ghost 6.64.0 → 6.65.0

package/core/server/services/mentions/mention-sending-service.js

@@ -81,8 +81,8 @@ module.exports = class MentionSendingService {
         return;
       }
       // make sure we have something to parse before we create a job
-      let html = post.get('status') === 'published' ? post.get('html') : null;
-      let previousHtml = post.previous('status') === 'published' ? post.previous('html') : null;
+      const html = post.get('status') === 'published' ? post.get('html') : null;
+      const previousHtml = post.previous('status') === 'published' ? post.previous('html') : null;
       if (html || previousHtml) {
         // Capture the source URL now, from the event's data, rather than
         // deferring the model into the job.

package/core/server/services/mentions/mention.js

@@ -309,12 +309,11 @@ module.exports = class Mention {
       timestamp = new Date();
     }
 
-    let payload;
-    payload = data.payload ? JSON.parse(JSON.stringify(data.payload)) : null;
+    const payload = data.payload ? JSON.parse(JSON.stringify(data.payload)) : null;
 
     /** @type boolean */
-    let verified;
-    verified = isNew ? false : !!data.verified;
+
+    const verified = isNew ? false : !!data.verified;
 
     /** @type {ObjectID | null} */
     let resourceId = null;

package/core/server/services/mentions/mentions-api.js

@@ -321,7 +321,10 @@ module.exports = class MentionsAPI {
    * @returns {Promise<Mention>}
    */
   async processWebmention(webmention) {
-    let mention = await this.#repository.getBySourceAndTarget(webmention.source, webmention.target);
+    const mention = await this.#repository.getBySourceAndTarget(
+      webmention.source,
+      webmention.target,
+    );
 
     return await this.#updateWebmention(mention, webmention);
   }

package/core/server/services/mentions-jobs/job-service.js

@@ -20,33 +20,6 @@ const workerMessageHandler = ({ name, message }) => {
   }
 };
 
-const initTestMode = () => {
-  // Output job queue length every 5 seconds
-  setInterval(() => {
-    logging.warn(
-      `${jobManager.inlineQueue.length()} jobs in the queue. Idle: ${jobManager.inlineQueue.idle()}`,
-    );
-
-    const runningScheduledjobs = Object.keys(jobManager.bree.workers);
-    if (Object.keys(jobManager.bree.workers).length) {
-      logging.warn(
-        `${Object.keys(jobManager.bree.workers).length} jobs running: ${runningScheduledjobs}`,
-      );
-    }
-
-    const scheduledJobs = Object.keys(jobManager.bree.intervals);
-    if (Object.keys(jobManager.bree.intervals).length) {
-      logging.warn(
-        `${Object.keys(jobManager.bree.intervals).length} scheduled jobs: ${scheduledJobs}`,
-      );
-    }
-
-    if (runningScheduledjobs.length === 0 && scheduledJobs.length === 0) {
-      logging.warn('No scheduled or running jobs');
-    }
-  }, 5000);
-};
-
 const jobManager = new JobManager({
   errorHandler,
   workerMessageHandler,
@@ -56,4 +29,3 @@ const jobManager = new JobManager({
 });
 
 module.exports = jobManager;
-module.exports.initTestMode = initTestMode;

package/core/server/services/milestones/milestones-service.js

@@ -300,7 +300,7 @@ module.exports = class MilestonesService {
     const membersMilestones = this.#milestonesConfig.members;
 
     // get the closest milestone we're over now
-    let achievedMilestones = this.#getMatchedMilestones(membersMilestones, membersCount);
+    const achievedMilestones = this.#getMatchedMilestones(membersMilestones, membersCount);
 
     // check for previously achieved milestones. We do not send an email when no
     // previous milestones exist

package/core/server/services/newsletters/newsletters-service.js

@@ -391,7 +391,7 @@ class NewslettersService {
         if (process.env.NODE_ENV !== 'production') {
           logging.warn(message.text);
         }
-        let msg = Object.assign(
+        const msg = Object.assign(
           {
             from: fromEmail,
             subject: 'Verify email address',

package/core/server/services/notifications/notifications.js

@@ -37,7 +37,7 @@ class Notifications {
    * @returns {Object[]} - all notifications
    */
   fetchAllNotifications() {
-    let allNotifications = this.settingsCache.get('notifications');
+    const allNotifications = this.settingsCache.get('notifications');
 
     // @TODO: this check can be removed to improve read operation perf. It's here only because
     //        reads are done often and this gives a possibility to self-heal any broken records.
@@ -67,7 +67,7 @@ class Notifications {
    * @returns {boolean}
    */
   areNotificationsValid(notifications) {
-    if (!_.isArray(notifications)) {
+    if (!Array.isArray(notifications)) {
       return false;
     }
 
@@ -151,7 +151,7 @@ class Notifications {
       addedAt: moment().toDate(),
     };
 
-    let notificationsToCheck = notifications;
+    const notificationsToCheck = notifications;
     let notificationsToAdd = [];
 
     const allNotifications = this.fetchAllNotifications();

package/core/server/services/oembed/oembed-service.js

@@ -90,15 +90,15 @@ const findUrlWithProvider = (url) => {
 
   // build up a list of URL variations to test against because the oembed
   // providers list is not always up to date with scheme or www vs non-www
-  let baseUrl = url.replace(/^\/\/|^https?:\/\/(?:www\.)?/, '');
-  let testUrls = [
+  const baseUrl = url.replace(/^\/\/|^https?:\/\/(?:www\.)?/, '');
+  const testUrls = [
     `https://${baseUrl}`,
     `https://www.${baseUrl}`,
     `http://${baseUrl}`,
     `http://www.${baseUrl}`,
   ];
 
-  for (let testUrl of testUrls) {
+  for (const testUrl of testUrls) {
     provider = hasProvider(testUrl);
     if (provider) {
       url = testUrl;
@@ -394,6 +394,80 @@ class OEmbedService {
     };
   }
 
+  /**
+   * Requests a URL through this.externalRequest and resolves with the response
+   * and at most the first chunk of its body, aborting the rest of the download.
+   *
+   * @param {string} url
+   * @returns {Promise<{response: import('got').Response, chunk?: Buffer}>}
+   */
+  fetchFirstChunk(url) {
+    return new Promise((resolve, reject) => {
+      const stream = this.externalRequest.stream(url, {
+        headers: {
+          'user-agent': USER_AGENT,
+          range: 'bytes=0-0',
+        },
+        timeout: {
+          request: DEFAULT_REQUEST_TIMEOUT,
+        },
+        decompress: false,
+        throwHttpErrors: false,
+      });
+      let response;
+
+      stream.on('response', (res) => {
+        response = res;
+      });
+      stream.once('data', (chunk) => {
+        stream.destroy();
+        resolve({ response, chunk });
+      });
+      stream.once('end', () => resolve({ response }));
+      stream.on('error', reject);
+    });
+  }
+
+  /**
+   * Checks that a favicon candidate is reachable and looks like an image.
+   *
+   * Replaces metascraper-logo-favicon's default resolver, which probes via
+   * reachable-url. reachable-url bundles got 11, which ignores the `dnsLookup`
+   * externalRequest installs to validate the resolved IP at connection time,
+   * leaving those probes open to DNS rebinding. Mirrors the default resolver's
+   * checks otherwise.
+   *
+   * @param {string} faviconUrl
+   * @param {Array<string|string[]>} [contentTypes] - allowed content types for the icon's extension
+   * @returns {Promise<{url: string} | undefined>}
+   */
+  async resolveFaviconUrl(faviconUrl, contentTypes) {
+    let result;
+    try {
+      result = await this.fetchFirstChunk(faviconUrl);
+    } catch {
+      return undefined;
+    }
+
+    const { response, chunk } = result;
+    if (!response || response.statusCode < 200 || response.statusCode >= 300) {
+      return undefined;
+    }
+
+    if (contentTypes) {
+      const contentType = response.headers['content-type']?.split(';')[0].toLowerCase();
+      if (!contentType || !contentTypes.some((ct) => contentType.includes(ct))) {
+        return undefined;
+      }
+      // An empty body or one starting with '<' (60) is markup, not an image
+      if (!chunk?.length || chunk[0] === 60) {
+        return undefined;
+      }
+    }
+
+    return { url: response.url };
+  }
+
   /**
    * @param {string} url
    * @param {string} html
@@ -477,6 +551,8 @@ class OEmbedService {
       require('metascraper-logo-favicon')({
         gotOpts,
         pickFn,
+        resolveFaviconUrl: (faviconUrl, contentTypes) =>
+          this.resolveFaviconUrl(faviconUrl, contentTypes),
       }),
       require('metascraper-logo')(),
     ];

package/core/server/services/permissions/can-this.js

@@ -132,7 +132,6 @@ class CanThisResult {
     const self = this;
     let userPermissionLoad;
     let apiKeyPermissionLoad;
-    let permissionsLoad;
 
     // Get context.user, context.api_key and context.app
     context = parseContext(context);
@@ -158,7 +157,7 @@ class CanThisResult {
     }
 
     // Wait for both user and api key permissions to load
-    permissionsLoad = Promise.all([userPermissionLoad, apiKeyPermissionLoad]).then(
+    const permissionsLoad = Promise.all([userPermissionLoad, apiKeyPermissionLoad]).then(
       function (result) {
         return {
           user: result[0],

package/core/server/services/post-scheduling/post-scheduling.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const moment_1 = __importDefault(require("moment"));
 const logging_1 = __importDefault(require("@tryghost/logging"));
 const build_signed_job_1 = require("../../adapters/scheduling/build-signed-job");
+const get_scheduler_idempotency_key_1 = require("../../adapters/scheduling/get-scheduler-idempotency-key");
 // CJS-only modules — typed loosely below. models is the Bookshelf registry
 // without TS declarations; the rest are JS modules without types.
 const models = require('../../models');
@@ -111,14 +112,20 @@ class PostScheduling {
         const resource = `${resourceType}s`;
         const publishedAt = event === 'unscheduled' ? model.previous('published_at') : model.get('published_at');
         const previousPublishedAt = model.previous('published_at');
+        const time = (0, moment_1.default)(publishedAt).valueOf();
         return (0, build_signed_job_1.buildSignedJob)({
             apiUrl: this.#apiUrl,
             path: ['schedules', resource, `${model.get('id')}/`],
-            time: (0, moment_1.default)(publishedAt).valueOf(),
+            time,
             key,
             extra: {
                 oldTime: previousPublishedAt ? (0, moment_1.default)(previousPublishedAt).valueOf() : null,
             },
+            // The key identifies one job: the URL already carries the resource
+            // and a token signed for this fire time under the current signing key,
+            // so re-registering the same job (e.g. a boot rebuild) yields the same
+            // key, while a reschedule or key rotation yields a new one.
+            getIdempotencyKey: (url) => (0, get_scheduler_idempotency_key_1.getSchedulerIdempotencyKey)({ namespace: 'post-scheduling', date: new Date(time), url }),
         });
     }
 }

package/core/server/services/posts/post-scheduling.js

@@ -65,6 +65,13 @@ const publishNow = async (resourceType, id, force, options) => {
     throw err;
   }
 
+  // The read above is filtered to scheduled resources, so a resource that an
+  // earlier delivery has already published normally surfaces as NotFound.
+  // Keep an explicit check so the outcome doesn't depend on that filter.
+  if (preScheduledResource.status !== 'scheduled') {
+    return NO_OP;
+  }
+
   const publishedAtMoment = moment(preScheduledResource.published_at);
 
   if (publishedAtMoment.diff(moment(), 'minutes') > publishAPostBySchedulerToleranceInMinutes) {

package/core/server/services/settings/settings-bread-service.js

@@ -128,7 +128,7 @@ class SettingsBREADService {
    * @returns
    */
   browse(context) {
-    let settings = this.settingsCache.getAll();
+    const settings = this.settingsCache.getAll();
 
     return this._formatBrowse(settings, context);
   }
@@ -199,7 +199,7 @@ class SettingsBREADService {
    * @returns
    */
   async edit(settings, options, stripeConnectData) {
-    let filteredSettings = settings.filter((setting) => {
+    const filteredSettings = settings.filter((setting) => {
       // The `stripe_connect_integration_token` "setting" is only used to set the `stripe_connect_*` settings.
       return (
         ![
@@ -488,7 +488,7 @@ class SettingsBREADService {
         if (process.env.NODE_ENV !== 'production') {
           logging.warn(message.text);
         }
-        let msg = Object.assign(
+        const msg = Object.assign(
           {
             from: fromEmail,
             subject: 'Verify email address',

package/core/server/services/settings/settings-utils.js

@@ -41,7 +41,7 @@ let SITE_UUID;
 function getOrGenerateSiteUuid() {
   if (!SITE_UUID) {
     try {
-      let configuredSiteUuid = config.get('site_uuid');
+      const configuredSiteUuid = config.get('site_uuid');
       if (configuredSiteUuid && validator.isUUID(configuredSiteUuid)) {
         SITE_UUID = configuredSiteUuid.toLowerCase();
         logging.info(`Setting site_uuid to configured value: ${SITE_UUID}`);

package/core/server/services/settings-helpers/settings-helpers.js

@@ -125,7 +125,7 @@ class SettingsHelpers {
   }
 
   getMembersSupportAddress() {
-    let supportAddress = this.settingsCache.get('members_support_address');
+    const supportAddress = this.settingsCache.get('members_support_address');
 
     if (!supportAddress) {
       // In the new flow, we make a difference between an empty setting (= use default) and a 'noreply' setting (=use noreply @ domain)

package/core/server/services/staff/staff-service-emails.js

@@ -44,7 +44,7 @@ class StaffServiceEmails {
         attributionTitle = 'Homepage';
       }
 
-      let staffUrl = this.urlUtils.urlJoin(
+      const staffUrl = this.urlUtils.urlJoin(
         this.urlUtils.urlFor('admin', true),
         '#',
         `/settings/staff/${user.slug}/email-notifications`,
@@ -101,7 +101,7 @@ class StaffServiceEmails {
         startedOn: this.getFormattedDate(subscription.startDate),
       };
 
-      let offerData = this.getOfferData(offer);
+      const offerData = this.getOfferData(offer);
 
       if (!offerData && subscription?.trialEnd) {
         const trialEnd = moment(subscription.trialEnd);
@@ -118,7 +118,7 @@ class StaffServiceEmails {
         attributionTitle = 'Homepage';
       }
 
-      let staffUrl = this.urlUtils.urlJoin(
+      const staffUrl = this.urlUtils.urlJoin(
         this.urlUtils.urlFor('admin', true),
         '#',
         `/settings/staff/${user.slug}/email-notifications`,
@@ -180,7 +180,7 @@ class StaffServiceEmails {
         cancellationReason: subscription.cancellationReason || '',
       };
 
-      let staffUrl = this.urlUtils.urlJoin(
+      const staffUrl = this.urlUtils.urlJoin(
         this.urlUtils.urlFor('admin', true),
         '#',
         `/settings/staff/${user.slug}/email-notifications`,
@@ -217,7 +217,7 @@ class StaffServiceEmails {
    * @param {string} recipient.slug
    */
   async getSharedData(recipient) {
-    let staffUrl = this.urlUtils.urlJoin(
+    const staffUrl = this.urlUtils.urlJoin(
       this.urlUtils.urlFor('admin', true),
       '#',
       `/settings/staff/${recipient.slug}/email-notifications`,
@@ -273,7 +273,7 @@ class StaffServiceEmails {
     for (const user of users) {
       const to = user.email;
 
-      let staffUrl = this.urlUtils.urlJoin(
+      const staffUrl = this.urlUtils.urlJoin(
         this.urlUtils.urlFor('admin', true),
         '#',
         `/settings/staff/${user.slug}/email-notifications`,
@@ -442,7 +442,7 @@ class StaffServiceEmails {
     for (const user of users) {
       const to = user.email;
 
-      let staffUrl = this.urlUtils.urlJoin(
+      const staffUrl = this.urlUtils.urlJoin(
         this.urlUtils.urlFor('admin', true),
         '#',
         `/settings/staff/${user.slug}/email-notifications`,
@@ -485,7 +485,7 @@ class StaffServiceEmails {
 
   /** @private */
   getMemberData(member) {
-    let name = member?.name || member?.email;
+    const name = member?.name || member?.email;
     return {
       name,
       email: member?.email,
@@ -607,7 +607,7 @@ class StaffServiceEmails {
       this.logging.warn(message.text);
     }
 
-    let msg = Object.assign(
+    const msg = Object.assign(
       {
         from: this.fromEmailAddress,
         forceTextContent: true,

package/core/server/services/stats/posts-stats-service.js

@@ -355,7 +355,7 @@ class PostsStatsService {
         .groupBy('source');
 
       // Now join all the data
-      let query = this.knex
+      const query = this.knex
         .with('free_referrers', freeReferrersCTE)
         .with('paid_referrers', paidReferrersCTE)
         .with('mrr_referrers', mrrReferrersCTE)
@@ -657,7 +657,7 @@ class PostsStatsService {
     const { dateFrom, dateTo } = getDateBoundaries(options);
 
     // Simpler approach mirroring _buildFreeMembersSubquery
-    let subquery = knex('members_created_events as mce')
+    const subquery = knex('members_created_events as mce')
       .select('mce.referrer_source as source')
       .countDistinct('mce.member_id as free_members')
       .leftJoin('members_subscription_created_events as msce', function () {
@@ -686,7 +686,7 @@ class PostsStatsService {
   _buildPaidReferrersSubquery(postId, options) {
     const knex = this.knex;
     const { dateFrom, dateTo } = getDateBoundaries(options);
-    let subquery = knex('members_subscription_created_events as msce')
+    const subquery = knex('members_subscription_created_events as msce')
       .select('msce.referrer_source as source')
       .countDistinct('msce.member_id as paid_members')
       .where('msce.attribution_id', postId)
@@ -708,7 +708,7 @@ class PostsStatsService {
   _buildMrrReferrersSubquery(postId, options) {
     const knex = this.knex;
     const { dateFrom, dateTo } = getDateBoundaries(options);
-    let subquery = knex('members_subscription_created_events as msce')
+    const subquery = knex('members_subscription_created_events as msce')
       .select('msce.referrer_source as source')
       .sum('mpse.mrr_delta as mrr')
       .join('members_paid_subscription_events as mpse', function () {
@@ -744,7 +744,7 @@ class PostsStatsService {
       const { dateFrom, dateTo } = getDateBoundaries(options);
 
       // Parse order field and direction
-      let [orderField, orderDirection = 'desc'] = order.split(' ');
+      const [orderField, orderDirection = 'desc'] = order.split(' ');
 
       // Map frontend order fields to database fields (simplified for ORDER BY)
       const orderFieldMap = {
@@ -834,7 +834,7 @@ class PostsStatsService {
       const { dateFrom, dateTo } = getDateBoundaries(options);
 
       // Parse order field and direction
-      let [orderField, orderDirection = 'desc'] = order.split(' ');
+      const [orderField, orderDirection = 'desc'] = order.split(' ');
 
       // Map frontend order fields to database fields (simplified for ORDER BY)
       const orderFieldMap = {
@@ -1095,7 +1095,7 @@ class PostsStatsService {
     const { dateFrom, dateTo } = getDateBoundaries(options);
 
     // Build optimized deltas query - avoid expensive JOIN
-    let deltasQuery = this.knex('members_subscribe_events as mse')
+    const deltasQuery = this.knex('members_subscribe_events as mse')
       .select(
         this.knex.raw(`DATE(mse.created_at) as date`),
         this.knex.raw(`SUM(CASE WHEN mse.subscribed = 1 THEN 1 ELSE -1 END) as value`),
@@ -1150,7 +1150,7 @@ class PostsStatsService {
     // Build complete time series with all dates
     const completeValues = [];
     let lastValue = startingValue; // Use provided starting value
-    let currentDate = rangeStart.clone();
+    const currentDate = rangeStart.clone();
 
     while (currentDate.isSameOrBefore(rangeEnd)) {
       const dateKey = currentDate.format('YYYY-MM-DD');
@@ -1507,7 +1507,7 @@ class PostsStatsService {
     try {
       // Build free members query (modeled after _buildFreeMembersSubquery)
       // Members who signed up on post but paid elsewhere/never
-      let freeMembersQuery = this.knex('members_created_events as mce')
+      const freeMembersQuery = this.knex('members_created_events as mce')
         .select('mce.attribution_id as post_id')
         .countDistinct('mce.member_id as free_members')
         .leftJoin('members_subscription_created_events as msce', function () {
@@ -1525,7 +1525,7 @@ class PostsStatsService {
 
       // Build paid members query (modeled after _buildPaidMembersSubquery)
       // Members whose paid conversion was attributed to this post
-      let paidMembersQuery = this.knex('members_subscription_created_events as msce')
+      const paidMembersQuery = this.knex('members_subscription_created_events as msce')
         .select('msce.attribution_id as post_id')
         .countDistinct('msce.member_id as paid_members')
         .whereIn('msce.attribution_type', ['post', 'page'])

package/core/server/services/stats/referrers-stats-service.js

@@ -226,7 +226,7 @@ class ReferrersStatsService {
     const { dateFrom: startDateTime, dateTo: endDateTime } = getDateBoundaries(options);
 
     // Join subscription created events with paid subscription events to get MRR changes
-    let query = knex('members_subscription_created_events as msce')
+    const query = knex('members_subscription_created_events as msce')
       .join('members_paid_subscription_events as mpse', function () {
         this.on('msce.member_id', '=', 'mpse.member_id').andOn(
           'msce.subscription_id',

package/core/server/services/stats/subscription-stats-service.js

@@ -25,12 +25,12 @@ class SubscriptionStatsService {
     });
 
     /** @type {SubscriptionHistoryEntry[]} */
-    let subscriptionHistoryEntries = [];
+    const subscriptionHistoryEntries = [];
 
     /** @type {string[]} */
-    let cadences = [];
+    const cadences = [];
     /** @type {string[]} */
-    let tiers = [];
+    const tiers = [];
 
     for (let index = subscriptionDeltaEntries.length - 1; index >= 0; index -= 1) {
       const entry = subscriptionDeltaEntries[index];

package/core/server/services/stats/utils/tinybird.js

@@ -82,6 +82,8 @@ const create = ({ config, request, settingsCache, tinybirdService }) => {
       }
     });
 
+    searchParams.ghost_client = 'server';
+
     // Convert searchParams to query string and append to URL
     const queryString = new URLSearchParams(searchParams).toString();
     const fullUrl = `${tinybirdUrl}?${queryString}`;
@@ -91,7 +93,12 @@ const create = ({ config, request, settingsCache, tinybirdService }) => {
         Authorization: `Bearer ${token}`,
       },
       timeout: {
-        request: 10000,
+        // Allow Tinybird's 30-second query deadline to finish before timing out locally.
+        request: 35000,
+      },
+      retry: {
+        // A failed request may still be executing; avoid duplicating expensive queries.
+        limit: 0,
       },
     };
 

package/core/server/services/stripe/stripe-api.js

@@ -367,7 +367,7 @@ module.exports = class StripeAPI {
         let latestCustomer = customers[0];
         let latestSubscriptionTime = 0;
 
-        for (let customer of customers) {
+        for (const customer of customers) {
           // skip customers with no subscriptions
           if (
             !customer.subscriptions ||
@@ -378,7 +378,7 @@ module.exports = class StripeAPI {
           }
 
           // find the customer with the most recent subscription
-          for (let subscription of customer.subscriptions.data) {
+          for (const subscription of customer.subscriptions.data) {
             if (
               subscription.current_period_end &&
               subscription.current_period_end > latestSubscriptionTime
@@ -606,7 +606,7 @@ module.exports = class StripeAPI {
       subscriptionData.trial_period_days = options.trialDays;
     }
 
-    let stripeSessionOptions = {
+    const stripeSessionOptions = {
       payment_method_types: this.PAYMENT_METHOD_TYPES,
       managed_payments: MANAGED_PAYMENTS_DISABLED,
       success_url: options.successUrl || this._config.checkoutSessionSuccessUrl,

package/core/server/services/stripe/stripe-migrations.js

@@ -69,7 +69,7 @@ module.exports = class StripeMigrations {
         logging.info(`Populating products and prices for existing stripe customers`);
         const uniquePlans = _.uniq(subscriptions.map((d) => _.get(d, 'plan.id')));
 
-        let stripePrices = [];
+        const stripePrices = [];
         for (const plan of uniquePlans) {
           try {
             const stripePrice = await this.api.getPrice(plan, {
@@ -356,9 +356,9 @@ module.exports = class StripeMigrations {
 
     if (!monthlyPrice) {
       logging.info('Could not any active Monthly price - creating a new one');
-      let defaultStripeProduct;
+
       const stripeProductsPage = await this.models.StripeProduct.findPage({ ...options, limit: 1 });
-      defaultStripeProduct = stripeProductsPage.data[0];
+      const defaultStripeProduct = stripeProductsPage.data[0];
       const price = await this.api.createPrice({
         currency: 'usd',
         amount: 5000,
@@ -445,9 +445,9 @@ module.exports = class StripeMigrations {
 
     if (!yearlyPrice) {
       logging.info('Could not any active yearly price - creating a new one');
-      let defaultStripeProduct;
+
       const stripeProductsPage = await this.models.StripeProduct.findPage({ ...options, limit: 1 });
-      defaultStripeProduct = stripeProductsPage.data[0];
+      const defaultStripeProduct = stripeProductsPage.data[0];
       const price = await this.api.createPrice({
         currency: 'usd',
         amount: 500,
@@ -621,7 +621,7 @@ module.exports = class StripeMigrations {
     });
     if (invalidSubscriptions.length > 0) {
       logging.warn(`Deleting ${invalidSubscriptions.length} invalid subscription(s)`);
-      for (let sub of invalidSubscriptions) {
+      for (const sub of invalidSubscriptions) {
         logging.warn(`Deleting subscription - ${sub.id} - no price found`);
         await sub.destroy(options);
       }