ghost 5.118.0 → 5.118.1

package/core/server/web/admin/app.js

@@ -9,7 +9,7 @@ const shared = require('../shared');
 const errorHandler = require('@tryghost/mw-error-handler');
 const sentry = require('../../../shared/sentry');
 const redirectAdminUrls = require('./middleware/redirect-admin-urls');
-const bridge = require('../../../bridge');
+const createServeAuthFrameFileMw = require('./middleware/serve-auth-frame-file');
 
 /**
  *
@@ -39,7 +39,7 @@ module.exports = function setupAdminApp() {
     // request to the Admin API /users/me/ endpoint to check if the user is logged in.
     //
     // Used by comments-ui to add moderation options to front-end comments when logged in.
-    adminApp.use('/auth-frame', bridge.ensureAdminAuthAssetsMiddleware(), function authFrameMw(req, res, next) {
+    adminApp.use('/auth-frame', function authFrameMw(req, res, next) {
         // only render content when we have an Admin session cookie,
         // otherwise return a 204 to avoid JS and API requests being made unnecessarily
         try {
@@ -52,9 +52,7 @@ module.exports = function setupAdminApp() {
         } catch (err) {
             next(err);
         }
-    }, serveStatic(
-        path.join(config.getContentPath('public'), 'admin-auth')
-    ));
+    }, createServeAuthFrameFileMw(config, urlUtils));
 
     // Ember CLI's live-reload script
     if (config.get('env') === 'development') {

package/core/server/web/admin/middleware/serve-auth-frame-file.js

@@ -0,0 +1,35 @@
+const path = require('node:path');
+const fs = require('node:fs/promises');
+
+function createServeAuthFrameFileMw(config, urlUtils) {
+    const placeholders = {
+        '{{SITE_ORIGIN}}': new URL(urlUtils.getSiteUrl()).origin
+    };
+
+    return function serveAuthFrameFileMw(req, res, next) {
+        const filename = path.parse(req.url).base;
+
+        let basePath = path.join(config.get('paths').publicFilePath, 'admin-auth');
+        let filePath;
+
+        if (filename === '') {
+            filePath = path.join(basePath, 'index.html');
+        } else {
+            filePath = path.join(basePath, filename);
+        }
+
+        return fs.readFile(filePath).then((data) => {
+            let dataString = data.toString();
+
+            for (const [key, value] of Object.entries(placeholders)) {
+                dataString = dataString.replace(key, value);
+            }
+
+            res.end(dataString);
+        }).catch(() => {
+            return next();
+        });
+    };
+}
+
+module.exports = createServeAuthFrameFileMw;

package/core/shared/config/env/config.development.docker.json

@@ -8,6 +8,14 @@
             "database": "ghost"
         }
     },
+    "mail": {
+        "from": "test@example.com",
+        "transport": "SMTP",
+        "options": {
+            "host": "mailhog",
+            "port": 1025
+        }
+    },
     "adapters": {
         "Redis": {
             "host": "redis",

package/core/shared/config/env/config.development.json

@@ -35,4 +35,4 @@
             "maxAge": 0
         }
     }
-}
+}

package/core/shared/config/helpers.js

@@ -1,5 +1,3 @@
-const crypto = require('crypto');
-const os = require('os');
 const path = require('path');
 const {URL} = require('url');
 
@@ -66,24 +64,6 @@ const isPrivacyDisabled = function isPrivacyDisabled(privacyFlag) {
     return this.get('privacy')[privacyFlag] === false;
 };
 
-/** @type {string|null} */
-let processTmpDirPath = null;
-
-/**
- * Get a tmp dir path for the current process
- *
- * @returns {string} - tmp dir path for the current process
- */
-function getProcessTmpDirPath() {
-    // Memoize the computed path to avoid re-computing it on each call - The
-    // value should not change during the lifetime of the process.
-    if (processTmpDirPath === null) {
-        processTmpDirPath = path.join(os.tmpdir(), `ghost_${crypto.randomUUID()}`);
-    }
-
-    return processTmpDirPath;
-}
-
 /**
  * @callback getContentPathFn
  * @param {string} type - the type of context you want the path for
@@ -108,7 +88,7 @@ const getContentPath = function getContentPath(type) {
     case 'settings':
         return path.join(this.get('paths:contentPath'), 'settings/');
     case 'public':
-        return path.join(getProcessTmpDirPath(this), 'public/');
+        return path.join(this.get('paths:contentPath'), 'public/');
     default:
         // new Error is allowed here, as we do not want config to depend on @tryghost/error
         // @TODO: revisit this decision when @tryghost/error is no longer dependent on all of ghost-ignition

package/core/shared/labs.js

@@ -26,8 +26,7 @@ const GA_FEATURES = [
     'themeErrorsNotification',
     'announcementBar',
     'customFonts',
-    'contentVisibility',
-    'socialLinks'
+    'contentVisibility'
 ];
 
 // NOTE: this allowlist is meant to be used to filter out any unexpected
@@ -38,20 +37,18 @@ const BETA_FEATURES = [
     'webmentions',
     'editorExcerpt',
     'ActivityPub',
+    'trafficAnalytics',
     'importMemberTier',
     'superEditors'
 ];
 
 const ALPHA_FEATURES = [
-    'NestPlayground',
     'urlCache',
     'emailCustomization',
     'mailEvents',
     'collectionsCard',
     'lexicalIndicators',
-    'adminXDemo',
-    'postsX',
-    'statsX',
+    'trafficAnalyticsAlpha',
     'captcha',
     'contentVisibilityAlpha',
     'explore'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ghost",
-  "version": "5.118.0",
+  "version": "5.118.1",
   "description": "The professional publishing platform",
   "author": "Ghost Foundation",
   "homepage": "https://ghost.org",
@@ -22,8 +22,11 @@
   "scripts": {
     "archive": "npm pack",
     "dev": "node --watch --import=tsx index.js",
-    "build:assets": "postcss core/frontend/public/ghost.css --no-map --use cssnano -o core/frontend/public/ghost.min.css",
+    "build:assets": "yarn build:assets:css && yarn build:assets:js",
+    "build:assets:js": "node bin/minify-assets.js",
+    "build:assets:css": "postcss core/frontend/public/ghost.css --no-map --use cssnano -o core/frontend/public/ghost.min.css",
     "build:tsc": "tsc",
+    "pretest": "yarn build:assets",
     "test": "yarn test:unit",
     "test:base": "mocha --reporter dot --require tsx --require=./test/utils/overrides.js --exit --trace-warnings --recursive --extension=test.js,test.ts",
     "test:single": "yarn test:base --timeout=60000",
@@ -40,7 +43,7 @@
     "test:browser:setup": "npx playwright install",
     "test:ci:e2e": "c8 -c ./.c8rc.e2e.json -o coverage-e2e yarn test:e2e -b",
     "test:ci:regression": "yarn test:regression -b",
-    "test:ci:integration": "c8 -c ./.c8rc.e2e.json -o coverage-integration --lines 53 --functions 47 --branches 74 --statements 53 yarn test:integration -b",
+    "test:ci:integration": "c8 -c ./.c8rc.e2e.json -o coverage-integration --lines 52 --functions 47 --branches 74 --statements 52 yarn test:integration -b",
     "test:unit:slow": "yarn test:unit --reporter=mocha-slow-test-reporter",
     "test:int:slow": "yarn test:integration --reporter=mocha-slow-test-reporter",
     "test:e2e:slow": "yarn test:e2e --reporter=mocha-slow-test-reporter",
@@ -66,28 +69,28 @@
     "@slack/webhook": "7.0.5",
     "@tryghost/adapter-base-cache": "0.1.12",
     "@tryghost/admin-api-schema": "4.5.5",
-    "@tryghost/api-framework": "file:components/tryghost-api-framework-5.118.0.tgz",
+    "@tryghost/api-framework": "file:components/tryghost-api-framework-5.118.1.tgz",
     "@tryghost/bookshelf-plugins": "0.6.25",
     "@tryghost/color-utils": "0.2.2",
     "@tryghost/config-url-helpers": "1.0.12",
-    "@tryghost/constants": "file:components/tryghost-constants-5.118.0.tgz",
-    "@tryghost/custom-fonts": "file:components/tryghost-custom-fonts-5.118.0.tgz",
-    "@tryghost/custom-theme-settings-service": "file:components/tryghost-custom-theme-settings-service-5.118.0.tgz",
+    "@tryghost/constants": "file:components/tryghost-constants-5.118.1.tgz",
+    "@tryghost/custom-fonts": "file:components/tryghost-custom-fonts-5.118.1.tgz",
+    "@tryghost/custom-theme-settings-service": "file:components/tryghost-custom-theme-settings-service-5.118.1.tgz",
     "@tryghost/database-info": "0.3.27",
     "@tryghost/debug": "0.1.32",
-    "@tryghost/domain-events": "file:components/tryghost-domain-events-5.118.0.tgz",
-    "@tryghost/donations": "file:components/tryghost-donations-5.118.0.tgz",
-    "@tryghost/email-addresses": "file:components/tryghost-email-addresses-5.118.0.tgz",
+    "@tryghost/domain-events": "file:components/tryghost-domain-events-5.118.1.tgz",
+    "@tryghost/donations": "file:components/tryghost-donations-5.118.1.tgz",
+    "@tryghost/email-addresses": "file:components/tryghost-email-addresses-5.118.1.tgz",
     "@tryghost/email-mock-receiver": "0.3.8",
-    "@tryghost/email-service": "file:components/tryghost-email-service-5.118.0.tgz",
-    "@tryghost/email-suppression-list": "file:components/tryghost-email-suppression-list-5.118.0.tgz",
-    "@tryghost/errors": "1.3.5",
+    "@tryghost/email-service": "file:components/tryghost-email-service-5.118.1.tgz",
+    "@tryghost/email-suppression-list": "file:components/tryghost-email-suppression-list-5.118.1.tgz",
+    "@tryghost/errors": "1.3.7",
     "@tryghost/helpers": "1.1.90",
-    "@tryghost/html-to-plaintext": "file:components/tryghost-html-to-plaintext-5.118.0.tgz",
+    "@tryghost/html-to-plaintext": "file:components/tryghost-html-to-plaintext-5.118.1.tgz",
     "@tryghost/http-cache-utils": "0.1.17",
-    "@tryghost/i18n": "file:components/tryghost-i18n-5.118.0.tgz",
+    "@tryghost/i18n": "file:components/tryghost-i18n-5.118.1.tgz",
     "@tryghost/image-transform": "1.3.0",
-    "@tryghost/job-manager": "file:components/tryghost-job-manager-5.118.0.tgz",
+    "@tryghost/job-manager": "file:components/tryghost-job-manager-5.118.1.tgz",
     "@tryghost/kg-card-factory": "5.1.0",
     "@tryghost/kg-converters": "1.1.0",
     "@tryghost/kg-default-atoms": "5.1.0",
@@ -97,34 +100,34 @@
     "@tryghost/kg-lexical-html-renderer": "1.3.5",
     "@tryghost/kg-mobiledoc-html-renderer": "7.1.1",
     "@tryghost/limit-service": "1.2.14",
-    "@tryghost/link-replacer": "file:components/tryghost-link-replacer-5.118.0.tgz",
+    "@tryghost/link-replacer": "file:components/tryghost-link-replacer-5.118.1.tgz",
     "@tryghost/logging": "2.4.21",
-    "@tryghost/magic-link": "file:components/tryghost-magic-link-5.118.0.tgz",
-    "@tryghost/member-attribution": "file:components/tryghost-member-attribution-5.118.0.tgz",
-    "@tryghost/member-events": "file:components/tryghost-member-events-5.118.0.tgz",
-    "@tryghost/members-csv": "file:components/tryghost-members-csv-5.118.0.tgz",
-    "@tryghost/members-offers": "file:components/tryghost-members-offers-5.118.0.tgz",
+    "@tryghost/magic-link": "file:components/tryghost-magic-link-5.118.1.tgz",
+    "@tryghost/member-attribution": "file:components/tryghost-member-attribution-5.118.1.tgz",
+    "@tryghost/member-events": "file:components/tryghost-member-events-5.118.1.tgz",
+    "@tryghost/members-csv": "file:components/tryghost-members-csv-5.118.1.tgz",
+    "@tryghost/members-offers": "file:components/tryghost-members-offers-5.118.1.tgz",
     "@tryghost/metrics": "1.0.37",
-    "@tryghost/mw-error-handler": "file:components/tryghost-mw-error-handler-5.118.0.tgz",
-    "@tryghost/mw-vhost": "file:components/tryghost-mw-vhost-5.118.0.tgz",
+    "@tryghost/mw-error-handler": "file:components/tryghost-mw-error-handler-5.118.1.tgz",
+    "@tryghost/mw-vhost": "file:components/tryghost-mw-vhost-5.118.1.tgz",
     "@tryghost/nodemailer": "0.3.45",
     "@tryghost/nql": "0.12.7",
-    "@tryghost/post-revisions": "file:components/tryghost-post-revisions-5.118.0.tgz",
-    "@tryghost/posts-service": "file:components/tryghost-posts-service-5.118.0.tgz",
+    "@tryghost/post-revisions": "file:components/tryghost-post-revisions-5.118.1.tgz",
+    "@tryghost/posts-service": "file:components/tryghost-posts-service-5.118.1.tgz",
     "@tryghost/pretty-cli": "1.2.44",
-    "@tryghost/prometheus-metrics": "file:components/tryghost-prometheus-metrics-5.118.0.tgz",
+    "@tryghost/prometheus-metrics": "file:components/tryghost-prometheus-metrics-5.118.1.tgz",
     "@tryghost/promise": "0.3.12",
     "@tryghost/request": "1.0.8",
     "@tryghost/root-utils": "0.3.30",
-    "@tryghost/security": "file:components/tryghost-security-5.118.0.tgz",
+    "@tryghost/security": "file:components/tryghost-security-5.118.1.tgz",
     "@tryghost/social-urls": "0.1.46",
     "@tryghost/string": "0.2.12",
-    "@tryghost/tiers": "file:components/tryghost-tiers-5.118.0.tgz",
+    "@tryghost/tiers": "file:components/tryghost-tiers-5.118.1.tgz",
     "@tryghost/tpl": "0.1.32",
     "@tryghost/url-utils": "4.4.8",
     "@tryghost/validator": "0.2.14",
     "@tryghost/version": "0.1.30",
-    "@tryghost/webmentions": "file:components/tryghost-webmentions-5.118.0.tgz",
+    "@tryghost/webmentions": "file:components/tryghost-webmentions-5.118.1.tgz",
     "@tryghost/zip": "1.1.46",
     "amperize": "0.6.1",
     "body-parser": "1.20.3",
@@ -173,7 +176,7 @@
     "intl": "1.2.5",
     "intl-messageformat": "5.4.3",
     "js-yaml": "4.1.0",
-    "json-stable-stringify": "1.2.1",
+    "json-stable-stringify": "1.3.0",
     "jsonpath": "1.1.1",
     "jsonwebtoken": "8.5.1",
     "juice": "9.1.0",
@@ -198,7 +201,7 @@
     "moment-timezone": "0.5.45",
     "multer": "1.4.4",
     "mysql2": "3.14.0",
-    "nconf": "0.12.1",
+    "nconf": "0.13.0",
     "node-fetch": "2.7.0",
     "node-jose": "2.2.0",
     "otplib": "12.0.1",
@@ -232,8 +235,8 @@
     "@tryghost/webhook-mock-receiver": "0.2.14",
     "@types/bookshelf": "1.2.9",
     "@types/common-tags": "1.8.4",
-    "@types/jsonwebtoken": "9.0.6",
-    "@types/node": "22.13.5",
+    "@types/jsonwebtoken": "9.0.9",
+    "@types/node": "22.14.1",
     "@types/node-jose": "1.1.13",
     "@types/sinon": "17.0.4",
     "@types/supertest": "6.0.3",
@@ -263,41 +266,41 @@
     "tmp": "0.2.3",
     "toml": "3.0.0",
     "tsx": "4.19.3",
-    "typescript": "5.8.2"
+    "typescript": "5.8.3"
   },
   "resolutions": {
-    "@tryghost/errors": "1.3.5",
+    "@tryghost/errors": "1.3.7",
     "@tryghost/logging": "2.4.21",
     "jackspeak": "2.1.1",
     "moment": "2.24.0",
     "moment-timezone": "0.5.45",
-    "@tryghost/api-framework": "file:components/tryghost-api-framework-5.118.0.tgz",
-    "@tryghost/constants": "file:components/tryghost-constants-5.118.0.tgz",
-    "@tryghost/custom-fonts": "file:components/tryghost-custom-fonts-5.118.0.tgz",
-    "@tryghost/custom-theme-settings-service": "file:components/tryghost-custom-theme-settings-service-5.118.0.tgz",
-    "@tryghost/domain-events": "file:components/tryghost-domain-events-5.118.0.tgz",
-    "@tryghost/donations": "file:components/tryghost-donations-5.118.0.tgz",
-    "@tryghost/email-addresses": "file:components/tryghost-email-addresses-5.118.0.tgz",
-    "@tryghost/email-service": "file:components/tryghost-email-service-5.118.0.tgz",
-    "@tryghost/email-suppression-list": "file:components/tryghost-email-suppression-list-5.118.0.tgz",
-    "@tryghost/html-to-plaintext": "file:components/tryghost-html-to-plaintext-5.118.0.tgz",
-    "@tryghost/i18n": "file:components/tryghost-i18n-5.118.0.tgz",
-    "@tryghost/job-manager": "file:components/tryghost-job-manager-5.118.0.tgz",
-    "@tryghost/link-replacer": "file:components/tryghost-link-replacer-5.118.0.tgz",
-    "@tryghost/magic-link": "file:components/tryghost-magic-link-5.118.0.tgz",
-    "@tryghost/member-attribution": "file:components/tryghost-member-attribution-5.118.0.tgz",
-    "@tryghost/member-events": "file:components/tryghost-member-events-5.118.0.tgz",
-    "@tryghost/members-csv": "file:components/tryghost-members-csv-5.118.0.tgz",
-    "@tryghost/mw-error-handler": "file:components/tryghost-mw-error-handler-5.118.0.tgz",
-    "@tryghost/mw-vhost": "file:components/tryghost-mw-vhost-5.118.0.tgz",
-    "@tryghost/members-offers": "file:components/tryghost-members-offers-5.118.0.tgz",
-    "@tryghost/post-events": "file:components/tryghost-post-events-5.118.0.tgz",
-    "@tryghost/post-revisions": "file:components/tryghost-post-revisions-5.118.0.tgz",
-    "@tryghost/posts-service": "file:components/tryghost-posts-service-5.118.0.tgz",
-    "@tryghost/prometheus-metrics": "file:components/tryghost-prometheus-metrics-5.118.0.tgz",
-    "@tryghost/security": "file:components/tryghost-security-5.118.0.tgz",
-    "@tryghost/tiers": "file:components/tryghost-tiers-5.118.0.tgz",
-    "@tryghost/webmentions": "file:components/tryghost-webmentions-5.118.0.tgz"
+    "@tryghost/api-framework": "file:components/tryghost-api-framework-5.118.1.tgz",
+    "@tryghost/constants": "file:components/tryghost-constants-5.118.1.tgz",
+    "@tryghost/custom-fonts": "file:components/tryghost-custom-fonts-5.118.1.tgz",
+    "@tryghost/custom-theme-settings-service": "file:components/tryghost-custom-theme-settings-service-5.118.1.tgz",
+    "@tryghost/domain-events": "file:components/tryghost-domain-events-5.118.1.tgz",
+    "@tryghost/donations": "file:components/tryghost-donations-5.118.1.tgz",
+    "@tryghost/email-addresses": "file:components/tryghost-email-addresses-5.118.1.tgz",
+    "@tryghost/email-service": "file:components/tryghost-email-service-5.118.1.tgz",
+    "@tryghost/email-suppression-list": "file:components/tryghost-email-suppression-list-5.118.1.tgz",
+    "@tryghost/html-to-plaintext": "file:components/tryghost-html-to-plaintext-5.118.1.tgz",
+    "@tryghost/i18n": "file:components/tryghost-i18n-5.118.1.tgz",
+    "@tryghost/job-manager": "file:components/tryghost-job-manager-5.118.1.tgz",
+    "@tryghost/link-replacer": "file:components/tryghost-link-replacer-5.118.1.tgz",
+    "@tryghost/magic-link": "file:components/tryghost-magic-link-5.118.1.tgz",
+    "@tryghost/member-attribution": "file:components/tryghost-member-attribution-5.118.1.tgz",
+    "@tryghost/member-events": "file:components/tryghost-member-events-5.118.1.tgz",
+    "@tryghost/members-csv": "file:components/tryghost-members-csv-5.118.1.tgz",
+    "@tryghost/mw-error-handler": "file:components/tryghost-mw-error-handler-5.118.1.tgz",
+    "@tryghost/mw-vhost": "file:components/tryghost-mw-vhost-5.118.1.tgz",
+    "@tryghost/members-offers": "file:components/tryghost-members-offers-5.118.1.tgz",
+    "@tryghost/post-events": "file:components/tryghost-post-events-5.118.1.tgz",
+    "@tryghost/post-revisions": "file:components/tryghost-post-revisions-5.118.1.tgz",
+    "@tryghost/posts-service": "file:components/tryghost-posts-service-5.118.1.tgz",
+    "@tryghost/prometheus-metrics": "file:components/tryghost-prometheus-metrics-5.118.1.tgz",
+    "@tryghost/security": "file:components/tryghost-security-5.118.1.tgz",
+    "@tryghost/tiers": "file:components/tryghost-tiers-5.118.1.tgz",
+    "@tryghost/webmentions": "file:components/tryghost-webmentions-5.118.1.tgz"
   },
   "nx": {
     "targets": {
@@ -316,7 +319,8 @@
       },
       "dev": {
         "dependsOn": [
-          "^build:ts"
+          "^build:ts",
+          "build:assets"
         ]
       },
       "test": {
@@ -331,12 +335,14 @@
       },
       "test:all": {
         "dependsOn": [
-          "^build:ts"
+          "^build:ts",
+          "build:assets"
         ]
       },
       "test:unit": {
         "dependsOn": [
-          "^build:ts"
+          "^build:ts",
+          "build:assets"
         ]
       },
       "test:integration": {
@@ -352,18 +358,21 @@
       "test:browser": {
         "dependsOn": [
           "^build:ts",
+          "build:assets",
           "ghost-admin:build"
         ]
       },
       "test:browser:admin": {
         "dependsOn": [
           "^build:ts",
+          "build:assets",
           "ghost-admin:build"
         ]
       },
       "test:browser:portal": {
         "dependsOn": [
           "^build:ts",
+          "build:assets",
           "ghost-admin:build"
         ]
       },