On July 22 the Drupal security team shipped ten contrib advisories — five with no fix, just 'uninstall it.' What 'unsupported' actually means (including why they all read 'Critical' regardless of real severity), why it keeps happening, and the audit I now run on my own composer.json.
Three core security advisories in a month, including a highly critical SQL injection in the database abstraction layer itself — exploited in the wild, anonymous, PostgreSQL-only. My blog runs MariaDB so I dodged it, but the JSON:API object-injection pair hit closer to home. What actually happened, and why serialized fields plus unserialize() are a bomb you keep in the building.
Attribute hooks have been stable since Drupal 11.1, so I converted this blog's SEO module from a procedural .module file to a #[Hook] class. The catch nobody mentions: procedural hooks aren't actually deprecated yet and won't be removed before Drupal 13, around 2028. What's worth doing now, what isn't, and the LegacyHook trap that quietly fires your hook twice.
OpenCode is my backup for when Claude Code taps out. A field note on provider-agnosticism — and why Copilot going token-based knocked it out of my daily-driver slot.
Field notes on running Drupal 10/11 on FrankenPHP in classic mode today, why worker mode is still off-limits for Drupal, and how it sits behind my Traefik/Coolify setup.
I built a real page in Drupal Canvas, the React page builder now default in Drupal CMS 2.0. Where the in-browser JSX workflow helps, and where my git instinct itches.
I pointed Upstash's Context7 MCP at Symfony, Laravel and Drupal contrib churn to see if its injected docs are current, complete, and worth the token budget.
Field notes on connecting a coding agent to a running Drupal install through the AI module's MCP server, and the governance gaps of letting it build content types and run actions.
A working Drupal dev's honest, first-person take on heading to DrupalCon Rotterdam this September: what it is, why 2026 matters, and my contribution-day nerves.
