ghost 6.17.2 → 6.18.1

package/core/server/services/lib/member-signup-contexts.ts

@@ -0,0 +1,22 @@
+// Signup context describes the sign-in state when the Stripe checkout session is created.
+// NEEDS_MAGIC_LINK_EMAIL: No guaranteed sign-in path exists yet (custom/direct checkout paths).
+// HAS_PRECHECKOUT_MAGIC_LINK: Ghost generated a signup magic-link before Stripe (standard Portal flow).
+// ALREADY_AUTHENTICATED: Request came from a signed-in member identity (for example, opening a paid signup link directly).
+export const SIGNUP_CONTEXTS = {
+    NEEDS_MAGIC_LINK_EMAIL: 'needs_magic_link_email',
+    HAS_PRECHECKOUT_MAGIC_LINK: 'has_precheckout_magic_link',
+    ALREADY_AUTHENTICATED: 'already_authenticated'
+} as const;
+
+export type SignupContext = typeof SIGNUP_CONTEXTS[keyof typeof SIGNUP_CONTEXTS];
+
+/**
+ * Signup-paid email can be skipped when welcome email is active only if
+ * checkout already has a reliable sign-in path.
+ *
+ * - HAS_PRECHECKOUT_MAGIC_LINK: standard Portal flow generated signup link before Stripe
+ * - ALREADY_AUTHENTICATED: checkout request came from an already signed-in member
+ */
+export function canWelcomeEmailReplaceSignupPaidEmail(signupContext?: SignupContext) {
+    return signupContext === SIGNUP_CONTEXTS.HAS_PRECHECKOUT_MAGIC_LINK || signupContext === SIGNUP_CONTEXTS.ALREADY_AUTHENTICATED;
+}

package/core/server/services/member-welcome-emails/member-welcome-email-renderer.js

@@ -53,14 +53,12 @@ class MemberWelcomeEmailRenderer {
      * Applies replacement tokens to a string
      * Supports fallback values: {first_name, "friend"} renders "friend" if name is empty
      * @param {Object} options
+     * @param {{id: string, getValue: () => string|undefined}[]} options.definitions - Replacement token definitions
      * @param {string} options.text - The text to process (content body or subject line)
-     * @param {Object} options.member - Member data
-     * @param {Object} options.siteSettings - Site settings
      * @param {boolean} [options.escapeHtml=false] - Whether to HTML-escape replaced values
      * @returns {string}
      */
-    #applyReplacements({text, member, siteSettings, escapeHtml = false}) {
-        const definitions = this.#buildReplacementDefinitions({member, siteSettings});
+    #applyReplacements({definitions, text, escapeHtml = false}) {
         let processed = wrapReplacementStrings(text);
 
         processed = processed.replace(REPLACEMENT_REGEX, (match, property, fallback) => {
@@ -96,8 +94,17 @@ class MemberWelcomeEmailRenderer {
             });
         }
 
-        const contentWithReplacements = this.#applyReplacements({text: content, member, siteSettings, escapeHtml: true});
-        const subjectWithReplacements = this.#applyReplacements({text: subject, member, siteSettings, escapeHtml: false});
+        const definitions = this.#buildReplacementDefinitions({member, siteSettings});
+
+        // Remove <code> wrappers around replacement strings (Lexical treats curly braces as inline code)
+        const tokenIds = definitions.map(d => d.id).join('|');
+        content = content.replace(
+            new RegExp(`<code>(\\{(?:${tokenIds})(?:\\s*,?\\s*"[^"]*")?\\})<\\/code>`, 'g'),
+            '$1'
+        );
+
+        const contentWithReplacements = this.#applyReplacements({definitions, text: content, escapeHtml: true});
+        const subjectWithReplacements = this.#applyReplacements({definitions, text: subject, escapeHtml: false});
 
         const managePreferencesUrl = new URL('#/portal/account/newsletters', siteSettings.url).href;
         const year = new Date().getFullYear();
@@ -124,4 +131,3 @@ class MemberWelcomeEmailRenderer {
 }
 
 module.exports = MemberWelcomeEmailRenderer;
-

package/core/server/services/member-welcome-emails/service.js

@@ -2,11 +2,12 @@ const logging = require('@tryghost/logging');
 const errors = require('@tryghost/errors');
 const urlUtils = require('../../../shared/url-utils');
 const settingsCache = require('../../../shared/settings-cache');
-const config = require('../../../shared/config');
 const emailAddressService = require('../email-address');
+const settingsHelpers = require('../settings-helpers');
+const EmailAddressParser = require('../email-address/email-address-parser');
 const mail = require('../mail');
 // @ts-expect-error type checker has trouble with the dynamic exporting in models
-const {AutomatedEmail} = require('../../models');
+const {AutomatedEmail, Newsletter} = require('../../models');
 const MemberWelcomeEmailRenderer = require('./member-welcome-email-renderer');
 const {MEMBER_WELCOME_EMAIL_LOG_KEY, MEMBER_WELCOME_EMAIL_SLUGS, MESSAGES} = require('./constants');
 
@@ -14,6 +15,7 @@ class MemberWelcomeEmailService {
     #mailer;
     #renderer;
     #memberWelcomeEmails = {free: null, paid: null};
+    #defaultNewsletterSenderOptions = null;
 
     constructor() {
         emailAddressService.init();
@@ -29,7 +31,71 @@ class MemberWelcomeEmailService {
         };
     }
 
+    async #getDefaultNewsletterSenderOptions() {
+        const newsletter = await Newsletter.getDefaultNewsletter();
+        if (!newsletter) {
+            return {};
+        }
+
+        let senderName = settingsCache.get('title') || '';
+        if (newsletter.get('sender_name')) {
+            senderName = newsletter.get('sender_name');
+        }
+
+        let fromAddress = settingsHelpers.getNoReplyAddress();
+        if (newsletter.get('sender_email')) {
+            fromAddress = newsletter.get('sender_email');
+        }
+
+        const fromAddresses = emailAddressService.service.getAddress({
+            from: {
+                address: fromAddress,
+                name: senderName || undefined
+            }
+        });
+
+        const from = EmailAddressParser.stringify(fromAddresses.from);
+        const replyToSetting = newsletter.get('sender_reply_to');
+        let replyTo = null;
+
+        if (replyToSetting === 'support') {
+            replyTo = settingsHelpers.getMembersSupportAddress();
+        } else if (replyToSetting === 'newsletter' && !emailAddressService.service.managedEmailEnabled) {
+            replyTo = from;
+        } else {
+            const addresses = emailAddressService.service.getAddress({
+                from: {
+                    address: fromAddress,
+                    name: senderName || undefined
+                },
+                replyTo: replyToSetting === 'newsletter' ? undefined : {address: replyToSetting}
+            });
+
+            if (addresses.replyTo) {
+                replyTo = EmailAddressParser.stringify(addresses.replyTo);
+            }
+        }
+
+        return {
+            from,
+            ...(replyTo ? {
+                replyTo
+            } : {})
+        };
+    }
+
+    async #getSenderOptions() {
+        if (this.#defaultNewsletterSenderOptions) {
+            return this.#defaultNewsletterSenderOptions;
+        }
+
+        this.#defaultNewsletterSenderOptions = await this.#getDefaultNewsletterSenderOptions();
+        return this.#defaultNewsletterSenderOptions;
+    }
+
     async loadMemberWelcomeEmails() {
+        this.#defaultNewsletterSenderOptions = await this.#getDefaultNewsletterSenderOptions();
+
         for (const [memberStatus, slug] of Object.entries(MEMBER_WELCOME_EMAIL_SLUGS)) {
             const row = await AutomatedEmail.findOne({slug});
 
@@ -50,8 +116,14 @@ class MemberWelcomeEmailService {
     }
 
     async send({member, memberStatus}) {
+        if (!member.email) {
+            throw new errors.IncorrectUsageError({
+                message: MESSAGES.MISSING_RECIPIENT_EMAIL
+            });
+        }
+
         const name = member?.name ? `${member.name} at ` : '';
-        logging.info(`${MEMBER_WELCOME_EMAIL_LOG_KEY} Sending welcome email to ${name}${member?.email}`);
+        logging.info(`${MEMBER_WELCOME_EMAIL_LOG_KEY} Sending welcome email to ${name}${member.email}`);
 
         const memberWelcomeEmail = this.#memberWelcomeEmails[memberStatus];
 
@@ -77,21 +149,15 @@ class MemberWelcomeEmailService {
             siteSettings: this.#getSiteSettings()
         });
 
-        const testInbox = config.get('memberWelcomeEmailTestInbox');
-        const toEmail = testInbox || member.email;
-
-        if (!toEmail) {
-            throw new errors.IncorrectUsageError({
-                message: MESSAGES.MISSING_RECIPIENT_EMAIL
-            });
-        }
+        const senderOptions = await this.#getSenderOptions();
 
         await this.#mailer.send({
-            to: toEmail,
+            to: member.email,
             subject,
             html,
             text,
-            forceTextContent: true
+            forceTextContent: true,
+            ...senderOptions
         });
     }
 
@@ -140,12 +206,16 @@ class MemberWelcomeEmailService {
             siteSettings: this.#getSiteSettings()
         });
 
+        // Test sends should always reflect the latest newsletter sender settings.
+        const senderOptions = await this.#getDefaultNewsletterSenderOptions();
+
         await this.#mailer.send({
             to: email,
             subject: `[Test] ${renderedSubject}`,
             html,
             text,
-            forceTextContent: true
+            forceTextContent: true,
+            ...senderOptions
         });
     }
 }
@@ -160,4 +230,3 @@ class MemberWelcomeEmailServiceWrapper {
 }
 
 module.exports = new MemberWelcomeEmailServiceWrapper();
-

package/core/server/services/members/members-api/controllers/router-controller.js

@@ -7,6 +7,8 @@ const errors = require('@tryghost/errors');
 const {isEmail} = require('@tryghost/validator');
 const normalizeEmail = require('../utils/normalize-email');
 const {getInboxLinks} = require('../../../../lib/get-inbox-links');
+const {SIGNUP_CONTEXTS} = require('../../../lib/member-signup-contexts');
+/** @typedef {import('../../../lib/member-signup-contexts').SignupContext} SignupContext */
 
 const messages = {
     emailRequired: 'Email is required.',
@@ -392,6 +394,12 @@ module.exports = class RouterController {
                 });
             }
 
+            if (!offer.tier) {
+                throw new BadRequestError({
+                    message: 'Offer does not have a tier'
+                });
+            }
+
             tier = await this._tiersService.api.read(offer.tier.id);
             cadence = offer.cadence;
         } else if (tierId) {
@@ -469,6 +477,8 @@ module.exports = class RouterController {
         }
 
         const member = options.member;
+        /** @type {SignupContext} */
+        let ghostSignupContext = (options.isAuthenticated && member) ? SIGNUP_CONTEXTS.ALREADY_AUTHENTICATED : SIGNUP_CONTEXTS.NEEDS_MAGIC_LINK_EMAIL;
 
         if (!member && options.email) {
             // Create a signup link if there is no member with this email address
@@ -485,6 +495,7 @@ module.exports = class RouterController {
                 // Redirect to the original success url after sign up
                 referrer: options.successUrl
             });
+            ghostSignupContext = SIGNUP_CONTEXTS.HAS_PRECHECKOUT_MAGIC_LINK;
         }
 
         if (member) {
@@ -509,6 +520,9 @@ module.exports = class RouterController {
             }
         }
 
+        // Set by server to distinguish between checkout flows in Stripe webhooks.
+        options.metadata.ghostSignupContext = ghostSignupContext;
+
         try {
             const paymentLink = await this._paymentsService.getPaymentLink(options);
 

package/core/server/services/members/members-api/repositories/member-repository.js

@@ -1769,7 +1769,7 @@ module.exports = class MemberRepository {
             });
         }
 
-        if (offer.tier.id !== tierId) {
+        if (offer.tier && offer.tier.id !== tierId) {
             throw new errors.BadRequestError({
                 message: tpl(messages.offerTierMismatch)
             });

package/core/server/services/members/members-api/services/payments-service.js

@@ -72,6 +72,11 @@ class PaymentsService {
         let coupon = null;
         let trialDays = null;
         if (offer) {
+            if (!offer.tier) {
+                throw new BadRequestError({
+                    message: 'Offer does not have a tier'
+                });
+            }
             if (!tier.id.equals(offer.tier.id)) {
                 throw new BadRequestError({
                     message: 'This Offer is not valid for the Tier'

package/core/server/services/oembed/oembed-service.js

@@ -10,7 +10,7 @@ const iconv = require('iconv-lite');
 const path = require('path');
 
 // Some sites block non-standard user agents so we need to mimic a typical browser
-const USER_AGENT = 'Mozilla/5.0 (compatible; Ghost/5.0; +https://ghost.org/)';
+const USER_AGENT = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36';
 
 const messages = {
     noUrlProvided: 'No url provided.',

package/core/server/services/offers/application/offer-mapper.js

@@ -26,9 +26,9 @@
  * @prop {number} redemption_count
  * @prop {'signup'|'retention'} redemption_type
  *
- * @prop {object} tier
- * @prop {string} tier.id
- * @prop {string} tier.name
+ * @prop {object|null} tier
+ * @prop {string} [tier.id]
+ * @prop {string} [tier.name]
  * @prop {string} created_at
  * @prop {string|null} last_redeemed
  */
@@ -55,10 +55,9 @@ class OfferMapper {
             status: offer.status.value,
             redemption_count: offer.redemptionCount,
             redemption_type: offer.redemptionType.value,
-            tier: {
-                id: offer.tier.id,
-                name: offer.tier.name
-            },
+            tier: offer.tier
+                ? {id: offer.tier.id, name: offer.tier.name}
+                : null,
             created_at: offer.createdAt,
             last_redeemed: offer.lastRedeemed
         };

package/core/server/services/offers/application/offers-api.js

@@ -165,12 +165,12 @@ class OffersAPI {
                 return [];
             }
 
-            // Filter by tier and cadence
-            let available = allOffers.filter(offer => offer.tier.id === tierId && offer.cadence.value === cadence);
+            // Filter by tier and cadence - Null-tier offers (retention) match any tier with the correct cadence
+            let available = allOffers.filter(offer => (offer.tier === null || offer.tier.id === tierId) && offer.cadence.value === cadence);
             debug(`listOffersAvailableToSubscription: ${available.length} offers match tier and cadence`);
 
             if (available.length === 0) {
-                const tierIds = [...new Set(allOffers.map(o => o.tier.id))];
+                const tierIds = [...new Set(allOffers.filter(o => o.tier !== null).map(o => o.tier.id))];
                 const cadences = [...new Set(allOffers.map(o => o.cadence.value))];
                 debug(`listOffersAvailableToSubscription: no offers match - available tiers: [${tierIds.join(', ')}], available cadences: [${cadences.join(', ')}]`);
 

package/core/server/services/offers/domain/errors/index.js

@@ -18,6 +18,7 @@ class InvalidOfferCode extends InvalidPropError {}
 class InvalidOfferType extends InvalidPropError {}
 class InvalidOfferAmount extends InvalidPropError {}
 class InvalidOfferCurrency extends InvalidPropError {}
+class InvalidOfferTier extends InvalidPropError {}
 class InvalidOfferTierName extends InvalidPropError {}
 class InvalidOfferCadence extends InvalidPropError {}
 class InvalidOfferDuration extends InvalidPropError {}
@@ -36,6 +37,7 @@ module.exports = {
     InvalidOfferCurrency,
     InvalidOfferCadence,
     InvalidOfferDuration,
+    InvalidOfferTier,
     InvalidOfferTierName,
     InvalidOfferCoupon,
     InvalidOfferStatus,

package/core/server/services/offers/domain/models/offer.js

@@ -31,7 +31,7 @@ const StripeCoupon = require('./stripe-coupon');
  * @prop {OfferCurrency} [currency]
  * @prop {OfferStatus} status
  * @prop {string|null} [stripeCouponId]
- * @prop {OfferTier} tier
+ * @prop {OfferTier|null} tier
  * @prop {number} redemptionCount
  * @prop {OfferRedemptionType} redemptionType
  * @prop {string} createdAt
@@ -55,7 +55,7 @@ const StripeCoupon = require('./stripe-coupon');
  * @prop {string} [stripe_coupon_id]
  * @prop {number} [redemptionCount]
  * @prop {string} [redemption_type]
- * @prop {TierProps|OfferTier} tier
+ * @prop {TierProps|OfferTier|null} tier
  * @prop {Date} [created_at]
  * @prop {Date} [last_redeemed]
  */
@@ -356,8 +356,20 @@ class Offer {
             }
         }
 
-        const tier = OfferTier.create(data.tier);
         const redemptionType = OfferRedemptionType.create(data.redemption_type || 'signup');
+        const tier = data.tier ? OfferTier.create(data.tier) : null;
+
+        if (redemptionType.value === 'signup' && !tier) {
+            throw new errors.InvalidOfferTier({
+                message: 'Signup offers must be associated with a tier'
+            });
+        }
+
+        if (redemptionType.value === 'retention' && tier) {
+            throw new errors.InvalidOfferTier({
+                message: 'Retention offers cannot be associated with a specific tier'
+            });
+        }
 
         return new Offer({
             id,

package/core/server/services/offers/offer-bookshelf-repository.js

@@ -125,10 +125,9 @@ class OfferBookshelfRepository {
                 redemptionCount: count,
                 redemption_type: json.redemption_type,
                 status: json.active ? 'active' : 'archived',
-                tier: {
-                    id: json.product.id,
-                    name: json.product.name
-                },
+                tier: json.product && json.product.id
+                    ? {id: json.product.id, name: json.product.name}
+                    : null,
                 created_at: json.created_at,
                 last_redeemed: lastRedeemedObject.length > 0 ? lastRedeemedObject[0].created_at : null
             }, null);
@@ -225,7 +224,7 @@ class OfferBookshelfRepository {
             discount_type: offer.type.value === 'fixed' ? 'amount' : offer.type.value,
             discount_amount: offer.amount.value,
             interval: offer.cadence.value,
-            product_id: offer.tier.id,
+            product_id: offer.tier ? offer.tier.id : null,
             duration: offer.duration.value.type,
             duration_in_months: offer.duration.value.type === 'repeating' ? offer.duration.value.months : null,
             currency: offer.currency ? offer.currency.value : null,

package/core/server/services/stats/utils/tinybird.js

@@ -19,6 +19,7 @@ const create = ({config, request, settingsCache, tinybirdService}) => {
      * @param {string} [options.timezone] - Timezone for the query
      * @param {string} [options.memberStatus] - Member status filter (defaults to 'all')
      * @param {string} [options.postType] - Post type filter
+     * @param {string} [options.version] - Version override (e.g., 'v3') - bypasses config version
      * @returns {Object} Object with URL and request options
      */
     const buildRequest = (pipeName, options = {}) => {
@@ -32,9 +33,10 @@ const create = ({config, request, settingsCache, tinybirdService}) => {
         const tokenData = tinybirdService.getToken();
         const token = tokenData?.token;
 
-        // Use version from config if provided for constructing the URL
+        // Use version from options if provided, otherwise fall back to config
         // Pattern: api_kpis -> api_kpis_v2 (single underscore + version)
-        const version = statsConfig?.version;
+        // Pass empty string to force unversioned endpoint
+        const version = options.version !== undefined ? options.version : statsConfig?.version;
         const pipeUrl = version ?
             `/v0/pipes/${pipeName}_${version}.json` :
             `/v0/pipes/${pipeName}.json`;
@@ -64,7 +66,7 @@ const create = ({config, request, settingsCache, tinybirdService}) => {
         }
         // Add any other options that might be needed
         Object.entries(options).forEach(([key, value]) => {
-            if (!['dateFrom', 'dateTo', 'timezone', 'memberStatus', 'postType'].includes(key) && value !== undefined && value !== null) {
+            if (!['dateFrom', 'dateTo', 'timezone', 'memberStatus', 'postType', 'version'].includes(key) && value !== undefined && value !== null) {
                 // Convert camelCase to snake_case for Tinybird API
                 const snakeKey = key.replace(/[A-Z]/g, letter => `_${letter.toLowerCase()}`);
                 // Handle arrays by converting them to comma-separated strings for Tinybird

package/core/server/services/stripe/services/webhook/checkout-session-event-service.js

@@ -1,6 +1,10 @@
 const _ = require('lodash');
 const errors = require('@tryghost/errors');
 const logging = require('@tryghost/logging');
+const {
+    canWelcomeEmailReplaceSignupPaidEmail
+} = require('../../../lib/member-signup-contexts');
+/** @typedef {import('../../../lib/member-signup-contexts').SignupContext} SignupContext */
 
 /**
  * Handles `checkout.session.completed` webhook events
@@ -24,6 +28,7 @@ module.exports = class CheckoutSessionEventService {
      * @param {object} deps.donationRepository
      * @param {object} deps.staffServiceEmails
      * @param {function} deps.sendSignupEmail
+     * @param {function} deps.isPaidWelcomeEmailActive
      */
     constructor(deps) {
         this.api = deps.api;
@@ -260,7 +265,18 @@ module.exports = class CheckoutSessionEventService {
         }
 
         if (checkoutType !== 'upgrade') {
-            this.deps.sendSignupEmail(customer.email);
+            const ghostSignupContext = /** @type {SignupContext | undefined} */ (session.metadata?.ghostSignupContext);
+            const shouldSkipSignupEmailWhenWelcomeEmailActive = canWelcomeEmailReplaceSignupPaidEmail(ghostSignupContext);
+
+            if (shouldSkipSignupEmailWhenWelcomeEmailActive) {
+                const isPaidWelcomeEmailActive = await this.deps.isPaidWelcomeEmailActive();
+                if (!isPaidWelcomeEmailActive) {
+                    this.deps.sendSignupEmail(customer.email);
+                }
+            } else {
+                // Direct checkout flows do not have a pre-checkout sign-in path.
+                this.deps.sendSignupEmail(customer.email);
+            }
         }
     }
 };

package/core/server/services/stripe/stripe-service.js

@@ -8,6 +8,7 @@ const {StripeLiveEnabledEvent, StripeLiveDisabledEvent} = require('./events');
 const SubscriptionEventService = require('./services/webhook/subscription-event-service');
 const InvoiceEventService = require('./services/webhook/invoice-event-service');
 const CheckoutSessionEventService = require('./services/webhook/checkout-session-event-service');
+const memberWelcomeEmailService = require('../member-welcome-emails/service');
 
 /**
  * @typedef {object} IStripeServiceConfig
@@ -120,6 +121,13 @@ module.exports = class StripeService {
                     },
                     tokenData: {}
                 });
+            },
+            async isPaidWelcomeEmailActive() {
+                if (!labs.isSet('welcomeEmails')) {
+                    return false;
+                }
+                memberWelcomeEmailService.init();
+                return memberWelcomeEmailService.api.isMemberWelcomeEmailActive('paid');
             }
         });
 

package/core/shared/config/defaults.json

@@ -186,6 +186,12 @@
         },
         "theme": {
             "maxAge": 31536000
+        },
+        "assets": {
+            "contentBasedHash": {
+                "enabled": false,
+                "maxSize": 100000
+            }
         }
     },
     "optimization": {

package/core/shared/labs.js

@@ -27,7 +27,9 @@ const GA_FEATURES = [
     'explore',
     'inboxlinks',
     'commentModeration',
-    'commentPermalinks'
+    'commentPermalinks',
+    'featurebaseFeedback',
+    'welcomeEmails'
 ];
 
 // These features are considered publicly available and can be enabled/disabled by users
@@ -48,10 +50,8 @@ const PRIVATE_FEATURES = [
     'emailCustomization',
     'tagsX',
     'emailUniqueid',
-    'welcomeEmails',
     'themeTranslation',
     'indexnow',
-    'featurebaseFeedback',
     'transistor'
 ];
 

package/core/shared/url-utils.js

@@ -8,7 +8,8 @@ const urlUtils = new UrlUtils({
     getAdminUrl: config.getAdminUrl,
     assetBaseUrls: {
         media: config.get('urls:media'),
-        files: config.get('urls:files')
+        files: config.get('urls:files'),
+        image: config.get('urls:image')
     },
     slugs: config.get('slugs').protected,
     redirectCacheMaxAge: config.get('caching:301:maxAge'),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ghost",
-  "version": "6.17.2",
+  "version": "6.18.1",
   "description": "The professional publishing platform",
   "author": "Ghost Foundation",
   "homepage": "https://ghost.org",
@@ -83,7 +83,7 @@
     "@tryghost/helpers": "1.1.97",
     "@tryghost/html-to-plaintext": "1.0.4",
     "@tryghost/http-cache-utils": "0.1.20",
-    "@tryghost/i18n": "file:components/tryghost-i18n-6.17.2.tgz",
+    "@tryghost/i18n": "file:components/tryghost-i18n-6.18.1.tgz",
     "@tryghost/image-transform": "1.4.6",
     "@tryghost/job-manager": "1.0.3",
     "@tryghost/kg-card-factory": "5.1.7",
@@ -105,7 +105,7 @@
     "@tryghost/mw-vhost": "1.0.1",
     "@tryghost/nodemailer": "0.3.48",
     "@tryghost/nql": "0.12.8",
-    "@tryghost/parse-email-address": "file:components/tryghost-parse-email-address-6.17.2.tgz",
+    "@tryghost/parse-email-address": "file:components/tryghost-parse-email-address-6.18.1.tgz",
     "@tryghost/pretty-cli": "1.2.47",
     "@tryghost/prometheus-metrics": "1.0.2",
     "@tryghost/promise": "0.3.15",
@@ -171,7 +171,7 @@
     "intl-messageformat": "5.4.3",
     "js-yaml": "4.1.0",
     "jsonc-parser": "3.3.1",
-    "jsonpath": "1.1.1",
+    "jsonpath": "1.2.1",
     "jsonwebtoken": "8.5.1",
     "juice": "9.1.0",
     "keypair": "1.0.4",
@@ -271,8 +271,8 @@
     "jackspeak": "2.3.6",
     "moment": "2.24.0",
     "moment-timezone": "0.5.45",
-    "@tryghost/i18n": "file:components/tryghost-i18n-6.17.2.tgz",
-    "@tryghost/parse-email-address": "file:components/tryghost-parse-email-address-6.17.2.tgz"
+    "@tryghost/i18n": "file:components/tryghost-i18n-6.18.1.tgz",
+    "@tryghost/parse-email-address": "file:components/tryghost-parse-email-address-6.18.1.tgz"
   },
   "nx": {
     "targets": {