Funding contribution

"Anemone": The brief tale of a Drupal core security advisory

xjm — Sat, 28 Jun 2025 20:03:10 +0000

"Anemone": The brief tale of a Drupal core security advisory xjm Sat, 06/28/2025 - 15:03

A long while back, security researcher Sam Mortenson reported a cross-site scripting vulnerability in Drupal core's Link module. Essentially, the options property on link fields was not being properly sanitized. This meant cross-site scripting was possible under some circumstances -- and, as always for cross-site scripting, we were concerned that the XSS could be combined with other attacks and escalated to more serious exploits.

New core committer sponsors: HeroDevs, Salsa Digital, and... maybe you?

xjm — Fri, 13 Oct 2023 21:43:15 +0000

New core committer sponsors: HeroDevs, Salsa Digital, and... maybe you? xjm Fri, 10/13/2023 - 16:43

Great news: After a three-month search, I'm now contracting with two sponsors who are funding a total of 60% of my time for Drupal core release management. Let me introduce you!

Why sponsor a core committer?

xjm — Thu, 22 Dec 2022 01:40:05 +0000

Why sponsor a core committer? xjm Wed, 12/21/2022 - 19:40

This post was collaboratively authored with other Drupal core committers including quietone, pameeela, catch, effulgentsia, larowlan, lauriii, and Dries.

Fund xjm as a Drupal core release manager

xjm — Mon, 05 Dec 2022 18:44:09 +0000

Fund xjm as a Drupal core release manager xjm Mon, 12/05/2022 - 12:44

Hi, I'm xjm. I'm a Drupal core committer, one of eighteen people who are trusted to accept (merge) code changes to the Drupal project for the hundreds of thousands of sites that rely on it.

My role on the committer team is that of a release manager. We're the folks who actually create the Drupal core releases that you can install on your site.

Contribution, Influence, and Drupal 8

xjm — Tue, 10 Mar 2015 03:11:53 +0000

Contribution, Influence, and Drupal 8 xjm Mon, 03/09/2015 - 22:11

The most recent issue of Drupal Watchdog includes an article on software freedom and social change in Drupal. While this article raises a number of thoughtful questions about the social implications of the Drupal community's evolution, it includes some misinformation (both because it misrepresents the data that are easily available and because it lacks data that are not easily available). In the first part of this post, I look at the specific information presented in the article and provide some more depth, including some first-hand information about Acquia, since I work in Acquia's Office of the CTO. In the second part, I explore how we can mitigate some of the concerns the article raises.