"Anemone": The brief tale of a Drupal core security advisory xjm Sat, 06/28/2025 - 15:03 A long while back, security researcher Sam Mortenson reported a cross-site scripting vulnerability in Drupal core's Link module. Essentially, the options property on link fields was not being properly sanitized. This meant cross-site scripting was possible under some circumstances -- and, as always for…
New core committer sponsors: HeroDevs, Salsa Digital, and... maybe you? xjm Fri, 10/13/2023 - 16:43 Great news: After a three-month search, I'm now contracting with two sponsors who are funding a total of 60% of my time for Drupal core release management. Let me introduce you!
Why sponsor a core committer? xjm Wed, 12/21/2022 - 19:40 This post was collaboratively authored with other Drupal core committers including quietone , pameeela , catch , effulgentsia , larowlan , lauriii , and Dries .
Fund xjm as a Drupal core release manager xjm Mon, 12/05/2022 - 12:44 Hi, I'm xjm. I'm a Drupal core committer , one of eighteen people who are trusted to accept (merge) code changes to the Drupal project for the hundreds of thousands of sites that rely on it. My role on the committer team is that of a release manager. We're the folks who actually create the Drupal core releases that you can…
Security, Drupal 9, and Navigating the Changing Web Landscape (DrupalSouth 2019 keynote) xjm Sun, 12/22/2019 - 19:28 Back in 2013, I led the core contribution mentoring day at DrupalCon Sydney . I'd already flown from the US to Europe three times at that point (first for Drupal Developer Days Barcelona , then for DrupalCon Munich and the Paris VDC sprint, and finally for a whirlwind 72 hours in…
Help triage major bugs at the Florida DrupalCamp or your local camp (yes, you!) xjm Tue, 02/14/2017 - 22:35 Florida Drupalcamp 2017 is less than a week away, February 17-19, in vibrant Orlando. Not only is the camp schedule packed with great sessions and trainings, but there's also a contribution sprint that both helps Drupal 8 core maintainers, and gives you a chance to contribute and learn about…
Join the Drupal 8 major triage at DrupalCon New Orleans xjm Tue, 04/26/2016 - 22:57 On April 20, five months after the launch of Drupal 8.0.0, we released Drupal 8.1.0 , the first scheduled minor update. Drupal 8.1.0 comes with both new features and bug fixes that were not eligible for monthly patch releases. Now is a great time to try Drupal 8 if you haven't yet! Drupal 8.1.0 is production-ready,…
Emacs keybindings, PhpStorm, Mac OS, and the random characters I almost add to Drupal xjm Mon, 02/01/2016 - 14:41 Drupal 8 developers, as a whole, are a bit gushy about PhpStorm . I use it; it's useful. But a decade and a half of my programmer muscle memory is Emacs keybindings, so when I use a different tool than Emacs, I feel like I'm trying to cut vegetables with a mallet, or write with a wad…
Getting Drupal 8 done: DrupalCon Los Angeles sprints xjm Thu, 05/07/2015 - 23:51 The DrupalCon Los Angeles extended sprints start this Saturday, May 9, and the main sprint day on Friday, May 15 is just a little over a week away. I'll be leading a Drupal 8 Critical Burndown sprint to help get D8 done, and kgoel and cilefen will be leading a sprint to triage Drupal 8 majors. And we need your help!…
Contribution, Influence, and Drupal 8 xjm Mon, 03/09/2015 - 22:11 The most recent issue of Drupal Watchdog includes an article on software freedom and social change in Drupal . While this article raises a number of thoughtful questions about the social implications of the Drupal community's evolution, it includes some misinformation (both because it misrepresents the data that are easily available…