ghost 6.55.0 → 6.56.0

package/core/server/services/members/members-api/services/payments-service.js

@@ -14,7 +14,6 @@ class PaymentsService {
      * @param {import('../../../offers/application/offers-api')} deps.offersAPI
      * @param {import('../../../stripe/stripe-api')} deps.stripeAPIService
      * @param {{get(key: string): any}} deps.settingsCache
-     * @param {{service: import('../../../gifts/gift-service').GiftService}} deps.giftService
      */
     constructor(deps) {
         /** @private */
@@ -31,9 +30,6 @@ class PaymentsService {
         this.stripeAPIService = deps.stripeAPIService;
         /** @private */
         this.settingsCache = deps.settingsCache;
-        /** @private */
-        this.giftService = deps.giftService;
-
         DomainEvents.subscribe(OfferCreatedEvent, async (event) => {
             await this.getCouponForOffer(event.data.offer.id);
         });
@@ -65,7 +61,7 @@ class PaymentsService {
      * @param {Tier.Cadence} params.cadence
      * @param {Offer} [params.offer]
      * @param {Member} [params.member]
-     * @param {import('../../../gifts/gift').Gift} [params.gift]
+     * @param {number|null} [params.giftTrialDays]
      * @param {Object.<string, any>} [params.metadata]
      * @param {string} params.successUrl
      * @param {string} params.cancelUrl
@@ -73,7 +69,7 @@ class PaymentsService {
      *
      * @returns {Promise<URL>}
      */
-    async getPaymentLink({tier, cadence, offer, member, gift, metadata, successUrl, cancelUrl, email}) {
+    async getPaymentLink({tier, cadence, offer, member, giftTrialDays, metadata, successUrl, cancelUrl, email}) {
         let coupon = null;
         let trialDays = null;
         if (offer) {
@@ -94,12 +90,10 @@ class PaymentsService {
             }
         }
 
-        // If continuing from a gift subscription, add gift remaining days as trial
-        if (trialDays === null && gift) {
-            const remainingDays = this.giftService.service.getRemainingActiveDays(gift);
-            if (remainingDays > 0) {
-                trialDays = Math.min(remainingDays, 730); // Stripe max trial period
-            }
+        // Gift subscriptions owns the continuation calculation. This adapter only
+        // translates the stable decision into the recurring Stripe checkout.
+        if (trialDays === null && giftTrialDays !== undefined) {
+            trialDays = giftTrialDays;
         }
 
         let customer = null;
@@ -163,62 +157,6 @@ class PaymentsService {
         return session.url;
     }
 
-    /**
-     * @param {object} params
-     * @param {import('../../../tiers/tier')} params.tier
-     * @param {'month'|'year'} params.cadence
-     * @param {number} params.duration
-     * @param {string} params.successUrl
-     * @param {string} params.cancelUrl
-     * @param {object} params.metadata
-     * @param {object} [params.member]
-     * @param {boolean} params.isAuthenticated
-     * @param {string} [params.email]
-     *
-     * @returns {Promise<string>}
-     */
-    async getGiftPaymentLink({tier, cadence, duration, metadata, successUrl, cancelUrl, member, isAuthenticated, email}) {
-        let customer = null;
-        if (member && isAuthenticated) {
-            customer = await this.getCustomerForMember(member);
-        }
-
-        const amount = tier.getPrice(cadence);
-        const currency = tier.currency.toLowerCase();
-
-        const token = this.giftService.service.generateToken();
-
-        const successUrlObj = new URL(successUrl);
-        successUrlObj.searchParams.set('stripe', 'gift-purchase-success');
-        successUrlObj.searchParams.set('gift_token', token);
-        successUrlObj.searchParams.set('gift_tier', tier.id.toHexString());
-        successUrlObj.searchParams.set('gift_cadence', cadence);
-
-        const data = {
-            amount,
-            currency,
-            tierName: tier.name,
-            cadence,
-            duration,
-            metadata: {
-                ...metadata,
-                ghost_gift: 'true',
-                gift_token: token,
-                tier_id: tier.id.toHexString(),
-                cadence,
-                duration: String(duration)
-            },
-            successUrl: successUrlObj.toString(),
-            cancelUrl,
-            customer,
-            customerEmail: !customer && email ? email : null
-        };
-
-        const session = await this.stripeAPIService.createGiftCheckoutSession(data);
-
-        return session.url;
-    }
-
     async getCustomerForMember(member) {
         const rows = await this.StripeCustomerModel.where({
             member_id: member.id

package/core/server/services/members-custom-fields/schema.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DbCustomFieldValueWithField = exports.DbCustomFieldValue = exports.DbCustomField = exports.FieldStatusSchema = exports.FIELD_STATUS = void 0;
+exports.DbCustomFieldValueWithField = exports.StoredCompositeValue = exports.DbCustomFieldValue = exports.DbCustomField = exports.FieldStatusSchema = exports.FIELD_STATUS = void 0;
 const zod_1 = require("zod");
 const custom_field_types_1 = require("@tryghost/custom-field-types");
 const db_date_1 = require("../../lib/db-date");
@@ -37,6 +37,13 @@ exports.DbCustomFieldValue = zod_1.z.object({
     created_at: db_date_1.DbDate,
     updated_at: db_date_1.DbDate.nullable()
 });
+// A composite value once decoded: sub-field keys to values, and no narrower. Which
+// sub-fields a composite has is its field type's business, not the row's.
+//
+// It doubles as the guard on a stored blob. A JSON column can just as easily hold an
+// array, a null or a bare number, and a record rejects all three — so parsing against
+// this is what narrows the type, with no assertion needed.
+exports.StoredCompositeValue = zod_1.z.record(zod_1.z.string(), zod_1.z.unknown());
 // The value join a read needs: the field's identity and type travel with the
 // stored columns, so a row can be decoded without a second lookup. `type` is
 // parsed as the field-type enum, which narrows it with no cast.

package/core/server/services/members-custom-fields/schema.ts

@@ -44,6 +44,14 @@ export const DbCustomFieldValue = z.object({
 
 type CustomFieldValueRow = z.infer<typeof DbCustomFieldValue>;
 
+// A composite value once decoded: sub-field keys to values, and no narrower. Which
+// sub-fields a composite has is its field type's business, not the row's.
+//
+// It doubles as the guard on a stored blob. A JSON column can just as easily hold an
+// array, a null or a bare number, and a record rejects all three — so parsing against
+// this is what narrows the type, with no assertion needed.
+export const StoredCompositeValue = z.record(z.string(), z.unknown());
+
 // The value join a read needs: the field's identity and type travel with the
 // stored columns, so a row can be decoded without a second lookup. `type` is
 // parsed as the field-type enum, which narrows it with no cast.

package/core/server/services/members-custom-fields/values-service.js

@@ -21,6 +21,21 @@ const MAX_KEY_LENGTH = 191;
 // validated by its own field type's schema, which isn't known until the key is
 // resolved to a definition.
 const ValuesInput = zod_1.z.record(zod_1.z.string().max(MAX_KEY_LENGTH), zod_1.z.unknown());
+// JSON.parse as a total function. Anything unreadable — unparseable text, or the null
+// a nullable column can always return — reads as `undefined`, which no value schema
+// accepts. That way a corrupt blob is turned away by the same check that turns away a
+// well-formed one of the wrong shape, instead of needing a branch of its own.
+function decodeJson(raw) {
+    if (raw === null) {
+        return undefined;
+    }
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
  * The value half of member custom fields: reading and writing what a member holds
  * for each defined field. It belongs to the member aggregate — a value is data
@@ -188,28 +203,129 @@ class CustomFieldValuesService {
         }
         return writes;
     }
+    /**
+     * @private
+     * The composite values this member already holds for the fields in a plan,
+     * keyed by field id. Composites only: a scalar has nothing to merge into.
+     *
+     * Read through the caller's executor, never the base connection. On a
+     * single-connection pool a read off `this.knex` inside an open transaction
+     * waits for the connection that transaction is holding, and hangs.
+     *
+     * A blob that won't decode is left out, so the write replaces it rather than
+     * merging into something unreadable.
+     */
+    async storedComposites(trx, memberId, writes) {
+        const composites = new Map();
+        // Merging is only meaningful for a value with parts, which is a fact about the
+        // type's shape rather than the column it lands in. Asking the storage type
+        // instead would sweep in the first json-backed type that isn't a record — a
+        // multi-select held as a list, say — and log a decode failure for every row of
+        // an import, over a value that reads back perfectly well.
+        const fieldIds = writes
+            .filter(({ field, value }) => value !== undefined && (0, custom_field_types_1.subFieldsOf)(field.type) !== null)
+            .map(({ field }) => field.id);
+        if (fieldIds.length === 0) {
+            return composites;
+        }
+        const rows = await trx(VALUES_TABLE)
+            .where('member_id', memberId)
+            .whereIn('custom_field_id', fieldIds)
+            .whereNotNull('value_json')
+            .select('custom_field_id', 'value_json')
+            // Merging reads a value and writes it back, so the row has to stay still in
+            // between: without the lock a write committing after this read is overwritten
+            // by the sub-fields it just replaced. knex omits this on SQLite, which needs
+            // no lock — its pool is a single connection, so writes never overlap.
+            .forUpdate();
+        for (const row of rows) {
+            // The blob is the edge here: the columns come from a query written just
+            // above, but whatever an earlier write left in value_json is unknown until
+            // it is read back. Parsing it is what narrows the type, and it rejects the
+            // array, null or bare number the column could equally be holding.
+            const stored = schema_1.StoredCompositeValue.safeParse(decodeJson(row.value_json));
+            if (stored.success) {
+                composites.set(row.custom_field_id, stored.data);
+                continue;
+            }
+            logging_1.default.warn(`Replacing an unreadable custom field value rather than merging into it (member '${memberId}', field '${row.custom_field_id}').`);
+        }
+        return composites;
+    }
+    /**
+     * @private
+     * The stored sub-fields with the incoming ones written over them, re-checked
+     * against the field type before it is handed back.
+     *
+     * The re-check is what makes this safe to write without a second thought. Both
+     * halves were valid when they were written, but "valid" is a moving target: the
+     * stored half may predate a change to the type, so it can carry a sub-field the
+     * type has since dropped or a bound it has since tightened. Parsing the result
+     * strips what no longer belongs instead of faithfully persisting it on every
+     * import from here on.
+     *
+     * A merged value that won't parse falls back to the incoming value alone rather
+     * than failing. The row is trying to write something valid, and refusing it over
+     * data that was already in the database punishes the wrong write.
+     */
+    mergeComposite(field, existing, incoming) {
+        const merged = custom_field_types_1.FIELD_TYPES[field.type].value.safeParse({ ...existing, ...incoming });
+        if (merged.success) {
+            return merged.data;
+        }
+        logging_1.default.warn(`Replacing a custom field value that no longer validates rather than merging into it (field '${field.key}').`);
+        return incoming;
+    }
     /**
      * Apply a plan from `planWrite`.
      *
      * Merge, not replace: only the fields in the plan are touched, so a caller
      * that doesn't know about a field can't erase it.
      *
+     * `mergeComposites` extends that same rule from a field to a composite's
+     * sub-fields, because a sub-field is a field: a row writes the sub-fields it
+     * fills and leaves the rest alone, exactly as a blank `name` column leaves a
+     * member's name alone. The CSV import needs it — without it a file naming one
+     * address column would replace the whole address, clearing five sub-fields it
+     * never mentioned. The API does not merge: a PUT sends a whole address, so
+     * what it sends is what should be stored.
+     *
+     * The merge is asked for here rather than at plan time, where the caller's intent
+     * is otherwise expressed, because it cannot happen before a transaction is open:
+     * it reads the stored value and writes it back, and the row lock that keeps those
+     * two steps together only exists inside the transaction. `planWrite` runs before
+     * one is opened -- the importer plans a row, then opens a transaction per member --
+     * so a merge decided there would have to read outside the lock it depends on.
+     *
      * Always transactional, so a mid-batch failure rolls the batch back. Passed an
      * executor it joins that transaction -- the importer passes its per-member one, so a
      * failed value write takes the member with it; passed nothing it opens its own.
      */
-    async applyWrite(memberId, writes, executor = this.knex) {
+    async applyWrite(memberId, writes, executor = this.knex, { mergeComposites = false } = {}) {
         if (writes.length === 0) {
             return;
         }
         const apply = async (trx) => {
+            const stored = mergeComposites
+                ? await this.storedComposites(trx, memberId, writes)
+                : new Map();
             for (const { field, value } of writes) {
                 const target = { member_id: memberId, custom_field_id: field.id };
                 if (value === undefined) {
                     await trx(VALUES_TABLE).where(target).del();
                     continue;
                 }
-                const valueColumns = (0, storage_1.storageColumnsFor)(field.type, value);
+                // Both sides of the merge go through the same shape check, so it joins
+                // two objects the type system knows about rather than two assertions.
+                // The plan already validated `value` against its field type, so for a
+                // composite this parse cannot fail; a scalar simply doesn't match, and
+                // falls through to being written as it stands.
+                const existing = stored.get(field.id);
+                const incoming = schema_1.StoredCompositeValue.safeParse(value);
+                const merged = existing && incoming.success
+                    ? this.mergeComposite(field, existing, incoming.data)
+                    : value;
+                const valueColumns = (0, storage_1.storageColumnsFor)(field.type, merged);
                 await trx(VALUES_TABLE)
                     .insert({ id: new bson_objectid_1.default().toHexString(), ...target, ...valueColumns, created_at: new Date() })
                     // The unique index on (member_id, custom_field_id) is

package/core/server/services/members-custom-fields/values-service.ts

@@ -3,8 +3,8 @@ import errors from '@tryghost/errors';
 import logging from '@tryghost/logging';
 import type {Knex} from 'knex';
 import {z} from 'zod';
-import {FIELD_TYPES, type FieldType} from '@tryghost/custom-field-types';
-import {DbCustomFieldValueWithField, FIELD_STATUS} from './schema';
+import {FIELD_TYPES, subFieldsOf, type FieldType} from '@tryghost/custom-field-types';
+import {DbCustomFieldValueWithField, FIELD_STATUS, StoredCompositeValue} from './schema';
 import {activeFields} from './queries';
 import {storageCodecFor, storageColumnsFor} from './storage';
 
@@ -20,6 +20,21 @@ const MAX_KEY_LENGTH = 191;
 // resolved to a definition.
 const ValuesInput = z.record(z.string().max(MAX_KEY_LENGTH), z.unknown());
 
+// JSON.parse as a total function. Anything unreadable — unparseable text, or the null
+// a nullable column can always return — reads as `undefined`, which no value schema
+// accepts. That way a corrupt blob is turned away by the same check that turns away a
+// well-formed one of the wrong shape, instead of needing a branch of its own.
+function decodeJson(raw: string | null): unknown {
+    if (raw === null) {
+        return undefined;
+    }
+    try {
+        return JSON.parse(raw);
+    } catch {
+        return undefined;
+    }
+}
+
 // The field facts the value path needs: the id to write the FK, the key to match
 // input against, the name for error messages, and the type to pick the validator
 // and storage column. All columns on members_custom_fields, so a value operation
@@ -222,22 +237,126 @@ export class CustomFieldValuesService {
         return writes;
     }
 
+    /**
+     * @private
+     * The composite values this member already holds for the fields in a plan,
+     * keyed by field id. Composites only: a scalar has nothing to merge into.
+     *
+     * Read through the caller's executor, never the base connection. On a
+     * single-connection pool a read off `this.knex` inside an open transaction
+     * waits for the connection that transaction is holding, and hangs.
+     *
+     * A blob that won't decode is left out, so the write replaces it rather than
+     * merging into something unreadable.
+     */
+    private async storedComposites(trx: Knex, memberId: string, writes: PlannedWrite[]): Promise<Map<string, Record<string, unknown>>> {
+        const composites = new Map<string, Record<string, unknown>>();
+        // Merging is only meaningful for a value with parts, which is a fact about the
+        // type's shape rather than the column it lands in. Asking the storage type
+        // instead would sweep in the first json-backed type that isn't a record — a
+        // multi-select held as a list, say — and log a decode failure for every row of
+        // an import, over a value that reads back perfectly well.
+        const fieldIds = writes
+            .filter(({field, value}) => value !== undefined && subFieldsOf(field.type) !== null)
+            .map(({field}) => field.id);
+
+        if (fieldIds.length === 0) {
+            return composites;
+        }
+
+        const rows = await trx(VALUES_TABLE)
+            .where('member_id', memberId)
+            .whereIn('custom_field_id', fieldIds)
+            .whereNotNull('value_json')
+            .select('custom_field_id', 'value_json')
+            // Merging reads a value and writes it back, so the row has to stay still in
+            // between: without the lock a write committing after this read is overwritten
+            // by the sub-fields it just replaced. knex omits this on SQLite, which needs
+            // no lock — its pool is a single connection, so writes never overlap.
+            .forUpdate();
+
+        for (const row of rows) {
+            // The blob is the edge here: the columns come from a query written just
+            // above, but whatever an earlier write left in value_json is unknown until
+            // it is read back. Parsing it is what narrows the type, and it rejects the
+            // array, null or bare number the column could equally be holding.
+            const stored = StoredCompositeValue.safeParse(decodeJson(row.value_json));
+            if (stored.success) {
+                composites.set(row.custom_field_id, stored.data);
+                continue;
+            }
+            logging.warn(`Replacing an unreadable custom field value rather than merging into it (member '${memberId}', field '${row.custom_field_id}').`);
+        }
+
+        return composites;
+    }
+
+    /**
+     * @private
+     * The stored sub-fields with the incoming ones written over them, re-checked
+     * against the field type before it is handed back.
+     *
+     * The re-check is what makes this safe to write without a second thought. Both
+     * halves were valid when they were written, but "valid" is a moving target: the
+     * stored half may predate a change to the type, so it can carry a sub-field the
+     * type has since dropped or a bound it has since tightened. Parsing the result
+     * strips what no longer belongs instead of faithfully persisting it on every
+     * import from here on.
+     *
+     * A merged value that won't parse falls back to the incoming value alone rather
+     * than failing. The row is trying to write something valid, and refusing it over
+     * data that was already in the database punishes the wrong write.
+     */
+    private mergeComposite(field: ActiveField, existing: Record<string, unknown>, incoming: Record<string, unknown>): unknown {
+        const merged = FIELD_TYPES[field.type].value.safeParse({...existing, ...incoming});
+        if (merged.success) {
+            return merged.data;
+        }
+
+        logging.warn(`Replacing a custom field value that no longer validates rather than merging into it (field '${field.key}').`);
+        return incoming;
+    }
+
     /**
      * Apply a plan from `planWrite`.
      *
      * Merge, not replace: only the fields in the plan are touched, so a caller
      * that doesn't know about a field can't erase it.
      *
+     * `mergeComposites` extends that same rule from a field to a composite's
+     * sub-fields, because a sub-field is a field: a row writes the sub-fields it
+     * fills and leaves the rest alone, exactly as a blank `name` column leaves a
+     * member's name alone. The CSV import needs it — without it a file naming one
+     * address column would replace the whole address, clearing five sub-fields it
+     * never mentioned. The API does not merge: a PUT sends a whole address, so
+     * what it sends is what should be stored.
+     *
+     * The merge is asked for here rather than at plan time, where the caller's intent
+     * is otherwise expressed, because it cannot happen before a transaction is open:
+     * it reads the stored value and writes it back, and the row lock that keeps those
+     * two steps together only exists inside the transaction. `planWrite` runs before
+     * one is opened -- the importer plans a row, then opens a transaction per member --
+     * so a merge decided there would have to read outside the lock it depends on.
+     *
      * Always transactional, so a mid-batch failure rolls the batch back. Passed an
      * executor it joins that transaction -- the importer passes its per-member one, so a
      * failed value write takes the member with it; passed nothing it opens its own.
      */
-    async applyWrite(memberId: string, writes: PlannedWrite[], executor: Knex = this.knex): Promise<void> {
+    async applyWrite(
+        memberId: string,
+        writes: PlannedWrite[],
+        executor: Knex = this.knex,
+        {mergeComposites = false}: {mergeComposites?: boolean} = {}
+    ): Promise<void> {
         if (writes.length === 0) {
             return;
         }
 
         const apply = async (trx: Knex) => {
+            const stored = mergeComposites
+                ? await this.storedComposites(trx, memberId, writes)
+                : new Map<string, Record<string, unknown>>();
+
             for (const {field, value} of writes) {
                 const target = {member_id: memberId, custom_field_id: field.id};
 
@@ -246,7 +365,18 @@ export class CustomFieldValuesService {
                     continue;
                 }
 
-                const valueColumns = storageColumnsFor(field.type, value);
+                // Both sides of the merge go through the same shape check, so it joins
+                // two objects the type system knows about rather than two assertions.
+                // The plan already validated `value` against its field type, so for a
+                // composite this parse cannot fail; a scalar simply doesn't match, and
+                // falls through to being written as it stands.
+                const existing = stored.get(field.id);
+                const incoming = StoredCompositeValue.safeParse(value);
+                const merged = existing && incoming.success
+                    ? this.mergeComposite(field, existing, incoming.data)
+                    : value;
+
+                const valueColumns = storageColumnsFor(field.type, merged);
                 await trx(VALUES_TABLE)
                     .insert({id: new ObjectID().toHexString(), ...target, ...valueColumns, created_at: new Date()})
                     // The unique index on (member_id, custom_field_id) is

package/core/server/services/oembed/oembed-service.js

@@ -9,6 +9,7 @@ const charset = require('charset');
 const iconv = require('iconv-lite');
 const path = require('path');
 const crypto = require('crypto');
+const imageTransform = require('@tryghost/image-transform');
 
 // Some sites block non-standard user agents so we need to mimic a typical browser
 // Note: the Ghost/5.0 string _may_ be in use by 3rd parties so use caution when updating across majors
@@ -39,7 +40,26 @@ const messages = {
     insufficientMetadata: 'URL contains insufficient metadata.',
     unknownProvider: 'No provider found for supplied URL.',
     unableToFetchOembed: 'Unable to fetch requested embed.',
-    unauthorized: 'URL contains a private resource.'
+    unauthorized: 'URL contains a private resource.',
+    unconvertibleSvg: 'SVG image is too large or compressed to convert.'
+};
+
+const SVG_RASTER_SIZE = 256;
+const SVG_RASTER_TIMEOUT_SECONDS = 10;
+const MAX_SVG_BYTES = 32 * 1024;
+const GZIP_MAGIC = [0x1f, 0x8b];
+
+const SVG_EXTENSIONS = new Set(['.svg', '.svgz']);
+const SVG_SNIFF_BYTES = 1024;
+
+const shouldRasterize = (buffer, ext) => {
+    if (SVG_EXTENSIONS.has(ext.toLowerCase())) {
+        return true;
+    }
+
+    const head = buffer.subarray(0, SVG_SNIFF_BYTES).toString('utf8').trimStart();
+
+    return head.startsWith('<') && /<svg[\s:>]/i.test(head);
 };
 
 /**
@@ -175,14 +195,35 @@ class OEmbedService {
         }
 
         // Fetch image buffer from the URL
-        const imageBuffer = await this.fetchImageBuffer(imageUrl);
+        let imageBuffer = await this.fetchImageBuffer(imageUrl);
 
         // Extract file name from URL
         const fileName = path.basename(new URL(imageUrl).pathname);
-        const ext = path.extname(fileName);
+        let ext = path.extname(fileName);
         const baseName = ext ? path.basename(fileName, ext) : fileName;
         const name = this.imageStore.getSanitizedFileName(baseName);
 
+        if (shouldRasterize(imageBuffer, ext)) {
+            if (imageBuffer.length > MAX_SVG_BYTES || GZIP_MAGIC.every((byte, index) => imageBuffer[index] === byte)) {
+                throw new errors.ValidationError({
+                    message: tpl(messages.unconvertibleSvg),
+                    context: imageUrl
+                });
+            }
+
+            imageBuffer = await imageTransform.resizeFromBuffer(imageBuffer, {
+                // without `format` this returns the original bytes whenever they
+                // are smaller, storing the SVG under a .png name
+                format: 'png',
+                width: SVG_RASTER_SIZE,
+                height: SVG_RASTER_SIZE,
+                withoutEnlargement: false,
+                timeout: SVG_RASTER_TIMEOUT_SECONDS
+            });
+
+            ext = '.png';
+        }
+
         const uniqueFileName = `${name}-${crypto.randomUUID()}${ext}`;
         const targetPath = path.join(imageType, uniqueFileName);
 

package/core/server/services/posts/posts-service.js

@@ -312,6 +312,17 @@ class PostsService {
             });
         }
 
+        // The `comments.in_reply_to_id` references form chains between a post's
+        // comments, which MySQL cannot resolve while cascade-deleting them
+        // alongside `comments.parent_id`. Clear the references first so the
+        // `comments.post_id` cascade delete can do its job
+        await this.models.Post.bulkEdit(deleteIds, 'comments', {
+            data: {in_reply_to_id: null},
+            column: 'post_id',
+            transacting: options.transacting,
+            throwErrors: true
+        });
+
         // Posts and emails
         await this.models.Post.bulkDestroy(deleteEmailIds, 'emails', {transacting: options.transacting, throwErrors: true});
         const result = await this.models.Post.bulkDestroy(deleteIds, 'posts', {...options, throwErrors: true});

package/core/server/services/route-settings/dynamic-routing-service.js

@@ -54,10 +54,8 @@ class DynamicRoutingService {
     }
 
     async loadRouteSettings() {
-        const {buildRouterSettings} = require('./activation-bridge');
-
         try {
-            return buildRouterSettings(await this.store.get());
+            return await this.store.get();
         } catch (err) {
             // A stored-content error means the site's routes.yaml is invalid —
             // either it fails validation or it isn't parseable YAML. Log a