ghost 6.63.0 → 6.65.0

package/core/server/web/well-known.js

@@ -2,35 +2,31 @@ const express = require('../../shared/express');
 const settings = require('../../shared/settings-cache');
 const config = require('../../shared/config');
 const { cacheControl } = require('./shared/middleware');
+const { getPublicKeyInfo } = require('../lib/public-jwk');
 
 module.exports = function setupWellKnownApp() {
   const wellKnownApp = express('well-known');
 
-  const jose = require('node-jose');
   const dangerousPrivateKey = settings.get('ghost_private_key');
-  const keyStore = jose.JWK.createKeyStore();
-  const keyStoreReady = keyStore.add(dangerousPrivateKey, 'pem');
-
-  const getSafePublicJWKS = async () => {
-    await keyStoreReady;
-    return keyStore.toJSON();
-  };
+  const keyReady = getPublicKeyInfo(dangerousPrivateKey);
 
   const cache = cacheControl('public', { maxAge: config.get('caching:wellKnown:maxAge') });
 
   wellKnownApp.get('/jwks.json', cache, async function jwksMiddleware(req, res) {
-    const jwks = await getSafePublicJWKS();
+    const { kid, jwk } = await keyReady;
 
     // there's only one key in the store atm
     // based on this setting all of the keys to have
     // "use": "sig" property
-    const keys = jwks.keys.map((key) => ({
-      e: key.e,
-      kid: key.kid,
-      kty: key.kty,
-      n: key.n,
-      use: 'sig',
-    }));
+    const keys = [
+      {
+        e: jwk.e,
+        kid,
+        kty: jwk.kty,
+        n: jwk.n,
+        use: 'sig',
+      },
+    ];
 
     res.json({ keys });
   });

package/core/shared/config/defaults.json

@@ -71,6 +71,10 @@
     "active": "LocalImagesStorage",
     "media": "LocalMediaStorage",
     "files": "LocalFilesStorage",
+    "imports": {
+      "adapter": "LocalStorageBase",
+      "staticFileURLPrefix": "content/imports"
+    },
     "LocalMediaStorage": {},
     "LocalFilesStorage": {}
   },
@@ -305,8 +309,7 @@
         "enabled": false,
         "threshold": 500
       }
-    },
-    "openedJobLagWarningMinutes": 30
+    }
   },
   "linkClickTrackingCacheMemberUuid": false,
   "backgroundJobs": {
@@ -364,7 +367,8 @@
   },
   "bulkEmail": {
     "batchSize": 1000,
-    "captureLinkClickBadMemberUuid": false
+    "captureLinkClickBadMemberUuid": false,
+    "perRecipientMessageId": false
   },
   "disableJSBackups": false,
   "disableMigrationBackups": false,

package/core/shared/custom-theme-settings-cache/custom-theme-settings-service.js

@@ -238,7 +238,7 @@ module.exports = class CustomThemeSettingsService {
       return [];
     }
 
-    let removedIds = [];
+    const removedIds = [];
 
     // sync any knownSettings that have changed in the theme
     for (const knownSetting of knownSettings) {

package/core/shared/{flush-logs.js → flush.js}

@@ -3,15 +3,19 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.flushLogs = flushLogs;
+exports.flushLogsAndMetrics = flushLogsAndMetrics;
 const promises_1 = require("node:timers/promises");
 const logging_1 = __importDefault(require("@tryghost/logging"));
+const metrics_1 = __importDefault(require("@tryghost/metrics"));
 const DEFAULT_TIMEOUT_MS = 2000;
 /**
  * Drain buffered log transports before the process exits, bounded so a stuck
  * transport can never block shutdown.
  */
-async function flushLogs(timeoutMs = DEFAULT_TIMEOUT_MS) {
+async function flushLogsAndMetrics(timeoutMs = DEFAULT_TIMEOUT_MS) {
     // Unreffed so the loser of the race can't hold the event loop open
-    await Promise.race([logging_1.default.flush(), (0, promises_1.setTimeout)(timeoutMs, undefined, { ref: false })]);
+    await Promise.race([
+        Promise.all([logging_1.default.flush(), metrics_1.default.flush()]),
+        (0, promises_1.setTimeout)(timeoutMs, undefined, { ref: false }),
+    ]);
 }

package/core/shared/labs.js

@@ -41,12 +41,14 @@ const PUBLIC_BETA_FEATURES = [
 // Which is only visible if the developer experiments flag is enabled
 const PRIVATE_FEATURES = [
   'automations',
+  'automationsPerTier',
   'automationRunAnalytics',
   'automationsTinybirdSync',
   'stripeAutomaticTax',
   'importMemberTier',
   'csvContentImporter',
   'adminUIRefresh',
+  'admin7Pill',
   'tagsX',
   'emailUniqueid',
   'improveSendingUI',
@@ -60,7 +62,9 @@ const PRIVATE_FEATURES = [
   'selfServeArchives',
   'machinePayments',
   'postsListReact',
+  'membersActivityReact',
   'editorReact',
+  'dunningWarnings',
 ];
 
 module.exports.GA_KEYS = [...GA_FEATURES];
@@ -117,7 +121,6 @@ module.exports.isSet = function isSet(flag) {
  */
 module.exports.enabledHelper = function enabledHelper(options, callback) {
   const errDetails = {};
-  let errString;
 
   if (module.exports.isSet(options.flagKey) === true) {
     // helper is active, use the callback
@@ -143,7 +146,7 @@ module.exports.enabledHelper = function enabledHelper(options, callback) {
   );
 
   const { SafeString } = require('express-hbs');
-  errString = new SafeString(
+  const errString = new SafeString(
     `<script>console.error("${_.values(errDetails).join(' ')}");</script>`,
   );
 

package/core/shared/settings-cache/cache-manager.js

@@ -240,7 +240,7 @@ class CacheManager {
   getPublic() {
     // This block correctly builds the type signature for the return value
     /** @type {PublicSettingsCache} */
-    let settings = Object.fromEntries(
+    const settings = Object.fromEntries(
       Object.keys(this.publicSettings).map((key) => [this.publicSettings[key], null]),
     );
 

package/core/shared/timing-safe-string-equal.js

@@ -0,0 +1,26 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.timingSafeStringEqual = timingSafeStringEqual;
+const crypto_1 = __importDefault(require("crypto"));
+/**
+ * Compares a value Ghost computed (an HMAC digest, say) with one taken from a
+ * request, without the response time revealing how much of it matched.
+ * Anything that is not a string never matches: a query param repeated in the
+ * URL arrives as an array, and that is as wrong as a bad key.
+ */
+function timingSafeStringEqual(expected, provided) {
+    if (typeof provided !== 'string') {
+        return false;
+    }
+    const expectedBuffer = Buffer.from(expected, 'utf16le');
+    const providedBuffer = Buffer.from(provided, 'utf16le');
+    // crypto.timingSafeEqual throws when the lengths differ. The digests compared
+    // here have a fixed, public length, so returning early gives nothing away.
+    if (expectedBuffer.length !== providedBuffer.length) {
+        return false;
+    }
+    return crypto_1.default.timingSafeEqual(expectedBuffer, providedBuffer);
+}

package/nodemon.json

@@ -1,6 +1,6 @@
 {
   "watch": [".", "../*"],
-  "ignore": ["../admin/**", "content/**", "core/built/**"],
+  "ignore": ["../admin/**", "content/**", "core/built/**", "test/**"],
   "ext": "js,mjs,cjs,json,ts,tsx",
   "exec": "node --conditions=source --import=tsx"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ghost",
-  "version": "6.63.0",
+  "version": "6.65.0",
   "description": "The professional publishing platform",
   "keywords": [
     "blog",
@@ -54,60 +54,60 @@
     "@tryghost/adapter-base-jobs": "file:components/tryghost-adapter-base-jobs-0.0.0.tgz",
     "@tryghost/adapter-base-redirects": "file:components/tryghost-adapter-base-redirects-0.0.0.tgz",
     "@tryghost/adapter-base-route-settings": "file:components/tryghost-adapter-base-route-settings-0.0.0.tgz",
-    "@tryghost/adapter-base-scheduling": "file:components/tryghost-adapter-base-scheduling-0.2.3.tgz",
+    "@tryghost/adapter-base-scheduling": "file:components/tryghost-adapter-base-scheduling-0.2.4.tgz",
     "@tryghost/adapter-base-sso": "file:components/tryghost-adapter-base-sso-0.1.3.tgz",
     "@tryghost/admin-api-schema": "file:components/tryghost-admin-api-schema-0.0.0.tgz",
-    "@tryghost/api-framework": "3.3.12",
-    "@tryghost/bookshelf-plugins": "2.3.12",
+    "@tryghost/api-framework": "file:components/tryghost-api-framework-0.0.0.tgz",
+    "@tryghost/bookshelf-plugins": "2.3.15",
     "@tryghost/brute-knex": "3.2.2",
     "@tryghost/checkout": "file:components/tryghost-checkout-0.0.0.tgz",
-    "@tryghost/color-utils": "0.2.20",
-    "@tryghost/config-url-helpers": "1.0.27",
-    "@tryghost/custom-fonts": "1.0.11",
-    "@tryghost/database-info": "2.3.12",
-    "@tryghost/debug": "2.3.12",
-    "@tryghost/domain-events": "3.3.13",
-    "@tryghost/email-mock-receiver": "2.3.12",
-    "@tryghost/errors": "3.3.12",
-    "@tryghost/helpers": "1.1.106",
-    "@tryghost/html-to-plaintext": "1.0.11",
+    "@tryghost/color-utils": "0.2.21",
+    "@tryghost/config-url-helpers": "1.0.28",
+    "@tryghost/custom-fonts": "1.0.12",
+    "@tryghost/database-info": "2.3.14",
+    "@tryghost/debug": "2.3.14",
+    "@tryghost/domain-events": "3.3.15",
+    "@tryghost/email-mock-receiver": "2.3.14",
+    "@tryghost/errors": "3.3.14",
+    "@tryghost/helpers": "1.1.107",
+    "@tryghost/html-to-plaintext": "1.0.12",
     "@tryghost/i18n": "file:components/tryghost-i18n-0.0.0.tgz",
-    "@tryghost/image-transform": "1.4.17",
+    "@tryghost/image-transform": "1.4.18",
     "@tryghost/job-manager": "1.0.9",
     "@tryghost/kg-card-factory": "file:components/tryghost-kg-card-factory-5.2.4.tgz",
     "@tryghost/kg-converters": "file:components/tryghost-kg-converters-1.2.5.tgz",
-    "@tryghost/kg-default-cards": "file:components/tryghost-kg-default-cards-10.3.5.tgz",
+    "@tryghost/kg-default-cards": "file:components/tryghost-kg-default-cards-10.3.6.tgz",
     "@tryghost/kg-default-nodes": "file:components/tryghost-kg-default-nodes-2.2.1.tgz",
     "@tryghost/kg-html-to-lexical": "file:components/tryghost-kg-html-to-lexical-1.4.0.tgz",
-    "@tryghost/kg-lexical-html-renderer": "file:components/tryghost-kg-lexical-html-renderer-1.5.0.tgz",
+    "@tryghost/kg-lexical-html-renderer": "file:components/tryghost-kg-lexical-html-renderer-1.5.1.tgz",
     "@tryghost/kg-markdown-html-renderer": "file:components/tryghost-kg-markdown-html-renderer-7.2.4.tgz",
     "@tryghost/limit-service": "file:components/tryghost-limit-service-0.0.0.tgz",
-    "@tryghost/logging": "5.4.3",
+    "@tryghost/logging": "5.4.5",
     "@tryghost/metafield-types": "file:components/tryghost-metafield-types-0.0.0.tgz",
-    "@tryghost/metrics": "3.5.3",
+    "@tryghost/metrics": "3.6.0",
     "@tryghost/mg-clean-html": "0.12.6",
     "@tryghost/mongo-knex": "0.11.2",
-    "@tryghost/mongo-utils": "0.6.5",
-    "@tryghost/mw-error-handler": "1.0.13",
-    "@tryghost/mw-vhost": "1.0.6",
-    "@tryghost/nodemailer": "2.3.12",
+    "@tryghost/mongo-utils": "0.6.6",
+    "@tryghost/mw-error-handler": "3.3.14",
+    "@tryghost/mw-vhost": "3.3.14",
+    "@tryghost/nodemailer": "2.3.14",
     "@tryghost/nql": "0.13.4",
     "@tryghost/nql-lang": "0.7.0",
     "@tryghost/nql-string": "file:components/tryghost-nql-string-0.0.0.tgz",
     "@tryghost/parse-email-address": "file:components/tryghost-parse-email-address-0.0.0.tgz",
-    "@tryghost/pretty-cli": "3.3.12",
-    "@tryghost/prometheus-metrics": "1.0.8",
-    "@tryghost/referrer-parser": "0.1.21",
-    "@tryghost/request": "4.0.5",
-    "@tryghost/root-utils": "2.3.12",
-    "@tryghost/security": "1.0.6",
-    "@tryghost/social-urls": "0.1.63",
-    "@tryghost/string": "0.3.5",
-    "@tryghost/tpl": "2.3.12",
-    "@tryghost/url-utils": "5.2.6",
-    "@tryghost/validator": "3.2.12",
-    "@tryghost/version": "2.3.12",
-    "@tryghost/zip": "3.5.11",
+    "@tryghost/pretty-cli": "3.3.14",
+    "@tryghost/prometheus-metrics": "5.0.0",
+    "@tryghost/referrer-parser": "0.1.22",
+    "@tryghost/request": "4.0.7",
+    "@tryghost/root-utils": "2.3.14",
+    "@tryghost/security": "3.3.14",
+    "@tryghost/social-urls": "0.1.64",
+    "@tryghost/string": "0.3.6",
+    "@tryghost/tpl": "2.3.14",
+    "@tryghost/url-utils": "5.3.0",
+    "@tryghost/validator": "3.2.14",
+    "@tryghost/version": "2.3.14",
+    "@tryghost/zip": "3.5.13",
     "@x402/core": "2.12.0",
     "@x402/evm": "2.12.0",
     "@x402/hono": "2.12.0",
@@ -120,7 +120,7 @@
     "cache-manager-ioredis": "2.1.0",
     "chalk": "4.1.2",
     "charset": "1.0.1",
-    "cheerio": "0.22.0",
+    "cheerio": "1.2.0",
     "clsx": "2.1.1",
     "common-tags": "1.8.2",
     "compression": "1.8.1",
@@ -141,7 +141,6 @@
     "express-jwt": "8.5.1",
     "express-lazy-router": "1.0.6",
     "express-query-boolean": "2.0.0",
-    "express-queue": "0.0.13",
     "express-session": "1.19.0",
     "fastq": "^1.20.1",
     "file-type": "21.3.4",
@@ -149,24 +148,26 @@
     "fs-extra": "11.3.6",
     "ghost-storage-base": "file:components/ghost-storage-base-3.0.0.tgz",
     "glob": "13.0.6",
-    "got": "15.1.0",
-    "gscan": "6.4.2",
+    "got": "16.0.0",
+    "gscan": "6.6.1",
     "handlebars": "4.7.9",
     "heic-convert": "2.1.0",
     "hono": "4.12.18",
     "html-to-text": "5.1.1",
     "html5parser": "2.0.2",
     "human-number": "3.0.0",
-    "iconv-lite": "0.7.2",
+    "iconv-lite": "0.7.3",
     "image-size": "1.2.1",
     "intl-messageformat": "5.4.3",
+    "ipaddr.js": "2.5.0",
+    "jose": "6.2.12",
     "js-yaml": "4.3.0",
     "jsdom": "30.0.1",
     "jsonc-parser": "3.3.1",
     "jsonwebtoken": "8.5.1",
-    "juice": "9.1.0",
+    "juice": "11.1.1",
     "knex": "2.4.2",
-    "knex-migrator": "5.4.1",
+    "knex-migrator": "6.2.1",
     "leaky-bucket": "2.2.0",
     "lodash": "4.18.1",
     "luxon": "3.7.2",
@@ -187,10 +188,9 @@
     "moment-timezone": "0.5.45",
     "mppx": "0.6.20",
     "multer": "2.2.0",
-    "mysql2": "3.22.5",
+    "mysql2": "3.24.4",
     "nconf": "0.13.0",
     "node-html-markdown": "2.0.0",
-    "node-jose": "2.2.0",
     "nodemailer": "8.0.11",
     "on-headers": "1.1.0",
     "otplib": "12.0.1",
@@ -199,7 +199,7 @@
     "probability-distributions": "0.9.1",
     "probe-image-size": "7.3.0",
     "rss": "1.2.2",
-    "sanitize-html": "2.17.5",
+    "sanitize-html": "2.17.7",
     "semver": "7.8.5",
     "sharp": "0.35.3",
     "simple-dom": "1.4.0",
@@ -212,7 +212,6 @@
     "type-fest": "5.7.0",
     "ua-parser-js": "1.0.41",
     "unidecode": "1.1.0",
-    "xml": "1.0.1",
     "zod": "4.4.3"
   },
   "optionalDependencies": {
@@ -226,5 +225,5 @@
     "node": "^22.23.1 || ^24.20.0"
   },
   "scripts": {},
-  "packageManager": "pnpm@12.4.0+sha512.37536c26ed40ab4134b6511e09f6b27f3ebb45687468f2406ca3805279a4e5ca158c1931350ad9774d6ab2108d71b3dbaeb39943159294375e4d053e8e05685c"
+  "packageManager": "pnpm@12.4.2+sha512.08adc6613180275c7c9edada39dcf08c9c61ad4e7eaf330a4f3461f102b0f907423454d117f98e72d47fef0616070644d7bffc973a6a57f5090a6d7c368b07c9"
 }

package/patches/@elastic__elasticsearch@8.19.2.patch

@@ -0,0 +1,67 @@
+diff --git a/lib/helpers.d.ts b/lib/helpers.d.ts
+index f21dc11510a89c5844c6d630397e69a34481a5e8..7d65004a87f96cd47f970c1e71844633d9a8b485 100644
+--- a/lib/helpers.d.ts
++++ b/lib/helpers.d.ts
+@@ -1,6 +1,6 @@
+ import { Readable } from 'node:stream';
+ import { TransportResult, TransportRequestOptions } from '@elastic/transport';
+-import { Table, TypeMap, AsyncRecordBatchStreamReader } from 'apache-arrow/Arrow.node';
++import type { Table, TypeMap, AsyncRecordBatchStreamReader } from 'apache-arrow/Arrow.node';
+ import Client from './client';
+ import * as T from './api/types';
+ import { Id } from './api/types';
+diff --git a/lib/helpers.js b/lib/helpers.js
+index 340ffc5ad6cbc11b3dd1a8d45d1a3dee5829ff32..7400bc10c8499a04a4cd7fa1c96454db67453aee 100644
+--- a/lib/helpers.js
++++ b/lib/helpers.js
+@@ -27,7 +27,19 @@ const node_assert_1 = tslib_1.__importDefault(require("node:assert"));
+ const timersPromises = tslib_1.__importStar(require("node:timers/promises"));
+ const node_stream_1 = require("node:stream");
+ const transport_1 = require("@elastic/transport");
+-const Arrow_node_1 = require("apache-arrow/Arrow.node");
++// Ghost patch: only the two ES|QL helpers below use apache-arrow, and nothing in
++// Ghost calls them - this eager require cost 145 modules / ~3.3MB RSS in every
++// process using the Elasticsearch log transport. 9.x defers it the same way.
++// .pnpmfile.mjs drops the dependency, so the require really can fail here.
++function loadArrow() {
++    try {
++        return require("apache-arrow/Arrow.node");
++    }
++    catch {
++        throw new Error('Package "apache-arrow" is required for Arrow functionality. ' +
++            'Install it with: npm install apache-arrow');
++    }
++}
+ const { ResponseError, ConfigurationError } = transport_1.errors;
+ const sleep = timersPromises.setTimeout;
+ const pImmediate = timersPromises.setImmediate;
+@@ -831,6 +843,7 @@ class Helpers {
+             },
+             async toArrowTable() {
+                 var _d;
++                const { tableFromIPC } = loadArrow();
+                 if (metaHeader !== null) {
+                     reqOptions.headers = (_d = reqOptions.headers) !== null && _d !== void 0 ? _d : {};
+                     reqOptions.headers['x-elastic-client-meta'] = `${metaHeader},h=qa`;
+@@ -838,10 +851,11 @@ class Helpers {
+                 params.format = 'arrow';
+                 // @ts-expect-error the return type will be ArrayBuffer when the format is set to 'arrow'
+                 const response = await client.esql.query(params, reqOptions);
+-                return (0, Arrow_node_1.tableFromIPC)(response);
++                return tableFromIPC(response);
+             },
+             async toArrowReader() {
+                 var _d;
++                const { AsyncRecordBatchStreamReader } = loadArrow();
+                 if (metaHeader !== null) {
+                     reqOptions.headers = (_d = reqOptions.headers) !== null && _d !== void 0 ? _d : {};
+                     reqOptions.headers['x-elastic-client-meta'] = `${metaHeader},h=qa`;
+@@ -850,7 +864,7 @@ class Helpers {
+                 params.format = 'arrow';
+                 // @ts-expect-error response is a Readable when asStream is true
+                 const response = await client.esql.query(params, reqOptions);
+-                return await Arrow_node_1.AsyncRecordBatchStreamReader.from(node_stream_1.Readable.from(response));
++                return await AsyncRecordBatchStreamReader.from(node_stream_1.Readable.from(response));
+             }
+         };
+         return helper;

package/patches/juice@11.1.1.patch

@@ -0,0 +1,46 @@
+diff --git a/lib/cheerio.js b/lib/cheerio.js
+index 809e0ac78bc01a98675b43a771140e9f35cd4c71..23c565ad94ec15dd2e7f8e605b1bb849ef6769bd 100644
+--- a/lib/cheerio.js
++++ b/lib/cheerio.js
+@@ -3,7 +3,11 @@
+ /**
+  * Module dependencies.
+  */
+-var cheerio = require('cheerio');
++// Ghost patch: cheerio's main entry eagerly loads parse5, undici and the whatwg
++// encoding stack (~20MB RSS per process) none of which juice uses - the `xml`
++// option below sets _useHtmlParser2, so parsing goes through htmlparser2 either
++// way. cheerio/slim is that same htmlparser2 path without the unused baggage.
++var cheerio = require('cheerio/slim');
+ var utils = require('./utils');
+ 
+ var cheerioLoad = function(html, options, encodeEntities) {
+diff --git a/lib/inline.js b/lib/inline.js
+index 083b8c58eb90184d0190cd0e3361a39638e4981b..492d0230dd2a3ee179359e3027f73cc7257023fe 100644
+--- a/lib/inline.js
++++ b/lib/inline.js
+@@ -117,7 +117,12 @@ module.exports = function makeJuiceClient(juiceClient) {
+               ? decode(styleAttributeValue)
+               : styleAttributeValue;
+             var cssText = '* { ' + cssStyleAttributeValue + ' } ';
+-            addProps(utils.parseCSS(cssText)[0][1], new utils.Selector('<style>', true));
++            // Ghost patch: parseCSS drops rules with no declarations, so a style
++            // attribute with none (e.g. `style=";"`) has no rule to read
++            var styleAttributeRule = utils.parseCSS(cssText)[0];
++            if (styleAttributeRule) {
++              addProps(styleAttributeRule[1], new utils.Selector('<style>', true));
++            }
+           }
+ 
+           // store reference to an element we need to compile style="" attr for
+@@ -158,7 +163,9 @@ module.exports = function makeJuiceClient(juiceClient) {
+         // go through the properties
+         function addProps(style, selector) {
+           for (var i = 0, l = style.length; i < l; i++) {
+-            if (style[i].type == 'property') {
++            // Ghost patch: mensch parses input like `a{b}` into a property with no
++            // value, which would throw on value.match below
++            if (style[i].type == 'property' && typeof style[i].value === 'string') {
+               var name = style[i].name;
+               var value = style[i].value;
+