---
title: "Drupal 1.4.0 Released"
video_id: LCeWJn6FXoU
url: https://www.youtube.com/watch?v=LCeWJn6FXoU
workflow_page: https://workflows-of-ai.com/workflow/drupal-140-released
language: en
captions: generated
---

0:00 Hi, so it's Marcus here to give you a
0:02 quick update on the 1.4.0 release.
0:06 It was yesterday.
0:08 Uh I realized while doing this video
0:10 that my last video was actually about
0:12 the 1.3 release.
0:14 Um I've been very busy, but I will try
0:17 to release more videos on things triple
0:19 and AI going forward. And in a steady
0:22 pattern.
0:23 Uh the 1.4.0 release happens only 2
0:27 months after the 1.3.0 release.
0:30 And I think this will be a common
0:32 pattern now for the AI module.
0:34 Uh we have reached some maturity.
0:36 Uh and even if AI changes daily, the
0:39 underlying infrastructure is quite
0:41 mature as well. This is also means that
0:44 this release is more focused on what AI
0:46 module really should be, an underlying
0:49 framework for others to build really
0:52 cool stuff on top of.
0:54 So, this will be reflected in this video
0:56 in comparison to 1.3.0. I will not have
0:59 as many end-user features.
1:02 Uh last time we were showing a lot of
1:04 cool field widget actions.
1:07 What I will show instead is rather how
1:10 this makes AI ready to be used in
1:13 enterprises.
1:15 Uh
1:16 or showing features that requires the
1:18 country module to showcase the full
1:20 capabilities of this.
1:22 Here we go.
1:29 We have added global guardrails. I will
1:32 showcase that. So, say that we are
1:35 Coca-Cola. We do not want this to
1:37 happen, that anyone can use our chatbot
1:40 to ask it why Pepsi tastes better than
1:41 Coca-Cola. Actually, we do not want it
1:44 to take requests or respond with Pepsi.
1:48 So, I have created a Pepsi guardrail.
1:51 So, we're just going to clear the
1:52 history here.
1:54 And we have our Pepsi guardrail uh that
1:56 is looking for the word Pepsi.
1:59 In our guardrail sets, there's now
2:01 global guardrails in 1.4.
2:03 Where we can set which guardrail should
2:06 always count. So, we just turn this on.
2:09 Open our assistant and ask this again.
2:12 And all of a sudden, it comes back very
2:15 quickly. The request contains companies
2:17 that we are not aligned with. Please
2:20 re-ask. So, that is a way of using
2:22 global guardrails.
2:29 Another improvement we're adding in
2:30 terms of guardrails in 1.4 is to add an
2:33 input linked limit guardrail into AI
2:35 core, because this is a crucial
2:38 guardrail
2:39 that is probably needed everywhere.
2:42 So, the idea behind this is that it
2:44 stops so-called denial of wallet
2:46 attacks,
2:47 which is basically taking
2:50 something super huge, maybe 500,000
2:53 input tokens. You're using Gemini that
2:55 can take 1 million tokens. And they're
2:58 adding this into a chatbot over and over
3:01 and over until one of the the following
3:04 three things happens.
3:06 You run out of uh uh
3:09 money temporarily,
3:12 or you hit the rate limit temporarily,
3:15 or even worse, at the end of the month
3:18 you get a huge huge bill
3:20 because someone did this over and over.
3:22 So, the idea is very simple. We're just
3:25 checking the input linked limit and
3:28 reacting to that.
3:30 So, in this case I've set you can only
3:32 use 10 tokens. It's using token based
3:34 counting. In this case, I'm going to go
3:36 to global guardrails, and you will see
3:39 it's uh added there. So, I can go to the
3:42 assistant and write say only hello, and
3:46 this should be three to four tokens,
3:49 which means that it should answer say
3:52 "Hello."
3:54 If I just copy this a couple of times
3:56 because I want to break your input
3:58 token,
4:00 you will see that very quickly you get
4:02 instead, "Your input has 21 tokens,
4:04 which exceeds the maximum 10 tokens." Of
4:06 course, you can control this error
4:08 message as you like.
4:15 Another thing we're adding is the
4:17 possibility to do guardrails on streams,
4:20 meaning that a guardrail can define when
4:22 a string should start buffering, when to
4:24 stop, and what to react to.
4:26 You might have noticed our latest
4:28 security update of the AI module where
4:30 we actually have hardcoded this for
4:32 links and image attributes in HTML and
4:35 markdown to stop exfiltration attacks
4:38 using prompt injections.
4:41 This is the so-called equal leak attack.
4:43 Most frameworks are still open for this,
4:46 but not Drupal.
4:47 But what we're opening up here is the
4:49 possibility to use the same method for
4:51 anything.
4:52 So, in this case,
4:54 uh we are a car company that has
4:56 released the MDX 1, MDX 2, and MDX 3.
5:00 And we're about to revolutionize the
5:02 world with something completely
5:04 groundbreaking. So, we want to release
5:06 this as the MDX 250
5:08 because it's so revolutionary.
5:12 We do not want journalists to know about
5:14 this beforehand, but it's really hard to
5:16 keep track of what editors are uploading
5:18 into our rag database that is connected
5:20 to our customer chat or journalist chat.
5:24 So, maybe we have something like this
5:25 happening. Can you tell me the future
5:27 MDX version what the future MDX version
5:30 will be called?
5:31 Someone calls this,
5:34 and all of a sudden, it streams out,
5:36 "The future MDX version will be called
5:39 MDX 450." So, even if we had a
5:41 guardrail, normal guardrail in this
5:44 case, we had streaming on in the chat
5:47 bot and then this happened, right?
5:50 So, what we're going to go ahead and do
5:52 now is that we're going to enable the
5:54 mocked up streaming guardrail.
5:57 Uh
5:58 this one is hardcoded just so you know,
6:00 what specific guardrail is for this will
6:02 come in the AI guardrail module and in
6:04 the AI 1.5.0 release.
6:07 So, now we try the same thing
6:10 and it's going to stream out. The future
6:12 MDX version will be called MDX redacted.
6:15 So, we have gone ahead and redacted it.
6:18 These are streamable guardrails.
6:25 In 1.4, we are also starting to improve
6:28 the guardrails so you can set specific
6:30 guardrails for specific framework
6:32 processes.
6:33 We're also going to add in AI agent 1.3
6:36 that you can set specific guardrails for
6:39 specific agents.
6:41 But, what we're adding in 1.4 of AI
6:43 module is that you can do it for the
6:45 automators. So, if I have automator, in
6:48 this case, I just have a summarizer of
6:50 the body field, for instance. If I go
6:53 down to advanced settings and at the
6:55 bottom, we have guardrail set. So, you
6:58 can set any guardrail specifically or
7:01 guardrail set specifically to any
7:04 any automator. This means that you can
7:07 have a specific guardrail and then also
7:10 a global guardrail and both of those
7:12 will run for the specific automator.
7:20 Another issue that we're adding in 1.4
7:24 that might look minor if you read the
7:26 issue is that we're moving exceptions
7:29 into event and making sure that that
7:31 event also can give back a chat output
7:35 that can happen deterministically,
7:37 programmatically,
7:38 via another LM, and so on.
7:41 This opens up to what you're seeing
7:43 here,
7:44 which is that we can make ECA take over
7:47 the whole lifespan of a request and a
7:51 response. This means that we can handle
7:53 failover, rerouting, guardrails,
7:56 basically whatever we want to do there
7:59 via ECA. I'm going to give three example
8:02 of how this can be useful, but that of
8:04 course does not cover the whole thing.
8:07 This will be in the AI ECA module. So,
8:09 in this case we get the Open AI GPT-5.2
8:12 call in.
8:14 It checks if this has complex tools.
8:16 Then we know that Claude Opus just works
8:18 with this better. So, it reroutes it to
8:20 Claude Opus.
8:23 If it doesn't have complex tools, we
8:25 count the request tokens.
8:27 And if the input request tokens is under
8:30 300 tokens, well, we probably don't have
8:34 to pay GPT-5.2, which is still a pretty
8:37 complex model.
8:39 And we reroute this to Gemini 1.5
8:41 instead.
8:43 So,
8:45 uh these are specific actions and
8:47 conditionals that we have added uh into
8:50 the AI ECA module.
8:52 Take another
8:53 uh
8:54 event here.
8:55 The response has failed and it's Open AI
8:58 for chat.
8:59 Well, if it fails, we just use Claude
9:02 Sonnet 4.5 instead.
9:04 This means that in this case we don't
9:06 care why it failed. You can actually
9:09 have conditional what the actual
9:11 exception is here.
9:13 Uh uh
9:14 because depending on the exception, you
9:16 might want to do different things of
9:19 course. So,
9:21 one fairly complex thing you can do here
9:23 is that you could for instance
9:26 check
9:27 something we added in 1.3. What are my
9:30 rate limits and when do they reset? The
9:33 rate limits will reset in 10 seconds.
9:35 Okay, then we wait 10 seconds before we
9:37 try again. So, you could do something
9:40 like that.
9:41 In this case, we basically create that
9:44 guardrail using the CA. So, we get the
9:46 provider response back and we're
9:48 basically checking contains feature
9:50 model name. In this case, we I just made
9:52 something up, MDX 450.
9:55 And if it contains MDX 450, it's not
9:58 going to give back that provider
9:59 response. Instead, it's going to give
10:01 back, "I'm sorry, Dave. I'm afraid I
10:03 can't do that."
10:04 So, we can actually control the response
10:06 as well.
10:13 In 1.4, we are also adding so-called
10:16 agentic skills. And this means that if
10:19 you're using Cloud Code, Code-X, Open
10:22 Code, something like this,
10:24 it's going to come with a lot of skills.
10:26 So, either you can use the AI best
10:28 practices module
10:30 to utilize the skills, or you can use
10:32 MPX skills and just point it at the
10:34 version of the Git repo, and you will
10:37 see, all of a sudden, in this case, that
10:39 you can get six different skills. And
10:42 all these skills are either because you
10:44 want to extend the AI module, you want
10:46 to create your own either contrib AI
10:48 provider, or maybe you have a private AI
10:51 provider,
10:52 or you want to help out with AI module,
10:55 create a functional JavaScript uh test,
10:57 for instance. These will install the
11:00 skills into wherever you have started
11:03 these commands.
11:05 And if you run your Cloud Agent or your
11:07 Code-X Agent or whatever you're using,
11:09 you can just use skills, and they're
11:11 going to use the best practices to
11:13 create these different parts. Now, if
11:17 you, for whatever reason, don't want to
11:19 use the uh agentic way of developing,
11:22 you're old-fashioned, you want to write
11:24 your own code,
11:25 these are built on top of generating
11:28 code using the Drush generate. So, we
11:30 have also added this. So, you can use
11:33 the drush generate to generate automated
11:36 type or guardrail or a provider. So,
11:39 basically uh
11:41 getting some skeleton code into your
11:44 repo.
11:45 I will create a video later going into
11:48 how to utilize the skills where I will
11:51 showcase how we can
11:52 uh go from zero to create operation type
11:55 and create a new AI provider around this
11:57 create a API explorer around this and so
12:00 on. But, this will happen in another
12:08 In 1.4.0,
12:10 we are introducing the chat processor
12:12 interface.
12:13 It is a contract between a processor,
12:16 which usually will be an agent, but
12:18 could be something custom,
12:20 and a conversational UI.
12:23 Something we saw earlier on is that one
12:25 size of conversational interfaces does
12:27 not fit all.
12:29 Say that you have a website that creates
12:31 multiple surveys per week, and that is
12:33 something you want an external partner
12:36 to do, but you do not necessarily want
12:38 them to learn how to use your Drupal
12:40 website. Well, here's one example of a
12:43 chatbot that that might help you with
12:46 that.
12:47 This is the Slack AI module that exposes
12:50 a chat processor for Slack. So, just
12:53 another version of a chat, and sets up a
12:55 bot user to be connected with an agent
12:59 on the Drupal website.
13:01 Here, you can see the current web forms
13:03 that are available on the website.
13:05 I will just go ahead and ask it here
13:09 to create a web form about accessibility
13:11 for me, but be specific that I want it
13:14 to give suggestions before it goes ahead
13:17 and does it.
13:18 You will see it has replaced replied to
13:21 me here what it's going to go ahead and
13:23 do. I do this to showcase the
13:24 possibilities,
13:26 but more importantly,
13:28 uh show that you can hold conversations
13:31 and memories with anything.
13:34 I will ask it to go ahead now,
13:37 and hopefully it will go ahead now and
13:39 create this then. And this means that we
13:41 open up the chatbot UI UI X space for
13:45 country modules. They can move faster,
13:47 have more releases,
13:49 and adapt to how fast AI is evolving.
13:52 You can create one chatbot that is for
13:55 the editors on the website, and a
13:58 completely other chatbot that is
14:00 performant and for the end users, for
14:02 instance.
14:04 This also means that we can create a
14:06 module for the
14:07 naive rag solutions that many users have
14:10 asked for.
14:11 So, non-agentic chat to find your
14:15 content that is cheaper, maybe not as
14:18 smart, but cheaper for the end user.
14:21 Another idea is to add an ECA processor
14:23 that makes it possible to use something
14:25 like Slack as a terminal command with
14:27 commands you set up in ECA.
14:30 If we now go back to the web form
14:31 because we see it has answered here,
14:33 right? And reload,
14:37 you will see
14:39 that our web form has been created. If
14:41 we click on it, you will see that it was
14:43 created as written.
14:45 This is the chat processor interface.
14:54 So, going back to the automators,
14:57 there's a small minor nifty thing that
14:59 makes a big big difference for what we
15:01 can do with automators.
15:04 So, if we go to our summarize automator,
15:08 uh as you know, we can set it so it gets
15:11 saved directly. We can set it so
15:13 it uh sorry, it's processed when we save
15:15 it directly. When it runs on cron,
15:17 there's a ECA module you can solve, so
15:20 it's part of ECA.
15:22 You can have it in the batch API, or you
15:24 can just field widget actions.
15:26 Uh there's a post processor module that
15:29 you can run if you want to use it in
15:30 API, as well. But, what's part of AI 1.4
15:34 is that you can make it into an action.
15:37 And this makes sure that it doesn't run
15:38 during entity save, but an action you
15:41 can, of course, uh wrap in something
15:42 like views bulk operation.
15:45 Which means that all of a sudden you can
15:47 have something like a
15:49 alt text. Say that you haven't set alt
15:52 text on over
15:54 1,000
15:55 entities or something. You can, all of a
15:57 sudden, set up a alt text automator,
15:59 choose the action, and then use views
16:01 bulk actions to just rerun those
16:04 thousand in a simple way.