ghost 5.130.2 → 6.0.0-alpha.2

package/core/server/web/shared/middleware/redirect-amp-urls.js

@@ -0,0 +1,36 @@
+const urlUtils = require('../../../../shared/url-utils');
+const localUtils = require('../utils');
+
+/**
+ * redirectAmpUrls middleware
+ *
+ * 1. Detect requests whose path ends with `/amp/` (case-insensitive) or `/amp` before a query-string
+ * 2. Issue a 301 redirect to the same URL without that suffix, preserving the query string.
+ *
+ * Needs to sit early in the public-site middleware stack so that the request never reaches
+ * the dynamic routers or results in a 404.
+ *
+ * Example:
+ *   /welcome/amp/      -> /welcome/
+ *   /welcome/amp/?q=1  -> /welcome/?q=1
+ *
+ * @param {import('express').Request} req - Express request object
+ * @param {import('express').Response} res - Express response object  
+ * @param {import('express').NextFunction} next - Express next function
+ * @returns {void}
+ */
+function redirectAmpUrls(req, res, next) {
+    const ampPattern = /\/amp\/?$/i;
+    const url = new URL(req.url, 'http://example.com');
+    
+    if (!ampPattern.test(url.pathname)) {
+        return next();
+    }
+
+    const sanitizedPath = url.pathname.replace(ampPattern, '/') + url.search;
+    const redirectPath = localUtils.removeOpenRedirectFromUrl(sanitizedPath);
+
+    return urlUtils.redirect301(res, redirectPath);
+}
+
+module.exports = redirectAmpUrls; 

package/core/shared/config/defaults.json

@@ -177,6 +177,8 @@
         }
     },
     "optimization": {
+        "maxLimit": 100,
+        "allowLimitAll": false,
         "getHelper": {
             "timeout": {
                 "threshold": 5000,

package/core/shared/config/overrides.json

@@ -12,10 +12,7 @@
         "publicFilePath": "core/frontend/public"
     },
     "apps": {
-        "internal": [
-            "private-blogging",
-            "amp"
-        ]
+        "internal": ["private-blogging"]
     },
     "slugs": {
         "protected": ["ghost", "rss", "amp"]

package/core/shared/labs.js

@@ -26,12 +26,12 @@ const GA_FEATURES = [
     'themeErrorsNotification',
     'announcementBar',
     'customFonts',
-    'contentVisibility'
+    'contentVisibility',
+    'explore'
 ];
 
 // These features are considered publicly available and can be enabled/disabled by users
 const PUBLIC_BETA_FEATURES = [
-    'ActivityPub',
     'superEditors',
     'editorExcerpt',
     'additionalPaymentMethods'
@@ -42,14 +42,10 @@ const PUBLIC_BETA_FEATURES = [
 const PRIVATE_FEATURES = [
     'stripeAutomaticTax',
     'webmentions',
-    'trafficAnalytics',
     'importMemberTier',
     'urlCache',
-    'mailEvents',
     'lexicalIndicators',
-    'ui60',
     'contentVisibilityAlpha',
-    'explore',
     'emailCustomization'
 ];
 

package/core/shared/max-limit-cap.js

@@ -0,0 +1,61 @@
+const config = require('../shared/config');
+
+// Prior to Ghost 6.x we allowed any limit value, including 'all', but as sites
+// grew in size it led to performance issues and mis-use of the API.
+
+// After Ghost 6.x we only allow a max limit of 100. This shared module provides
+// the core limit capping logic that can be used by both middleware and helpers.
+
+const limitConfig = {
+    allowLimitAll: config.get('optimization:allowLimitAll') || false,
+    maxLimit: config.get('optimization:maxLimit') || 100,
+    // Temporary exceptions to the max limit rule (HTTP-specific)
+    exceptionEndpoints: [
+        '/ghost/api/admin/posts/export/',
+        '/ghost/api/admin/emails/' // /:id/batches/ and /:id/recipient-failures/
+    ]
+};
+
+/**
+ * Apply limit capping logic to a limit value
+ * @param {string|number} limit - The limit value to cap
+ * @param {Object} options - Optional settings
+ * @param {string} [options.url] - URL to check against exception endpoints (for middleware)
+ * @returns {string|number} The capped limit value
+ */
+function applyLimitCap(limit, options = {}) {
+    if (!limit) {
+        return limit;
+    }
+
+    // If 'all' is globally allowed, skip everything else
+    if (limit === 'all' && limitConfig.allowLimitAll) {
+        return limit;
+    }
+
+    // Check exception endpoints - they bypass all limits (HTTP-specific)
+    if (options.url && limitConfig.exceptionEndpoints.some(endpoint => options.url.startsWith(endpoint))) {
+        return limit;
+    }
+
+    // 'all' is no longer supported so gets capped to maxLimit
+    if (limit === 'all') {
+        return limitConfig.maxLimit;
+    }
+
+    // Convert to number for comparison
+    const numericLimit = parseInt(String(limit), 10);
+
+    // If it's not a valid number or exceeds maxLimit, cap it
+    if (isNaN(numericLimit) || numericLimit > limitConfig.maxLimit) {
+        return limitConfig.maxLimit;
+    }
+
+    // Return the original limit if it's within bounds
+    return limit;
+}
+
+module.exports = {
+    applyLimitCap,
+    limitConfig
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ghost",
-  "version": "5.130.2",
+  "version": "6.0.0-alpha.2",
   "description": "The professional publishing platform",
   "author": "Ghost Foundation",
   "homepage": "https://ghost.org",
@@ -62,7 +62,7 @@
     "reset:data:tinybird": "cd core/server/data/tinybird/scripts && node reset-data-tinybird.js"
   },
   "engines": {
-    "node": "^18.12.1 || ^20.11.1 || ^22.13.1",
+    "node": "^22.13.1",
     "cli": "^1.27.0"
   },
   "dependencies": {
@@ -86,7 +86,7 @@
     "@tryghost/helpers": "1.1.97",
     "@tryghost/html-to-plaintext": "1.0.4",
     "@tryghost/http-cache-utils": "0.1.20",
-    "@tryghost/i18n": "file:components/tryghost-i18n-5.130.2.tgz",
+    "@tryghost/i18n": "file:components/tryghost-i18n-6.0.0-alpha.2.tgz",
     "@tryghost/image-transform": "1.4.6",
     "@tryghost/job-manager": "1.0.3",
     "@tryghost/kg-card-factory": "5.1.2",
@@ -122,7 +122,6 @@
     "@tryghost/validator": "0.2.17",
     "@tryghost/version": "0.1.33",
     "@tryghost/zip": "1.1.49",
-    "amperize": "0.6.1",
     "body-parser": "1.20.3",
     "bookshelf": "1.2.0",
     "bookshelf-relations": "2.8.0",
@@ -233,7 +232,7 @@
     "@types/bookshelf": "1.2.9",
     "@types/common-tags": "1.8.4",
     "@types/jsonwebtoken": "9.0.10",
-    "@types/node": "22.16.4",
+    "@types/node": "22.16.5",
     "@types/node-jose": "1.1.13",
     "@types/nodemailer": "6.4.17",
     "@types/sinon": "17.0.4",
@@ -274,7 +273,7 @@
     "jackspeak": "2.3.6",
     "moment": "2.24.0",
     "moment-timezone": "0.5.45",
-    "@tryghost/i18n": "file:components/tryghost-i18n-5.130.2.tgz"
+    "@tryghost/i18n": "file:components/tryghost-i18n-6.0.0-alpha.2.tgz"
   },
   "nx": {
     "targets": {