Stable release with security coverage. Supports D8 through D11. Contributors (16) dww, bluegeek9, Nikolay Shapovalov, dcam, supreetam09, benstallings, chi, saidatom, bharath-kondeti, anybody, sandeep sanwale, benjifisher, beloglazov91, damien laguerre, klausi, Anjali Mehta, geek-merlin Changelog Issues: 9 issues resolved.
something I'm finding frustrating recently is
a) I feel like LLMs have helped me learn some programming things that were hard for me to learn previously
b) I'm tired of LLMs being relentlessly pushed on us and do not want to participate in that by talking about my positive experiences
c) there are also lots of hazards associated with using LLMs to generate code that are not that easy to avoid
Want to bring that DrupalCon energy to Canada next year? 🇨🇦
The Canadian Drupal community is planning the first-ever DrupalCan Summit 2027, and they need your help to decide the host city!
Take a moment to shape the future of this landmark event by filling out this quick survey ➡️ https://forms.gle/zcrGxqSYDvJnZucv6
I've just finished reading The Faith of Beasts, by James S. A. Corey.
It's the second book in The Captives' War series, and by the same authors that wrote The Expense series of books and TV series.
It's an excellent read, and I can't wait for the third one in the series, and hopefully a TV series too.
⛔ Composer dependency policies block flagged malware by default, but only on 2.10. A project disabling the policy, or a CI image running Composer 2.4, still installs flagged versions normally until we can manually pull it from Packagist.
Private Packagist now refuses to serve dist files for malware-flagged versions at the repository level, regardless of the Composer version requesting them. Enabled by default for new and existing organizations.

This is the next post in our supply chain security series, following the supply chain security update, the Composer 2.10 release, and the recent post on closing Composer's download fallback paths. Composer 2.10's dependency policy framework is a substantial step forward for PHP supply chain security. It removes
I'm close to relaunching an ambitious remake of one of my oldest #Drupal projects and as part of my approach, I went in hard on Single Directory Components (SDC).
The opinionated advice on these Components is that everything should be one. Stop using anything but components. After slogging through a very complex project attempting to follow that advice, I've come to disagree.
What's great about SDCs is they encapsulate just about everything about an element within a single folder for easy reference, but it's a pipe dream to think we're ever going to be able to keep *everything* so tidy.
Consequently, making everything a component defeats the purpose. It creates a fog of excess code and makes it hard to identify what really matters.
My conclusion about best practices (for full stack developers) with SDC is that you shouldn't use them when there's no reason to use one. I really like the added options I have in structuring my sites with them, but the benefits are lost when taken to extremes.