ghost 5.116.2 → 5.118.0

package/core/server/services/milestones/service.js

@@ -23,7 +23,7 @@ const getStripeLiveEnabled = () => {
 };
 
 module.exports = {
-    /** @type {import('@tryghost/milestones/lib/MilestonesService')} */
+    /** @type {import('./MilestonesService')} */
     api: null,
 
     /**
@@ -34,7 +34,7 @@ module.exports = {
             const db = require('../../data/db');
             const MilestoneQueries = require('./MilestoneQueries');
 
-            const {MilestonesService} = require('@tryghost/milestones');
+            const MilestonesService = require('./MilestonesService');
             const config = require('../../../shared/config');
             const milestonesConfig = config.get('milestones');
 

package/core/server/services/newsletters/index.js

@@ -9,7 +9,7 @@ const emailAddressService = require('../email-address');
 
 const MAGIC_LINK_TOKEN_VALIDITY = 24 * 60 * 60 * 1000;
 const MAGIC_LINK_TOKEN_VALIDITY_AFTER_USAGE = 10 * 60 * 1000;
-const MAGIC_LINK_TOKEN_MAX_USAGE_COUNT = 3;
+const MAGIC_LINK_TOKEN_MAX_USAGE_COUNT = 7;
 
 module.exports = new NewslettersService({
     NewsletterModel: models.Newsletter,

package/core/server/services/public-config/config.js

@@ -20,7 +20,8 @@ module.exports = function getConfigProperties() {
         hostSettings: config.get('hostSettings'),
         tenor: config.get('tenor'),
         pintura: config.get('pintura'),
-        signupForm: config.get('signupForm')
+        signupForm: config.get('signupForm'),
+        security: config.get('security')
     };
 
     // WIP tinybird stats feature - it's entirely config driven instead of using an alpha flag for now

package/core/server/services/settings/settings-service.js

@@ -20,7 +20,7 @@ const emailAddressService = require('../email-address');
 
 const MAGIC_LINK_TOKEN_VALIDITY = 24 * 60 * 60 * 1000;
 const MAGIC_LINK_TOKEN_VALIDITY_AFTER_USAGE = 10 * 60 * 1000;
-const MAGIC_LINK_TOKEN_MAX_USAGE_COUNT = 3;
+const MAGIC_LINK_TOKEN_MAX_USAGE_COUNT = 7;
 
 /**
  * @returns {SettingsBREADService} instance of the PostsService

package/core/server/services/slack-notifications/SlackNotifications.js

@@ -47,7 +47,7 @@ class SlackNotifications {
 
     /**
      * @param {object} eventData
-     * @param {import('@tryghost/milestones/lib/InMemoryMilestoneRepository').Milestone} eventData.milestone
+     * @param {import('../milestones/Milestone')} eventData.milestone
      * @param {object} [eventData.meta]
      * @param {'import'|'email'|'skipped'|'initial'} [eventData.meta.reason]
      * @param {number} [eventData.meta.currentValue]

package/core/server/services/slack-notifications/SlackNotificationsService.js

@@ -1,7 +1,7 @@
-const {MilestoneCreatedEvent} = require('@tryghost/milestones');
+const MilestoneCreatedEvent = require('../milestones/MilestoneCreatedEvent');
 
 /**
- * @typedef {import('@tryghost/milestones/lib/InMemoryMilestoneRepository').Milestone} Milestone
+ * @typedef {import('../milestones/Milestone')} Milestone
  */
 
 /**

package/core/server/services/staff/StaffService.js

@@ -1,5 +1,5 @@
 const {MemberCreatedEvent, SubscriptionCancelledEvent, SubscriptionActivatedEvent} = require('@tryghost/member-events');
-const {MilestoneCreatedEvent} = require('@tryghost/milestones');
+const MilestoneCreatedEvent = require('../milestones/MilestoneCreatedEvent');
 
 // @NOTE: 'StaffService' is a vague name that does not describe what it's actually doing.
 //         Possibly, "StaffNotificationService" or "StaffEventNotificationService" would be a more accurate name

package/core/shared/config/defaults.json

@@ -13,6 +13,9 @@
         "forceUpdate": false
     },
     "privacy": false,
+    "security": {
+        "staffDeviceVerification": true
+    },
     "useMinFiles": true,
     "paths": {
         "contentPath": "content/",

package/core/shared/config/env/config.testing-mysql.json

@@ -18,6 +18,9 @@
     "logging": {
         "level": "error"
     },
+    "security": {
+        "staffDeviceVerification": false
+    },
     "spam": {
         "user_login": {
             "minWait": 600000,

package/core/shared/config/env/config.testing.json

@@ -14,6 +14,9 @@
     "logging": {
         "level": "error"
     },
+    "security": {
+        "staffDeviceVerification": false
+    },
     "spam": {
         "user_login": {
             "minWait": 600000,

package/core/shared/labs.js

@@ -26,7 +26,8 @@ const GA_FEATURES = [
     'themeErrorsNotification',
     'announcementBar',
     'customFonts',
-    'contentVisibility'
+    'contentVisibility',
+    'socialLinks'
 ];
 
 // NOTE: this allowlist is meant to be used to filter out any unexpected
@@ -38,7 +39,6 @@ const BETA_FEATURES = [
     'editorExcerpt',
     'ActivityPub',
     'importMemberTier',
-    'staff2fa',
     'superEditors'
 ];
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ghost",
-  "version": "5.116.2",
+  "version": "5.118.0",
   "description": "The professional publishing platform",
   "author": "Ghost Foundation",
   "homepage": "https://ghost.org",
@@ -40,7 +40,7 @@
     "test:browser:setup": "npx playwright install",
     "test:ci:e2e": "c8 -c ./.c8rc.e2e.json -o coverage-e2e yarn test:e2e -b",
     "test:ci:regression": "yarn test:regression -b",
-    "test:ci:integration": "c8 -c ./.c8rc.e2e.json -o coverage-integration --lines 54 --functions 47 --branches 75 --statements 54 yarn test:integration -b",
+    "test:ci:integration": "c8 -c ./.c8rc.e2e.json -o coverage-integration --lines 53 --functions 47 --branches 74 --statements 53 yarn test:integration -b",
     "test:unit:slow": "yarn test:unit --reporter=mocha-slow-test-reporter",
     "test:int:slow": "yarn test:integration --reporter=mocha-slow-test-reporter",
     "test:e2e:slow": "yarn test:e2e --reporter=mocha-slow-test-reporter",
@@ -66,28 +66,28 @@
     "@slack/webhook": "7.0.5",
     "@tryghost/adapter-base-cache": "0.1.12",
     "@tryghost/admin-api-schema": "4.5.5",
-    "@tryghost/api-framework": "file:components/tryghost-api-framework-5.116.2.tgz",
+    "@tryghost/api-framework": "file:components/tryghost-api-framework-5.118.0.tgz",
     "@tryghost/bookshelf-plugins": "0.6.25",
     "@tryghost/color-utils": "0.2.2",
     "@tryghost/config-url-helpers": "1.0.12",
-    "@tryghost/constants": "file:components/tryghost-constants-5.116.2.tgz",
-    "@tryghost/custom-fonts": "file:components/tryghost-custom-fonts-5.116.2.tgz",
-    "@tryghost/custom-theme-settings-service": "file:components/tryghost-custom-theme-settings-service-5.116.2.tgz",
+    "@tryghost/constants": "file:components/tryghost-constants-5.118.0.tgz",
+    "@tryghost/custom-fonts": "file:components/tryghost-custom-fonts-5.118.0.tgz",
+    "@tryghost/custom-theme-settings-service": "file:components/tryghost-custom-theme-settings-service-5.118.0.tgz",
     "@tryghost/database-info": "0.3.27",
     "@tryghost/debug": "0.1.32",
-    "@tryghost/domain-events": "file:components/tryghost-domain-events-5.116.2.tgz",
-    "@tryghost/donations": "file:components/tryghost-donations-5.116.2.tgz",
-    "@tryghost/email-addresses": "file:components/tryghost-email-addresses-5.116.2.tgz",
+    "@tryghost/domain-events": "file:components/tryghost-domain-events-5.118.0.tgz",
+    "@tryghost/donations": "file:components/tryghost-donations-5.118.0.tgz",
+    "@tryghost/email-addresses": "file:components/tryghost-email-addresses-5.118.0.tgz",
     "@tryghost/email-mock-receiver": "0.3.8",
-    "@tryghost/email-service": "file:components/tryghost-email-service-5.116.2.tgz",
-    "@tryghost/email-suppression-list": "file:components/tryghost-email-suppression-list-5.116.2.tgz",
+    "@tryghost/email-service": "file:components/tryghost-email-service-5.118.0.tgz",
+    "@tryghost/email-suppression-list": "file:components/tryghost-email-suppression-list-5.118.0.tgz",
     "@tryghost/errors": "1.3.5",
     "@tryghost/helpers": "1.1.90",
-    "@tryghost/html-to-plaintext": "file:components/tryghost-html-to-plaintext-5.116.2.tgz",
+    "@tryghost/html-to-plaintext": "file:components/tryghost-html-to-plaintext-5.118.0.tgz",
     "@tryghost/http-cache-utils": "0.1.17",
-    "@tryghost/i18n": "file:components/tryghost-i18n-5.116.2.tgz",
+    "@tryghost/i18n": "file:components/tryghost-i18n-5.118.0.tgz",
     "@tryghost/image-transform": "1.3.0",
-    "@tryghost/job-manager": "file:components/tryghost-job-manager-5.116.2.tgz",
+    "@tryghost/job-manager": "file:components/tryghost-job-manager-5.118.0.tgz",
     "@tryghost/kg-card-factory": "5.1.0",
     "@tryghost/kg-converters": "1.1.0",
     "@tryghost/kg-default-atoms": "5.1.0",
@@ -97,36 +97,34 @@
     "@tryghost/kg-lexical-html-renderer": "1.3.5",
     "@tryghost/kg-mobiledoc-html-renderer": "7.1.1",
     "@tryghost/limit-service": "1.2.14",
-    "@tryghost/link-replacer": "file:components/tryghost-link-replacer-5.116.2.tgz",
+    "@tryghost/link-replacer": "file:components/tryghost-link-replacer-5.118.0.tgz",
     "@tryghost/logging": "2.4.21",
-    "@tryghost/magic-link": "file:components/tryghost-magic-link-5.116.2.tgz",
-    "@tryghost/member-attribution": "file:components/tryghost-member-attribution-5.116.2.tgz",
-    "@tryghost/member-events": "file:components/tryghost-member-events-5.116.2.tgz",
-    "@tryghost/members-api": "file:components/tryghost-members-api-5.116.2.tgz",
-    "@tryghost/members-csv": "file:components/tryghost-members-csv-5.116.2.tgz",
-    "@tryghost/members-offers": "file:components/tryghost-members-offers-5.116.2.tgz",
+    "@tryghost/magic-link": "file:components/tryghost-magic-link-5.118.0.tgz",
+    "@tryghost/member-attribution": "file:components/tryghost-member-attribution-5.118.0.tgz",
+    "@tryghost/member-events": "file:components/tryghost-member-events-5.118.0.tgz",
+    "@tryghost/members-csv": "file:components/tryghost-members-csv-5.118.0.tgz",
+    "@tryghost/members-offers": "file:components/tryghost-members-offers-5.118.0.tgz",
     "@tryghost/metrics": "1.0.37",
-    "@tryghost/milestones": "file:components/tryghost-milestones-5.116.2.tgz",
-    "@tryghost/mw-error-handler": "file:components/tryghost-mw-error-handler-5.116.2.tgz",
-    "@tryghost/mw-vhost": "file:components/tryghost-mw-vhost-5.116.2.tgz",
+    "@tryghost/mw-error-handler": "file:components/tryghost-mw-error-handler-5.118.0.tgz",
+    "@tryghost/mw-vhost": "file:components/tryghost-mw-vhost-5.118.0.tgz",
     "@tryghost/nodemailer": "0.3.45",
     "@tryghost/nql": "0.12.7",
-    "@tryghost/post-revisions": "file:components/tryghost-post-revisions-5.116.2.tgz",
-    "@tryghost/posts-service": "file:components/tryghost-posts-service-5.116.2.tgz",
+    "@tryghost/post-revisions": "file:components/tryghost-post-revisions-5.118.0.tgz",
+    "@tryghost/posts-service": "file:components/tryghost-posts-service-5.118.0.tgz",
     "@tryghost/pretty-cli": "1.2.44",
-    "@tryghost/prometheus-metrics": "file:components/tryghost-prometheus-metrics-5.116.2.tgz",
+    "@tryghost/prometheus-metrics": "file:components/tryghost-prometheus-metrics-5.118.0.tgz",
     "@tryghost/promise": "0.3.12",
     "@tryghost/request": "1.0.8",
     "@tryghost/root-utils": "0.3.30",
-    "@tryghost/security": "file:components/tryghost-security-5.116.2.tgz",
-    "@tryghost/social-urls": "0.1.43",
+    "@tryghost/security": "file:components/tryghost-security-5.118.0.tgz",
+    "@tryghost/social-urls": "0.1.46",
     "@tryghost/string": "0.2.12",
-    "@tryghost/tiers": "file:components/tryghost-tiers-5.116.2.tgz",
+    "@tryghost/tiers": "file:components/tryghost-tiers-5.118.0.tgz",
     "@tryghost/tpl": "0.1.32",
     "@tryghost/url-utils": "4.4.8",
     "@tryghost/validator": "0.2.14",
     "@tryghost/version": "0.1.30",
-    "@tryghost/webmentions": "file:components/tryghost-webmentions-5.116.2.tgz",
+    "@tryghost/webmentions": "file:components/tryghost-webmentions-5.118.0.tgz",
     "@tryghost/zip": "1.1.46",
     "amperize": "0.6.1",
     "body-parser": "1.20.3",
@@ -165,7 +163,7 @@
     "ghost-storage-base": "1.0.0",
     "glob": "8.1.0",
     "got": "11.8.6",
-    "gscan": "4.47.0",
+    "gscan": "4.48.0",
     "handlebars": "4.7.8",
     "hcaptcha": "0.2.0",
     "html-to-text": "5.1.1",
@@ -209,7 +207,7 @@
     "probability-distributions": "0.9.1",
     "probe-image-size": "7.2.3",
     "rss": "1.2.2",
-    "sanitize-html": "2.15.0",
+    "sanitize-html": "2.16.0",
     "semver": "7.7.1",
     "simple-dom": "1.4.0",
     "stoppable": "1.1.0",
@@ -220,6 +218,7 @@
     "tiny-glob": "0.2.9",
     "tough-cookie": "4.1.4",
     "ua-parser-js": "1.0.40",
+    "uuid": "9.0.1",
     "xml": "1.0.1"
   },
   "optionalDependencies": {
@@ -228,12 +227,14 @@
   },
   "devDependencies": {
     "@actions/core": "1.11.1",
-    "@playwright/test": "1.51.1",
+    "@playwright/test": "1.52.0",
     "@tryghost/express-test": "0.13.15",
     "@tryghost/webhook-mock-receiver": "0.2.14",
     "@types/bookshelf": "1.2.9",
     "@types/common-tags": "1.8.4",
+    "@types/jsonwebtoken": "9.0.6",
     "@types/node": "22.13.5",
+    "@types/node-jose": "1.1.13",
     "@types/sinon": "17.0.4",
     "@types/supertest": "6.0.3",
     "c8": "8.0.1",
@@ -245,6 +246,7 @@
     "find-root": "1.1.0",
     "form-data": "4.0.0",
     "inquirer": "8.2.6",
+    "jwk-to-pem": "2.0.7",
     "jwks-rsa": "3.2.0",
     "mocha": "10.8.2",
     "mocha-slow-test-reporter": "0.1.2",
@@ -269,35 +271,33 @@
     "jackspeak": "2.1.1",
     "moment": "2.24.0",
     "moment-timezone": "0.5.45",
-    "@tryghost/api-framework": "file:components/tryghost-api-framework-5.116.2.tgz",
-    "@tryghost/constants": "file:components/tryghost-constants-5.116.2.tgz",
-    "@tryghost/custom-fonts": "file:components/tryghost-custom-fonts-5.116.2.tgz",
-    "@tryghost/custom-theme-settings-service": "file:components/tryghost-custom-theme-settings-service-5.116.2.tgz",
-    "@tryghost/domain-events": "file:components/tryghost-domain-events-5.116.2.tgz",
-    "@tryghost/donations": "file:components/tryghost-donations-5.116.2.tgz",
-    "@tryghost/email-addresses": "file:components/tryghost-email-addresses-5.116.2.tgz",
-    "@tryghost/email-service": "file:components/tryghost-email-service-5.116.2.tgz",
-    "@tryghost/email-suppression-list": "file:components/tryghost-email-suppression-list-5.116.2.tgz",
-    "@tryghost/html-to-plaintext": "file:components/tryghost-html-to-plaintext-5.116.2.tgz",
-    "@tryghost/i18n": "file:components/tryghost-i18n-5.116.2.tgz",
-    "@tryghost/job-manager": "file:components/tryghost-job-manager-5.116.2.tgz",
-    "@tryghost/link-replacer": "file:components/tryghost-link-replacer-5.116.2.tgz",
-    "@tryghost/magic-link": "file:components/tryghost-magic-link-5.116.2.tgz",
-    "@tryghost/member-attribution": "file:components/tryghost-member-attribution-5.116.2.tgz",
-    "@tryghost/member-events": "file:components/tryghost-member-events-5.116.2.tgz",
-    "@tryghost/members-api": "file:components/tryghost-members-api-5.116.2.tgz",
-    "@tryghost/members-csv": "file:components/tryghost-members-csv-5.116.2.tgz",
-    "@tryghost/milestones": "file:components/tryghost-milestones-5.116.2.tgz",
-    "@tryghost/mw-error-handler": "file:components/tryghost-mw-error-handler-5.116.2.tgz",
-    "@tryghost/mw-vhost": "file:components/tryghost-mw-vhost-5.116.2.tgz",
-    "@tryghost/members-offers": "file:components/tryghost-members-offers-5.116.2.tgz",
-    "@tryghost/post-events": "file:components/tryghost-post-events-5.116.2.tgz",
-    "@tryghost/post-revisions": "file:components/tryghost-post-revisions-5.116.2.tgz",
-    "@tryghost/posts-service": "file:components/tryghost-posts-service-5.116.2.tgz",
-    "@tryghost/prometheus-metrics": "file:components/tryghost-prometheus-metrics-5.116.2.tgz",
-    "@tryghost/security": "file:components/tryghost-security-5.116.2.tgz",
-    "@tryghost/tiers": "file:components/tryghost-tiers-5.116.2.tgz",
-    "@tryghost/webmentions": "file:components/tryghost-webmentions-5.116.2.tgz"
+    "@tryghost/api-framework": "file:components/tryghost-api-framework-5.118.0.tgz",
+    "@tryghost/constants": "file:components/tryghost-constants-5.118.0.tgz",
+    "@tryghost/custom-fonts": "file:components/tryghost-custom-fonts-5.118.0.tgz",
+    "@tryghost/custom-theme-settings-service": "file:components/tryghost-custom-theme-settings-service-5.118.0.tgz",
+    "@tryghost/domain-events": "file:components/tryghost-domain-events-5.118.0.tgz",
+    "@tryghost/donations": "file:components/tryghost-donations-5.118.0.tgz",
+    "@tryghost/email-addresses": "file:components/tryghost-email-addresses-5.118.0.tgz",
+    "@tryghost/email-service": "file:components/tryghost-email-service-5.118.0.tgz",
+    "@tryghost/email-suppression-list": "file:components/tryghost-email-suppression-list-5.118.0.tgz",
+    "@tryghost/html-to-plaintext": "file:components/tryghost-html-to-plaintext-5.118.0.tgz",
+    "@tryghost/i18n": "file:components/tryghost-i18n-5.118.0.tgz",
+    "@tryghost/job-manager": "file:components/tryghost-job-manager-5.118.0.tgz",
+    "@tryghost/link-replacer": "file:components/tryghost-link-replacer-5.118.0.tgz",
+    "@tryghost/magic-link": "file:components/tryghost-magic-link-5.118.0.tgz",
+    "@tryghost/member-attribution": "file:components/tryghost-member-attribution-5.118.0.tgz",
+    "@tryghost/member-events": "file:components/tryghost-member-events-5.118.0.tgz",
+    "@tryghost/members-csv": "file:components/tryghost-members-csv-5.118.0.tgz",
+    "@tryghost/mw-error-handler": "file:components/tryghost-mw-error-handler-5.118.0.tgz",
+    "@tryghost/mw-vhost": "file:components/tryghost-mw-vhost-5.118.0.tgz",
+    "@tryghost/members-offers": "file:components/tryghost-members-offers-5.118.0.tgz",
+    "@tryghost/post-events": "file:components/tryghost-post-events-5.118.0.tgz",
+    "@tryghost/post-revisions": "file:components/tryghost-post-revisions-5.118.0.tgz",
+    "@tryghost/posts-service": "file:components/tryghost-posts-service-5.118.0.tgz",
+    "@tryghost/prometheus-metrics": "file:components/tryghost-prometheus-metrics-5.118.0.tgz",
+    "@tryghost/security": "file:components/tryghost-security-5.118.0.tgz",
+    "@tryghost/tiers": "file:components/tryghost-tiers-5.118.0.tgz",
+    "@tryghost/webmentions": "file:components/tryghost-webmentions-5.118.0.tgz"
   },
   "nx": {
     "targets": {