Craft's fields/merge and entry-types/merge commands consolidate duplicate fields and rewrite your project config — a version-controlled cleanup tool with no real Drupal-core equivalent. Then an Oct 8 bug showed merges silently skipping field condition rules and Content Block fields. How to run it safely.
The Craft 6 alpha ships built-in Model Context Protocol servers that let an AI inspect and edit content, the content model and project config. The interesting part isn't the AI — it's the permissions design: OAuth 2.1, an explicit 'Use Craft MCP' permission, public access off by default, and writes that land as drafts.
An eager-loaded Matrix relation with orderBy and limit:1 returned the wrong row and said nothing. The fix adds an allowlist of 'safe' sort forms — the fingerprint of a security fix, because the same criteria-cleansing path produced two High-severity advisories this autumn.
Craft ships a security fix with only a severity and a GHSA ID, then publishes the full write-up about a month later in batches. I counted 128 advisory IDs in ten months and measured the real release-to-advisory gaps. A field guide to treating the changelog line as the alarm.
Craft and Drupal both theme with Twig, which fools you into thinking the front end will feel familiar. It doesn't — the template IS the controller, and query and cache discipline quietly become yours.
Craft added an opt-in Twig sandbox in 5.9, and all through 2026 it has kept producing authenticated-RCE advisories. A Drupal dev's notes on why letting editors run Twig is a privilege-escalation feature wherever you do it.
A Drupal dev's honest audit of Craft's out-of-the-box editor experience — first-class drafts and live preview that out-polish Drupal, parity on transforms and exports, and the one real gap: no approval workflow.
Opening Craft's Plugin Store and seeing a price on the field type you need is a values-level culture shock for a Drupal dev used to free GPL contrib. How the money works (20% cut, one-time + annual renewal), why the paid model is a feature disguised as a tax (maintenance funded by self-interest, not goodwill), and the real lock-in: 'we stopped paying' and 'we stopped getting security updates' are the same sentence.
The thing that made Craft feel different from Drupal wasn't a missing feature — it was a missing screen. There's no Views UI; you fetch content by writing element queries (a fluent Twig/PHP API) or hitting Craft's free first-party GraphQL. For a developer that's mostly better — all in code, all reviewable. For the site builder who shipped listings without a developer, it's a real loss worth naming.
My reflex to Craft's own managed hosting was the self-hoster's sneer — why pay for what I can run myself? But Craft Cloud isn't competing with my VPS's price; it's competing with my weekends and my bus factor, and that's a fairer fight than I wanted. What it includes, the lock-in the abstractions hide, and when managed hosting is the rational call vs. self-hosting pride.
