Security, Drupal 9, and Navigating the Changing Web Landscape
summary
Drupal 8 adopts semantic versioning, scheduled releases, and Composer to manage many third-party libraries (notably Symfony), which makes Drupal 9 effectively Drupal 8 minus deprecated code and with updated dependencies—targeted for June 2020 with December as fallback. Coordinated disclosure and security windows remain critical: about one in three security releases touch upstream libraries. Large JS stacks are a risk (the Admin UI React proof‑of‑concept has ~1,732 production deps), illustrated by incidents like left-pad breaking builds.
AI-written summary · about
chapters (16)
- 0:00Intro
- 1:53Scheduled releases, semantic versioning
- 2:38Modern tooling
- 8:03How Drupal practices coordinated disclsosure
- 10:35Zend & SA-CORE-2018-005: What almost happened
- 15:13Lightning 3.2.0
- 15:46Drawbacks of using Composer dependencies
- 19:58Drupal 8's JavaScript dependencies
- 21:39jQuery and jQuery UI, part 2
- 27:11Drupal and React
- 28:43npm micro-packages
- 31:46Auditing JavaScript dependency security
- 33:02Be careful about dependencies
- 33:44Keep dependencies updated, but locked
- 34:35Audit package security
- 36:36Drupal dependency release cycles
related talks
42mSecurity in Drupal: what can go wrong?
38mSecurity in Drupal 8: Tips and Tricks
40mSecuring your dependencies
36mOpenJS and Security Updates...
46mDrupal’s Scariest Things
34mStranger Danger: Finding Security Vulnerabilities Before They Find You!
48mImproving the Security of a Large Open Source Project One Step at a Time
40mResponsible Use of Node.js & Open Source Software Utilizing Best Practices at an...