Ghost Release: 2.25.2

TL;DR

Ghost 2.25.2: Performance Boost & Frontend Restructuring

This release focuses on significant internal code restructuring, moving frontend-related code into a dedicated /core/frontend directory for better organization. Performance improvements include replacing the JS-only RSA key generator with a native alternative for faster boot times. Several bug fixes address issues with async helpers in templates, redirects validation, and theme changes. Security has been enhanced with an update to js-yaml to address vulnerabilities.

Highlight of the Release

• Major code restructuring with frontend code moved to a dedicated /core/frontend directory
• Performance improvement with faster boot times by replacing JS-only RSA key generator with native alternative
• Fixed async helpers nested in template helpers
• Updated js-yaml to version 3.13.1 to address security vulnerabilities
• Moved members static mount point to /ghost/members to fix CORS issues

Migration Guide

For Theme Developers

If you're developing custom themes or extensions that interact with Ghost's helper system, be aware that many helper locations have changed due to the frontend extraction. Helper references should now point to /core/frontend/helpers instead of /core/server/helpers.

For Plugin Developers

If your code interacts with any of the moved services (routing, URL, themes, RSS, etc.), you'll need to update your imports to reference the new locations under /core/frontend/services.

For Site Administrators

No specific actions are required for this update. The changes are mostly internal restructuring that should not affect normal operation of your Ghost site.

Upgrade Recommendations

This release contains important bug fixes, performance improvements, and security updates. We recommend all Ghost installations be updated to version 2.25.2.

The upgrade process should be straightforward as there are no breaking changes for end users. However, developers with custom code that interacts with Ghost's internal structure should review the code restructuring changes.

To upgrade:

1. Back up your Ghost installation
2. Follow the standard Ghost update procedure for your installation method
3. If you're using custom themes or extensions, test them after the upgrade

Bug Fixes

• Fixed async helpers nested in template helpers (closes #10643)
• Fixed redirects.json file validation after refactoring
• Fixed a crash when theme is changed due to wrong reference to the site app from themes service
• Made pagination helper template output W3C compliant HTML by removing unneeded role="navigation" attribute from <nav> in pagination.hbs
• Changed post/page date picker format to 'YYYY-MM-DD' (#1213)

New Features

Code Restructuring

• Extracted frontend-related code into a dedicated /core/frontend directory
• Moved /core/apps into /core/frontend
• Moved /core/server/helpers to /core/frontend/helpers
• Moved /core/server/services/themes to /core/frontend/services
• Moved /core/server/services/routing to /core/frontend/services
• Moved /core/server/services/url to /core/frontend/services
• Moved /core/server/data/meta to /core/frontend/meta
• Moved /core/server/services/rss to /core/frontend/services
• Moved /core/server/data/xml to /core/frontend/services

Members Improvements

• Updated members-theme-bindings & public/members.js
• Ghost now injects exact URLs for static members pages and SSR endpoints
• Moved members static mount point to /ghost/members to fix CORS issues when admin is hosted on a different domain

Security Updates

• Updated js-yaml to version 3.13.1 to address security vulnerabilities described in https://github.com/nodeca/js-yaml/commit/b2f9e882397660da37c5c5bb92e8ccc7bb9eb668

Performance Improvements

• Replaced the JS-only RSA key generator library with a native alternative (rsa-keypair module) for faster Ghost boot times
• Extracted frontend code from redirects API controllers to reduce coupling points and improve maintainability
• Extracted frontend code from settings API controllers to make it easier to abstract frontend away from API

Impact Summary

Ghost 2.25.2 represents a significant internal restructuring effort, moving frontend-related code to a dedicated directory structure. This improves code organization and maintainability while setting the foundation for better separation between frontend and API components.

The performance improvements, particularly the replacement of the JS-only RSA key generator with a native alternative, will result in faster boot times for all Ghost installations. This is especially beneficial for sites that restart frequently or run in environments with limited resources.

Bug fixes address several important issues, including problems with async helpers in templates that could cause rendering issues, and a fix for CORS requests failing for members when the admin is hosted on a different domain than the site.

The security update to js-yaml addresses known vulnerabilities, enhancing the overall security posture of Ghost installations.

Overall, this release improves performance, fixes bugs, enhances security, and lays groundwork for better code organization without introducing breaking changes for end users.

Full Release Notes