ghost 5.129.1 → 5.130.0

package/core/server/services/email-service/EmailRenderer.js

@@ -1301,6 +1301,17 @@ class EmailRenderer {
             linkStyle,
             hasOutlineButtons,
 
+            // useful data
+            ctaBgColors: [
+                'grey',
+                'blue',
+                'green',
+                'yellow',
+                'red',
+                'pink',
+                'purple'
+            ],
+
             classes: {
                 container: clsx('container', {
                     'title-serif': titleFont === 'serif'

package/core/server/services/email-service/email-templates/partials/styles.hbs

@@ -381,15 +381,15 @@ h6 + .kg-paywall .kg-paywall-hr td {
 }
 
 /* Exclude CTA cards with colored backgrounds from custom text color, but allow transparent ones */
-.post-content-row .kg-cta-bg-grey .kg-cta-text p,
-.post-content-row .kg-cta-bg-blue .kg-cta-text p,
-.post-content-row .kg-cta-bg-green .kg-cta-text p,
-.post-content-row .kg-cta-bg-yellow .kg-cta-text p,
-.post-content-row .kg-cta-bg-red .kg-cta-text p,
-.post-content-row .kg-cta-bg-pink .kg-cta-text p,
-.post-content-row .kg-cta-bg-purple .kg-cta-text p {
+{{#each ctaBgColors}}
+.post-content-row .kg-cta-bg-{{this}} .kg-cta-text p,
+.post-content-row .kg-cta-bg-{{this}} .kg-cta-text ul,
+.post-content-row .kg-cta-bg-{{this}} .kg-cta-text ul li,
+.post-content-row .kg-cta-bg-{{this}} .kg-cta-text ol,
+.post-content-row .kg-cta-bg-{{this}} .kg-cta-text ol li {
     color: inherit !important;
 }
+{{/each}}
 
 .kg-cta-bg-none .kg-cta-sponsor-label span,
 .kg-cta-bg-white .kg-cta-sponsor-label span {
@@ -2530,3 +2530,8 @@ table.btn-accent a {
 {{/if}}
 
 </style>
+<!--[if mso]>
+<style type="text/css">
+    ul, ol { margin-left: 1.5em !important; } {{!-- fix bullets/numbers not appearing for lists in older Outlook versions --}}
+</style>
+<![endif]-->

package/core/server/services/explore-ping/ExplorePingService.js

@@ -1,7 +1,7 @@
 module.exports = class ExplorePingService {
     /**
      * @param {object} deps
-     * @param {{getPublic: () => import('../../../shared/settings-cache/CacheManager').PublicSettingsCache}} deps.settingsCache
+     * @param {{get: (string) => string}} deps.settingsCache
      * @param {object} deps.config
      * @param {object} deps.labs
      * @param {object} deps.logging
@@ -14,6 +14,7 @@ module.exports = class ExplorePingService {
      * }}} deps.posts
      * @param {{stats: {
      *   getTotalMembers: () => Promise<number>
+     *   getMRRHistory: () => Promise<number>
      * }}} deps.members
      */
     constructor({settingsCache, config, labs, logging, ghostVersion, request, posts, members}) {
@@ -28,45 +29,50 @@ module.exports = class ExplorePingService {
     }
 
     async constructPayload() {
-        /* eslint-disable camelcase */
-        const {title, description, icon, locale, accent_color, twitter, facebook, site_uuid} = this.settingsCache.getPublic();
-
-        // Get post statistics
-        const [totalPosts, lastPublishedAt, firstPublishedAt] = await Promise.all([
-            this.posts.stats.getTotalPostsPublished(),
-            this.posts.stats.getMostRecentlyPublishedPostDate(),
-            this.posts.stats.getFirstPublishedPostDate()
-        ]);
+        const payload = {
+            ghost: this.ghostVersion.full,
+            site_uuid: this.settingsCache.get('site_uuid'),
+            url: this.config.get('url'),
+            theme: this.settingsCache.get('active_theme')
+        };
 
-        // Get member statistics with error handling
-        let totalMembers = null;
         try {
-            totalMembers = await this.members.stats.getTotalMembers();
+            const [totalPosts, lastPublishedAt, firstPublishedAt] = await Promise.all([
+                this.posts.stats.getTotalPostsPublished(),
+                this.posts.stats.getMostRecentlyPublishedPostDate(),
+                this.posts.stats.getFirstPublishedPostDate()
+            ]);
+
+            payload.posts_total = totalPosts;
+            payload.posts_last = lastPublishedAt ? lastPublishedAt.toISOString() : null;
+            payload.posts_first = firstPublishedAt ? firstPublishedAt.toISOString() : null;
         } catch (err) {
-            this.logging.warn('Failed to fetch member statistics', {
+            this.logging.warn('Failed to fetch post statistics', {
                 error: err.message,
                 context: 'explore-ping-service'
             });
-            // Continue without member statistics
+            payload.posts_total = null;
+            payload.posts_last = null;
+            payload.posts_first = null;
         }
 
-        return {
-            ghost: this.ghostVersion.full,
-            site_uuid,
-            url: this.config.get('url'),
-            title,
-            description,
-            icon,
-            locale,
-            accent_color,
-            twitter,
-            facebook,
-            posts_first: firstPublishedAt ? firstPublishedAt.toISOString() : null,
-            posts_last: lastPublishedAt ? lastPublishedAt.toISOString() : null,
-            posts_total: totalPosts,
-            members_total: totalMembers
-        };
-        /* eslint-enable camelcase */
+        if (this.settingsCache.get('explore_ping_growth')) {
+            try {
+                const totalMembers = await this.members.stats.getTotalMembers();
+                const mrr = await this.members.stats.getMRRHistory();
+                payload.members_total = totalMembers;
+                payload.mrr = mrr;
+            } catch (err) {
+                this.logging.warn('Failed to fetch member statistics', {
+                    error: err.message,
+                    context: 'explore-ping-service'
+                });
+                payload.members_total = null;
+                payload.mrr = null;
+            }
+        }
+
+        return payload;
     }
 
     async makeRequest(exploreUrl, payload) {
@@ -95,12 +101,17 @@ module.exports = class ExplorePingService {
             return;
         }
 
-        const exploreUrl = this.config.get('explore:url');
+        const exploreUrl = this.config.get('explore:update_url');
         if (!exploreUrl) {
             this.logging.warn('Explore URL not set');
             return;
         }
 
+        if (!this.settingsCache.get('explore_ping')) {
+            this.logging.info('Explore ping disabled');
+            return;
+        }
+
         const payload = await this.constructPayload();
         await this.makeRequest(exploreUrl, payload);
     }

package/core/server/services/members/members-api/repositories/MemberRepository.js

@@ -947,10 +947,7 @@ module.exports = class MemberRepository {
             ghostProduct = await this._productRepository.get({stripe_product_id: subscriptionPriceData.product}, options);
             // Use first Ghost product as default product in case of missing link
             if (!ghostProduct) {
-                ghostProduct = await this._productRepository.getDefaultProduct({
-                    forUpdate: true,
-                    ...options
-                });
+                ghostProduct = await this._productRepository.getDefaultProduct(options);
             }
 
             // Link Stripe Product & Price to Ghost Product

package/core/server/services/public-config/config.js

@@ -25,6 +25,10 @@ module.exports = function getConfigProperties() {
         security: config.get('security')
     };
 
+    if (config.get('explore') && config.get('explore:testimonials_url')) {
+        configProperties.exploreTestimonialsUrl = config.get('explore:testimonials_url');
+    }
+
     // WIP tinybird stats feature - it's entirely config driven instead of using an alpha flag for now
     if (config.get('tinybird') && config.get('tinybird:stats')) {
         const statsConfig = config.get('tinybird:stats');

package/core/server/services/settings/settings-service.js

@@ -109,6 +109,10 @@ module.exports = {
         // Social web (ActivityPub)
         fields.push(new CalculatedField({key: 'social_web_enabled', type: 'boolean', group: 'social_web', fn: settingsHelpers.isSocialWebEnabled.bind(settingsHelpers), dependents: ['social_web', 'labs']}));
 
+        // Web analytics
+        fields.push(new CalculatedField({key: 'web_analytics_enabled', type: 'boolean', group: 'analytics', fn: settingsHelpers.isWebAnalyticsEnabled.bind(settingsHelpers), dependents: ['web_analytics', 'labs']}));
+        fields.push(new CalculatedField({key: 'web_analytics_configured', type: 'boolean', group: 'analytics', fn: settingsHelpers.isWebAnalyticsConfigured.bind(settingsHelpers), dependents: ['web_analytics']}));
+
         return fields;
     },
 

package/core/server/services/settings-helpers/SettingsHelpers.js

@@ -1,19 +1,22 @@
+const net = require('net');
 const tpl = require('@tryghost/tpl');
 const errors = require('@tryghost/errors');
 const EmailAddressParser = require('../email-address/EmailAddressParser');
 const logging = require('@tryghost/logging');
 const crypto = require('crypto');
+const debug = require('@tryghost/debug')('services:settings-helpers');
 
 const messages = {
     incorrectKeyType: 'type must be one of "direct" or "connect".'
 };
 
 class SettingsHelpers {
-    constructor({settingsCache, urlUtils, config, labs}) {
+    constructor({settingsCache, urlUtils, config, labs, limitService}) {
         this.settingsCache = settingsCache;
         this.urlUtils = urlUtils;
         this.config = config;
         this.labs = labs;
+        this.limitService = limitService;
     }
 
     isMembersEnabled() {
@@ -220,20 +223,124 @@ class SettingsHelpers {
     }
 
     /**
-     * Social web (ActivityPub) is enabled if:
-     * - Social web is enabled in the settings
-     * - 'ActivityPub' flag is enabled in the labs, for compatibility with Ghost 5.x
-     * - Config allows it (TODO)
-     * - Billing allows it (TODO)
+     * Calculated setting for Social web (ActivityPub)
      *
      * @returns {boolean}
      */
     isSocialWebEnabled() {
-        return this.settingsCache.get('social_web') === true && this.labs.isSet('ActivityPub');
+        // UI setting
+        if (this.settingsCache.get('social_web') !== true) {
+            debug('Social web is disabled in settings');
+            return false;
+        }
+
+        // Labs setting
+        if (!this.labs.isSet('ActivityPub')) {
+            debug('Social web is disabled in labs');
+            return false;
+        }
+
+        // Ghost (Pro) limits
+        if (this.limitService.isDisabled('limitSocialWeb')) {
+            debug('Social web is not available for Ghost (Pro) sites without a custom domain, or hosted on a subdirectory');
+            return false;
+        }
+
+        // Social web (ActivityPub) currently does not support Ghost sites hosted on a subdirectory, e.g. https://example.com/blog/
+        const subdirectory = this.urlUtils.getSubdir();
+        if (subdirectory) {
+            debug('Social web is not available for Ghost sites hosted on a subdirectory');
+            return false;
+        }
+
+        // Self-hosters cannot connect to production ActivityPub servers from localhost or IPs addresses
+        const siteUrl = new URL(this.urlUtils.getSiteUrl());
+        const isLocalhost = siteUrl.hostname === 'localhost' || siteUrl.hostname === '127.0.0.1' || siteUrl.hostname === '::1';
+        const isIP = net.isIP(siteUrl.hostname);
+        if (process.env.NODE_ENV === 'production' && (isLocalhost || isIP)) {
+            debug('Social web is not available from localhost or IPs addresses in production');
+            return false;
+        }
+
+        return true;
+    }
+
+    /**
+     * Calculated setting for Web analytics
+     *
+     *  Setting > Labs Flag > Config > Limit Service
+     * 
+     * @returns {boolean}
+     */
+    isWebAnalyticsEnabled() {
+        // UI setting
+        if (this.settingsCache.get('web_analytics') !== true) {
+            debug('Web analytics is disabled in settings');
+            return false;
+        }
+
+        // Labs setting
+        if (!this.labs.isSet('trafficAnalytics')) {
+            debug('Web analytics is disabled in labs');
+            return false;
+        }
+
+        // Check if web analytics can be configured (limit service and required config)
+        if (!this.isWebAnalyticsConfigured()) {
+            return false;
+        }
+
+        return true;
+    }
+
+    /**
+     * Check if web analytics can be configured (used for UI enable/disable state)
+     * 
+     * @returns {boolean}
+     */
+    isWebAnalyticsConfigured() {
+        // Correct config is required
+        if (!this._isValidTinybirdConfig()) {
+            return false;
+        }
+
+        // Ghost (Pro) limits
+        if (this.limitService.isDisabled('limitAnalytics')) {
+            debug('Web analytics configuration is not available for Ghost (Pro) sites without a custom domain, or hosted on a subdirectory');
+            return false;
+        }
+
+        return true;
     }
 
     // PRIVATE
 
+    /**
+     * Validates tinybird configuration for web analytics
+     * @returns {boolean} True if config is valid, false otherwise
+     * @private
+     */
+    _isValidTinybirdConfig() {
+        const tinybirdConfig = this.config.get('tinybird');
+        
+        // First requirement: tinybird:tracker:endpoint is always required
+        if (!tinybirdConfig || !tinybirdConfig.tracker?.endpoint) {
+            debug('Web analytics is not available without tinybird:tracker:endpoint');
+            return false;
+        }
+
+        // Second requirement: Either JWT config OR local stats config
+        const hasJwtConfig = !!(tinybirdConfig.workspaceId && tinybirdConfig.adminToken);
+        const hasLocalConfig = !!(tinybirdConfig.stats?.local?.enabled);
+        
+        if (!hasJwtConfig && !hasLocalConfig) {
+            debug('Web analytics requires either (workspaceId + adminToken) or stats.local.enabled');
+            return false;
+        }
+
+        return true;
+    }
+
     #managedEmailEnabled() {
         return !!this.config.get('hostSettings:managedEmail:enabled');
     }

package/core/server/services/settings-helpers/index.js

@@ -3,5 +3,6 @@ const urlUtils = require('../../../shared/url-utils');
 const config = require('../../../shared/config');
 const SettingsHelpers = require('./SettingsHelpers');
 const labs = require('../../../shared/labs');
+const limitService = require('../limits');
 
-module.exports = new SettingsHelpers({settingsCache, urlUtils, config, labs});
+module.exports = new SettingsHelpers({settingsCache, urlUtils, config, labs, limitService});

package/core/server/services/stats/StatsService.js

@@ -245,8 +245,7 @@ class StatsService {
         const request = deps.request || require('../../lib/request-external');
         const settingsCache = deps.settingsCache || require('../../../shared/settings-cache');
 
-        // Only create the client if Tinybird is configured
-        if (config.get('tinybird') && config.get('tinybird:stats')) {
+        if (settingsCache.get('web_analytics_enabled')) {
             // TODO: move the tinybird client to the tinybird service
             const TinybirdServiceWrapper = require('../tinybird');
             TinybirdServiceWrapper.init();

package/core/server/services/themes/installer.js

@@ -19,9 +19,18 @@ const messages = {
 const installFromGithub = async (ref) => {
     const [org, repo] = ref.toLowerCase().split('/');
 
-    //TODO: move the organization check to config
-    if (limitService.isLimited('customThemes') && org.toLowerCase() !== 'tryghost') {
-        await limitService.errorIfWouldGoOverLimit('customThemes', {value: repo.toLowerCase()});
+    if (limitService.isLimited('customThemes')) {
+        // The custom theme limit might consist of only one single theme, so we can't rely on
+        // the org alone to determine if the request is allowed or not.
+        const noOtherThemesAllowed = limitService.limits.customThemes?.allowlist?.length === 1;
+        //TODO: move the organization check to config
+        const isNotOfficialThemeRequest = org.toLowerCase() !== 'tryghost';
+
+        const checkThemeLimit = noOtherThemesAllowed || isNotOfficialThemeRequest;
+
+        if (checkThemeLimit) {
+            await limitService.errorIfWouldGoOverLimit('customThemes', {value: repo.toLowerCase()});
+        }
     }
 
     // omit /:ref so we fetch the default branch
@@ -62,6 +71,11 @@ const installFromGithub = async (ref) => {
             }));
         }
 
+        if (e instanceof errors.HostLimitError) {
+            // If the error is a HostLimitError, we can assume that the theme name is not allowed
+            return Promise.reject(e);
+        }
+
         throw e;
     } finally {
         // clean up tmp dir with downloaded file

package/core/shared/config/env/config.production.json

@@ -17,5 +17,9 @@
             "enabled": true
         },
         "transports": ["file"]
+    },
+    "explore": {
+        "update_url": "https://explore.ghost.org/api/update",
+        "testimonials_url": "https://explore.ghost.org/api/testimonials"
     }
 }

package/core/shared/labs.js

@@ -47,7 +47,6 @@ const PRIVATE_FEATURES = [
     'urlCache',
     'mailEvents',
     'lexicalIndicators',
-    'trafficAnalyticsAlpha',
     'ui60',
     'contentVisibilityAlpha',
     'explore',

package/core/shared/settings-cache/CacheManager.js

@@ -62,6 +62,8 @@ const _ = require('lodash');
  * @property {string|null} editor_default_email_recipients - Default email recipients for editor
  * @property {string|null} labs - JSON string of enabled labs features
  * @property {boolean|null} social_web_enabled - Whether social web is enabled
+ * @property {boolean|null} web_analytics_enabled - Whether web analytics is enabled
+ * @property {boolean|null} web_analytics_configured - Whether web analytics is configured
  * @property {never} [x] - Prevent accessing undefined properties
  */
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ghost",
-  "version": "5.129.1",
+  "version": "5.130.0",
   "description": "The professional publishing platform",
   "author": "Ghost Foundation",
   "homepage": "https://ghost.org",
@@ -75,20 +75,20 @@
     "@tryghost/admin-api-schema": "4.5.10",
     "@tryghost/api-framework": "1.0.2",
     "@tryghost/bookshelf-plugins": "0.6.27",
-    "@tryghost/color-utils": "0.2.8",
+    "@tryghost/color-utils": "0.2.9",
     "@tryghost/config-url-helpers": "1.0.17",
     "@tryghost/custom-fonts": "1.0.2",
     "@tryghost/database-info": "0.3.30",
     "@tryghost/debug": "0.1.35",
-    "@tryghost/domain-events": "1.0.1",
+    "@tryghost/domain-events": "1.0.2",
     "@tryghost/email-mock-receiver": "0.3.11",
     "@tryghost/errors": "1.3.8",
     "@tryghost/helpers": "1.1.97",
     "@tryghost/html-to-plaintext": "1.0.4",
     "@tryghost/http-cache-utils": "0.1.20",
-    "@tryghost/i18n": "file:components/tryghost-i18n-5.129.1.tgz",
+    "@tryghost/i18n": "file:components/tryghost-i18n-5.130.0.tgz",
     "@tryghost/image-transform": "1.4.6",
-    "@tryghost/job-manager": "1.0.2",
+    "@tryghost/job-manager": "1.0.3",
     "@tryghost/kg-card-factory": "5.1.2",
     "@tryghost/kg-clean-basic-html": "4.2.7",
     "@tryghost/kg-converters": "1.1.7",
@@ -100,8 +100,8 @@
     "@tryghost/kg-lexical-html-renderer": "1.3.24",
     "@tryghost/kg-markdown-html-renderer": "7.1.3",
     "@tryghost/kg-mobiledoc-html-renderer": "7.1.3",
-    "@tryghost/limit-service": "1.3.2",
-    "@tryghost/logging": "2.4.22",
+    "@tryghost/limit-service": "1.4.0",
+    "@tryghost/logging": "2.4.23",
     "@tryghost/members-csv": "2.0.3",
     "@tryghost/metrics": "1.0.38",
     "@tryghost/mw-error-handler": "1.0.7",
@@ -109,13 +109,13 @@
     "@tryghost/nodemailer": "0.3.48",
     "@tryghost/nql": "0.12.7",
     "@tryghost/pretty-cli": "1.2.47",
-    "@tryghost/prometheus-metrics": "1.0.1",
+    "@tryghost/prometheus-metrics": "1.0.2",
     "@tryghost/promise": "0.3.15",
     "@tryghost/referrer-parser": "0.1.8",
-    "@tryghost/request": "1.0.11",
+    "@tryghost/request": "1.0.12",
     "@tryghost/root-utils": "0.3.33",
     "@tryghost/security": "1.0.1",
-    "@tryghost/social-urls": "0.1.52",
+    "@tryghost/social-urls": "0.1.53",
     "@tryghost/string": "0.2.17",
     "@tryghost/tpl": "0.1.35",
     "@tryghost/url-utils": "4.4.14",
@@ -182,7 +182,7 @@
     "knex-migrator": "5.3.2",
     "leaky-bucket": "2.2.0",
     "lodash": "4.17.21",
-    "luxon": "3.6.1",
+    "luxon": "3.7.1",
     "mailgun.js": "10.4.0",
     "metascraper": "5.45.15",
     "metascraper-author": "5.45.10",
@@ -197,7 +197,7 @@
     "moment": "2.24.0",
     "moment-timezone": "0.5.45",
     "multer": "2.0.1",
-    "mysql2": "3.14.1",
+    "mysql2": "3.14.2",
     "nconf": "0.13.0",
     "node-fetch": "2.7.0",
     "node-jose": "2.2.0",
@@ -226,21 +226,21 @@
   },
   "devDependencies": {
     "@actions/core": "1.11.1",
-    "@playwright/test": "1.53.2",
+    "@playwright/test": "1.54.1",
     "@prettier/sync": "0.6.1",
     "@tryghost/express-test": "0.15.0",
     "@tryghost/webhook-mock-receiver": "0.2.17",
     "@types/bookshelf": "1.2.9",
     "@types/common-tags": "1.8.4",
     "@types/jsonwebtoken": "9.0.10",
-    "@types/node": "22.16.0",
+    "@types/node": "22.16.4",
     "@types/node-jose": "1.1.13",
     "@types/nodemailer": "6.4.17",
     "@types/sinon": "17.0.4",
     "@types/supertest": "6.0.3",
     "c8": "10.1.3",
     "cli-progress": "3.12.0",
-    "cssnano": "7.0.7",
+    "cssnano": "7.1.0",
     "detect-indent": "6.1.0",
     "detect-newline": "3.1.0",
     "expect": "29.7.0",
@@ -270,11 +270,11 @@
   },
   "resolutions": {
     "@tryghost/errors": "1.3.8",
-    "@tryghost/logging": "2.4.22",
+    "@tryghost/logging": "2.4.23",
     "jackspeak": "2.3.6",
     "moment": "2.24.0",
     "moment-timezone": "0.5.45",
-    "@tryghost/i18n": "file:components/tryghost-i18n-5.129.1.tgz"
+    "@tryghost/i18n": "file:components/tryghost-i18n-5.130.0.tgz"
   },
   "nx": {
     "targets": {