ghost 6.0.8 → 6.0.10

package/core/built/admin/index.html

@@ -6,7 +6,7 @@
     <title>Ghost</title>
 
     
-<meta name="ghost-admin/config/environment" content="%7B%22modulePrefix%22%3A%22ghost-admin%22%2C%22environment%22%3A%22production%22%2C%22cdnUrl%22%3A%22%22%2C%22editorUrl%22%3A%22%22%2C%22rootURL%22%3A%22%22%2C%22locationType%22%3A%22trailing-hash%22%2C%22EmberENV%22%3A%7B%22FEATURES%22%3A%7B%7D%2C%22EXTEND_PROTOTYPES%22%3A%7B%22Date%22%3Afalse%2C%22Array%22%3Atrue%2C%22String%22%3Atrue%2C%22Function%22%3Afalse%7D%2C%22_APPLICATION_TEMPLATE_WRAPPER%22%3Afalse%2C%22_JQUERY_INTEGRATION%22%3Atrue%2C%22_TEMPLATE_ONLY_GLIMMER_COMPONENTS%22%3Atrue%7D%2C%22APP%22%3A%7B%22version%22%3A%226.0%22%2C%22name%22%3A%22ghost-admin%22%7D%2C%22ember-simple-auth%22%3A%7B%7D%2C%22%40sentry%2Fember%22%3A%7B%22disablePerformance%22%3Atrue%2C%22sentry%22%3A%7B%7D%7D%2C%22ember-cli-mirage%22%3A%7B%22usingProxy%22%3Afalse%2C%22useDefaultPassthroughs%22%3Atrue%7D%2C%22exportApplicationGlobal%22%3Afalse%2C%22ember-load%22%3A%7B%22loadingIndicatorClass%22%3A%22ember-load-indicator%22%7D%2C%22editorFilename%22%3A%22koenig-lexical.umd.js%22%2C%22editorHash%22%3A%2237bd1e3e4d%22%2C%22adminXSettingsFilename%22%3A%22admin-x-settings.js%22%2C%22adminXSettingsHash%22%3A%22eeba8b2d8c%22%2C%22adminXActivitypubFilename%22%3A%22admin-x-activitypub.js%22%2C%22adminXActivitypubHash%22%3A%2236cc1964d0%22%2C%22postsFilename%22%3A%22posts.js%22%2C%22postsHash%22%3A%221289bfe662%22%2C%22statsFilename%22%3A%22stats.js%22%2C%22statsHash%22%3A%220049e3950f%22%2C%22adminXActivitypubRemoteConfigUrl%22%3A%22%2F.ghost%2Factivitypub%2Fstable%2Fclient-config%22%7D" />
+<meta name="ghost-admin/config/environment" content="%7B%22modulePrefix%22%3A%22ghost-admin%22%2C%22environment%22%3A%22production%22%2C%22cdnUrl%22%3A%22%22%2C%22editorUrl%22%3A%22%22%2C%22rootURL%22%3A%22%22%2C%22locationType%22%3A%22trailing-hash%22%2C%22EmberENV%22%3A%7B%22FEATURES%22%3A%7B%7D%2C%22EXTEND_PROTOTYPES%22%3A%7B%22Date%22%3Afalse%2C%22Array%22%3Atrue%2C%22String%22%3Atrue%2C%22Function%22%3Afalse%7D%2C%22_APPLICATION_TEMPLATE_WRAPPER%22%3Afalse%2C%22_JQUERY_INTEGRATION%22%3Atrue%2C%22_TEMPLATE_ONLY_GLIMMER_COMPONENTS%22%3Atrue%7D%2C%22APP%22%3A%7B%22version%22%3A%226.0%22%2C%22name%22%3A%22ghost-admin%22%7D%2C%22ember-simple-auth%22%3A%7B%7D%2C%22%40sentry%2Fember%22%3A%7B%22disablePerformance%22%3Atrue%2C%22sentry%22%3A%7B%7D%7D%2C%22ember-cli-mirage%22%3A%7B%22usingProxy%22%3Afalse%2C%22useDefaultPassthroughs%22%3Atrue%7D%2C%22exportApplicationGlobal%22%3Afalse%2C%22ember-load%22%3A%7B%22loadingIndicatorClass%22%3A%22ember-load-indicator%22%7D%2C%22editorFilename%22%3A%22koenig-lexical.umd.js%22%2C%22editorHash%22%3A%2237bd1e3e4d%22%2C%22adminXSettingsFilename%22%3A%22admin-x-settings.js%22%2C%22adminXSettingsHash%22%3A%22b272efcbc4%22%2C%22adminXActivitypubFilename%22%3A%22admin-x-activitypub.js%22%2C%22adminXActivitypubHash%22%3A%2258c4bfa71b%22%2C%22postsFilename%22%3A%22posts.js%22%2C%22postsHash%22%3A%22336ecd7f7c%22%2C%22statsFilename%22%3A%22stats.js%22%2C%22statsHash%22%3A%22a2e0991d78%22%2C%22adminXActivitypubRemoteConfigUrl%22%3A%22%2F.ghost%2Factivitypub%2Fstable%2Fclient-config%22%7D" />
 
     <meta name="viewport" content="user-scalable=no, width=device-width, initial-scale=1, maximum-scale=1, minimal-ui, viewport-fit=cover" />
     <meta name="pinterest" content="nopin" />
@@ -48,8 +48,8 @@
     <div id="ember-basic-dropdown-wormhole"></div>
 
     <script src="assets/vendor-aed0068cf9b67d042dd23a6343545b7b.js"></script>
-<script src="assets/chunk.397.1904882a4a78e2922f07.js"></script>
-<script src="assets/chunk.524.099dcd3975a0e60c5579.js"></script>
-    <script src="assets/ghost-138bb4718f8b9d666bdd7a2b45330d58.js"></script>
+<script src="assets/chunk.397.e5d027e53a68dff31d76.js"></script>
+<script src="assets/chunk.524.695215c994f8cbf547d3.js"></script>
+    <script src="assets/ghost-9c608430440a10746540adb7d2cd0f31.js"></script>
 </body>
 </html>

package/core/server/lib/lexical.js

@@ -93,7 +93,8 @@ module.exports = {
             },
             feature: {
                 contentVisibility: labs.isSet('contentVisibility'),
-                emailCustomization: true // force on until Koenig has been bumped
+                emailCustomization: true, // force on until Koenig has been bumped
+                emailUniqueid: labs.isSet('emailUniqueid')
             },
             nodeRenderers: this.customNodeRenderers
         }, userOptions);

package/core/server/lib/request-external.js

@@ -1,4 +1,9 @@
-const got = require('got');
+/**
+ * @typedef {import('got').Got} Got
+ * @typedef {import('got').ExtendOptions} ExtendOptions
+ */
+
+const got = /** @type {Got} */ (/** @type {unknown} */ (require('got')));
 const dnsPromises = require('dns').promises;
 const errors = require('@tryghost/errors');
 const config = require('../../shared/config');
@@ -66,6 +71,7 @@ async function disableRetries(options) {
 
 // same as our normal request lib but if any request in a redirect chain resolves
 // to a private IP address it will be blocked before the request is made.
+/** @type {ExtendOptions} */
 const gotOpts = {
     headers: {
         'user-agent': 'Ghost(https://github.com/TryGhost/Ghost)'

package/core/server/services/email-service/EmailRenderer.js

@@ -774,6 +774,13 @@ class EmailRenderer {
                     return this.createUnsubscribeUrl(member.uuid, {newsletterUuid});
                 },
                 required: true // Used in email headers
+            },
+            // Unique ID used for ad images to bypass ESP image proxies
+            {
+                id: 'uniqueid',
+                getValue: () => {
+                    return crypto.randomUUID();
+                }
             }
         ];
 

package/core/server/services/koenig/node-renderers/html-renderer.js

@@ -1,6 +1,7 @@
 const {addCreateDocumentOption} = require('../render-utils/add-create-document-option');
 const {renderEmptyContainer} = require('../render-utils/render-empty-container');
 const {renderWithVisibility} = require('../render-utils/visibility');
+const {wrapReplacementStrings} = require('../render-utils/replacement-strings');
 
 function renderHtmlNode(node, options = {}) {
     addCreateDocumentOption(options);
@@ -12,7 +13,13 @@ function renderHtmlNode(node, options = {}) {
         return renderEmptyContainer(document);
     }
 
-    const wrappedHtml = `\n<!--kg-card-begin: html-->\n${html}\n<!--kg-card-end: html-->\n`;
+    // Wrap replacement strings like {uniqueid} with %% for email processing
+    // Only wrap if emailUniqueid labs flag is enabled
+    let processedHtml = html;
+    if (options.feature?.emailUniqueid) {
+        processedHtml = wrapReplacementStrings(html);
+    }
+    const wrappedHtml = `\n<!--kg-card-begin: html-->\n${processedHtml}\n<!--kg-card-end: html-->\n`;
 
     const textarea = document.createElement('textarea');
     textarea.value = wrappedHtml;

package/core/server/services/oembed/OEmbedService.js

@@ -1,3 +1,6 @@
+// native fetch is not allowed in this file, use `this.externalRequest` instead to avoid SSRF
+/* eslint no-restricted-globals: ["error", "fetch"] */
+
 const errors = require('@tryghost/errors');
 const tpl = require('@tryghost/tpl');
 const logging = require('@tryghost/logging');
@@ -59,7 +62,7 @@ const findUrlWithProvider = (url) => {
  */
 
 /**
- * @typedef {(url: string, config: Object) => Promise} IExternalRequest
+ * @typedef {import('got').GotRequestFunction} IExternalRequest
  */
 
 /**
@@ -128,20 +131,12 @@ class OEmbedService {
     }
 
     /**
-     * Fetches the image buffer from a URL using fetch
+     * Fetches the image buffer from a URL using this.externalRequest
      * @param {String} imageUrl - URL of the image to fetch
      * @returns {Promise<Buffer>} - Promise resolving to the image buffer
      */
     async fetchImageBuffer(imageUrl) {
-        const response = await fetch(imageUrl);
-        
-        if (!response.ok) {
-            throw Error(`Failed to fetch image: ${response.statusText}`);
-        }
-
-        const arrayBuffer = await response.arrayBuffer();
-        
-        const buffer = Buffer.from(arrayBuffer);
+        const buffer = await this.externalRequest(imageUrl).buffer();
         return buffer;
     }
 

package/core/shared/labs.js

@@ -49,7 +49,8 @@ const PRIVATE_FEATURES = [
     'emailCustomization',
     'membersSigninOTC',
     'tagsX',
-    'utmTracking'
+    'utmTracking',
+    'emailUniqueid'
 ];
 
 module.exports.GA_KEYS = [...GA_FEATURES];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ghost",
-  "version": "6.0.8",
+  "version": "6.0.10",
   "description": "The professional publishing platform",
   "author": "Ghost Foundation",
   "homepage": "https://ghost.org",
@@ -86,7 +86,7 @@
     "@tryghost/helpers": "1.1.97",
     "@tryghost/html-to-plaintext": "1.0.4",
     "@tryghost/http-cache-utils": "0.1.20",
-    "@tryghost/i18n": "file:components/tryghost-i18n-6.0.8.tgz",
+    "@tryghost/i18n": "file:components/tryghost-i18n-6.0.10.tgz",
     "@tryghost/image-transform": "1.4.6",
     "@tryghost/job-manager": "1.0.3",
     "@tryghost/kg-card-factory": "5.1.2",
@@ -144,7 +144,7 @@
     "csso": "5.0.5",
     "csv-writer": "1.6.0",
     "date-fns": "2.30.0",
-    "dompurify": "3.2.6",
+    "dompurify": "3.2.7",
     "downsize": "0.0.8",
     "entities": "4.5.0",
     "express": "4.21.2",
@@ -196,7 +196,7 @@
     "moment": "2.24.0",
     "moment-timezone": "0.5.45",
     "multer": "2.0.2",
-    "mysql2": "3.14.2",
+    "mysql2": "3.15.0",
     "nconf": "0.13.0",
     "node-fetch": "2.7.0",
     "node-jose": "2.2.0",
@@ -214,7 +214,7 @@
     "stripe": "8.222.0",
     "superagent": "5.3.1",
     "superagent-throttle": "1.0.1",
-    "terser": "5.43.1",
+    "terser": "5.44.0",
     "tiny-glob": "0.2.9",
     "ua-parser-js": "1.0.41",
     "xml": "1.0.1"
@@ -225,14 +225,14 @@
   },
   "devDependencies": {
     "@actions/core": "1.11.1",
-    "@playwright/test": "1.54.1",
+    "@playwright/test": "1.55.0",
     "@prettier/sync": "0.6.1",
     "@tryghost/express-test": "0.15.0",
     "@tryghost/webhook-mock-receiver": "0.2.17",
     "@types/bookshelf": "1.2.9",
     "@types/common-tags": "1.8.4",
     "@types/jsonwebtoken": "9.0.10",
-    "@types/node": "22.18.3",
+    "@types/node": "22.18.6",
     "@types/node-jose": "1.1.13",
     "@types/nodemailer": "6.4.19",
     "@types/sinon": "17.0.4",
@@ -262,7 +262,7 @@
     "should": "13.2.3",
     "sinon": "18.0.1",
     "supertest": "6.3.4",
-    "tmp": "0.2.3",
+    "tmp": "0.2.5",
     "toml": "3.0.0",
     "tsx": "4.20.5",
     "typescript": "5.8.3"
@@ -273,7 +273,7 @@
     "jackspeak": "2.3.6",
     "moment": "2.24.0",
     "moment-timezone": "0.5.45",
-    "@tryghost/i18n": "file:components/tryghost-i18n-6.0.8.tgz"
+    "@tryghost/i18n": "file:components/tryghost-i18n-6.0.10.tgz"
   },
   "nx": {
     "targets": {