Why Vardot Sponsors a Drupal Core Release Manager
We're sponsoring a Drupal core maintainer. She's known on Drupal.org as xjm. She's one of the release managers responsible for creating Drupal core releases. Her primary focus is keeping Drupal core stable and secure.
Drupal has no license fees. But free code was never free to run. Investing back in the people who maintain Drupal core benefits us, the community, the maintainers, and the software.
Key Takeaways
- We sponsor xjm, a Drupal core release manager and longtime core contributor.
- Release managers create Drupal core releases and decide which changes are allowed in each version.
- The sponsorship gives us no early or private security information.
- Our staff maintain modules and contribute to Drupal, and we sponsor contributors where it's needed.
- A sponsorship is a stated intention. An agency's Drupal.org contribution record is the evidence.
Why Does Vardot Sponsor a Drupal Core Release Manager?
We sponsor xjm because the work of maintaining Drupal core is underfunded. A lot of the people who maintain it do so without being paid, which is obviously unsustainable. Those people need to be sponsored. As a company, we believe in the power of the community, and we sponsor those core contributors.
Even paid core maintenance is shrinking. xjm points out that in 2022, at least 15 people worked on Drupal core in most or all of their paid time, and that number has dropped sharply since. She was a full-time, paid release manager for a decade, and since 2023 her sponsored time has fallen to a fraction of that. Releases still have to ship on deadlines, especially when security vulnerabilities are reported.
When I wrote about joining the Drupal AI Initiative. I said the part of open source I find worth defending is putting real engineering hours into something you don't own, so everyone benefits. Sponsoring a core maintainer applies the same idea to the code every Drupal site runs on.
When I told xjm we wanted to write about this, she said the more people see this kind of information from businesses, the more they understand that it's "both needed and a savvy investment." That's why we're writing this post.
What Does a Drupal Core Release Manager Do?
Release managers create Drupal core releases and manage the release schedule. They also evaluate which changes are allowed and how disruptive each could be. They are part of the Drupal Core Leadership Team, the group that makes the final decisions on the direction of Drupal core.
Every Drupal site runs on Drupal core, so every site relies on that work. It isn't small, either. Drupal.org puts the typical commitment for Leadership Team members at 10 to 15 hours a month, and for some it's full-time.
xjm has been doing this work for more than a decade, and we're one of the organizations that sponsor it.
Her record goes back further than that. She founded the Drupal core contribution mentoring program in 2011, and in 2012 she was part of the four-person team that got Views into Drupal core. Since 2015, she has tagged more than 300 Drupal core releases. All of it is public on her Drupal.org page.
Does Sponsorship Give Vardot Early Security Information?
No. xjm is also a member of the Drupal Security Team, and that role is hers, independent of who sponsors her.
Under Drupal.org's Security Team expectations for employers and the team's disclosure policy for members, members don't tell their organization when a security release is coming, and they don't share private information from security issues. We learn about Drupal security releases when everyone else does, from the public security advisories on Drupal.org. Instead, the benefit we get from our investment extends to everyone else as well: secure Drupal sites and a core platform that adapts to ongoing security threats in the ecosystem.
What Is Stewarded Open Source?
At DrupalCon Rotterdam on 29 September 2026, Dries Buytaert gave a name to what Drupal offers beyond the code: Stewarded Open Source. It means open source that comes with ongoing maintenance, security releases, and a community that keeps looking after it, according to the keynote recap on Drupal.org. He pointed to Drupal as the example: proven at scale, and not owned by any single vendor.
That stewardship doesn't happen by itself. Core maintainers like xjm carry much of it.
Who Wins When an Agency Sponsors a Core Maintainer?
We win as an agency, the community wins, the maintainer wins, and the software wins.
As a Drupal Certified Partner, we understand and believe that investing back in the community, in the core maintainers, and in the Drupal software in general is a win-win-win situation.
How Can You Tell Whether a Drupal Agency Gives Back?
Ask for the record. Plenty of agencies say they support the Drupal community, and sponsorship pages tend to flatten into logos. Drupal.org shows what's behind them.
If you're choosing a Drupal partner, ask for their Drupal.org organization page. It lists the credits they've earned, the projects they maintain, and the contributor roles they support. A sponsorship is a stated intention. The contribution record is the evidence. We go deeper on this in What a Drupal Agency's Contribution Record Tells You.
How Else Does Vardot Contribute to Drupal?
Sponsoring xjm is one part of how we contribute. Our staff maintain modules and contribute to Drupal, and we also sponsor contributors where it's needed. We maintain Varbase, our open-source Drupal distribution, along with its recipes and modules.
We're a Drupal Diamond Certified Partner and a Gold Sponsor of the Drupal AI Initiative. To see how we build on Drupal for our clients, explore our Drupal development services.
Open Source Does Not Mean Free
Drupal is free to download and use, but it doesn't maintain itself. It takes people like xjm to keep the core moving, and that work needs to be sponsored.
Sponsoring it helps core contributors, the Drupal community and ecosystem, and us as an agency. That's why we do it.
xjm still needs more funding for core release management and security work. If your organization builds on Drupal, I’d encourage you to step up and sponsor her, too.
She explains what’s needed in Do you like having secure Drupal sites? Help fund xjm.
xjm, thank you for the great work you’re doing.