Talking Drupal

Today we are talking about Drupal 12, Field UI and UX. We'll also cover DruBOM as our module of the week.
For show notes visit:
https://www.talkingDrupal.com/577
Topics
Drupal 12 Release Prep
Release Cadence Debate
Field UI Modal UX Issues
Button Confusion
Modal UX Patterns
Evidence Based UX
Muscle Memory Traps
Jakobs Law Explained
Listener Feedback
PHP Vulnerability Breakdown
Security Hygiene Automation
Vendor Module Support
Resources
Drupal 12 Deprecation Status Summary
Jakob's law Nielson
Laws of UX
Hosts
Nic Laflin - nLighteneddevelopment.com nicxvan
John Picozzi - epam.com johnpicozzi
Emma Horrell - emma-horrell
MOTW
Correspondent
Martin Anderson-Clutz - mandclu.com mandclu
Brief description: Have you ever wanted a full inventory of everything your Drupal site is built from, checked against public security advisories, and exportable as a standard SBOM? There's a module for that.

Module name/project name: DruBOM - Drupal Bill of Materials (SBOM)

Brief history How old: created in Oct 2023 by Paolo Mainardi (paolomainardi) of SparkFabrik, and rewritten this fall
Versions available: 1.0.0-beta4, which works with Drupal 11.3 and 12
Maintainership
Actively maintained, latest release and latest commit both just this past Sunday
Security coverage: opted in, though there's no stable release yet
Test coverage
Documentation: an in-depth README, plus separate docs on the advisory sources and on scanning in CI
Number of open issues: 4 open issues, none of which are bugs, and one of them is the plan for a stable release

Usage stats: 9 sites

Module features and usage SBOM stands for software bill of materials, a list of every component a site is built from, with its version, license, and source. Auditors, security teams, and customers are asking for them more and more
DruBOM takes a snapshot that covers the PHP runtime and its extensions, Composer packages, Drupal modules and themes, asset libraries like jQuery and CKEditor 5, and npm, Yarn, and pnpm lockfiles in your themes and modules
Anything it can't read shows up as a coverage gap. Gaps are always listed, never hidden
Advisory checks are opt-in. You can check against drupal.org security advisories, the Packagist advisory database, OSV.dev for npm, and the PHP project's own advisories
Packages from private repositories are never sent out, and you can list private npm scopes to keep them out of advisory checks too
Findings that appear in the CISA or ENISA catalogs of known exploited vulnerabilities get flagged and go to the top of the list
For each finding you can record a decision on whether your site is actually affected, called a VEX statement. A decision applies only to that exact package version and gets confirmed again after each new snapshot
The admin dashboard under Reports has an interactive dependency map, so you can see which Drupal project brought in some deep npm package
For CI, drush drubom:check can fail a pipeline when open findings hit a severity threshold, and the export is a standard SPDX 3.0.1 document ready for auditors
Under the hood, it's all pure PHP now. The original version wrapped the Syft and Grype binaries, and the rewrite dropped them. Running drush updb saves your old reports as files before removing the old settings
There's also a bin/drubom-scan script that builds the SBOM from the codebase files without running any of the site's code. That's useful when an auditor shouldn't have to trust the site, or after a suspected compromise
Caveats: you need a private file system, and few security tools read SPDX 3 yet
Update Status in core is the obvious comparison. Both tell you when something on your site has a security advisory, but Update Status checks drupal.org release data for Drupal projects only. DruBOM builds its inventory from lockfiles and the codebase, so it also covers Composer, npm, libraries, and PHP, and matches advisories against exact versions

Today we are talking about AI, Drupal, and what's new with guests Dr. Christoph Breidert & Scott Falconer. We'll also cover Drupal AI Demo as our module of the week.
For show notes visit:
https://www.talkingDrupal.com/576
Topics
Inside vs Outside AI
Agent Permissions and Scoping
Drupal Org and GitLab Future
Outside AI Examples Teaser
Why CMS Still Matters
Agent Swarms Expose Data
Shadow IT And Liability
CMS As Context Engine
Content Governance At Scale
Provenance And Regulation
MCP And Client Integrations
Rosetta Sprint Challenges
Keeping Up With AI
Resources
Drupal AI Initiative: introducing Inside AI and Outside AI
Guests
Christoph Breidert - 1xINTERNET.com breidert
Scott Falconer - managing-ai.com scott-falconer
Hosts
Nic Laflin - nLighteneddevelopment.com nicxvan
John Picozzi - epam.com johnpicozzi
MOTW
Correspondent
Martin Anderson-Clutz - mandclu.com mandclu
Brief description: Have you ever wanted to try out all of Drupal's AI features on a realistic site, and then pop the hood to see exactly how they're configured? There's a demo for that.

Module name/project name: Drupal AI Demo
https://new.drupal.org/ai/demo

Brief history How old: project created on Oct 4, 2026 by Christoph Breidert (breidert), a Drupal AI Product Lead, with support from 1xINTERNET, FreelyGive, and Foster Interactive. The demo itself was revealed in the Driesnote at DrupalCon Rotterdam
The demo runs on Drupal CMS with the Drupal AI modules, running on Drupal 11.4

Maintainership Looks to be actively maintained
Documentation: the project has a README that is really clear about what you can try and who has access to what
Number of open issues: 83, 2 of which are bugs

Module features and usage The demo is a site for Northmoor University, a fictional coastal university, with realistic programs, news, events, people, and images
You launch your own copy for free through Drupal Forge. No install, no config, no credit card, and AI credits are included, courtesy of amazee.ai. Each demo instance lasts 30 days
Features include AI search with cited answers, page generation in Canvas, content review, auto-classification, translation, image validation, image generation and alt text, AI disclosure labels, observability, and an MCP server so tools like Claude can work with the site's content
Each feature has a step-by-step explainer page in an "AI Features" section, right in the demo site
The best part is you have full admin access, so every agent, prompt, index, and view is right there to inspect, tweak, or rebuild on your own site
Lots of the features are public recipes you can use today, like AI Answers, AI Image Alt Text, AI Content Classification, and AI SEO Optimizer
The big caveat: the ai_demo project is really a placeholder. It's the README plus the issue queue. The actual build (content, theme, demo-specific recipes, deployment) lives in a private GitLab repo for Drupal AI Partners
So the project's real job is feedback: issue templates for bugs, feature requests, feature-page fixes, and plans, each tagged by demo component. Fixes show up the next time you launch a new copy
The build was a big community effort: from August to late September, more than 100 contributors, 1,442 commits across 54 projects, and 616 merged MRs, adding roughly 596,000 lines of code
Back in episode #529 we covered the AI Ecosystem Recipe, and both are about getting the Drupal AI stack in front of you fast. The difference is mechanism: the recipe applies the AI modules to your own site for you to configure, while the demo is a fully-baked, hosted instance with content and prompts already tuned, so you can not only try out but also reverse-engineer a working setup

In a Talking Drupal Cafe conversation, Stephen Cross chats with recent Talking Drupal Guest Host, Tim "Tea Sharp," a relatively new Drupal user at Appalachian State University, starting with a light discussion about a 3:00 PM drink before digging into Tim's path from sustainability science and design through nonprofit work, WordPress site building, and finally Drupal in higher ed. Tim describes learning Drupal 7, discovering Views, and then helping his team manually consolidate hundreds of departmental subdomain sites while migrating to Drupal 10 using a product approach and a shared distribution initially built with Lullabot. He discusses training and documentation for non-technical site managers, professional development through DrupalCon Atlanta and Drupal Camp Asheville, interest in Drupal AI for tasks like alt text generation, and aspirations to keep speaking, contribute more, and improve module discoverability and documentation.
For show notes visit:
https://www.talkingDrupal.com/cafe021
Topics
Finding Talking Drupal
From Sustainability to Design
Pandemic Pivot to Web
WordPress Site Builder Era
Discovering Drupal at App State
Drupal 10 Rebuild and Consolidation
Team Structure and Iteration
AI in Drupal Workflows
Upgrade Blockers Cleared
Aspiring Drupal Speaker
Raycast Productivity Talk
Stage Fright Reframed
Posting Beyond Comfort
Finding a Username
Joining Talking Drupal
Better Module Discovery
Open Source Burnout Lessons
Why More TD Cafe
Final Encouragement
Tim Sharp
Tim is a self-taught Web Developer at Appalachian State University in Boone, North Carolina. At App State, he works with a team of developers to support over 300 websites. Tim is passionate about community organizing and recently became a co-organizer of Drupal Camp Asheville.
Stephen Cross
Stephen is the founder of Talking Drupal and Drupal Developer.
Guests
Tim Sharp - tea-sharp
Stephen Cross - stephencross

Today we are talking about Drupal Advocacy, Non-Code Contribution, and the future with guest Tiffany Farriss. We'll also cover Better Social Sharing Buttons as our module of the week.
For show notes visit:
https://www.talkingDrupal.com/575
Topics
Tiffany New DA Role
Sustaining Drupal Next 25
Time Box And Priorities
Three Bucket Strategy
Fixing DA Finances
Transparency And Trust
Trust Through Transparency
What Advocacy Solves
Why Reputation Lags
From Scattered To Focused
Beyond The Drupal Bubble
Problem First Storytelling
Proof Over Promotion
Scaling Non Code Contributions
Funding Drupal Sustainability
Success Metrics
Resources
Drupal Advocacy Program
Guests
Tiffany Farriss - association.drupal.org farriss
Hosts
Nic Laflin - nLighteneddevelopment.com nicxvan
John Picozzi - epam.com johnpicozzi
Tim Sharp - tea-sharp
MOTW
Correspondent
Martin Anderson-Clutz - mandclu.com mandclu
Brief description: Have you ever wanted to let visitors share your content on social media, without loading any tracking scripts or third-party JavaScript? There's a module for that.

Module name/project name: Better Social Sharing Buttons

Brief history How old: created in Aug 2018 by Joery Lemmens (flyke), though recent releases are by Shelane French (shelane)
Versions available: 5.0.0, which works with Drupal 10.1, 11, and 12

Maintainership Actively maintained, latest release in July, adding Drupal 12 support
Security coverage
Number of open issues: 17, 5 of which are bugs against older branches

Usage stats: 8,347 sites

Module features and usage Supports 16 services, including Facebook, X, LinkedIn, Bluesky, Reddit, Pinterest, WhatsApp, Telegram, and email, plus handy extras like print and copy link
Each button is just a plain link to that service's share URL, opening in a new tab. No trackers, no external API calls, no ad servers
That's a nice win for performance, and for privacy and GDPR, since nothing third-party loads until a visitor actually clicks
You can place it as a block, as a pseudo field on nodes or paragraphs, or call it from Twig with Twig Tweak
The global settings form lets you enable services and drag them into order, and each block instance can override that list, the icon set, and the sizing
The module comes with two icon sets: colored squares, which become round if you set the radius to 100%, or flat icons you can color with a CSS fill. The colored set also exposes CSS custom properties, so you can re-brand it from your theme
The icons are minified SVGs in a single sprite, so they load once no matter how many buttons are on the page
There's also a per-node submodule: enable it per content type, and editors with the right permission get a checkbox to turn sharing on or off for individual nodes
Under the hood it's nearly all Twig, one template partial per service, with just a little JavaScript for copy link, print, and Bluesky. Copy link even uses an aria-live region to announce the confirmation to screen readers
The block uses the current page's URL and title, so it works on user and term pages too, while the field version shares the node's own URL and title
Developers can tweak what gets shared with an alter hook on the block's items
Caveats: Facebook Messenger needs a Facebook App ID, and Metatag is recommended so services get proper Open Graph previews, and if a service changes its share URL format, the module needs an update
Back in episode #548 we covered Social Media Links, and the two look similar: both give you a block of social network icons, with a choice of icon sets. But they solve opposite problems. Social Media Links is "follow us": it links out to your own profiles, using URLs you configure in the block or a field. Better Social Sharing Buttons is "share this": it builds each link on the fly from the current page's title and URL. So plenty of sites could use both

Today we are talking about the UN, Open Source, and Drupal with guests Tim Lehnen & Henry Poole. We'll also cover Live Update as our module of the week.
For show notes visit:
https://www.talkingDrupal.com/574
Topics
What Is UN Open Source Week
Why Open Source Fits UN Goals
Who Attends and What Tech Is There
Conference Audience and DPI DPG
Drupal as a Digital Public Good
UN Uses Drupal at Scale
Why Attend and What to Gain
Upstream First Contracting
Open Procurement Curriculum
Reaching Procurement Conferences
Steering Spend Upstream
Funding Open Source Legally
Talking Louder Beyond Drupal
Digital Sovereignty Explained
Governance Values Matter
Fixing Funding Perception
Community Next Steps Closing
Resources
Appalachia
Omar Mohsine
Digital public infrastructure - DPI
Digital public good - DPG
ShareIT act Agencies need to use open source
PDF: https://www.govinfo.gov/content/pkg/COMPS-17951/pdf/COMPS-17951.pdf

Ditap
NCMA
Sovereign tech agency
Palantir blog
Eva black - Four opens
FSF - Four freedoms
Drupal's open web manifesto https://www.drupal.org/association/open-web-manifesto
https://openwebsitealliance.org/charter.html#open-web-manifesto

Guests
Henry Poole - civicactions.com henry-poole
Tim Lehnen - drupal.org hestenet
Hosts
Nic Laflin - nLighteneddevelopment.com nicxvan
John Picozzi - epam.com johnpicozzi
Tim Sharp - tea-sharp
MOTW
Correspondent
Martin Anderson-Clutz - mandclu.com mandclu
Brief description: Have you ever wanted parts of your Drupal pages, like blocks, views, or notifications, to update in real time without a page refresh, and without having to stand up extra infrastructure to do it? There's a module for that.

Module name/project name: Live Update

Brief history How old: created in Sep 2026 by Alessandro Feijó (afeijo) of Mindcore
Versions available: 1.0.0-alpha6, which works with Drupal 11 and 12

Maintainership Actively maintained, latest release just a week ago
No security coverage yet, since it was just created and only has alpha releases
Test coverage
Documentation: a detailed README, plus a roadmap doc and a built-in demo page
Number of open issues: none

Usage stats: 14 sites

Module features and usage Live Update positions itself as a generic real-time event layer for Drupal: modules publish events to named channels, and browsers subscribed to those channels update just the affected part of the page
Out of the box it uses plain HTTP polling back to Drupal, every 5 seconds by default, so it works on pretty much any host with no extra services
The transport is pluggable, though. Set it to automatic and it'll try WebSockets first, then an experimental Server-Sent Events submodule, then fall back to polling
For site builders, the base module adds an "Update this block live" checkbox to any block in the block layout, no code needed
There's also a whole suite of submodules: live-refreshing Views displays, single-entity updates, user presence blocks like "who's viewing this page", a notification bell with toasts, queue progress monitoring, remote JSON API tables, and an admin dashboard with an event monitor
One I think editorial teams will like: Live Update Form, which warns you when someone else is editing the same content you are
For developers, publishing is one line, a liveupdate_publish() helper or an injectable service, and on the front end you can either use data attributes in your markup or subscribe through a small JavaScript API
Every channel is access-controlled, and modules can weigh in on who's allowed to subscribe through by implementing hook_liveupdate_channel_access()
Under the hood, events are stored in their own database table with an optional time-to-live, and expired ones get cleaned up on cron. Polling clients just ask for anything newer than the last event ID they saw
There's a solid set of Drush commands too, including one to publish a test event straight from the command line, which is handy for debugging
Caveat: this is very new and still alpha, so I'd treat it as one to watch and experiment with rather than deploy into production today
And if polling isn't enough for you, there's a companion project, Live Update Go: https://www.drupal.org/project/liveupdate_go
It's the push transport Live Update is designed around. A small Drupal module, plus a standalone gateway written in Go that gives browsers a native WebSocket connection
Drupal stays in charge: it checks channel access, hands the browser a short-lived signed token, and sends signed events to the gateway, which fans them out to connected clients
You run the gateway as its own service, with systemd or Docker, behind a TLS reverse proxy. The README is very clear that you shouldn't try to launch it from PHP
It can scale horizontally using Redis or Valkey pub/sub, one gateway can serve multiple Drupal sites with isolated tenants, and if it ever goes down, Live Update falls back automatically and switches back once it recovers
Same maintainer, created at the start of October, and also alpha, with an alpha1 release and one reported site so far