellington 2026

Jonnie Haddon: Try government again, we've redecorated

Creative HQ, the NZ government-owned innovation agency that runs the GovTech accelerator · Watch

A pitch to small vendors to come back to government work. Haddon's review of 62 public-sector innovation projects found very few delivered real value, and those that did shipped something useful inside existing constraints. He called this "leapfrogging" the resistance mountain of election cycles, risk aversion and silo funding (the resistance mountain (11:42–15:38)). His example was the Department of Conservation weed alert tool, built with Wellington agency X Equals: from problem statement to a working system in three to four months, with its budget tripled once it proved itself (the weeds alert case (19:36–22:37)). He then listed why now is different: NZ procurement rules favouring local firms, a faster Better Business Case process, and a new Government Digital Delivery Agency (why now (22:37–28:07)). An audience member pushed back that easy wins can let government dodge structural fixes (Q&A (33:12–38:50)).

Serge van Dam: Death to the black box

Investor in private cloud and AI companies, former ERP implementer and organisational psychologist · Watch

A provocation from outside open source, which he admitted knowing little about. His theme: AI is collapsing the cost of building software, and that is an opportunity to deliver public services once judged unaffordable (affordability as opportunity (3:11–7:42)). His examples were anecdotal and some numbers were, in his words, made up, such as a custom SaaS built for about $12k against a $40m government estimate (the cost-collapse examples (10:48–15:24)). Two ideas landed for this audience. Put the procurement officer in the build room (procurement in the room (16:56–21:22)). And open source has a branding problem with executive buyers: "community" sounds amateur, so sell affordability, sovereignty and the options you leave your successor (open source's branding problem (21:22–25:30)).

DrupalSouth steering committee

Julia Topliss, Chris Burgess, Margery Tongway and Vladimir Roudakov · Watch

The committee announced the Gold Coast next year and Canberra in 2028 (7:15–9:25), and floated two ideas that matter to agencies. The first is a vendor checklist for buyers of Drupal services, including a GovCMS version, aimed at inexperienced, non-contributing agencies that undercut on price; it has already been raised with GovCMS for the Drupal Services Panel refresh (the vendor checklist (9:25–11:57)). The second is leaving Linux Australia's governance to become an incorporated association, so the event can take creative risks (the incorporation question (19:52–23:28)). Panellists disagreed on whether meetups are dying (meetups and joint CMS events (15:14–19:52)).

The tone the keynotes set. Practical and slightly defiant. The product keynote argued Drupal can now win small projects; the two outside keynotes argued that government and AI are both rewarding small, fast, close-to-the-client teams. Neither was triumphant: Drupal CMS adoption data is three months old, and several speakers worried aloud about what cheaper software means for agency revenue.

The new starting point: Drupal CMS, recipes and site templates

Drupal CMS is now pitched squarely at projects Drupal used to lose. Pamela Barone described Drupal CMS as vetted, stable modules with default configuration and no patches, built from recipes so a site can be stripped back without lock-in (not a distribution (7:20–11:30)). Michael Strelan showed the mechanics. Recipes can declare prerequisites, apply non-destructively to existing sites with config strict set to false, and stack into features (anatomy of a recipe (5:04–10:43), re-applying live (10:43–14:29)). A template is simply a large recipe that "drush site export" produces from any site (building a template (15:37–21:44)). The catch is that templates have no upgrade path, and agencies may end up supporting sites on several template versions.

Two builders reported back. Morpht's Murray Woodman said about 90% of the effort in a "vertical" government template went into horizontal components and Canvas integration (patterns across templates (3:38–7:30)). A component library whose structure already maps to SDCs (DaisyUI) saved design work (DaisyUI and Canvas (15:48–18:24)), and one image component serves both Canvas and Paragraphs, since GovCMS won't have Canvas (the platform-agnostic image SDC (20:39–23:01)). He was frank that ordinary node edit pages are not well served by Canvas yet, and that commercial viability is unproven. From the buyer's side, a one-person Auckland agency showed what a premium SDC theme now contains for about NZD 1,000: 50 components, variants and CSS tokens, with no build step (what a premium theme contains (2:12–5:27)). He was vague on licensing (maintenance and licensing (18:54–21:27)). Wellington's Sparks Interactive argued that separating code from content is what made its Sector distribution profitable (Sector (7:45–11:31)).

So what: Drupal CMS and templates genuinely lower the cost of small builds and demos. Treat a template as a starting point with no upgrade path, and judge the marketplace as a showcase until there is revenue evidence.

Components and the front end

Three answers to the same question, how to build maintainable components, were on show. PreviousNext's Pinto module defines each component as a strictly typed PHP class reusing Storybook's Twig, so mistakes fail loudly (building a Pinto component (5:47–12:01)). Its author argued against YAML-based SDCs, but conceded that Canvas is tightly coupled to SDC and Pinto's Canvas integration isn't public yet (why not SDC (20:04–23:55)). An Australian Public Service developer found SDCs give structure but not isolation (structure, not isolation (4:47–8:14)). He wrapped Shoelace web components inside SDCs to survive a legacy Bootstrap theme, then packaged the pattern as a block type plus recipe for Layout Builder users (blocks for site builders (14:39–19:41)).

Front-end developers were also told to reach for JavaScript less. Container queries and :has() can run client-side filtering as a CSS state machine (container queries and :has() (3:59–7:04)), and the Popover API with anchor positioning replaces tooltip libraries (Popover and anchor positioning (9:42–16:16)). On the AI side, Acquia showed two routes from Lovable designs into Canvas. A direct export matches visually but hard-codes content (limits of hard-coded components (11:02–13:28)). The alternative is an agent guided by AGENTS.md rules, such as "anything with more than a handful of entries becomes a content type" (AGENTS.md rules (20:29–26:07)).

So what: SDCs are the shared contract for Canvas, so new component work should target them. Keep content structured even when AI generates the design, and drop JavaScript libraries the browser now replaces.

Building with AI agents: faster, and riskier

Alex Skrypnyk, maintainer of Vortex, gave the most detailed account of agent-driven Drupal delivery. A planning skill interviews you until the spec is clear (plan, spec and TDD (5:41–10:32)). The agent writes a failing Behat test first, and a pull-request loop runs CI and review bots before a human is called (the autonomous PR loop (10:32–16:32)). Architecture rules are encoded as CI scripts so that agent drift fails the build (architecture lint rules (16:32–20:25)). He was honest that agents drift and context switching is the real cost (mental load (27:10–32:35)). Annex Digital's testers use Cursor skills to draft test cases from Jira tickets into their test-management tool (AI-generated test cases (16:31–19:08)).

The security talk was the counterweight. Bastion Security's CTO catalogued vulnerability classes in vibe-coded apps (common vulnerability classes (2:31–5:20)), war stories of destructive agents and prompt injection (war stories (17:28–23:40)), and the move from "vibe coding" to "vibe engineering" (mitigations (23:40–27:46)). He noted there is no secure-coding rule set for Drupal agents yet, which is a gap the community could fill. amazee.io described governing AI as a platform first: an LLM proxy, spend limits per key and team, and region-locked models for data residency, including Australian inference on Bedrock (the control plane (6:32–10:33)). It also told the story of a $150,000 overnight bill caused by a pricing error (budgets and the bill (12:02–15:11)). A user researcher warned that understanding can't be outsourced, and that hallucination rises with each conversational turn (cognitive cost (16:25–20:30)).

So what: agents can deliver Drupal features when tests, CI rules and human review form the loop. Put spend limits, data residency and secure-coding rules in place before scaling them.

AI inside the CMS: context, search and the editor

Several talks converged on one idea: AI output is only as good as the content and context behind it. Salsa Digital's AI Context module stores rules as revisionable Drupal entities, scoped narrowly by use case, section, bundle or role, with the global scope kept tiny (scopes and global caution (8:13–11:42)). The speaker could not say where context ends and structured content begins (context versus structure (27:40–30:10)). Ruth and Co argued that content is infrastructure, citing GOV.UK Chat's finding that answers are only as good as the published pages (GOV.UK Chat (5:06–7:25)). She uses an LLM to find semantic duplication before designing a CMS (LLM content analysis (13:42–17:29)). Weave's content designers showed typed information types and page patterns for a state government site of about 10,000 pages (information types and patterns (7:11–11:53)), and argued that web pages should feel as complete and bounded as a good PDF (accordions, word counts and labels (14:26–17:54)).

On search, PreviousNext built hybrid semantic search with retrieval-augmented answers in OpenSearch. It weights semantic results 70% and keyword 30%, feeds the top five results to the model, and lazy-loads the summary with a cost cut-off switch (the OpenSearch setup (16:59–22:39), cost and latency (22:39–26:12)). A Canberra agency argued the editor's experience is Drupal's most undervalued AI opportunity: suggested metadata, alt-text sweeps and duplicate detection (the publisher experience (12:11–17:51)). It also said interfaces should cue users when search starts answering plain-language questions (plain-language users (4:26–8:07)). An analytics consultant offered an early signal of AI Overviews: Search Console impressions rising while clicks stay flat (signals of AI discovery (1:36–4:44)).

So what: before buying AI features, invest in typed content, single sources of truth and written rules. That work improves search, AI answers and the editor's experience at once.

A hostile web: bots, scrapers and agents

Two talks reached the same conclusion from different angles. Sean Hamlin showed why the old playbook fails: residential proxies and curl-impersonate present home IPs and Chrome-identical TLS fingerprints (why blocking fails (1:05–4:32)). His recommended layers are Facet Bot Blocker for faceted search (Drupal-native options (4:32–7:57)), Anubis proof-of-work in front of expensive routes, and keeping bot rules in the site's own repository. Separating logged-in editors from bots upstream remains hard (authenticated traffic (23:58–26:30)). Janna Malikova told site owners to read raw access logs, because analytics filters bots out and CDNs miss disguised ones (known bots versus disguised scrapers (4:46–8:15)). Her tricks: a "canary" URL that appears only in the sitemap, lazy-loading paid scripts so crawlers don't run up bills (canary and lazy-loading (7:02–9:38)), and serving AI bots Markdown (Markdown and llms.txt (9:38–12:05)). PreviousNext added 404 pages to its load-test scenarios because bots hammer them (K6 scenarios and 404s (13:33–19:15)).

So what: decide which bots bring value and serve them cheaply; throttle or challenge the rest at the routes that cost money. Expect agent-driven real browsers to get through anyway.

Security, performance and operations

The region's hosting teams brought unusually practical sessions. PreviousNext's Skpr team automates security. PHPStan is the foundation, and a broken dependency update gets pinned and ticketed so the bot keeps upgrading everything else (pinning and cooldowns (7:51–11:23)). A one-minute OWASP ZAP baseline runs on every PR, with a full scan weekly against a disposable environment (ZAP baseline versus full (14:38–18:09)). The OSV work means Drupal advisories now sit in a cross-ecosystem database (converting advisories (7:56–12:05)). The same speaker suggested a central scanner that ignores every "accepted risk" once a week (ignore the ignores (22:56–25:43)). Morpht's Marji Cermak argued that content moderation is a security control under Australia's PSPF and ISM (content as a security surface (2:31–4:41)). The talk showed a JSON-configured Cypress package that tests each role's access at each workflow state, installed live in about 15 minutes (the live install (12:26–16:04)).

On performance, PreviousNext warned that one component missing cache metadata can make a whole page uncacheable (the max-age 0 pitfall (20:23–23:40)). It also suggested adding network latency locally to expose chatty database access (local profiling (23:40–28:29)). Catalyst's OpenTelemetry work proved Solr took only 248 ms of a four-second request (the Solr span (20:00–22:49)), and its SPX profiling found a two-second-per-result access check hidden in a contrib theme (the flame graph (2:16–5:53)). The nsw.gov.au Valkey story showed why a cache clear with the Redis module can be expensive (why misses aren't instant (3:23–5:39)). For local and hosted environments, there were sessions on extending DDEV (custom commands and corporate certificates (16:21–20:21)) and on running Drupal declaratively on NixOS, still in beta (the NixOS demo (14:20–19:56)).

So what: most of this is cheap to adopt now: OSV scanning, a weekly ZAP run, workflow tests, cacheability checks and OpenTelemetry. Together they turn security and performance from audits into routine.

Government delivery: smaller, faster, closer

Government talks split on method but agreed on the problem. X Equals argued that procurement demanding false certainty causes waste (failure modes (6:30–10:38)), and that proximity is the "killer app": a day each sprint in the agency's office (get in the room (10:38–14:30)). Its Department of Conservation weed tool runs on Drupal 11 with a Python alert engine (the weed tool stack (14:30–20:17)). EY's Ian Laslett took the enterprise view: at scale, trust, governance and process redesign outweigh the build. He has seen two or three developers cost $10m because of six months of paperwork (why the tech blitz fails (11:51–15:12)). He would keep Drupal as the trusted content core rather than a workflow engine (what Drupal is for (18:26–22:20)). Catalyst's head of delivery admitted a year of failed pitches: every technical Drupal strength (no licence fees, no lock-in) has a ready counter-argument, so sell outcomes and a vision instead (the objections (5:12–10:54), six lessons (19:01–24:23)).

Accessibility was treated as a delivery practice, not a checklist. Health New Zealand's chief advisor on disability said consultation feedback has barely changed in a decade and that disability data is a black hole (the 17%, 34%, 51% figures (5:38–10:21)). The talk warned that replacing phone channels with digital-only booking quietly excludes people (the MVP trap (14:16–18:39)). NZ's CWAC crawler adds tests that axe-core lacks, such as keyboard focus by pixel comparison and reflow at 320px (custom tests (6:41–9:29)), and becomes a service from July (the roadmap (16:10–18:36)). A Canberra consultancy shared workshop methods, such as a confidence "vibe check" that exposes gaps between leaders and operational staff (favourite activities (9:49–14:00)).

So what: government buyers are being told, from inside government, to fund small slices and work closely with suppliers. Agencies that can show fast, close, accessible delivery have an opening.

The market, agencies and the community

PreviousNext's Owen Lansbury put the downturn in context: global, not Drupal-specific, with client budgets "generally halved" (the global downturn (1:13–5:48)). Drupal installs have fallen about 40% since 2014, mostly as Drupal 7 retires, while modern Drupal sits around 500,000 sites and ranks second among high-traffic sites (the market numbers (5:48–12:20)). Some of his figures were garbled in the recording. His advice: become a certified partner, join the AI and marketing initiatives, and contribute (five takeaways (22:08–27:55)). Several talks showed Drupal as a back end beyond websites. The Diggers Club embeds Drupal tools inside the Shopify admin after leaving NetSuite (Drupal inside Shopify (18:30–23:51)). Xequals runs games and a ticketing product on core permissions and JSON:API (permissioned, connected data (2:12–5:47)). The Pacific Community went from a decoupled Next.js site back to full Drupal for a small, form-heavy site (static to Drupal and back (5:14–8:44)).

The community conversation was about sustainability. The steering committee wants a vendor checklist in GovCMS panel contracts and is weighing independence from Linux Australia. Meetups are shrinking while AI meetups fill, so the committee floated joint open-source CMS events (meetups and joint events (15:14–19:52)).

So what: the market is smaller and more price-pressured, but Drupal holds its high-end position. Certification, contribution and a credible buyer checklist are becoming how serious agencies distinguish themselves.

Technologies and tools

Sorted by attention received. The signal is a read for a typical Drupal team: adopt now, watch (promising, gaps remain), or hype (claims ahead of evidence).

Tensions and open questions

• Cheaper for whom? Every keynote celebrated falling build costs; agency speakers reported halved budgets, clients demanding 25% annual savings, and fear that Drupal CMS shrinks projects.
• Templates: shop front or business card? The product lead wants 100+ templates and a marketplace with buy paths; the people building them see no upgrade path, uncertain revenue, and buyers who will expect SaaS-like support.
• Small and fast, or governed and slow. X Equals and the keynotes argued small local teams beat big programmes; EY argued governance and trust dominate at scale, even if it means $10m for a few developers.
• AI speed versus AI safety. Coding-agent talks showed autonomous loops; the security talk said quality degrades with each revision and agent errors compound; there is no Drupal secure-coding rule set yet.
• Context or content? Context modules put brand and structure rules into prose for AI; content designers argued for typed content and patterns; nobody could say where one ends and the other begins.
• Block bots or serve them. Hosting teams put proof-of-work in front of routes; other speakers serve bots Markdown and llms.txt to stay visible in AI answers. Real browsers driven by agents beat both.
• Canvas versus the rest. Canvas is Drupal's page builder, but GovCMS won't have it, Pinto has no public Canvas integration, node editing is weak, and Layout Builder and Paragraphs remain the practical choice for many.
• Numbers that don't add up. Several talks leaned on unsourced or garbled figures: bot shares from CDN dashboards, made-up cost comparisons, implausible market statistics. Treat headline numbers with care.

Talk index

Some speaker and company names are uncertain in the auto-generated captions.

Key takeaways

Evaluators of Drupal

• New: Drupal CMS 2 with Canvas and site templates makes small Drupal sites economic for the first time.
• Proven: government-scale sites (nsw.gov.au, NZ agencies) and non-web uses from Shopify tooling to ticketing.
• Still early: marketplace buying, multilingual Canvas and adoption data, which is three months old.
• Ask any vendor: do they contribute, and how do they test security and editorial workflows automatically?

Editors

• AI will increasingly suggest metadata, alt text and links; you approve.
• Clear, typed content with one source of truth is what makes AI answers right.
• Your workflow permissions are a security control; expect them to be tested.

Marketers

• Rising impressions with flat clicks means AI Overviews are answering for you.
• Sell outcomes and vision, not open source or flexibility.
• Write brand rules down as concrete, checkable examples; AI will follow them.

Site owners

• Read your raw logs: a large share of traffic may be bots that analytics hides.
• Protect search, login and forms first; they are the expensive routes.
• Check cacheability: one component can make a page uncacheable.

Developers

• Add OSV-Scanner and a weekly ZAP scan to CI; pin and ticket broken updates.
• If you use agents, keep runs short, test first, and lint architecture in CI.
• Profile with realistic latency, and use OpenTelemetry spans to find the slow layer.

Site builders

• Recipes apply safely to existing sites when config strict is false.
• Drush site export turns any site into a template recipe.
• Block types plus recipes can make components placeable without developers.

Themers

• Target SDCs; they are Canvas's contract, and keep them platform-agnostic.
• Use container queries, :has() and the Popover API before reaching for JavaScript.
• Design tokens and variant props let one theme serve many brands.

The Drupal community

• DrupalSouth goes to the Gold Coast next, then Canberra in 2028.
• Write a Drupal secure-coding rule set for AI agents; none exists yet.
• Help sell Drupal on outcomes and sovereignty, not on being open source.
• Contribute: Drupal CMS needs contributors in our time zones.

AI Generated. Sources: the DrupalSouth Wellington 2026 session recordings on YouTube.