ghost 5.129.2 → 5.130.0

package/core/built/admin/index.html

@@ -6,7 +6,7 @@
     <title>Ghost</title>
 
     
-<meta name="ghost-admin/config/environment" content="%7B%22modulePrefix%22%3A%22ghost-admin%22%2C%22environment%22%3A%22production%22%2C%22cdnUrl%22%3A%22%22%2C%22editorUrl%22%3A%22%22%2C%22rootURL%22%3A%22%22%2C%22locationType%22%3A%22trailing-hash%22%2C%22EmberENV%22%3A%7B%22FEATURES%22%3A%7B%7D%2C%22EXTEND_PROTOTYPES%22%3A%7B%22Date%22%3Afalse%2C%22Array%22%3Atrue%2C%22String%22%3Atrue%2C%22Function%22%3Afalse%7D%2C%22_APPLICATION_TEMPLATE_WRAPPER%22%3Afalse%2C%22_JQUERY_INTEGRATION%22%3Atrue%2C%22_TEMPLATE_ONLY_GLIMMER_COMPONENTS%22%3Atrue%7D%2C%22APP%22%3A%7B%22version%22%3A%225.129%22%2C%22name%22%3A%22ghost-admin%22%7D%2C%22ember-simple-auth%22%3A%7B%7D%2C%22%40sentry%2Fember%22%3A%7B%22disablePerformance%22%3Atrue%2C%22sentry%22%3A%7B%7D%7D%2C%22ember-cli-mirage%22%3A%7B%22usingProxy%22%3Afalse%2C%22useDefaultPassthroughs%22%3Atrue%7D%2C%22exportApplicationGlobal%22%3Afalse%2C%22ember-load%22%3A%7B%22loadingIndicatorClass%22%3A%22ember-load-indicator%22%7D%2C%22editorFilename%22%3A%22koenig-lexical.umd.js%22%2C%22editorHash%22%3A%2237bd1e3e4d%22%2C%22adminXSettingsFilename%22%3A%22admin-x-settings.js%22%2C%22adminXSettingsHash%22%3A%22657b852ebf%22%2C%22adminXActivitypubFilename%22%3A%22admin-x-activitypub.js%22%2C%22adminXActivitypubHash%22%3A%2240f7252084%22%2C%22postsFilename%22%3A%22posts.js%22%2C%22postsHash%22%3A%22be74778cd8%22%2C%22statsFilename%22%3A%22stats.js%22%2C%22statsHash%22%3A%222dcb5663ba%22%2C%22adminXActivitypubCustomUrl%22%3A%22https%3A%2F%2Fcdn.jsdelivr.net%2Fghost%2Fadmin-x-activitypub%400%2Fdist%2Fadmin-x-activitypub.js%22%7D" />
+<meta name="ghost-admin/config/environment" content="%7B%22modulePrefix%22%3A%22ghost-admin%22%2C%22environment%22%3A%22production%22%2C%22cdnUrl%22%3A%22%22%2C%22editorUrl%22%3A%22%22%2C%22rootURL%22%3A%22%22%2C%22locationType%22%3A%22trailing-hash%22%2C%22EmberENV%22%3A%7B%22FEATURES%22%3A%7B%7D%2C%22EXTEND_PROTOTYPES%22%3A%7B%22Date%22%3Afalse%2C%22Array%22%3Atrue%2C%22String%22%3Atrue%2C%22Function%22%3Afalse%7D%2C%22_APPLICATION_TEMPLATE_WRAPPER%22%3Afalse%2C%22_JQUERY_INTEGRATION%22%3Atrue%2C%22_TEMPLATE_ONLY_GLIMMER_COMPONENTS%22%3Atrue%7D%2C%22APP%22%3A%7B%22version%22%3A%225.130%22%2C%22name%22%3A%22ghost-admin%22%7D%2C%22ember-simple-auth%22%3A%7B%7D%2C%22%40sentry%2Fember%22%3A%7B%22disablePerformance%22%3Atrue%2C%22sentry%22%3A%7B%7D%7D%2C%22ember-cli-mirage%22%3A%7B%22usingProxy%22%3Afalse%2C%22useDefaultPassthroughs%22%3Atrue%7D%2C%22exportApplicationGlobal%22%3Afalse%2C%22ember-load%22%3A%7B%22loadingIndicatorClass%22%3A%22ember-load-indicator%22%7D%2C%22editorFilename%22%3A%22koenig-lexical.umd.js%22%2C%22editorHash%22%3A%2237bd1e3e4d%22%2C%22adminXSettingsFilename%22%3A%22admin-x-settings.js%22%2C%22adminXSettingsHash%22%3A%2262b55e2aae%22%2C%22adminXActivitypubFilename%22%3A%22admin-x-activitypub.js%22%2C%22adminXActivitypubHash%22%3A%226d96d71fe8%22%2C%22postsFilename%22%3A%22posts.js%22%2C%22postsHash%22%3A%223ad9cd1892%22%2C%22statsFilename%22%3A%22stats.js%22%2C%22statsHash%22%3A%22701e8fc366%22%2C%22adminXActivitypubCustomUrl%22%3A%22https%3A%2F%2Fcdn.jsdelivr.net%2Fghost%2Fadmin-x-activitypub%400%2Fdist%2Fadmin-x-activitypub.js%22%7D" />
 
     <meta name="viewport" content="user-scalable=no, width=device-width, initial-scale=1, maximum-scale=1, minimal-ui, viewport-fit=cover" />
     <meta name="pinterest" content="nopin" />
@@ -49,7 +49,7 @@
 
     <script src="assets/vendor-c89102f24c3d9502e9db741509767580.js"></script>
 <script src="assets/chunk.728.214803966b81ffdb1acd.js"></script>
-<script src="assets/chunk.524.c8313bccd308920abf9c.js"></script>
-    <script src="assets/ghost-db9fcb8c1f65776f3ee11c39f19a660b.js"></script>
+<script src="assets/chunk.524.2443bfd380e6da0cbabd.js"></script>
+    <script src="assets/ghost-5d9c65b5c4ef960a664cd664b2616dea.js"></script>
 </body>
 </html>

package/core/frontend/helpers/match.js

@@ -57,6 +57,9 @@ const handleMatch = (data, operator, value) => {
     case '<=':
         result = data <= value;
         break;
+    case '~':
+        result = _.isString(data) && _.isString(value) && data.includes(value);
+        break;
     case '~^':
         result = _.isString(data) && _.isString(value) && data.startsWith(value);
         break;

package/core/frontend/meta/schema.js

@@ -78,6 +78,24 @@ function trimSameAs(author) {
     return sameAs;
 }
 
+/**
+ * Build contributor objects for schema.org Article schema.
+ *
+ * @param {Object[]} authors - Array of author objects (excluding primary author)
+ */
+function buildContributorObjects(authors) {
+    return authors.map(author => trimSchema({
+        '@type': 'Person',
+        name: escapeExpression(author.name),
+        image: author.profile_image ? schemaImageObject({url: author.profile_image}) : null,
+        url: author.url || null,
+        sameAs: trimSameAs(author),
+        description: author.meta_description ?
+            escapeExpression(author.meta_description) :
+            null
+    }));
+}
+
 function getPostSchema(metaData, data) {
     // CASE: metaData.excerpt for post context is populated by either the custom excerpt, the meta description,
     // or the automated excerpt of 50 words. It is empty for any other context.
@@ -101,6 +119,7 @@ function getPostSchema(metaData, data) {
                 escapeExpression(data[context].primary_author.metaDescription) :
                 null
         },
+        contributor: data[context].authors && data[context].authors.length > 1 ? buildContributorObjects(data[context].authors.slice(1)) : null,
         headline: escapeExpression(metaData.metaTitle),
         url: metaData.url,
         datePublished: metaData.publishedDate,

package/core/server/api/endpoints/utils/serializers/input/settings.js

@@ -78,7 +78,9 @@ const EDITABLE_SETTINGS = [
     'heading_font',
     'blocked_email_domains',
     'require_email_mfa',
-    'social_web'
+    'social_web',
+    'explore_ping',
+    'explore_ping_growth'
 ];
 
 module.exports = {

package/core/server/api/endpoints/utils/serializers/input/utils/settings-key-group-mapper.js

@@ -48,7 +48,9 @@ const keyGroupMapping = {
     portal_name: 'portal',
     portal_button: 'portal',
     portal_plans: 'portal',
-    require_email_mfa: 'security'
+    require_email_mfa: 'security',
+    explore_ping: 'explore',
+    explore_ping_growth: 'explore'
 };
 
 const mapKeyToGroup = (key) => {

package/core/server/api/endpoints/utils/serializers/input/utils/settings-key-type-mapper.js

@@ -55,7 +55,9 @@ const keyTypeMapping = {
     labs: 'object',
     unsplash: 'object',
     bulk_email_settings: 'object',
-    require_email_mfa: 'boolean'
+    require_email_mfa: 'boolean',
+    explore_ping: 'boolean',
+    explore_ping_growth: 'boolean'
 };
 
 const mapKeyToType = (key) => {

package/core/server/api/endpoints/utils/serializers/output/config.js

@@ -22,7 +22,8 @@ module.exports = {
             'pintura',
             'signupForm',
             'stats',
-            'security'
+            'security',
+            'exploreTestimonialsUrl'
         ];
 
         frame.response = {

package/core/server/data/migrations/versions/5.130/2025-07-11-14-14-54-add-explore-settings.js

@@ -0,0 +1,16 @@
+const {combineTransactionalMigrations, addSetting} = require('../../utils');
+
+module.exports = combineTransactionalMigrations(
+    addSetting({
+        key: 'explore_ping',
+        value: 'true',
+        type: 'boolean',
+        group: 'explore'
+    }),
+    addSetting({
+        key: 'explore_ping_growth',
+        value: 'false',
+        type: 'boolean',
+        group: 'explore'
+    })
+);

package/core/server/data/schema/default-settings/default-settings.json

@@ -628,5 +628,23 @@
             },
             "type": "boolean"
         }
+    },
+    "explore": {
+        "explore_ping": {
+            "defaultValue": "true",
+            "validations": {
+                "isEmpty": false,
+                "isIn": [["true", "false"]]
+            },
+            "type": "boolean"
+        },
+        "explore_ping_growth": {
+            "defaultValue": "false",
+            "validations": {
+                "isEmpty": false,
+                "isIn": [["true", "false"]]
+            },
+            "type": "boolean"
+        }
     }
 }

package/core/server/services/activitypub/ActivityPubService.js

@@ -18,12 +18,32 @@ class ActivityPubService {
         this.identityTokenService = identityTokenService;
     }
     getExpectedWebhooks(secret) {
-        return [{
+        return [
+            {
                 event: 'post.published',
                 target_url: new URL('.ghost/activitypub/v1/webhooks/post/published', this.siteUrl),
                 api_version: 'v5.100.0',
                 secret
-            }];
+            },
+            {
+                event: 'post.deleted',
+                target_url: new URL('.ghost/activitypub/v1/webhooks/post/deleted', this.siteUrl),
+                api_version: 'v5.100.0',
+                secret
+            },
+            {
+                event: 'post.unpublished',
+                target_url: new URL('.ghost/activitypub/v1/webhooks/post/unpublished', this.siteUrl),
+                api_version: 'v5.100.0',
+                secret
+            },
+            {
+                event: 'post.published.edited',
+                target_url: new URL('.ghost/activitypub/v1/webhooks/post/updated', this.siteUrl),
+                api_version: 'v5.100.0',
+                secret
+            }
+        ];
     }
     async checkWebhookState(expectedWebhooks, integration) {
         this.logging.info(`Checking ActivityPub Webhook state`);

package/core/server/services/activitypub/ActivityPubService.ts

@@ -25,12 +25,32 @@ export class ActivityPubService {
     ) {}
 
     getExpectedWebhooks(secret: string): ExpectedWebhook[] {
-        return [{
-            event: 'post.published',
-            target_url: new URL('.ghost/activitypub/v1/webhooks/post/published', this.siteUrl),
-            api_version: 'v5.100.0',
-            secret
-        }];
+        return [
+            {
+                event: 'post.published',
+                target_url: new URL('.ghost/activitypub/v1/webhooks/post/published', this.siteUrl),
+                api_version: 'v5.100.0',
+                secret
+            },
+            {
+                event: 'post.deleted',
+                target_url: new URL('.ghost/activitypub/v1/webhooks/post/deleted', this.siteUrl),
+                api_version: 'v5.100.0',
+                secret
+            },
+            {
+                event: 'post.unpublished',
+                target_url: new URL('.ghost/activitypub/v1/webhooks/post/unpublished', this.siteUrl),
+                api_version: 'v5.100.0',
+                secret
+            },
+            {
+                event: 'post.published.edited',
+                target_url: new URL('.ghost/activitypub/v1/webhooks/post/updated', this.siteUrl),
+                api_version: 'v5.100.0',
+                secret
+            }
+        ];
     }
 
     async checkWebhookState(expectedWebhooks: ExpectedWebhook[], integration: {id: string}) {

package/core/server/services/email-service/email-templates/partials/styles.hbs

@@ -381,7 +381,6 @@ h6 + .kg-paywall .kg-paywall-hr td {
 }
 
 /* Exclude CTA cards with colored backgrounds from custom text color, but allow transparent ones */
-{{#hasFeature "emailCustomization"}}
 {{#each ctaBgColors}}
 .post-content-row .kg-cta-bg-{{this}} .kg-cta-text p,
 .post-content-row .kg-cta-bg-{{this}} .kg-cta-text ul,
@@ -391,17 +390,6 @@ h6 + .kg-paywall .kg-paywall-hr td {
     color: inherit !important;
 }
 {{/each}}
-{{else}}
-.post-content-row .kg-cta-bg-grey .kg-cta-text p,
-.post-content-row .kg-cta-bg-blue .kg-cta-text p,
-.post-content-row .kg-cta-bg-green .kg-cta-text p,
-.post-content-row .kg-cta-bg-yellow .kg-cta-text p,
-.post-content-row .kg-cta-bg-red .kg-cta-text p,
-.post-content-row .kg-cta-bg-pink .kg-cta-text p,
-.post-content-row .kg-cta-bg-purple .kg-cta-text p {
-    color: inherit !important;
-}
-{{/hasFeature}}
 
 .kg-cta-bg-none .kg-cta-sponsor-label span,
 .kg-cta-bg-white .kg-cta-sponsor-label span {
@@ -2542,10 +2530,8 @@ table.btn-accent a {
 {{/if}}
 
 </style>
-{{#hasFeature "emailCustomization"}}
 <!--[if mso]>
 <style type="text/css">
     ul, ol { margin-left: 1.5em !important; } {{!-- fix bullets/numbers not appearing for lists in older Outlook versions --}}
 </style>
 <![endif]-->
-{{/hasFeature}}

package/core/server/services/explore-ping/ExplorePingService.js

@@ -1,7 +1,7 @@
 module.exports = class ExplorePingService {
     /**
      * @param {object} deps
-     * @param {{getPublic: () => import('../../../shared/settings-cache/CacheManager').PublicSettingsCache}} deps.settingsCache
+     * @param {{get: (string) => string}} deps.settingsCache
      * @param {object} deps.config
      * @param {object} deps.labs
      * @param {object} deps.logging
@@ -14,6 +14,7 @@ module.exports = class ExplorePingService {
      * }}} deps.posts
      * @param {{stats: {
      *   getTotalMembers: () => Promise<number>
+     *   getMRRHistory: () => Promise<number>
      * }}} deps.members
      */
     constructor({settingsCache, config, labs, logging, ghostVersion, request, posts, members}) {
@@ -28,45 +29,50 @@ module.exports = class ExplorePingService {
     }
 
     async constructPayload() {
-        /* eslint-disable camelcase */
-        const {title, description, icon, locale, accent_color, twitter, facebook, site_uuid} = this.settingsCache.getPublic();
-
-        // Get post statistics
-        const [totalPosts, lastPublishedAt, firstPublishedAt] = await Promise.all([
-            this.posts.stats.getTotalPostsPublished(),
-            this.posts.stats.getMostRecentlyPublishedPostDate(),
-            this.posts.stats.getFirstPublishedPostDate()
-        ]);
+        const payload = {
+            ghost: this.ghostVersion.full,
+            site_uuid: this.settingsCache.get('site_uuid'),
+            url: this.config.get('url'),
+            theme: this.settingsCache.get('active_theme')
+        };
 
-        // Get member statistics with error handling
-        let totalMembers = null;
         try {
-            totalMembers = await this.members.stats.getTotalMembers();
+            const [totalPosts, lastPublishedAt, firstPublishedAt] = await Promise.all([
+                this.posts.stats.getTotalPostsPublished(),
+                this.posts.stats.getMostRecentlyPublishedPostDate(),
+                this.posts.stats.getFirstPublishedPostDate()
+            ]);
+
+            payload.posts_total = totalPosts;
+            payload.posts_last = lastPublishedAt ? lastPublishedAt.toISOString() : null;
+            payload.posts_first = firstPublishedAt ? firstPublishedAt.toISOString() : null;
         } catch (err) {
-            this.logging.warn('Failed to fetch member statistics', {
+            this.logging.warn('Failed to fetch post statistics', {
                 error: err.message,
                 context: 'explore-ping-service'
             });
-            // Continue without member statistics
+            payload.posts_total = null;
+            payload.posts_last = null;
+            payload.posts_first = null;
         }
 
-        return {
-            ghost: this.ghostVersion.full,
-            site_uuid,
-            url: this.config.get('url'),
-            title,
-            description,
-            icon,
-            locale,
-            accent_color,
-            twitter,
-            facebook,
-            posts_first: firstPublishedAt ? firstPublishedAt.toISOString() : null,
-            posts_last: lastPublishedAt ? lastPublishedAt.toISOString() : null,
-            posts_total: totalPosts,
-            members_total: totalMembers
-        };
-        /* eslint-enable camelcase */
+        if (this.settingsCache.get('explore_ping_growth')) {
+            try {
+                const totalMembers = await this.members.stats.getTotalMembers();
+                const mrr = await this.members.stats.getMRRHistory();
+                payload.members_total = totalMembers;
+                payload.mrr = mrr;
+            } catch (err) {
+                this.logging.warn('Failed to fetch member statistics', {
+                    error: err.message,
+                    context: 'explore-ping-service'
+                });
+                payload.members_total = null;
+                payload.mrr = null;
+            }
+        }
+
+        return payload;
     }
 
     async makeRequest(exploreUrl, payload) {
@@ -95,12 +101,17 @@ module.exports = class ExplorePingService {
             return;
         }
 
-        const exploreUrl = this.config.get('explore:url');
+        const exploreUrl = this.config.get('explore:update_url');
         if (!exploreUrl) {
             this.logging.warn('Explore URL not set');
             return;
         }
 
+        if (!this.settingsCache.get('explore_ping')) {
+            this.logging.info('Explore ping disabled');
+            return;
+        }
+
         const payload = await this.constructPayload();
         await this.makeRequest(exploreUrl, payload);
     }

package/core/server/services/public-config/config.js

@@ -25,6 +25,10 @@ module.exports = function getConfigProperties() {
         security: config.get('security')
     };
 
+    if (config.get('explore') && config.get('explore:testimonials_url')) {
+        configProperties.exploreTestimonialsUrl = config.get('explore:testimonials_url');
+    }
+
     // WIP tinybird stats feature - it's entirely config driven instead of using an alpha flag for now
     if (config.get('tinybird') && config.get('tinybird:stats')) {
         const statsConfig = config.get('tinybird:stats');

package/core/server/services/themes/installer.js

@@ -19,9 +19,18 @@ const messages = {
 const installFromGithub = async (ref) => {
     const [org, repo] = ref.toLowerCase().split('/');
 
-    //TODO: move the organization check to config
-    if (limitService.isLimited('customThemes') && org.toLowerCase() !== 'tryghost') {
-        await limitService.errorIfWouldGoOverLimit('customThemes', {value: repo.toLowerCase()});
+    if (limitService.isLimited('customThemes')) {
+        // The custom theme limit might consist of only one single theme, so we can't rely on
+        // the org alone to determine if the request is allowed or not.
+        const noOtherThemesAllowed = limitService.limits.customThemes?.allowlist?.length === 1;
+        //TODO: move the organization check to config
+        const isNotOfficialThemeRequest = org.toLowerCase() !== 'tryghost';
+
+        const checkThemeLimit = noOtherThemesAllowed || isNotOfficialThemeRequest;
+
+        if (checkThemeLimit) {
+            await limitService.errorIfWouldGoOverLimit('customThemes', {value: repo.toLowerCase()});
+        }
     }
 
     // omit /:ref so we fetch the default branch
@@ -62,6 +71,11 @@ const installFromGithub = async (ref) => {
             }));
         }
 
+        if (e instanceof errors.HostLimitError) {
+            // If the error is a HostLimitError, we can assume that the theme name is not allowed
+            return Promise.reject(e);
+        }
+
         throw e;
     } finally {
         // clean up tmp dir with downloaded file

package/core/shared/config/env/config.production.json

@@ -17,5 +17,9 @@
             "enabled": true
         },
         "transports": ["file"]
+    },
+    "explore": {
+        "update_url": "https://explore.ghost.org/api/update",
+        "testimonials_url": "https://explore.ghost.org/api/testimonials"
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ghost",
-  "version": "5.129.2",
+  "version": "5.130.0",
   "description": "The professional publishing platform",
   "author": "Ghost Foundation",
   "homepage": "https://ghost.org",
@@ -86,7 +86,7 @@
     "@tryghost/helpers": "1.1.97",
     "@tryghost/html-to-plaintext": "1.0.4",
     "@tryghost/http-cache-utils": "0.1.20",
-    "@tryghost/i18n": "file:components/tryghost-i18n-5.129.2.tgz",
+    "@tryghost/i18n": "file:components/tryghost-i18n-5.130.0.tgz",
     "@tryghost/image-transform": "1.4.6",
     "@tryghost/job-manager": "1.0.3",
     "@tryghost/kg-card-factory": "5.1.2",
@@ -226,21 +226,21 @@
   },
   "devDependencies": {
     "@actions/core": "1.11.1",
-    "@playwright/test": "1.53.2",
+    "@playwright/test": "1.54.1",
     "@prettier/sync": "0.6.1",
     "@tryghost/express-test": "0.15.0",
     "@tryghost/webhook-mock-receiver": "0.2.17",
     "@types/bookshelf": "1.2.9",
     "@types/common-tags": "1.8.4",
     "@types/jsonwebtoken": "9.0.10",
-    "@types/node": "22.16.3",
+    "@types/node": "22.16.4",
     "@types/node-jose": "1.1.13",
     "@types/nodemailer": "6.4.17",
     "@types/sinon": "17.0.4",
     "@types/supertest": "6.0.3",
     "c8": "10.1.3",
     "cli-progress": "3.12.0",
-    "cssnano": "7.0.7",
+    "cssnano": "7.1.0",
     "detect-indent": "6.1.0",
     "detect-newline": "3.1.0",
     "expect": "29.7.0",
@@ -274,7 +274,7 @@
     "jackspeak": "2.3.6",
     "moment": "2.24.0",
     "moment-timezone": "0.5.45",
-    "@tryghost/i18n": "file:components/tryghost-i18n-5.129.2.tgz"
+    "@tryghost/i18n": "file:components/tryghost-i18n-5.130.0.tgz"
   },
   "nx": {
     "targets": {