ghost 6.63.0 → 6.64.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ghost",
-  "version": "6.63.0",
+  "version": "6.64.0",
   "description": "The professional publishing platform",
   "keywords": [
     "blog",
@@ -57,57 +57,57 @@
     "@tryghost/adapter-base-scheduling": "file:components/tryghost-adapter-base-scheduling-0.2.3.tgz",
     "@tryghost/adapter-base-sso": "file:components/tryghost-adapter-base-sso-0.1.3.tgz",
     "@tryghost/admin-api-schema": "file:components/tryghost-admin-api-schema-0.0.0.tgz",
-    "@tryghost/api-framework": "3.3.12",
-    "@tryghost/bookshelf-plugins": "2.3.12",
+    "@tryghost/api-framework": "file:components/tryghost-api-framework-0.0.0.tgz",
+    "@tryghost/bookshelf-plugins": "2.3.15",
     "@tryghost/brute-knex": "3.2.2",
     "@tryghost/checkout": "file:components/tryghost-checkout-0.0.0.tgz",
-    "@tryghost/color-utils": "0.2.20",
-    "@tryghost/config-url-helpers": "1.0.27",
-    "@tryghost/custom-fonts": "1.0.11",
-    "@tryghost/database-info": "2.3.12",
-    "@tryghost/debug": "2.3.12",
-    "@tryghost/domain-events": "3.3.13",
-    "@tryghost/email-mock-receiver": "2.3.12",
-    "@tryghost/errors": "3.3.12",
-    "@tryghost/helpers": "1.1.106",
-    "@tryghost/html-to-plaintext": "1.0.11",
+    "@tryghost/color-utils": "0.2.21",
+    "@tryghost/config-url-helpers": "1.0.28",
+    "@tryghost/custom-fonts": "1.0.12",
+    "@tryghost/database-info": "2.3.14",
+    "@tryghost/debug": "2.3.14",
+    "@tryghost/domain-events": "3.3.15",
+    "@tryghost/email-mock-receiver": "2.3.14",
+    "@tryghost/errors": "3.3.14",
+    "@tryghost/helpers": "1.1.107",
+    "@tryghost/html-to-plaintext": "1.0.12",
     "@tryghost/i18n": "file:components/tryghost-i18n-0.0.0.tgz",
-    "@tryghost/image-transform": "1.4.17",
+    "@tryghost/image-transform": "1.4.18",
     "@tryghost/job-manager": "1.0.9",
     "@tryghost/kg-card-factory": "file:components/tryghost-kg-card-factory-5.2.4.tgz",
     "@tryghost/kg-converters": "file:components/tryghost-kg-converters-1.2.5.tgz",
-    "@tryghost/kg-default-cards": "file:components/tryghost-kg-default-cards-10.3.5.tgz",
+    "@tryghost/kg-default-cards": "file:components/tryghost-kg-default-cards-10.3.6.tgz",
     "@tryghost/kg-default-nodes": "file:components/tryghost-kg-default-nodes-2.2.1.tgz",
     "@tryghost/kg-html-to-lexical": "file:components/tryghost-kg-html-to-lexical-1.4.0.tgz",
-    "@tryghost/kg-lexical-html-renderer": "file:components/tryghost-kg-lexical-html-renderer-1.5.0.tgz",
+    "@tryghost/kg-lexical-html-renderer": "file:components/tryghost-kg-lexical-html-renderer-1.5.1.tgz",
     "@tryghost/kg-markdown-html-renderer": "file:components/tryghost-kg-markdown-html-renderer-7.2.4.tgz",
     "@tryghost/limit-service": "file:components/tryghost-limit-service-0.0.0.tgz",
-    "@tryghost/logging": "5.4.3",
+    "@tryghost/logging": "5.4.5",
     "@tryghost/metafield-types": "file:components/tryghost-metafield-types-0.0.0.tgz",
-    "@tryghost/metrics": "3.5.3",
+    "@tryghost/metrics": "3.6.0",
     "@tryghost/mg-clean-html": "0.12.6",
     "@tryghost/mongo-knex": "0.11.2",
-    "@tryghost/mongo-utils": "0.6.5",
-    "@tryghost/mw-error-handler": "1.0.13",
-    "@tryghost/mw-vhost": "1.0.6",
-    "@tryghost/nodemailer": "2.3.12",
+    "@tryghost/mongo-utils": "0.6.6",
+    "@tryghost/mw-error-handler": "3.3.14",
+    "@tryghost/mw-vhost": "3.3.14",
+    "@tryghost/nodemailer": "2.3.14",
     "@tryghost/nql": "0.13.4",
     "@tryghost/nql-lang": "0.7.0",
     "@tryghost/nql-string": "file:components/tryghost-nql-string-0.0.0.tgz",
     "@tryghost/parse-email-address": "file:components/tryghost-parse-email-address-0.0.0.tgz",
-    "@tryghost/pretty-cli": "3.3.12",
-    "@tryghost/prometheus-metrics": "1.0.8",
-    "@tryghost/referrer-parser": "0.1.21",
-    "@tryghost/request": "4.0.5",
-    "@tryghost/root-utils": "2.3.12",
-    "@tryghost/security": "1.0.6",
-    "@tryghost/social-urls": "0.1.63",
-    "@tryghost/string": "0.3.5",
-    "@tryghost/tpl": "2.3.12",
-    "@tryghost/url-utils": "5.2.6",
-    "@tryghost/validator": "3.2.12",
-    "@tryghost/version": "2.3.12",
-    "@tryghost/zip": "3.5.11",
+    "@tryghost/pretty-cli": "3.3.14",
+    "@tryghost/prometheus-metrics": "5.0.0",
+    "@tryghost/referrer-parser": "0.1.22",
+    "@tryghost/request": "4.0.7",
+    "@tryghost/root-utils": "2.3.14",
+    "@tryghost/security": "3.3.14",
+    "@tryghost/social-urls": "0.1.64",
+    "@tryghost/string": "0.3.6",
+    "@tryghost/tpl": "2.3.14",
+    "@tryghost/url-utils": "5.3.0",
+    "@tryghost/validator": "3.2.14",
+    "@tryghost/version": "2.3.14",
+    "@tryghost/zip": "3.5.13",
     "@x402/core": "2.12.0",
     "@x402/evm": "2.12.0",
     "@x402/hono": "2.12.0",
@@ -120,7 +120,7 @@
     "cache-manager-ioredis": "2.1.0",
     "chalk": "4.1.2",
     "charset": "1.0.1",
-    "cheerio": "0.22.0",
+    "cheerio": "1.2.0",
     "clsx": "2.1.1",
     "common-tags": "1.8.2",
     "compression": "1.8.1",
@@ -149,22 +149,23 @@
     "fs-extra": "11.3.6",
     "ghost-storage-base": "file:components/ghost-storage-base-3.0.0.tgz",
     "glob": "13.0.6",
-    "got": "15.1.0",
-    "gscan": "6.4.2",
+    "got": "16.0.0",
+    "gscan": "6.6.1",
     "handlebars": "4.7.9",
     "heic-convert": "2.1.0",
     "hono": "4.12.18",
     "html-to-text": "5.1.1",
     "html5parser": "2.0.2",
     "human-number": "3.0.0",
-    "iconv-lite": "0.7.2",
+    "iconv-lite": "0.7.3",
     "image-size": "1.2.1",
     "intl-messageformat": "5.4.3",
+    "jose": "6.2.12",
     "js-yaml": "4.3.0",
     "jsdom": "30.0.1",
     "jsonc-parser": "3.3.1",
     "jsonwebtoken": "8.5.1",
-    "juice": "9.1.0",
+    "juice": "11.1.1",
     "knex": "2.4.2",
     "knex-migrator": "5.4.1",
     "leaky-bucket": "2.2.0",
@@ -190,7 +191,6 @@
     "mysql2": "3.22.5",
     "nconf": "0.13.0",
     "node-html-markdown": "2.0.0",
-    "node-jose": "2.2.0",
     "nodemailer": "8.0.11",
     "on-headers": "1.1.0",
     "otplib": "12.0.1",
@@ -199,7 +199,7 @@
     "probability-distributions": "0.9.1",
     "probe-image-size": "7.3.0",
     "rss": "1.2.2",
-    "sanitize-html": "2.17.5",
+    "sanitize-html": "2.17.7",
     "semver": "7.8.5",
     "sharp": "0.35.3",
     "simple-dom": "1.4.0",

package/patches/@elastic__elasticsearch@8.19.2.patch

@@ -0,0 +1,67 @@
+diff --git a/lib/helpers.d.ts b/lib/helpers.d.ts
+index f21dc11510a89c5844c6d630397e69a34481a5e8..7d65004a87f96cd47f970c1e71844633d9a8b485 100644
+--- a/lib/helpers.d.ts
++++ b/lib/helpers.d.ts
+@@ -1,6 +1,6 @@
+ import { Readable } from 'node:stream';
+ import { TransportResult, TransportRequestOptions } from '@elastic/transport';
+-import { Table, TypeMap, AsyncRecordBatchStreamReader } from 'apache-arrow/Arrow.node';
++import type { Table, TypeMap, AsyncRecordBatchStreamReader } from 'apache-arrow/Arrow.node';
+ import Client from './client';
+ import * as T from './api/types';
+ import { Id } from './api/types';
+diff --git a/lib/helpers.js b/lib/helpers.js
+index 340ffc5ad6cbc11b3dd1a8d45d1a3dee5829ff32..7400bc10c8499a04a4cd7fa1c96454db67453aee 100644
+--- a/lib/helpers.js
++++ b/lib/helpers.js
+@@ -27,7 +27,19 @@ const node_assert_1 = tslib_1.__importDefault(require("node:assert"));
+ const timersPromises = tslib_1.__importStar(require("node:timers/promises"));
+ const node_stream_1 = require("node:stream");
+ const transport_1 = require("@elastic/transport");
+-const Arrow_node_1 = require("apache-arrow/Arrow.node");
++// Ghost patch: only the two ES|QL helpers below use apache-arrow, and nothing in
++// Ghost calls them - this eager require cost 145 modules / ~3.3MB RSS in every
++// process using the Elasticsearch log transport. 9.x defers it the same way.
++// .pnpmfile.mjs drops the dependency, so the require really can fail here.
++function loadArrow() {
++    try {
++        return require("apache-arrow/Arrow.node");
++    }
++    catch {
++        throw new Error('Package "apache-arrow" is required for Arrow functionality. ' +
++            'Install it with: npm install apache-arrow');
++    }
++}
+ const { ResponseError, ConfigurationError } = transport_1.errors;
+ const sleep = timersPromises.setTimeout;
+ const pImmediate = timersPromises.setImmediate;
+@@ -831,6 +843,7 @@ class Helpers {
+             },
+             async toArrowTable() {
+                 var _d;
++                const { tableFromIPC } = loadArrow();
+                 if (metaHeader !== null) {
+                     reqOptions.headers = (_d = reqOptions.headers) !== null && _d !== void 0 ? _d : {};
+                     reqOptions.headers['x-elastic-client-meta'] = `${metaHeader},h=qa`;
+@@ -838,10 +851,11 @@ class Helpers {
+                 params.format = 'arrow';
+                 // @ts-expect-error the return type will be ArrayBuffer when the format is set to 'arrow'
+                 const response = await client.esql.query(params, reqOptions);
+-                return (0, Arrow_node_1.tableFromIPC)(response);
++                return tableFromIPC(response);
+             },
+             async toArrowReader() {
+                 var _d;
++                const { AsyncRecordBatchStreamReader } = loadArrow();
+                 if (metaHeader !== null) {
+                     reqOptions.headers = (_d = reqOptions.headers) !== null && _d !== void 0 ? _d : {};
+                     reqOptions.headers['x-elastic-client-meta'] = `${metaHeader},h=qa`;
+@@ -850,7 +864,7 @@ class Helpers {
+                 params.format = 'arrow';
+                 // @ts-expect-error response is a Readable when asStream is true
+                 const response = await client.esql.query(params, reqOptions);
+-                return await Arrow_node_1.AsyncRecordBatchStreamReader.from(node_stream_1.Readable.from(response));
++                return await AsyncRecordBatchStreamReader.from(node_stream_1.Readable.from(response));
+             }
+         };
+         return helper;

package/patches/juice@11.1.1.patch

@@ -0,0 +1,46 @@
+diff --git a/lib/cheerio.js b/lib/cheerio.js
+index 809e0ac78bc01a98675b43a771140e9f35cd4c71..23c565ad94ec15dd2e7f8e605b1bb849ef6769bd 100644
+--- a/lib/cheerio.js
++++ b/lib/cheerio.js
+@@ -3,7 +3,11 @@
+ /**
+  * Module dependencies.
+  */
+-var cheerio = require('cheerio');
++// Ghost patch: cheerio's main entry eagerly loads parse5, undici and the whatwg
++// encoding stack (~20MB RSS per process) none of which juice uses - the `xml`
++// option below sets _useHtmlParser2, so parsing goes through htmlparser2 either
++// way. cheerio/slim is that same htmlparser2 path without the unused baggage.
++var cheerio = require('cheerio/slim');
+ var utils = require('./utils');
+ 
+ var cheerioLoad = function(html, options, encodeEntities) {
+diff --git a/lib/inline.js b/lib/inline.js
+index 083b8c58eb90184d0190cd0e3361a39638e4981b..492d0230dd2a3ee179359e3027f73cc7257023fe 100644
+--- a/lib/inline.js
++++ b/lib/inline.js
+@@ -117,7 +117,12 @@ module.exports = function makeJuiceClient(juiceClient) {
+               ? decode(styleAttributeValue)
+               : styleAttributeValue;
+             var cssText = '* { ' + cssStyleAttributeValue + ' } ';
+-            addProps(utils.parseCSS(cssText)[0][1], new utils.Selector('<style>', true));
++            // Ghost patch: parseCSS drops rules with no declarations, so a style
++            // attribute with none (e.g. `style=";"`) has no rule to read
++            var styleAttributeRule = utils.parseCSS(cssText)[0];
++            if (styleAttributeRule) {
++              addProps(styleAttributeRule[1], new utils.Selector('<style>', true));
++            }
+           }
+ 
+           // store reference to an element we need to compile style="" attr for
+@@ -158,7 +163,9 @@ module.exports = function makeJuiceClient(juiceClient) {
+         // go through the properties
+         function addProps(style, selector) {
+           for (var i = 0, l = style.length; i < l; i++) {
+-            if (style[i].type == 'property') {
++            // Ghost patch: mensch parses input like `a{b}` into a property with no
++            // value, which would throw on value.match below
++            if (style[i].type == 'property' && typeof style[i].value === 'string') {
+               var name = style[i].name;
+               var value = style[i].value;
+