Core

Hey Dreeps,

BAD Camp is around the corner, and our IO's are prepping! Read the latest updates from:
- WSCCI: http://drupal.org/community-initiatives/drupal-core#wscci
- Layouts: http://drupal.org/community-initiatives/drupal-core#layouts
- Multilingual: http://drupal.org/community-initiatives/drupal-core#d8mi

And, bonus, WSCCI meetings are now EVERY Tuesday and not every other tuesday in #drupal-wscci at 11-noon Central Time until further notice!

-Shannon

The Blocks and Layouts Initaitve has come a long way since its initial inception, and there are a lot of people working in this space right now. We had a phone call together (which is documented at https://docs.google.com/a/acquia.com/document/d/1sCAnSD6o7Q5sXo3H_cCRTyP...), and posted an updated roadmap that covers what each team is working on at http://drupal.org/node/1818142.

There are essentially five "prongs" of this initaitive, all working in parallel:

<

ul>

Security was always Drupal's highest priority. However, the theming system was never as secure we wished it was. We are proposing using Twig and its auto escape feature (although any auto escaping theme engine could be used). This raises the problem of double escapes. Read more on the problems and the suggested solutions at http://drupal.org/node/1818266 . Carefully thought out feedback would be much appreciated.

Drupal lacks an abstraction layer for handling anonymous users - Even worse: The fact that users and accounts are the same thing in Drupal unnecessarily complicates solutions that try to work with anonymous- and registered users alike. The core comment module illustrates this problem quite well and the contrib space is full of custom solutions that try to work around this problem e.g. for anonymous voting, CRM systems, etc.

Discuss whether to increase the issue count thresholds for major and critical tasks:
http://drupal.org/node/1810428

The following proposal grew out of some ideas I've been thinking about recently, with input and refinement from members of the Drupal security team. I am putting it up for public discussion and hope to implement it as soon as possible.

The proposal is simply to stagger security and bugfix point releases of Drupal core, so that we no longer aim to do both on one day. The content of the releases would remain the same.

To be more specific, I am proposing that we have two Drupal core "release windows" per month, as follows:

1. Bugfix releases on the first Wednesday of the month. (Next release window: November 7)
2. Security releases on the third Wednesday of the month. (Next release window: October 17, assuming we implement this policy in time. The one after that would be November 21.)

I've updated CMI info thanks to Greg, check it out here: http://drupal.org/community-initiatives/drupal-core#cmi

He's working through some pretty big architecture options, and the community has been awesome about stepping up and supporting this initiative - so huge thanks to you all for keeping so many balls in the air!

As part of the Spark initiative, there are several features being prepared for submission to the Drupal 8 core queue that make use of rich client-side interaction for which a JavaScript MVC framework would make the code more standardized and maintainable. Backbone.js is possibly the most well known choice. http://drupal.org/node/1149866 is the issue for adding it to core, and Dries commented on the issue expressing support for it. Since this is a big decision for Drupal, we're looking for more community feedback.