ghost 6.60.0 → 6.62.0

package/core/server/web/api/endpoints/admin/routes.js

@@ -146,6 +146,25 @@ module.exports = function apiRoutes() {
   // Tiers
   router.get('/tiers', mw.authAdminApi, http(api.tiers.browse));
   router.post('/tiers', mw.authAdminApi, http(api.tiers.add));
+  // What a tier's checkout asks for, read when a Stripe checkout session is built.
+  // Registered before /tiers/:id so the literal path isn't captured by :id.
+  //
+  // A sub-resource rather than a key on the tier, because the tier payload is a public
+  // projection: `tiers-public` shares this docName's serializer, so anything on a tier is
+  // rendered by themes. This is admin-only configuration that no client renders, since
+  // the questions are drawn by Stripe's own checkout page rather than by Portal.
+  //
+  // Named for the configuration rather than the checkout, so it cannot be mistaken for
+  // the session that `create-stripe-checkout-session` creates from it.
+  router.get('/tiers/checkout_config', mw.authAdminApi, http(api.tiersCheckoutConfig.browse));
+  router.get('/tiers/:id/checkout_config', mw.authAdminApi, http(api.tiersCheckoutConfig.read));
+  router.put(
+    '/tiers/:id/checkout_config',
+    mw.authAdminApi,
+    labs.enabledMiddleware('stripeCheckoutCollection'),
+    http(api.tiersCheckoutConfig.edit),
+  );
+
   router.get('/tiers/:id', mw.authAdminApi, http(api.tiers.read));
   router.put('/tiers/:id', mw.authAdminApi, http(api.tiers.edit));
 
@@ -176,44 +195,39 @@ module.exports = function apiRoutes() {
 
   router.get('/members/stripe_connect', mw.authAdminApi, http(api.membersStripeConnect.auth));
 
-  // Member custom field definitions — gated by the members_custom_fields flag.
-  // Registered before /members/:id so the literal path isn't captured by :id.
-  router.get(
-    '/members/custom_fields',
-    mw.authAdminApi,
-    labs.enabledMiddleware('membersCustomFields'),
-    http(api.membersCustomFields.browse),
-  );
+  // Reading definitions is deliberately not behind the feature flag: Admin asks every site
+  // for them, and a site without the flag simply has none, so the answer is an empty list
+  // rather than a 404. Creating and changing them is flagged. Registered before /members/:id
+  // so the literal path is not captured as an id.
+  router.get('/members/metafields/:namespace', mw.authAdminApi, http(api.membersMetafields.browse));
   router.post(
-    '/members/custom_fields',
+    '/members/metafields/:namespace',
     mw.authAdminApi,
     labs.enabledMiddleware('membersCustomFields'),
-    http(api.membersCustomFields.add),
+    http(api.membersMetafields.add),
   );
-  // A PUT on the collection sets the publisher's order for the whole list.
   router.put(
-    '/members/custom_fields',
+    '/members/metafields/:namespace',
     mw.authAdminApi,
     labs.enabledMiddleware('membersCustomFields'),
-    http(api.membersCustomFields.reorder),
+    http(api.membersMetafields.reorder),
   );
   router.get(
-    '/members/custom_fields/:key',
+    '/members/metafields/:namespace/:key',
     mw.authAdminApi,
-    labs.enabledMiddleware('membersCustomFields'),
-    http(api.membersCustomFields.read),
+    http(api.membersMetafields.read),
   );
   router.put(
-    '/members/custom_fields/:key',
+    '/members/metafields/:namespace/:key',
     mw.authAdminApi,
     labs.enabledMiddleware('membersCustomFields'),
-    http(api.membersCustomFields.edit),
+    http(api.membersMetafields.edit),
   );
   router.delete(
-    '/members/custom_fields/:key',
+    '/members/metafields/:namespace/:key',
     mw.authAdminApi,
     labs.enabledMiddleware('membersCustomFields'),
-    http(api.membersCustomFields.destroy),
+    http(api.membersMetafields.destroy),
   );
 
   router.get('/members/:id', mw.authAdminApi, http(api.members.read));

package/core/server/web/api/middleware/upload.js

@@ -37,8 +37,8 @@ const messages = {
     invalidFile: 'Please select a valid CSV file.',
   },
   posts: {
-    missingFile: 'Please select a posts CSV file.',
-    invalidFile: 'Please select a valid CSV file.',
+    missingFile: 'Please select a posts CSV or ZIP file.',
+    invalidFile: 'Please select a valid CSV or ZIP file.',
   },
   images: {
     missingFile: 'Please select an image.',

package/core/server/web/parent/app.js

@@ -12,6 +12,11 @@ module.exports = function setupParentApp() {
   const parentApp = express('parent');
 
   parentApp.use(mw.requestId);
+
+  if (config.get('queryParameterFiltering:enabled')) {
+    parentApp.use(mw.filterQueryParameters);
+  }
+
   parentApp.use(mw.logRequest);
 
   // Register event emitter on req/res to trigger cache invalidation webhook event

package/core/server/web/parent/middleware/filter-query-parameters.js

@@ -0,0 +1,94 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.filterQueryParameters = filterQueryParameters;
+const logging_1 = __importDefault(require("@tryghost/logging"));
+const query_parameter_policy_1 = require("../../query-parameter-policy");
+const allowedQueryParameters = new Set(query_parameter_policy_1.queryParameterPolicy.public.map((entry) => entry.name));
+const allowedContentApiQueryParameters = new Set(query_parameter_policy_1.queryParameterPolicy.contentApi.map((entry) => entry.name));
+const CONTENT_API_PATH_PATTERN = /\/ghost\/api\/(?:(?:v[0-9]+|canary)\/content|content)(?:\/|$)/;
+const EXEMPT_PATH_PATTERNS = [
+    /\/ghost\/api(?:\/|$)/,
+    /\/\.ghost(?:\/|$)/,
+    /\/\.well-known(?:\/|$)/,
+    /\/socket\.io(?:\/|$)/,
+];
+const MAX_LOGGED_PARAMETERS = 10;
+const REQUEST_URL_BASE = 'http://ignored.example';
+const replaceQueryString = (requestTarget, filteredRequestTarget) => {
+    const requestUrl = new URL(requestTarget, REQUEST_URL_BASE);
+    const filteredUrl = new URL(filteredRequestTarget, REQUEST_URL_BASE);
+    return `${requestUrl.pathname}${filteredUrl.search}`;
+};
+const replaceParsedQuery = (query, requestTarget) => {
+    for (const parameter of Object.keys(query)) {
+        delete query[parameter];
+    }
+    const { searchParams } = new URL(requestTarget, REQUEST_URL_BASE);
+    for (const parameter of new Set(searchParams.keys())) {
+        const values = searchParams.getAll(parameter);
+        query[parameter] = values.length === 1 ? values[0] : values;
+    }
+};
+const removeUnknownParameters = (searchParams, allowlist) => {
+    const removed = new Set();
+    for (const parameter of [...searchParams.keys()]) {
+        if (!allowlist.has(parameter)) {
+            searchParams.delete(parameter);
+            removed.add(parameter);
+        }
+    }
+    return removed;
+};
+const filterRequestTarget = (requestTarget) => {
+    const { pathname, searchParams } = new URL(requestTarget, REQUEST_URL_BASE);
+    const contentApiRequest = CONTENT_API_PATH_PATTERN.test(pathname);
+    const exemptPath = EXEMPT_PATH_PATTERNS.some((pattern) => pattern.test(pathname));
+    if (!contentApiRequest && exemptPath) {
+        return {
+            requestTarget,
+            removedUnknownParameters: [],
+        };
+    }
+    const allowlist = contentApiRequest ? allowedContentApiQueryParameters : allowedQueryParameters;
+    const removedUnknownParameters = removeUnknownParameters(searchParams, allowlist);
+    if (removedUnknownParameters.size === 0) {
+        return {
+            requestTarget,
+            removedUnknownParameters: [],
+        };
+    }
+    const query = searchParams.toString();
+    return {
+        requestTarget: query ? `${pathname}?${query}` : pathname,
+        removedUnknownParameters: [...removedUnknownParameters].sort(),
+    };
+};
+/**
+ * Applies Ghost(Pro)'s public query parameter allowlist in local development.
+ *
+ * Update the production policy and this manifest together when adding a parameter.
+ * This middleware is enabled by the root pnpm dev Docker Compose configuration.
+ */
+function filterQueryParameters(req, _res, next) {
+    const requestTarget = req.originalUrl;
+    const result = filterRequestTarget(requestTarget);
+    if (result.requestTarget !== requestTarget) {
+        const query = req.query;
+        req.originalUrl = result.requestTarget;
+        req.url = replaceQueryString(req.url, result.requestTarget);
+        replaceParsedQuery(query, result.requestTarget);
+    }
+    if (result.removedUnknownParameters.length > 0) {
+        const strippedParameters = result.removedUnknownParameters
+            .slice(0, MAX_LOGGED_PARAMETERS)
+            .map(encodeURIComponent)
+            .join(', ');
+        const omittedParameterCount = result.removedUnknownParameters.length - MAX_LOGGED_PARAMETERS;
+        const omittedParameters = omittedParameterCount > 0 ? `, and ${omittedParameterCount} more` : '';
+        logging_1.default.warn(`[query-parameter-filter] Stripped undeclared query parameter(s) from ${req.path}: ${strippedParameters}${omittedParameters}`);
+    }
+    next();
+}

package/core/server/web/parent/middleware/index.js

@@ -1,5 +1,6 @@
 module.exports = {
   emitEvents: require('./emit-events'),
+  filterQueryParameters: require('./filter-query-parameters').filterQueryParameters,
   ghostLocals: require('./ghost-locals').ghostLocals,
   logRequest: require('./log-request'),
   queueRequest: require('./queue-request'),

package/core/server/web/query-parameter-policy/index.js

@@ -0,0 +1,9 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.queryParameterPolicy = void 0;
+const policy_json_1 = __importDefault(require("./policy.json"));
+const schema_1 = require("./schema");
+exports.queryParameterPolicy = (0, schema_1.parseQueryParameterPolicy)(policy_json_1.default);

package/core/server/web/query-parameter-policy/policy.json

@@ -0,0 +1,58 @@
+{
+  "schemaVersion": 1,
+  "public": [
+    { "name": "m", "reason": "Link tracking" },
+    { "name": "v", "reason": "Asset invalidation" },
+    { "name": "r", "reason": "Password-protected site redirects" },
+    { "name": "token", "reason": "Members API authentication" },
+    { "name": "action", "reason": "Unsubscribe links" },
+    { "name": "ssml", "reason": "Ghost SSO" },
+    { "name": "ssts", "reason": "Ghost SSO" },
+    { "name": "uuid", "reason": "Member UUID used for unsubscribing" },
+    { "name": "key", "reason": "Members key used to sign unsubscribe paths" },
+    { "name": "portal-action", "reason": "Members Portal actions" },
+    { "name": "newsletter", "reason": "Multiple newsletters, including unsubscribe links" },
+    { "name": "comments", "reason": "Unsubscribing from comment notifications" },
+    { "name": "updatesandannouncements", "reason": "Unsubscribing from automations emails" },
+    { "name": "firstStart", "reason": "Opening the getting-started modal" },
+    { "name": "include", "reason": "Frontend comments API includes" },
+    { "name": "fields", "reason": "Frontend comments API field selection" },
+    { "name": "limit", "reason": "Frontend comments API pagination" },
+    { "name": "order", "reason": "Frontend comments API sorting" },
+    { "name": "filter", "reason": "Frontend comments API filtering" },
+    { "name": "page", "reason": "Frontend comments API pagination" },
+    { "name": "ids", "reason": "Frontend comments counts API" },
+    { "name": "via", "reason": "FirstPromoter referral tracking" },
+    { "name": "ref", "reason": "Attribution tracking" },
+    { "name": "source", "reason": "Attribution tracking" },
+    { "name": "utm_source", "reason": "Attribution tracking" },
+    { "name": "utm_medium", "reason": "Attribution tracking" },
+    { "name": "attribution_id", "reason": "Attribution tracking" },
+    { "name": "attribution_type", "reason": "Attribution tracking" },
+    { "name": "resource", "reason": "WebFinger resource lookup" },
+    { "name": "sr_id", "reason": "Signup redirect tracking" },
+    { "name": "member_status", "reason": "Testing card and paywall content visibility" },
+    {
+      "name": "member_tier",
+      "reason": "Previewing card and paywall visibility for a specific tier"
+    },
+    { "name": "otc_verification", "reason": "One-time codes in member sign-ins" },
+    { "name": "admin", "reason": "Admin toolbar activation" },
+    { "name": "admin_toolbar", "reason": "Admin toolbar suppression" },
+    { "name": "gift", "reason": "Gift-link unlock token on canonical post URLs" },
+    { "name": "step", "reason": "Automations analytics" }
+  ],
+  "contentApi": [
+    { "name": "absolute_urls", "reason": "Converts relative URLs to absolute URLs" },
+    { "name": "collection", "reason": "Filters resources by collection" },
+    { "name": "debug", "reason": "Enables debug mode where available" },
+    { "name": "fields", "reason": "Limits returned fields" },
+    { "name": "filter", "reason": "Filters resources using NQL" },
+    { "name": "formats", "reason": "Selects content formats" },
+    { "name": "include", "reason": "Includes related resources" },
+    { "name": "key", "reason": "Content API authentication key" },
+    { "name": "limit", "reason": "Number of resources per page" },
+    { "name": "order", "reason": "Sort order" },
+    { "name": "page", "reason": "Page number for paginated results" }
+  ]
+}

package/core/server/web/query-parameter-policy/schema.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseQueryParameterPolicy = parseQueryParameterPolicy;
+const zod_1 = require("zod");
+const ALLOWED_NAME_CHARACTERS = /^[A-Za-z_-]+$/;
+const QueryParameterPolicyEntrySchema = zod_1.z.object({
+    name: zod_1.z
+        .string()
+        .min(1, { error: 'Parameter names must be nonempty.' })
+        .regex(ALLOWED_NAME_CHARACTERS, {
+        error: 'Parameter names must only contain letters, underscores, and hyphens.',
+    }),
+    reason: zod_1.z
+        .string()
+        .refine((reason) => reason.trim().length > 0, { error: 'Parameter reasons must be nonempty.' }),
+});
+const QueryParameterListSchema = zod_1.z
+    .array(QueryParameterPolicyEntrySchema)
+    .superRefine((entries, context) => {
+    const names = new Set();
+    for (const entry of entries) {
+        if (names.has(entry.name)) {
+            context.addIssue({
+                code: 'custom',
+                message: `Duplicate parameter name "${entry.name}".`,
+            });
+        }
+        names.add(entry.name);
+    }
+});
+const QueryParameterPolicySchema = zod_1.z.object({
+    schemaVersion: zod_1.z.literal(1, { error: 'Unsupported schema version; expected 1.' }),
+    public: QueryParameterListSchema,
+    contentApi: QueryParameterListSchema,
+});
+function parseQueryParameterPolicy(value) {
+    return QueryParameterPolicySchema.parse(value);
+}

package/core/shared/config/defaults.json

@@ -31,6 +31,9 @@
   },
   "useMinFiles": true,
   "verifyRequestIntegrity": true,
+  "queryParameterFiltering": {
+    "enabled": false
+  },
   "paths": {
     "contentPath": "content/",
     "fixtures": "core/server/data/schema/fixtures/fixtures",

package/core/shared/config/env/config.testing-mysql.json

@@ -11,7 +11,7 @@
     "connection": {
       "host": "127.0.0.1",
       "user": "root",
-      "password": "",
+      "password": "root",
       "database": "ghost_testing"
     }
   },
@@ -19,6 +19,9 @@
     "level": "error",
     "logClientErrorsAsError": false
   },
+  "queryParameterFiltering": {
+    "enabled": true
+  },
   "adapters": {
     "Redis": {
       "host": "127.0.0.1",

package/core/shared/config/env/config.testing.json

@@ -15,6 +15,9 @@
     "level": "error",
     "logClientErrorsAsError": false
   },
+  "queryParameterFiltering": {
+    "enabled": true
+  },
   "adapters": {
     "Redis": {
       "host": "127.0.0.1",

package/core/shared/config/overrides.json

@@ -28,12 +28,14 @@
       ]
     },
     "posts": {
-      "extensions": [".csv"],
+      "extensions": [".csv", ".zip"],
       "contentTypes": [
         "text/csv",
         "application/csv",
         "application/octet-stream",
-        "application/vnd.ms-excel"
+        "application/vnd.ms-excel",
+        "application/zip",
+        "application/x-zip-compressed"
       ]
     },
     "images": {

package/core/shared/labs.js

@@ -27,7 +27,7 @@ const messages = {
 };
 
 // flags in this list always return `true`, allows quick global enable prior to full flag removal
-const GA_FEATURES = ['automationAnalytics'];
+const GA_FEATURES = ['automationAnalytics', 'giftSubCustomization', 'tagDetailsReact'];
 
 // These features are considered publicly available and can be enabled/disabled by users
 const PUBLIC_BETA_FEATURES = [
@@ -46,17 +46,19 @@ const PRIVATE_FEATURES = [
   'importMemberTier',
   'csvContentImporter',
   'adminUIRefresh',
+  'admin7PageChrome',
   'tagsX',
   'emailUniqueid',
   'themeTranslation',
   'pictureImageFormats',
   'getHelperDeduplication',
   'membersCustomFields',
+  'stripeCheckoutCollection',
+  'membersImportRedesign',
   'paywallImprovements',
-  'giftSubCustomization',
-  'tagDetailsReact',
   'selfServeArchives',
   'machinePayments',
+  'postsListReact',
 ];
 
 module.exports.GA_KEYS = [...GA_FEATURES];
@@ -107,13 +109,9 @@ module.exports.isSet = function isSet(flag) {
  * @param {string} options.flagKey the internal lookup key of the flag e.g. labs.isSet(matchHelper)
  * @param {string} options.flagName the user-facing name of the flag e.g. Match helper
  * @param {string} options.helperName Name of the helper to be enabled/disabled
- * @param {string} [options.errorMessage] Optional replacement error message
- * @param {string} [options.errorContext] Optional replacement context message
- * @param {string} [options.errorHelp] Optional replacement help message
  * @param {string} [options.helpUrl] Url to show in the help message
- * @param {string} [options.async] is the helper async?
  * @param {function} callback
- * @returns {Promise<Handlebars.SafeString>|Handlebars.SafeString}
+ * @returns {Handlebars.SafeString}
  */
 module.exports.enabledHelper = function enabledHelper(options, callback) {
   const errDetails = {};
@@ -125,14 +123,14 @@ module.exports.enabledHelper = function enabledHelper(options, callback) {
   }
 
   // Else, the helper is not active and we need to handle this as an error
-  errDetails.message = tpl(options.errorMessage || messages.errorMessage, {
+  errDetails.message = tpl(messages.errorMessage, {
     helperName: options.helperName,
   });
-  errDetails.context = tpl(options.errorContext || messages.errorContext, {
+  errDetails.context = tpl(messages.errorContext, {
     helperName: options.helperName,
     flagName: options.flagName,
   });
-  errDetails.help = tpl(options.errorHelp || messages.errorHelp, { url: options.helpUrl });
+  errDetails.help = tpl(messages.errorHelp, { url: options.helpUrl });
 
   logging.error(
     new errors.DisabledFeatureError({
@@ -147,10 +145,6 @@ module.exports.enabledHelper = function enabledHelper(options, callback) {
     `<script>console.error("${_.values(errDetails).join(' ')}");</script>`,
   );
 
-  if (options.async) {
-    return Promise.resolve(errString);
-  }
-
   return errString;
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ghost",
-  "version": "6.60.0",
+  "version": "6.62.0",
   "description": "The professional publishing platform",
   "keywords": [
     "blog",
@@ -50,11 +50,20 @@
     "@isaacs/ttlcache": "1.4.1",
     "@sentry/node": "7.120.4",
     "@slack/webhook": "7.1.0",
+    "@tryghost/adapter-base-cache": "file:components/tryghost-adapter-base-cache-0.2.0.tgz",
+    "@tryghost/adapter-base-jobs": "file:components/tryghost-adapter-base-jobs-0.0.0.tgz",
+    "@tryghost/adapter-base-redirects": "file:components/tryghost-adapter-base-redirects-0.0.0.tgz",
+    "@tryghost/adapter-base-route-settings": "file:components/tryghost-adapter-base-route-settings-0.0.0.tgz",
+    "@tryghost/adapter-base-scheduling": "file:components/tryghost-adapter-base-scheduling-0.2.3.tgz",
+    "@tryghost/adapter-base-sso": "file:components/tryghost-adapter-base-sso-0.1.3.tgz",
+    "@tryghost/admin-api-schema": "file:components/tryghost-admin-api-schema-0.0.0.tgz",
     "@tryghost/api-framework": "3.3.9",
     "@tryghost/bookshelf-plugins": "2.3.8",
     "@tryghost/brute-knex": "3.2.2",
+    "@tryghost/checkout": "file:components/tryghost-checkout-0.0.0.tgz",
     "@tryghost/color-utils": "0.2.20",
     "@tryghost/config-url-helpers": "1.0.27",
+    "@tryghost/custom-field-types": "file:components/tryghost-custom-field-types-0.0.0.tgz",
     "@tryghost/custom-fonts": "1.0.11",
     "@tryghost/database-info": "2.3.2",
     "@tryghost/debug": "2.3.9",
@@ -63,8 +72,16 @@
     "@tryghost/errors": "3.3.9",
     "@tryghost/helpers": "1.1.106",
     "@tryghost/html-to-plaintext": "1.0.11",
+    "@tryghost/i18n": "file:components/tryghost-i18n-0.0.0.tgz",
     "@tryghost/image-transform": "1.4.17",
     "@tryghost/job-manager": "1.0.9",
+    "@tryghost/kg-card-factory": "file:components/tryghost-kg-card-factory-5.2.4.tgz",
+    "@tryghost/kg-converters": "file:components/tryghost-kg-converters-1.2.5.tgz",
+    "@tryghost/kg-default-cards": "file:components/tryghost-kg-default-cards-10.3.5.tgz",
+    "@tryghost/kg-default-nodes": "file:components/tryghost-kg-default-nodes-2.2.1.tgz",
+    "@tryghost/kg-html-to-lexical": "file:components/tryghost-kg-html-to-lexical-1.4.0.tgz",
+    "@tryghost/kg-lexical-html-renderer": "file:components/tryghost-kg-lexical-html-renderer-1.5.0.tgz",
+    "@tryghost/kg-markdown-html-renderer": "file:components/tryghost-kg-markdown-html-renderer-7.2.4.tgz",
     "@tryghost/limit-service": "1.5.6",
     "@tryghost/logging": "5.4.0",
     "@tryghost/metrics": "3.5.0",
@@ -76,18 +93,19 @@
     "@tryghost/nodemailer": "2.3.1",
     "@tryghost/nql": "0.13.4",
     "@tryghost/nql-lang": "0.7.0",
+    "@tryghost/nql-string": "file:components/tryghost-nql-string-0.0.0.tgz",
+    "@tryghost/parse-email-address": "file:components/tryghost-parse-email-address-0.0.0.tgz",
     "@tryghost/pretty-cli": "3.3.2",
     "@tryghost/prometheus-metrics": "1.0.8",
-    "@tryghost/promise": "2.3.2",
     "@tryghost/referrer-parser": "0.1.21",
-    "@tryghost/request": "4.0.2",
+    "@tryghost/request": "4.0.3",
     "@tryghost/root-utils": "2.3.2",
     "@tryghost/security": "1.0.6",
     "@tryghost/social-urls": "0.1.63",
     "@tryghost/string": "0.3.5",
     "@tryghost/tpl": "2.3.9",
     "@tryghost/url-utils": "5.2.6",
-    "@tryghost/validator": "0.2.22",
+    "@tryghost/validator": "3.2.10",
     "@tryghost/version": "2.3.2",
     "@tryghost/zip": "3.5.1",
     "@x402/core": "2.12.0",
@@ -129,6 +147,7 @@
     "file-type": "21.3.4",
     "form-data": "4.0.6",
     "fs-extra": "11.3.6",
+    "ghost-storage-base": "file:components/ghost-storage-base-3.0.0.tgz",
     "glob": "13.0.6",
     "got": "15.1.0",
     "gscan": "6.4.2",
@@ -194,26 +213,7 @@
     "ua-parser-js": "1.0.41",
     "unidecode": "1.1.0",
     "xml": "1.0.1",
-    "zod": "4.4.3",
-    "@tryghost/adapter-base-jobs": "file:components/tryghost-adapter-base-jobs-0.0.0.tgz",
-    "@tryghost/adapter-base-cache": "file:components/tryghost-adapter-base-cache-0.2.0.tgz",
-    "@tryghost/adapter-base-scheduling": "file:components/tryghost-adapter-base-scheduling-0.2.3.tgz",
-    "@tryghost/adapter-base-sso": "file:components/tryghost-adapter-base-sso-0.1.3.tgz",
-    "@tryghost/admin-api-schema": "file:components/tryghost-admin-api-schema-0.0.0.tgz",
-    "@tryghost/custom-field-types": "file:components/tryghost-custom-field-types-0.0.0.tgz",
-    "@tryghost/adapter-base-route-settings": "file:components/tryghost-adapter-base-route-settings-0.0.0.tgz",
-    "@tryghost/i18n": "file:components/tryghost-i18n-0.0.0.tgz",
-    "@tryghost/kg-card-factory": "file:components/tryghost-kg-card-factory-5.2.4.tgz",
-    "@tryghost/adapter-base-redirects": "file:components/tryghost-adapter-base-redirects-0.0.0.tgz",
-    "@tryghost/kg-converters": "file:components/tryghost-kg-converters-1.2.5.tgz",
-    "@tryghost/kg-default-cards": "file:components/tryghost-kg-default-cards-10.3.5.tgz",
-    "@tryghost/kg-html-to-lexical": "file:components/tryghost-kg-html-to-lexical-1.4.0.tgz",
-    "@tryghost/kg-lexical-html-renderer": "file:components/tryghost-kg-lexical-html-renderer-1.5.0.tgz",
-    "@tryghost/kg-markdown-html-renderer": "file:components/tryghost-kg-markdown-html-renderer-7.2.4.tgz",
-    "@tryghost/kg-default-nodes": "file:components/tryghost-kg-default-nodes-2.2.0.tgz",
-    "@tryghost/nql-string": "file:components/tryghost-nql-string-0.0.0.tgz",
-    "ghost-storage-base": "file:components/ghost-storage-base-3.0.0.tgz",
-    "@tryghost/parse-email-address": "file:components/tryghost-parse-email-address-0.0.0.tgz"
+    "zod": "4.4.3"
   },
   "optionalDependencies": {
     "better-sqlite3": "12.11.1"
@@ -226,5 +226,5 @@
     "node": "^22.23.1"
   },
   "scripts": {},
-  "packageManager": "pnpm@11.21.0+sha512.521705bce689924eac72f5a3587122f362689ef6571e55ba80076fd637c11132ecffada26fad4ea79c485bfddbfd3d5a2a5b05805a77e893de71ec8a6cca3bb1"
+  "packageManager": "pnpm@12.2.1+sha512.f55ca68aacb9eb5ab69c66f828a98af89a32286703aef1f8da131ca7eab4d677f34bfa85e186467a919c0799df8b6f4aa240f7dc2919b33b3273190104162616"
 }