Ghost Release: 1.21.7

TL;DR

Ghost 1.21.7: Bug Fixes and Multilingual Improvements

This maintenance release addresses several important bugs including a fix for the updated_at timestamp not being properly updated, corrects a schema.org type misspelling, and enhances the {{reading_time}} helper with better multilingual support. The update also includes numerous dependency updates, including a security fix from a HackerOne report.

Highlight of the Release

• Fixed issue with updated_at timestamps not updating when content is modified
• Enhanced {{reading_time}} helper with support for diacritics and Chinese characters
• Corrected schema.org type from misspelled version to proper WebSite format
• Security improvement through dependency updates

Migration Guide

No migration steps are required for this update. This is a maintenance release that can be installed with standard update procedures.

To update to Ghost 1.21.7:

1. Back up your Ghost installation
2. Follow the standard update process for your installation method (CLI, Docker, or manual installation)
3. Restart your Ghost instance

No database migrations or configuration changes are needed.

Upgrade Recommendations

This release is recommended for all users as it contains important bug fixes and security updates.

The fixes for the updated_at timestamp and multilingual reading time are particularly important for sites with active content creation workflows or non-English content. The security update addressing a HackerOne report also makes this an important update for maintaining site security.

Since this is a patch release (1.21.6 → 1.21.7), the upgrade should be straightforward with minimal risk.

Bug Fixes

Fixed updated_at Timestamp Not Updating

A bug in the latest Bookshelf release was causing the updated_at attribute to not be automatically updated when content was modified. This has been fixed, and additional protections were added:

• Protection against directly overriding the updated_at property without making other changes
• Fixed handling of non-valid model attributes in Bookshelf's model.changed object

Corrected Schema.org Type

• Updated the schema type from incorrect spelling to WebSite as per the official schema.org specification
• This ensures proper SEO metadata formatting for Ghost sites

Fixed Internationalization Key

• Corrected the wrong i18n key from errors.models.posts.postNotFound to errors.models.post.postNotFound
• While the i18n library would fall back to a valid error key, this ensures proper error handling

New Features

Enhanced Multilingual Support

The {{reading_time}} helper has been improved to better support multiple languages:

• Added support for diacritics characters (À-ÿ) in the word counting algorithm
• Implemented better handling of Chinese text for more accurate reading time estimates
• Changed the word count implementation to match the one used by SimpleMDE for consistency

This enhancement ensures more accurate reading time estimates for content in languages beyond English.

Security Updates

Security Improvements

This release includes dependency updates that resolve a security vulnerability reported through HackerOne (report #310439). Key security-related dependency updates include:

• Lodash updated to 4.17.5
• Express updated to 4.16.3
• Sanitize-html updated to 1.18.2

These updates help maintain the security posture of Ghost installations.

Performance Improvements

No specific performance improvements were highlighted in this release. The focus was primarily on bug fixes, dependency updates, and multilingual support enhancements.

Impact Summary

Ghost 1.21.7 is a maintenance release that addresses several important bugs and enhances multilingual support. The most significant impact is the fix for the updated_at timestamp not being properly updated when content is modified, which ensures content modification dates are accurately tracked.

The improved {{reading_time}} helper now provides more accurate estimates for content with diacritics and Chinese characters, making Ghost more accessible for multilingual publications. The correction of the schema.org type improves SEO compliance.

Security has been enhanced through multiple dependency updates, including addressing a vulnerability reported through HackerOne. While these changes are primarily under-the-hood improvements, they collectively enhance Ghost's reliability, security, and international compatibility.

Full Release Notes