ghost 6.53.0 → 6.54.1

package/core/server/services/webhooks/serialize.js

@@ -1,4 +1,18 @@
-module.exports = async (event, model) => {
+// The event model doesn't reliably carry the relations the URL service reads
+// when routing (collection filters like tags:internal-tag), so under lazy
+// routing an under-loaded post 404s. Ask the URL service which relations it
+// needs and load only the ones missing — reloading a relation the event
+// already carries (e.g. authors) would strip its nested roles from the
+// payload. Returns [] under eager routing, which resolves URLs by id.
+const loadRequiredUrlRelations = async (model, urlService) => {
+    const required = urlService.getRequiredRelations();
+    const missing = required.filter(relation => !model.relations[relation]);
+    if (missing.length) {
+        await model.load(missing);
+    }
+};
+
+module.exports = ({urlService}) => async (event, model) => {
     const _ = require('lodash');
     const api = require('../../api').endpoints;
     const apiFramework = require('@tryghost/api-framework');
@@ -28,6 +42,7 @@ module.exports = async (event, model) => {
         case 'posts':
         case 'pages':
             frame.options.formats = POST_FORMATS;
+            await loadRequiredUrlRelations(model, urlService);
             frame.options.withRelated = POST_WITH_RELATED;
             model._originalOptions = {
                 withRelated: POST_WITH_RELATED

package/core/server/web/admin/app.js

@@ -3,7 +3,7 @@ const path = require('path');
 const express = require('../../../shared/express');
 const serveStatic = express.static;
 const config = require('../../../shared/config');
-const urlUtils = require('../../../shared/url-utils');
+const urlUtils = require('../../../shared/url-utils').default;
 const shared = require('../shared');
 const errorHandler = require('@tryghost/mw-error-handler');
 const sentry = require('../../../shared/sentry');

package/core/server/web/admin/middleware/redirect-admin-urls.js

@@ -1,4 +1,4 @@
-const urlUtils = require('../../../../shared/url-utils');
+const urlUtils = require('../../../../shared/url-utils').default;
 
 /**
  *

package/core/server/web/api/endpoints/admin/routes.js

@@ -33,6 +33,7 @@ module.exports = function apiRoutes() {
     router.post('/posts', mw.authAdminApi, http(api.posts.add));
     router.delete('/posts', mw.authAdminApi, http(api.posts.bulkDestroy));
     router.put('/posts/bulk', mw.authAdminApi, http(api.posts.bulkEdit));
+    router.post('/posts/upload', mw.authAdminApi, labs.enabledMiddleware('csvContentImporter'), apiMw.upload.single('postsfile'), apiMw.upload.validation({type: 'posts'}), http(api.posts.importCSV));
     router.get('/posts/:id', mw.authAdminApi, http(api.posts.read));
     router.get('/posts/slug/:slug', mw.authAdminApi, http(api.posts.read));
     router.put('/posts/:id', mw.authAdminApi, http(api.posts.edit));

package/core/server/web/api/middleware/cors.js

@@ -1,7 +1,7 @@
 const cors = require('cors');
 const url = require('url');
 const os = require('os');
-const urlUtils = require('../../../../shared/url-utils');
+const urlUtils = require('../../../../shared/url-utils').default;
 const config = require('../../../../shared/config');
 
 let allowlist = [];

package/core/server/web/api/middleware/upload.js

@@ -34,6 +34,10 @@ const messages = {
         missingFile: 'Please select a members CSV file.',
         invalidFile: 'Please select a valid CSV file.'
     },
+    posts: {
+        missingFile: 'Please select a posts CSV file.',
+        invalidFile: 'Please select a valid CSV file.'
+    },
     images: {
         missingFile: 'Please select an image.',
         invalidFile: 'Please select a valid image.'

package/core/server/web/gift-preview/controller.js

@@ -40,7 +40,7 @@ function escapeHtml(str) {
 async function giftPreview(req, res) {
     const giftService = require('../../services/gifts').service;
     const tiersService = require('../../services/tiers');
-    const urlUtils = require('../../../shared/url-utils');
+    const urlUtils = require('../../../shared/url-utils').default;
     const settingsCache = require('../../../shared/settings-cache');
 
     const siteUrl = urlUtils.getSiteUrl().replace(/\/$/, '');

package/core/server/web/shared/middleware/redirect-amp-urls.js

@@ -1,4 +1,4 @@
-const urlUtils = require('../../../../shared/url-utils');
+const urlUtils = require('../../../../shared/url-utils').default;
 const localUtils = require('../utils');
 
 /**

package/core/server/web/shared/middleware/uncapitalise.js

@@ -13,7 +13,7 @@
 //  req.path =  /ghost/signin/
 
 const errors = require('@tryghost/errors');
-const urlUtils = require('../../../../shared/url-utils');
+const {default: urlUtils, BASE_API_PATH} = require('../../../../shared/url-utils');
 const tpl = require('@tryghost/tpl');
 const localUtils = require('../utils');
 
@@ -27,7 +27,7 @@ const uncapitalise = function uncapitalise(req, res, next) {
     let decodedURI;
 
     const isSignupOrReset = pathToTest.match(/^(.*\/ghost\/(signup|reset)\/)/i);
-    const isAPIRegExp = new RegExp(`^(.*${urlUtils.BASE_API_PATH}(/(v[\\d.]+|canary))?/.*?/)`, 'i');
+    const isAPIRegExp = new RegExp(`^(.*${BASE_API_PATH}(/(v[\\d.]+|canary))?/.*?/)`, 'i');
     const isAPI = pathToTest.match(isAPIRegExp);
 
     if (isSignupOrReset) {

package/core/server/web/shared/middleware/url-redirects.js

@@ -1,7 +1,7 @@
 const url = require('url');
 const path = require('path');
 const debug = require('@tryghost/debug')('web:shared:mw:url-redirects');
-const urlUtils = require('../../../../shared/url-utils');
+const urlUtils = require('../../../../shared/url-utils').default;
 
 const urlRedirects = {};
 

package/core/shared/config/defaults.json

@@ -54,7 +54,8 @@
         },
         "route-settings": {
             "active": "FileStore",
-            "FileStore": {}
+            "FileStore": {},
+            "S3RouteSettingsStore": {}
         }
     },
     "storage": {
@@ -70,6 +71,12 @@
     "members": {
         "contentApiAccess": [],
         "paymentProcessors": [],
+        "customFields": {
+            "maxDefinitions": 100
+        },
+        "importer": {
+            "inlineThreshold": 500
+        },
         "emailTemplate": {
             "showSiteHeader": true,
             "showPoweredBy": true
@@ -359,5 +366,6 @@
         "captureLinkClickBadMemberUuid": false
     },
     "disableJSBackups": false,
-    "disableMigrationBackups": false
+    "disableMigrationBackups": false,
+    "usingLoopbackReverseProxy": false
 }

package/core/shared/config/overrides.json

@@ -22,6 +22,10 @@
             "extensions": [".csv"],
             "contentTypes": ["text/csv", "application/csv", "application/octet-stream", "application/vnd.ms-excel"]
         },
+        "posts": {
+            "extensions": [".csv"],
+            "contentTypes": ["text/csv", "application/csv", "application/octet-stream", "application/vnd.ms-excel"]
+        },
         "images": {
             "extensions": [".jpg", ".jpeg", ".gif", ".png", ".svg", ".svgz", ".ico", ".webp"],
             "contentTypes": ["image/jpeg", "image/png", "image/gif", "image/svg+xml", "image/x-icon", "image/vnd.microsoft.icon", "image/webp"]

package/core/shared/express.js

@@ -2,6 +2,7 @@ const debug = require('@tryghost/debug')('shared:express');
 const express = require('express');
 const {createLazyRouter} = require('express-lazy-router');
 const sentry = require('./sentry');
+const config = require('../../core/shared/config');
 
 const lazyLoad = createLazyRouter();
 
@@ -17,7 +18,11 @@ module.exports = (name) => {
 
     // Make sure 'req.secure' is valid for proxied requests
     // (X-Forwarded-Proto header will be checked, if present)
-    app.enable('trust proxy');
+    if (config.get('usingLoopbackReverseProxy')) {
+        app.set('trust proxy', 'loopback');
+    } else {
+        app.enable('trust proxy');
+    }
 
     // Sentry must be our first error handler. Mounting it here means all custom error handlers will come after
     app.use(sentry.errorHandler);

package/core/shared/labs.js

@@ -64,7 +64,8 @@ const PRIVATE_FEATURES = [
     'getHelperDeduplication',
     'memberDetailsReact',
     'membersCustomFields',
-    'previewByTier'
+    'previewByTier',
+    'paywallImprovements'
 ];
 
 module.exports.GA_KEYS = [...GA_FEATURES];

package/core/shared/url-utils.js

@@ -1,20 +1,24 @@
-const UrlUtils = require('@tryghost/url-utils');
-const config = require('./config');
-
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BASE_API_PATH = void 0;
+const url_utils_1 = __importDefault(require("@tryghost/url-utils"));
+const config_1 = __importDefault(require("./config"));
 const BASE_API_PATH = '/ghost/api';
-const urlUtils = new UrlUtils({
-    getSubdir: config.getSubdir,
-    getSiteUrl: config.getSiteUrl,
-    getAdminUrl: config.getAdminUrl,
+exports.BASE_API_PATH = BASE_API_PATH;
+const urlUtils = new url_utils_1.default({
+    getSubdir: config_1.default.getSubdir,
+    getSiteUrl: config_1.default.getSiteUrl,
+    getAdminUrl: config_1.default.getAdminUrl,
     assetBaseUrls: {
-        media: config.get('urls:media'),
-        files: config.get('urls:files'),
-        image: config.get('urls:image')
+        media: config_1.default.get('urls:media'),
+        files: config_1.default.get('urls:files'),
+        image: config_1.default.get('urls:image')
     },
-    slugs: config.get('slugs').protected,
-    redirectCacheMaxAge: config.get('caching:301:maxAge'),
+    slugs: config_1.default.get('slugs').protected,
+    redirectCacheMaxAge: config_1.default.get('caching:301:maxAge'),
     baseApiPath: BASE_API_PATH
 });
-
-module.exports = urlUtils;
-module.exports.BASE_API_PATH = BASE_API_PATH;
+exports.default = urlUtils;

package/core/shared/url-utils.ts

@@ -0,0 +1,20 @@
+import UrlUtils from '@tryghost/url-utils';
+import config from './config';
+
+const BASE_API_PATH = '/ghost/api';
+const urlUtils = new UrlUtils({
+    getSubdir: config.getSubdir,
+    getSiteUrl: config.getSiteUrl,
+    getAdminUrl: config.getAdminUrl as () => string,
+    assetBaseUrls: {
+        media: config.get('urls:media'),
+        files: config.get('urls:files'),
+        image: config.get('urls:image')
+    },
+    slugs: config.get('slugs').protected,
+    redirectCacheMaxAge: config.get('caching:301:maxAge'),
+    baseApiPath: BASE_API_PATH
+});
+
+export default urlUtils;
+export {BASE_API_PATH};

package/ghost.js

@@ -20,6 +20,5 @@ case 'generate-data':
     require('./core/cli/command').run(mode);
     break;
 default:
-    // New boot sequence
     require('./core/boot')();
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ghost",
-  "version": "6.53.0",
+  "version": "6.54.1",
   "description": "The professional publishing platform",
   "author": "Ghost Foundation",
   "homepage": "https://ghost.org",
@@ -53,26 +53,23 @@
     "@isaacs/ttlcache": "1.4.1",
     "@sentry/node": "7.120.4",
     "@slack/webhook": "7.1.0",
-    "@tryghost/adapter-base-cache": "0.1.27",
-    "@tryghost/admin-api-schema": "4.7.5",
-    "@tryghost/api-framework": "3.2.4",
-    "@tryghost/bookshelf-plugins": "2.2.4",
-    "@tryghost/brute-knex": "3.2.0",
+    "@tryghost/api-framework": "3.3.5",
+    "@tryghost/bookshelf-plugins": "2.3.2",
+    "@tryghost/brute-knex": "3.2.1",
     "@tryghost/color-utils": "0.2.19",
     "@tryghost/config-url-helpers": "1.0.27",
     "@tryghost/custom-fonts": "1.0.11",
-    "@tryghost/database-info": "2.3.1",
-    "@tryghost/debug": "2.2.3",
-    "@tryghost/domain-events": "3.2.5",
+    "@tryghost/database-info": "2.3.2",
+    "@tryghost/debug": "2.3.5",
+    "@tryghost/domain-events": "3.3.5",
     "@tryghost/email-mock-receiver": "2.1.0",
-    "@tryghost/errors": "1.3.13",
+    "@tryghost/errors": "3.3.5",
     "@tryghost/helpers": "1.1.106",
     "@tryghost/html-to-plaintext": "1.0.11",
     "@tryghost/image-transform": "1.4.17",
     "@tryghost/job-manager": "1.0.9",
     "@tryghost/limit-service": "1.5.6",
-    "@tryghost/logging": "4.2.1",
-    "@tryghost/members-csv": "2.0.7",
+    "@tryghost/logging": "5.3.0",
     "@tryghost/metrics": "1.0.43",
     "@tryghost/mongo-knex": "0.10.1",
     "@tryghost/mongo-utils": "0.6.5",
@@ -81,20 +78,20 @@
     "@tryghost/nodemailer": "2.3.1",
     "@tryghost/nql": "0.13.1",
     "@tryghost/nql-lang": "0.6.6",
-    "@tryghost/pretty-cli": "3.2.3",
+    "@tryghost/pretty-cli": "3.3.2",
     "@tryghost/prometheus-metrics": "1.0.8",
-    "@tryghost/promise": "2.2.3",
-    "@tryghost/referrer-parser": "0.1.19",
-    "@tryghost/request": "1.0.17",
-    "@tryghost/root-utils": "2.2.3",
+    "@tryghost/promise": "2.3.2",
+    "@tryghost/referrer-parser": "0.1.21",
+    "@tryghost/request": "3.3.4",
+    "@tryghost/root-utils": "2.3.2",
     "@tryghost/security": "1.0.6",
     "@tryghost/social-urls": "0.1.63",
     "@tryghost/string": "0.3.5",
-    "@tryghost/tpl": "2.2.3",
+    "@tryghost/tpl": "2.3.5",
     "@tryghost/url-utils": "5.2.6",
     "@tryghost/validator": "0.2.22",
-    "@tryghost/version": "2.2.3",
-    "@tryghost/zip": "3.3.4",
+    "@tryghost/version": "2.3.2",
+    "@tryghost/zip": "3.5.1",
     "body-parser": "1.20.5",
     "bookshelf": "1.2.0",
     "bookshelf-relations": "2.8.0",
@@ -130,7 +127,6 @@
     "file-type": "21.3.4",
     "form-data": "4.0.6",
     "fs-extra": "11.3.6",
-    "ghost-storage-base": "2.1.5",
     "glob": "13.0.6",
     "got": "13.0.0",
     "gscan": "6.4.2",
@@ -189,8 +185,6 @@
     "simple-dom": "1.4.0",
     "stoppable": "1.1.0",
     "stripe": "8.222.0",
-    "superagent": "5.3.1",
-    "superagent-throttle": "1.0.1",
     "terser": "5.48.0",
     "tiny-glob": "0.2.9",
     "tldts": "^7.4.4",
@@ -198,25 +192,26 @@
     "ua-parser-js": "1.0.41",
     "xml": "1.0.1",
     "zod": "4.4.3",
-    "@tryghost/adapter-base-redirects": "file:components/tryghost-adapter-base-redirects-0.0.0.tgz",
+    "@tryghost/adapter-base-cache": "file:components/tryghost-adapter-base-cache-0.2.0.tgz",
     "@tryghost/adapter-base-route-settings": "file:components/tryghost-adapter-base-route-settings-0.0.0.tgz",
-    "@tryghost/adapter-base-scheduling": "file:components/tryghost-adapter-base-scheduling-0.0.0.tgz",
-    "@tryghost/i18n": "file:components/tryghost-i18n-0.0.0.tgz",
-    "@tryghost/adapter-base-sso": "file:components/tryghost-adapter-base-sso-0.0.0.tgz",
+    "@tryghost/adapter-base-redirects": "file:components/tryghost-adapter-base-redirects-0.0.0.tgz",
+    "@tryghost/adapter-base-scheduling": "file:components/tryghost-adapter-base-scheduling-0.2.0.tgz",
+    "@tryghost/adapter-base-sso": "file:components/tryghost-adapter-base-sso-0.1.1.tgz",
+    "@tryghost/admin-api-schema": "file:components/tryghost-admin-api-schema-0.0.0.tgz",
     "@tryghost/custom-field-types": "file:components/tryghost-custom-field-types-0.0.0.tgz",
-    "@tryghost/kg-card-factory": "file:components/tryghost-kg-card-factory-5.2.3.tgz",
-    "@tryghost/kg-clean-basic-html": "file:components/tryghost-kg-clean-basic-html-4.3.3.tgz",
-    "@tryghost/kg-converters": "file:components/tryghost-kg-converters-1.2.3.tgz",
-    "@tryghost/kg-default-nodes": "file:components/tryghost-kg-default-nodes-2.1.3.tgz",
+    "@tryghost/i18n": "file:components/tryghost-i18n-0.0.0.tgz",
+    "@tryghost/kg-default-cards": "file:components/tryghost-kg-default-cards-10.3.3.tgz",
     "@tryghost/kg-html-to-lexical": "file:components/tryghost-kg-html-to-lexical-1.3.3.tgz",
+    "@tryghost/kg-default-nodes": "file:components/tryghost-kg-default-nodes-2.1.3.tgz",
     "@tryghost/kg-lexical-html-renderer": "file:components/tryghost-kg-lexical-html-renderer-1.4.3.tgz",
-    "@tryghost/kg-markdown-html-renderer": "file:components/tryghost-kg-markdown-html-renderer-7.2.3.tgz",
-    "@tryghost/kg-default-cards": "file:components/tryghost-kg-default-cards-10.3.3.tgz",
-    "@tryghost/parse-email-address": "file:components/tryghost-parse-email-address-0.0.0.tgz"
+    "@tryghost/kg-card-factory": "file:components/tryghost-kg-card-factory-5.2.3.tgz",
+    "@tryghost/parse-email-address": "file:components/tryghost-parse-email-address-0.0.0.tgz",
+    "ghost-storage-base": "file:components/ghost-storage-base-3.0.0.tgz",
+    "@tryghost/kg-converters": "file:components/tryghost-kg-converters-1.2.3.tgz"
   },
   "optionalDependencies": {
     "better-sqlite3": "12.11.1"
   },
   "scripts": {},
-  "packageManager": "pnpm@11.13.0+sha512.88d94724d8f2e6c186744a5584c6e59ecac869ec7ba15e9cb4cd628e8dc7066820b2481d8ee3b51ea8da323a7378068aa58c556a3720d32b7c20a051d088363a"
+  "packageManager": "pnpm@11.15.1+sha512.81350b07e53c9538a02f1f2303b4290fa2d7be04e56e2a970c4cc4b417dc761de196edabd49d55c7dc9580db81007c44143e4e3d7e462b3000d23c255122d065"
 }