Drupal Development

Or in other words - collecting and accessing services from the container, without injecting the whole container.

With some recent security advisories for Cross Site Scripting (XSS), it feels like an opportune time to remind those who author Twig templates for Drupal:
If you're using Twig's |raw filter, you're probably doing it wrong
 

We recently shipped semantic search on GovCMS for Cancer Australia, the national agency for cancer control. It's backed by OpenSearch and AWS Bedrock, with AI-generated answers layered on top of the results. Here's how we built it, and how it's hosted.

Recently, we worked on a project for Catholic Schools NSW, where one of the key requirements was controlling access to content. Some pages and resources needed to be available only to authenticated users, while the rest of the site remained publicly accessible. 

That requirement didn’t stop at the website itself, but it also extended to search. Authenticated users needed to see protected content in their results, while anonymous visitors should only see public content. 

This presented an interesting challenge. In a decoupled architecture, search doesn’t automatically inherit Drupal’s access controls, so we needed a way to make search permission-aware without compromising performance. We used OpenSearch to build a solution that ensured users only saw content they were authorised to access, while keeping the search experience seamless. 

Drupal 11.4 is here. Several features landing in this cycle, and across the broader 11.x series, trace back to ideas we explored in contrib first. Worth noting too: Drupal major releases don't introduce new features. The real architectural work happens in the minors, and by the time 12.0 arrives, much of it will already be available, paving the way for the next series of improvements in 12.x.

Here's what we've been working on, and what else is worth knowing about.

Way back in 2017, Lee “larowlan” Rowlands penned what would become one of the most popular blog posts on this site. I’m of course talking about “Safely extending Drupal 8 plugin classes without fear of constructor changes”. 

This well-read article, inspired by Thomas Seidl of Search API fame, has become somewhat of a reference piece, frequently cited in: 

• blog posts
• change records
• Github issues
• Drupal Slack threads (search for "fear of constructor changes"), and 
• StackExchange answers (remember those?)

As of Drupal 11.4, there is a new approach using attributes that simplifies this further. So, I thought it would be fun to piggyback off Lee's success prudent to update the original post so modern developers (both human and robots) are in the loop.

But first, a quick recap of how dependency injection has evolved in Symfony and Drupal over the years. You can skip to the end if you’re not interested.

Sharing content between sites has long been a common problem. However, Drupal offers a multitude of solutions to address this issue. 

Together with Paper Moose, we teamed up with Cancer Australia to rebuild their consolidated website on GovCMS PaaS. This was our first live Drupal 11 website project. 

Learn how we built our most modern website to date with GovCMS.

Accessibility goes beyond compliance: it’s not about robots reading your site, but about people being able to use it with ease.

You've probably seen some excitement in the Drupal community around Experience Builder. The current version (0.5.0-alpha1) shows a giant leap forward in Drupal's page building and editing experience.

Post co-authored with NSW Resources. A critical issue with the management of content currency on our Drupal website, nsw.gov.au/nswresources required an innovative solution to provide us with an automated content audit process. 

The Drupal Association has published client guides to RFPs that prioritise open source software solutions.