Ghost Release: 2.26.0

TL;DR

Ghost 2.26.0 introduces several enhancements to the Content API, image handling, and site SEO capabilities. The update adds the url value to the Content API settings endpoint, improves image alt text editing, fixes the img_url helper for relative paths, and introduces global site SEO fields for theme helpers. Security has been tightened by preventing the Admin API from fetching internal integrations. This release focuses on improving developer experience, content management capabilities, and site SEO optimization.

Highlight of the Release

• Added url value to the Content API /settings/ endpoint
• Added ability to edit alt text for image cards
• Introduced global site SEO fields for theme helpers
• Fixed img_url helper when using image sizes with relative paths
• Enhanced security by preventing Admin API from fetching internal integrations

Migration Guide

No specific migration steps are required for this update. The changes are backward compatible and should not break existing functionality.

If you're using custom themes that rely on the previous behavior of the {{meta_title}}, {{meta_description}}, {{og_image}}, or {{twitter_image}} helpers, you may want to review your theme code to ensure it works correctly with the new global site SEO fields.

For developers using the img_url helper with relative paths, the fix should resolve any issues without requiring changes to your code.

Upgrade Recommendations

This update is recommended for all Ghost users, especially for:

1. Site owners who want to take advantage of the improved SEO capabilities with global site SEO fields
2. Content creators who need to edit alt text for image cards
3. Developers using the Content API who need access to the site's URL
4. Anyone experiencing issues with the img_url helper when using relative paths

The security enhancement preventing Admin API access to internal integrations makes this update particularly important for sites with multiple administrators or custom integrations.

As always, it's recommended to backup your Ghost installation before upgrading.

Bug Fixes

Fixed img_url helper when using image sizes with relative paths

The img_url helper has been updated to properly handle relative paths when using image sizes. The fix updates the getImageWithSize function to consider relative paths without a leading slash as the "base case." If a path has a leading slash, it's now removed, processed through the function, and then the slash is prepended back.

Updated YAML parser error to be InvalidUsageError

YAML parser errors now return a 4xx error instead of a 5xx error, correctly indicating that these issues can only be fixed by the user uploading a file rather than being server-side problems. Similarly, amp parser errors remain as 5xx errors as they indicate issues that need to be fixed at the code level.

Removed noise from members-ssr error logging

The error logging for members-ssr has been refined to use a more appropriate logging level instead of the error logger, which was too extreme for these types of errors. This update also removes stacktraces from the logs to improve readability during development and log analysis.

New Features

Added url value to the Content API /settings/ endpoint

The Content API's /settings/ endpoint now includes the site's url property in its response. This was added manually since it's a configuration value rather than a settings value, making it easier for developers to access this crucial piece of information.

Added ability to edit alt text for image cards

Content creators can now edit the alt text for image cards directly in the editor. This enhancement improves accessibility and SEO capabilities, allowing for better descriptions of images for screen readers and search engines.

Added global site SEO fields for theme helpers

This release introduces global site SEO fields that can be used in theme helpers, significantly improving SEO capabilities:

• Changed {{meta_title}} helper to use site 'meta_title' field
• Changed {{meta_description}} helper to use site 'meta_description' field
• Changed {{og_image}} helper to use site 'og_image' field
• Changed {{twitter_image}} helper to use site 'twitter_image' field
• Added site title handling for og/twitter metadata

Added logging for members-ssr errors

New logging has been implemented for members-ssr errors to help debug issues with members-ssr functionality. The logging has been refined to avoid excessive noise in logs while still providing useful debugging information.

Security Updates

Ensured Admin API cannot fetch internal integrations

Security has been enhanced by forcing a filter on read and browse requests to the integrations endpoint. This limits fetches to only "custom" and "builtin" integration types, preventing access to "internal" integrations. Test coverage for "internal" integrations has also been expanded to ensure this security measure is robust.

Performance Improvements

Dependency updates for improved performance

Several dependencies have been updated to their latest versions, which include performance improvements:

• Updated dependency @tryghost/helpers to v1.1.7
• Updated dependency @tryghost/social-urls to v0.1.1
• Updated dependency @tryghost/url-utils to v0.1.4
• Updated dependency gscan to v2.6.6
• Updated dependency intl-messageformat to v5.1.2
• Updated dependency knex to v0.19.1
• Updated dependency simple-html-tokenizer to v0.5.8

Added resolution for moment-timezone version

A resolution has been added to ensure Ghost uses moment-timezone version 0.5.23 until tests are updated to work with the latest version. This prevents potential performance issues that could arise from using an incompatible version.

Impact Summary

Ghost 2.26.0 delivers significant improvements across several areas:

For SEO and accessibility, the ability to edit alt text for image cards and the introduction of global site SEO fields provide site owners with better tools to optimize their content for search engines and improve accessibility.

For developers, the addition of the url value to the Content API settings endpoint, improved error handling, and fixes to the img_url helper enhance the development experience and fix known issues.

Security is strengthened by preventing the Admin API from accessing internal integrations, which is particularly important for multi-user Ghost installations.

The update to Casper (the default theme) to version 2.10.5 ensures that users on the default theme receive the latest improvements and fixes.

Overall, this release focuses on quality-of-life improvements, bug fixes, and security enhancements that benefit all types of Ghost users.

Full Release Notes