ghost 6.63.0 → 6.65.0

package/core/server/data/tinybird/fixtures/automation_run_events.ndjson

@@ -0,0 +1,7 @@
+{"site_uuid":"bd05ceed-1df9-4af7-832a-d3b5faa7ca1d","id":"run-0","updated_at":"2020-01-01T01:00:00.000Z","inserted_at":"2020-01-01T02:00:00.000Z","payload":{"site_uuid":"bd05ceed-1df9-4af7-832a-d3b5faa7ca1d","id":"run-0","automation_id":"automation-1","created_at":"2020-01-01T01:00:00.000Z","updated_at":"2020-01-01T01:00:00.000Z"}}
+{"site_uuid":"bd05ceed-1df9-4af7-832a-d3b5faa7ca1d","id":"run-1","updated_at":"2020-01-01T01:00:00.000Z","inserted_at":"2020-01-01T02:00:00.000Z","payload":{"site_uuid":"bd05ceed-1df9-4af7-832a-d3b5faa7ca1d","id":"run-1","automation_id":"automation-1","created_at":"2020-01-01T01:00:00.000Z","updated_at":"2020-01-01T01:00:00.000Z"}}
+{"site_uuid":"bd05ceed-1df9-4af7-832a-d3b5faa7ca1d","id":"run-2","updated_at":"2020-01-01T01:00:00.000Z","inserted_at":"2020-01-01T02:00:00.000Z","payload":{"site_uuid":"bd05ceed-1df9-4af7-832a-d3b5faa7ca1d","id":"run-2","automation_id":"automation-1","created_at":"2020-01-01T01:00:00.000Z","updated_at":"2020-01-01T01:00:00.000Z"}}
+{"site_uuid":"bd05ceed-1df9-4af7-832a-d3b5faa7ca1d","id":"run-3","updated_at":"2020-02-01T01:00:00.000Z","inserted_at":"2020-02-01T02:00:00.000Z","payload":{"site_uuid":"bd05ceed-1df9-4af7-832a-d3b5faa7ca1d","id":"run-3","automation_id":"automation-1","created_at":"2020-02-01T01:00:00.123Z","updated_at":"2020-02-01T01:00:00.000Z"}}
+{"site_uuid":"bd05ceed-1df9-4af7-832a-d3b5faa7ca1d","id":"run-3","updated_at":"2020-01-01T01:00:00.000Z","inserted_at":"2020-02-01T03:00:00.000Z","payload":{"site_uuid":"bd05ceed-1df9-4af7-832a-d3b5faa7ca1d","id":"run-3","automation_id":"automation-1","created_at":"2029-12-31T01:00:00.000Z","updated_at":"2020-01-01T01:00:00.000Z"}}
+{"site_uuid":"bd05ceed-1df9-4af7-832a-d3b5faa7ca1d","id":"run-4","updated_at":"2020-01-01T01:00:00.000Z","inserted_at":"2020-01-01T02:00:00.000Z","payload":{"site_uuid":"bd05ceed-1df9-4af7-832a-d3b5faa7ca1d","id":"run-4","automation_id":"automation-2","created_at":"2020-01-01T01:00:00.000Z","updated_at":"2020-01-01T01:00:00.000Z"}}
+{"site_uuid":"6cce57c1-c0df-4771-bb86-53cbf494f90f","id":"run-1","updated_at":"2020-01-01T01:00:00.000Z","inserted_at":"2020-01-01T02:00:00.000Z","payload":{"site_uuid":"6cce57c1-c0df-4771-bb86-53cbf494f90f","id":"run-1","automation_id":"automation-1","created_at":"2020-01-01T01:00:00.000Z","updated_at":"2020-01-01T01:00:00.000Z"}}

package/core/server/data/tinybird/fixtures/automation_run_step_events.ndjson

@@ -0,0 +1,8 @@
+{"site_uuid":"bd05ceed-1df9-4af7-832a-d3b5faa7ca1d","id":"step-1","updated_at":"2020-01-01T01:00:00.000Z","inserted_at":"2020-01-01T02:00:00.000Z","payload":{"site_uuid":"bd05ceed-1df9-4af7-832a-d3b5faa7ca1d","id":"step-1","automation_run_id":"run-1","status":"pending","updated_at":"2020-01-01T01:00:00.000Z"}}
+{"site_uuid":"bd05ceed-1df9-4af7-832a-d3b5faa7ca1d","id":"step-1","updated_at":"2020-01-01T03:00:00.000Z","inserted_at":"2020-01-01T04:00:00.000Z","payload":{"site_uuid":"bd05ceed-1df9-4af7-832a-d3b5faa7ca1d","id":"step-1","automation_run_id":"run-1","status":"finished","updated_at":"2020-01-01T03:00:00.000Z"}}
+{"site_uuid":"bd05ceed-1df9-4af7-832a-d3b5faa7ca1d","id":"step-2","updated_at":"2020-01-01T05:00:00.000Z","inserted_at":"2020-01-01T06:00:00.000Z","payload":{"site_uuid":"bd05ceed-1df9-4af7-832a-d3b5faa7ca1d","id":"step-2","automation_run_id":"run-1","status":"pending","updated_at":"2020-01-01T05:00:00.000Z"}}
+{"site_uuid":"bd05ceed-1df9-4af7-832a-d3b5faa7ca1d","id":"step-2","updated_at":"2020-01-01T07:00:00.000Z","inserted_at":"2020-01-01T08:00:00.000Z","payload":{"site_uuid":"bd05ceed-1df9-4af7-832a-d3b5faa7ca1d","id":"step-2","automation_run_id":"run-1","status":"pending","updated_at":"2020-01-01T07:00:00.000Z"}}
+{"site_uuid":"bd05ceed-1df9-4af7-832a-d3b5faa7ca1d","id":"step-3","updated_at":"2020-01-01T01:00:00.000Z","inserted_at":"2020-01-01T02:00:00.000Z","payload":{"site_uuid":"bd05ceed-1df9-4af7-832a-d3b5faa7ca1d","id":"step-3","automation_run_id":"run-2","status":"pending","updated_at":"2020-01-01T01:00:00.000Z"}}
+{"site_uuid":"bd05ceed-1df9-4af7-832a-d3b5faa7ca1d","id":"step-3","updated_at":"2020-01-01T03:00:00.000Z","inserted_at":"2020-01-01T04:00:00.000Z","payload":{"site_uuid":"bd05ceed-1df9-4af7-832a-d3b5faa7ca1d","id":"step-3","automation_run_id":"run-2","status":"finished","updated_at":"2020-01-01T03:00:00.000Z"}}
+{"site_uuid":"bd05ceed-1df9-4af7-832a-d3b5faa7ca1d","id":"step-4","updated_at":"2020-01-01T05:00:00.000Z","inserted_at":"2020-01-01T06:00:00.000Z","payload":{"site_uuid":"bd05ceed-1df9-4af7-832a-d3b5faa7ca1d","id":"step-4","automation_run_id":"run-2","status":"pending","updated_at":"2020-01-01T05:00:00.000Z"}}
+{"site_uuid":"bd05ceed-1df9-4af7-832a-d3b5faa7ca1d","id":"step-4","updated_at":"2020-01-01T07:00:00.000Z","inserted_at":"2020-01-01T08:00:00.000Z","payload":{"site_uuid":"bd05ceed-1df9-4af7-832a-d3b5faa7ca1d","id":"step-4","automation_run_id":"run-2","status":"pending","updated_at":"2020-01-01T07:00:00.000Z"}}

package/core/server/data/tinybird/pipes/mv_automation_run_steps.pipe

@@ -0,0 +1,13 @@
+NODE extract_automation_run_steps
+SQL >
+    WITH JSONExtract(payload, 'Tuple(automation_run_id String, status String)') AS payload_json
+    SELECT
+        site_uuid,
+        id,
+        updated_at,
+        getSubcolumn(payload_json, 'automation_run_id') AS automation_run_id,
+        getSubcolumn(payload_json, 'status') AS status
+    FROM automation_run_step_events
+
+TYPE MATERIALIZED
+DATASOURCE _mv_automation_run_steps

package/core/server/data/tinybird/pipes/mv_automation_runs.pipe

@@ -0,0 +1,15 @@
+NODE extract_automation_runs
+SQL >
+    WITH JSONExtract(payload, 'Tuple(automation_id String, created_at String)') AS payload_json
+    SELECT
+        site_uuid,
+        id,
+        updated_at,
+        getSubcolumn(payload_json, 'automation_id') AS automation_id,
+        parseDateTime64BestEffort(
+            getSubcolumn(payload_json, 'created_at'), 3, 'UTC'
+        ) AS created_at
+    FROM automation_run_events
+
+TYPE MATERIALIZED
+DATASOURCE _mv_automation_runs

package/core/server/data/tinybird/pipes/mv_hits.pipe

@@ -2,6 +2,11 @@ TOKEN "axis" READ
 
 NODE mv_hits_0
 SQL >
+    WITH
+        JSONExtract(
+            payload,
+            'Tuple(meta Tuple(received_timestamp String, referrerSource String), locale String, location String, referrerSource String, pathname String, href String, member_uuid String, member_status String, post_uuid String, post_type String, gift_link String, `user-agent` String, device String, utm_source String, utm_medium String, utm_campaign String, utm_term String, utm_content String)'
+        ) AS payload_json
     SELECT
         timestamp,
         inserted_at,
@@ -9,33 +14,33 @@ SQL >
         -- Nullable fields incur performance penalty in clickhouse, so we default to zero (unix epoch)
         -- instead of null.
         parseDateTime64BestEffortOrZero(
-            JSONExtractString(payload, 'meta', 'received_timestamp'), 3
+            getSubcolumn(payload_json, 'meta.received_timestamp'), 3
         ) as received_at,
         action,
         version,
         coalesce(session_id, '0') as session_id,
-        JSONExtractString(payload, 'locale') as locale,
-        JSONExtractString(payload, 'location') as location,
+        getSubcolumn(payload_json, 'locale') as locale,
+        getSubcolumn(payload_json, 'location') as location,
         case
-            when JSONExtractString(payload, 'referrerSource') = ''
-            then JSONExtractString(payload, 'meta', 'referrerSource')
-            else JSONExtractString(payload, 'referrerSource')
+            when getSubcolumn(payload_json, 'referrerSource') = ''
+            then getSubcolumn(payload_json, 'meta.referrerSource')
+            else getSubcolumn(payload_json, 'referrerSource')
         end as referrer,
-        JSONExtractString(payload, 'pathname') as pathname,
-        JSONExtractString(payload, 'href') as href,
+        getSubcolumn(payload_json, 'pathname') as pathname,
+        getSubcolumn(payload_json, 'href') as href,
         site_uuid,
-        JSONExtractString(payload, 'member_uuid') as member_uuid,
-        JSONExtractString(payload, 'member_status') as member_status,
-        JSONExtractString(payload, 'post_uuid') as post_uuid,
-        JSONExtractString(payload, 'post_type') as post_type,
-        JSONExtractString(payload, 'gift_link') as gift_link,
-        lower(JSONExtractString(payload, 'user-agent')) as user_agent,
-        JSONExtractString(payload, 'device') as device,
-        JSONExtractString(payload, 'utm_source') as utm_source,
-        JSONExtractString(payload, 'utm_medium') as utm_medium,
-        JSONExtractString(payload, 'utm_campaign') as utm_campaign,
-        JSONExtractString(payload, 'utm_term') as utm_term,
-        JSONExtractString(payload, 'utm_content') as utm_content
+        getSubcolumn(payload_json, 'member_uuid') as member_uuid,
+        getSubcolumn(payload_json, 'member_status') as member_status,
+        getSubcolumn(payload_json, 'post_uuid') as post_uuid,
+        getSubcolumn(payload_json, 'post_type') as post_type,
+        getSubcolumn(payload_json, 'gift_link') as gift_link,
+        lower(getSubcolumn(payload_json, 'user-agent')) as user_agent,
+        getSubcolumn(payload_json, 'device') as device,
+        getSubcolumn(payload_json, 'utm_source') as utm_source,
+        getSubcolumn(payload_json, 'utm_medium') as utm_medium,
+        getSubcolumn(payload_json, 'utm_campaign') as utm_campaign,
+        getSubcolumn(payload_json, 'utm_term') as utm_term,
+        getSubcolumn(payload_json, 'utm_content') as utm_content
     FROM analytics_events
     where action = 'page_hit'
 

package/core/server/data/tinybird/pipes/mv_pending_automation_runs.pipe

@@ -0,0 +1,7 @@
+NODE extract_pending_automation_runs
+SQL >
+    SELECT site_uuid, id, automation_run_id, status = 'pending' AS is_pending, updated_at
+    FROM _mv_automation_run_steps
+
+TYPE MATERIALIZED
+DATASOURCE _mv_pending_automation_runs

package/core/server/data/tinybird/scripts/docker-analytics-manager.js

@@ -361,7 +361,7 @@ class DockerAnalyticsManager {
 
     const userSessionData = this.userSessions.get(userKey);
 
-    for (let session of userSessionData) {
+    for (const session of userSessionData) {
       const timeDiff = (timestamp.getTime() - session.startTime.getTime()) / (1000 * 60 * 60);
       if (timeDiff <= 3 && timeDiff >= 0) {
         return session.sessionId;
@@ -571,7 +571,7 @@ class DockerAnalyticsManager {
 
     // Generate base timestamp for this session
     const firstContent = this.selectContent();
-    let baseTimestamp = this.generateTimestamp(firstContent.published_at);
+    const baseTimestamp = this.generateTimestamp(firstContent.published_at);
 
     // Generate consistent session attributes
     const memberStatus = this.weightedChoice(this.memberStatusWeights);

package/core/server/data/tinybird/tests/api_automation_browse_stats.yaml

@@ -0,0 +1,18 @@
+- name: automation_browse_stats
+  description: Uses latest run and step versions for automation browse statistics
+  parameters: site_uuid=bd05ceed-1df9-4af7-832a-d3b5faa7ca1d
+  expected_result: |
+    {"automation_id":"automation-1","last_run_created_at":"2020-02-01T01:00:00.123Z","total_run_count":4,"in_progress_run_count":2}
+    {"automation_id":"automation-2","last_run_created_at":"2020-01-01T01:00:00.000Z","total_run_count":1,"in_progress_run_count":0}
+
+- name: automation_browse_stats_other_site
+  description: Restricts statistics to one site
+  parameters: site_uuid=6cce57c1-c0df-4771-bb86-53cbf494f90f
+  expected_result: |
+    {"automation_id":"automation-1","last_run_created_at":"2020-01-01T01:00:00.000Z","total_run_count":1,"in_progress_run_count":0}
+
+- name: automation_browse_stats_missing_site_uuid
+  description: Requires site UUID
+  expected_http_status: 400
+  parameters: ''
+  expected_result: ''

package/core/server/ghost-server.js

@@ -14,7 +14,7 @@ const metrics_1 = __importDefault(require("@tryghost/metrics"));
 // @ts-expect-error This module lacks type definitions.
 const notify_1 = __importDefault(require("./notify"));
 const errify_1 = require("../shared/errify");
-const flush_logs_1 = require("../shared/flush-logs");
+const flush_1 = require("../shared/flush");
 const moment_1 = __importDefault(require("moment"));
 const stoppable_1 = __importDefault(require("stoppable"));
 const node_util_1 = require("node:util");
@@ -75,7 +75,7 @@ class GhostServer {
     start(rootApp) {
         debug('Starting...');
         this.rootApp = rootApp;
-        const { host, port, testmode, shutdownTimeout } = this.serverConfig;
+        const { host, port, shutdownTimeout } = this.serverConfig;
         return new Promise((resolve, reject) => {
             const httpServer = rootApp.listen(port, host);
             httpServer.on('error', (error) => {
@@ -104,10 +104,6 @@ class GhostServer {
             httpServer.on('listening', () => {
                 debug('...Started');
                 this._logStartMessages();
-                // Debug logs output in testmode only
-                if (testmode) {
-                    this._startTestMode();
-                }
                 debug('Notifying server ready (success)');
                 return notify_1.default.notifyServerStarted().finally(() => {
                     resolve(this);
@@ -137,12 +133,12 @@ class GhostServer {
             this.isShuttingDown = true;
             logging_1.default.warn((0, tpl_1.default)(messages.ghostIsShuttingDown));
             await this.stop();
-            await (0, flush_logs_1.flushLogs)();
+            await (0, flush_1.flushLogsAndMetrics)();
             process.exit(code);
         }
         catch (error) {
             logging_1.default.error(error);
-            await (0, flush_logs_1.flushLogs)();
+            await (0, flush_1.flushLogsAndMetrics)();
             process.exit(1);
         }
     }
@@ -273,20 +269,6 @@ class GhostServer {
             });
         }
     }
-    /**
-     * Internal Method for TestMode.
-     */
-    _startTestMode() {
-        // Output how many connections are open every 5 seconds
-        const connectionInterval = setInterval(() => this.httpServer?.getConnections((_err, connections) => logging_1.default.warn(`${connections} connections currently open`)), 5000);
-        // Output a notice when the server closes
-        const { httpServer } = this;
-        (0, node_assert_1.default)(httpServer, 'httpServer must be set before starting test mode');
-        httpServer.on('close', function () {
-            clearInterval(connectionInterval);
-            logging_1.default.warn('Server has fully closed');
-        });
-    }
     /**
      * Log Start Messages
      */

package/core/server/lib/generate-password.js

@@ -0,0 +1,54 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generatePassword = void 0;
+const errors = __importStar(require("@tryghost/errors"));
+// @ts-expect-error This module lacks type definitions.
+const security = __importStar(require("@tryghost/security"));
+const validate_password_1 = require("./validate-password");
+const generatePassword = (email) => {
+    for (let i = 0; i < 1000; i++) {
+        // secretlint-disable-next-line @secretlint/secretlint-rule-pattern
+        const password = security.identifier.uid(50);
+        if ((0, validate_password_1.validatePassword)(password, email).isValid) {
+            return password;
+        }
+    }
+    throw new errors.InternalServerError({
+        message: 'Unable to generate a valid password after 1000 iterations',
+        context: 'generatePassword',
+    });
+};
+exports.generatePassword = generatePassword;

package/core/server/lib/image/image-size.js

@@ -273,12 +273,10 @@ class ImageSize {
    * @returns {object} imageObject or error
    */
   getImageSizeFromStoragePath(imagePath) {
-    let filePath;
-
     imagePath = this.urlUtils.urlFor('image', { image: imagePath }, true);
 
     // get the storage readable filePath
-    filePath = this.storageUtils.getLocalImagesStoragePath(imagePath);
+    const filePath = this.storageUtils.getLocalImagesStoragePath(imagePath);
 
     return this.imageStore
       .read({ path: filePath })

package/core/server/lib/public-jwk.js

@@ -0,0 +1,77 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getPublicKeyInfo = getPublicKeyInfo;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const errors = __importStar(require("@tryghost/errors"));
+// Parsing a PEM and thumbprinting it costs real CPU, so results are shared
+// across every consumer of the same key. Keyed by digest so the cache never
+// holds another reference to private key material.
+const cache = new Map();
+async function parse(privateKeyPem) {
+    // jose 6 is ESM-only. tsc emits this as `require('jose')` under module: commonjs,
+    // which resolves via Node's require(esm) - available on every Node in `engines`.
+    const { calculateJwkThumbprint } = await Promise.resolve().then(() => __importStar(require('jose')));
+    // Node handles both PKCS#1 and PKCS#8 PEMs, and exports public fields only.
+    const publicKey = node_crypto_1.default.createPublicKey(node_crypto_1.default.createPrivateKey(privateKeyPem));
+    const { kty, n, e } = publicKey.export({ format: 'jwk' });
+    if (kty !== 'RSA' || !n || !e) {
+        throw new errors.IncorrectUsageError({
+            message: 'Expected an RSA private key',
+        });
+    }
+    const jwk = { kty, n, e };
+    return { kid: await calculateJwkThumbprint(jwk, 'sha256'), jwk };
+}
+/**
+ * Public JWK and `kid` for a PEM-encoded RSA private key. Never returns private
+ * parameters.
+ */
+function getPublicKeyInfo(privateKeyPem) {
+    const digest = node_crypto_1.default.createHash('sha256').update(privateKeyPem).digest('hex');
+    let info = cache.get(digest);
+    if (!info) {
+        info = parse(privateKeyPem).catch((err) => {
+            // Don't pin a failure forever - a later caller should retry.
+            cache.delete(digest);
+            throw err;
+        });
+        cache.set(digest, info);
+    }
+    return info;
+}

package/core/server/lib/request-external.js

@@ -12,6 +12,7 @@ const dnsPromises = require('dns').promises;
 const errors = require('@tryghost/errors');
 const config = require('../../shared/config');
 const validator = require('@tryghost/validator');
+const ipaddr = require('ipaddr.js');
 
 // Shared keep-alive agents so outbound HTTPS connections are pooled and reused
 // across page renders / oEmbed / webmention / recommendations / image probes.
@@ -44,70 +45,58 @@ function normalizeIPv4(addr) {
   return null;
 }
 
+const IPV4_COMPATIBLE = ipaddr.IPv6.parseCIDR('::/96');
+const NAT64_WELL_KNOWN = ipaddr.IPv6.parseCIDR('64:ff9b::/96');
+
 /**
- * Normalize an IPv6 address from any expanded form (e.g. 0:0:0:0:0:0:0:1)
- * to compressed notation (e.g. ::1) using the WHATWG URL parser.
- * Returns null if the address is not a valid IPv6 address.
+ * Build an IPv4 address from two 16-bit IPv6 groups.
+ *
+ * @param {number} hi
+ * @param {number} lo
+ * @returns {ipaddr.IPv4}
  */
-function normalizeIPv6(addr) {
-  try {
-    const hostname = new URL('http://[' + addr + ']/').hostname;
-    // hostname includes brackets, strip them
-    const normalized = hostname.slice(1, -1);
-    if (net.isIPv6(normalized)) {
-      return normalized;
-    }
-  } catch {
-    // URL parsing failed
-  }
-  return null;
+function ipv4FromGroups(hi, lo) {
+  return new ipaddr.IPv4([(hi >> 8) & 0xff, hi & 0xff, (lo >> 8) & 0xff, lo & 0xff]);
 }
 
 /**
- * Check if a normalized (dotted-decimal) IPv4 address falls in a private/reserved range.
+ * Default-deny: anything outside ipaddr.js's plain "unicast" range is private.
+ * IPv6 transition prefixes that route to an embedded IPv4 address are classified
+ * by that IPv4 address instead, so e.g. DNS64-synthesized addresses for public
+ * hosts are still allowed on NAT64 networks.
+ *
+ * @param {ipaddr.IPv4 | ipaddr.IPv6} address
+ * @returns {boolean}
  */
-function isPrivateIPv4(addr) {
-  const parts = addr.split('.');
-  const a = parseInt(parts[0], 10);
-  const b = parseInt(parts[1], 10);
+function isPrivateAddress(address) {
+  if (address instanceof ipaddr.IPv6) {
+    const parts = address.parts;
 
-  // 10.0.0.0/8
-  if (a === 10) {
-    return true;
-  }
-  // 172.16.0.0/12
-  if (a === 172 && b >= 16 && b <= 31) {
-    return true;
-  }
-  // 192.168.0.0/16
-  if (a === 192 && b === 168) {
-    return true;
-  }
-  // 127.0.0.0/8
-  if (a === 127) {
-    return true;
-  }
-  // 169.254.0.0/16
-  if (a === 169 && b === 254) {
-    return true;
-  }
-  // 100.64.0.0/10 (carrier-grade NAT, RFC 6598)
-  if (a === 100 && b >= 64 && b <= 127) {
-    return true;
-  }
-  // 198.18.0.0/15 (benchmarking, RFC 2544)
-  if (a === 198 && (b === 18 || b === 19)) {
-    return true;
-  }
-  // 0.0.0.0/8
-  if (a === 0) {
-    return true;
-  }
-  // 240.0.0.0/4 (reserved) and 255.255.255.255 (broadcast)
-  if (a >= 240) {
-    return true;
+    // ::/96 - unspecified, loopback and deprecated IPv4-compatible addresses (RFC 4291).
+    // ipaddr.js classifies IPv4-compatible addresses such as ::7f00:1 as unicast.
+    if (address.match(IPV4_COMPATIBLE)) {
+      return true;
+    }
+
+    switch (address.range()) {
+      // ::ffff:0:0/96 IPv4-mapped (RFC 4291) and ::ffff:0:0:0/96 IPv4-translated (RFC 6145)
+      case 'ipv4Mapped':
+      case 'rfc6145':
+        return isPrivateAddress(ipv4FromGroups(parts[6], parts[7]));
+      // 64:ff9b::/96 NAT64 well-known prefix (RFC 6052). The 64:ff9b:1::/48 local-use
+      // prefix (RFC 8215) has a network-specific IPv4 position, so it stays blocked.
+      case 'rfc6052':
+        if (address.match(NAT64_WELL_KNOWN)) {
+          return isPrivateAddress(ipv4FromGroups(parts[6], parts[7]));
+        }
+        return true;
+      // 2002::/16 6to4 (RFC 3056)
+      case '6to4':
+        return isPrivateAddress(ipv4FromGroups(parts[1], parts[2]));
+    }
   }
-  return false;
+
+  return address.range() !== 'unicast';
 }
 
 function isPrivateIp(addr) {
@@ -116,70 +105,17 @@ function isPrivateIp(addr) {
     return true;
   }
 
-  // Check for IPv4-mapped IPv6 in dotted notation (e.g. ::ffff:192.168.0.1)
-  const v4DottedMatch = addr.match(/^::ffff:(\d[\d.]+)$/i);
-  if (v4DottedMatch) {
-    const normalized = normalizeIPv4(v4DottedMatch[1]);
-    if (normalized) {
-      return isPrivateIPv4(normalized);
-    }
+  let address;
+  try {
+    // WHATWG normalization first so every IPv4 form Node will connect to
+    // (decimal, octal, hex, integer, shortened) is parsed the same way
+    address = ipaddr.parse(normalizeIPv4(addr) ?? addr);
+  } catch {
+    // Unrecognized format - fail closed
     return true;
   }
 
-  // Check for IPv4-mapped IPv6 in hex notation (e.g. ::ffff:7f00:1)
-  const v4HexMatch = addr.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i);
-  if (v4HexMatch) {
-    const hi = parseInt(v4HexMatch[1], 16);
-    const lo = parseInt(v4HexMatch[2], 16);
-    const mapped =
-      ((hi >> 8) & 0xff) + '.' + (hi & 0xff) + '.' + ((lo >> 8) & 0xff) + '.' + (lo & 0xff);
-    return isPrivateIPv4(mapped);
-  }
-
-  // Try normalizing as IPv4 (handles decimal, octal, hex, and integer notation)
-  const normalized = normalizeIPv4(addr);
-  if (normalized) {
-    return isPrivateIPv4(normalized);
-  }
-
-  // IPv6 checks
-  const normalized6 = normalizeIPv6(addr);
-  if (normalized6) {
-    // ::1 loopback, :: unspecified
-    if (normalized6 === '::1' || normalized6 === '::' || normalized6 === '::0') {
-      return true;
-    }
-    // fc00::/7 unique local
-    if (/^f[cd][0-9a-f]{2}:/i.test(normalized6)) {
-      return true;
-    }
-    // fe80::/10 link-local
-    if (/^fe[89ab][0-9a-f]:/i.test(normalized6)) {
-      return true;
-    }
-    // Re-check for IPv4-mapped IPv6 after normalization
-    // Handles expanded forms like 0:0:0:0:0:ffff:127.0.0.1 which normalize to ::ffff:...
-    const v4DottedNorm = normalized6.match(/^::ffff:(\d[\d.]+)$/i);
-    if (v4DottedNorm) {
-      const normV4 = normalizeIPv4(v4DottedNorm[1]);
-      if (normV4) {
-        return isPrivateIPv4(normV4);
-      }
-      return true;
-    }
-    const v4HexNorm = normalized6.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i);
-    if (v4HexNorm) {
-      const hi = parseInt(v4HexNorm[1], 16);
-      const lo = parseInt(v4HexNorm[2], 16);
-      const mapped =
-        ((hi >> 8) & 0xff) + '.' + (hi & 0xff) + '.' + ((lo >> 8) & 0xff) + '.' + (lo & 0xff);
-      return isPrivateIPv4(mapped);
-    }
-    return false;
-  }
-
-  // Unrecognized format - fail closed
-  return true;
+  return isPrivateAddress(address);
 }
 
 async function errorIfHostnameResolvesToPrivateIp(options) {

package/core/server/models/base/plugins/actions.js

@@ -1,4 +1,3 @@
-const _ = require('lodash');
 const errors = require('@tryghost/errors');
 const logging = require('@tryghost/logging');
 
@@ -27,7 +26,7 @@ module.exports = function (Bookshelf) {
       return Bookshelf.model('Action')
         .add(action, { autoRefresh: false })
         .catch((err) => {
-          if (_.isArray(err)) {
+          if (Array.isArray(err)) {
             err = err[0];
           }
 
@@ -99,7 +98,7 @@ module.exports = function (Bookshelf) {
           return;
         }
 
-        let context = {
+        const context = {
           action_name: options.actionName,
         };
 

package/core/server/models/base/plugins/crud.js

@@ -302,10 +302,9 @@ module.exports = function (Bookshelf) {
        */
       add: function add(data, unfilteredOptions) {
         const options = this.filterOptions(unfilteredOptions, 'add');
-        let model;
 
         data = this.filterData(data);
-        model = this.forge(data);
+        const model = this.forge(data);
 
         // We allow you to disable timestamps when importing posts so that the new posts `updated_at` value is the same
         // as the import json blob. More details refer to https://github.com/TryGhost/Ghost/issues/1696

package/core/server/models/base/plugins/events.js

@@ -8,7 +8,7 @@ const schema = require('../../../data/schema');
 const events = require('../../../lib/common/events');
 
 // Run tests or development with NUMERIC_IDS=1 to enable numeric object IDs
-let forceNumericObjectIds = process.env.NODE_ENV !== 'production' && !!process.env.NUMERIC_IDS;
+const forceNumericObjectIds = process.env.NODE_ENV !== 'production' && !!process.env.NUMERIC_IDS;
 let numberGenerator = 0;
 
 module.exports = function (Bookshelf) {
@@ -103,11 +103,11 @@ module.exports = function (Bookshelf) {
 
       /**
        * Do not call `toJSON`. This can remove properties e.g. password.
-       * @returns {*}
+       * @returns {Promise<void>}
        */
-      onValidate: function onValidate(model, columns, options) {
+      onValidate: async function onValidate(model, columns, options) {
         this.setEmptyValuesToNull();
-        return schema.validate(this.tableName, this, options);
+        schema.validate(this.tableName, this, options);
       },
 
       onFetched() {},