Ghost Release: 2.36.0

TL;DR

Ghost 2.36.0: Enhanced Members Email Customization

This release focuses on improving the members email system in Ghost, adding capabilities for customization of email content, subjects, and sender addresses. It also includes improvements to the API for handling member-only content visibility and renames a key setting for member signup configuration.

Note: This release was marked with a critical warning about potential content loss when editing with markdown cards. Users should exercise caution or wait for a patched version.

Highlight of the Release

• Enhanced customization for member emails including custom 'from' addresses, subjects, and text content
• Added visibility property for posts in the canary API to support styling member-only content
• Improved email authentication with HS256 signed tokens for magic links
• Renamed member setting from requirePaymentForSignup to allowSelfSignup for clarity
• Fixed button styling to use sentence case instead of title case

Migration Guide

Migration Notes

1. Setting Rename: The member setting requirePaymentForSignup has been renamed to allowSelfSignup to match members API usage. If you're accessing this setting programmatically, you'll need to update your code.

2. New Auth Secret: This release introduces a new members_email_auth_secret setting used for signing HS256 JWTs. It requires a 64-byte (256-bit) hex string. The system should handle this automatically, but custom implementations that interact with member authentication may need adjustments.

3. Email Customization: If you have custom code that interacts with the Ghost email system, note that GhostMailer has been extended to accept a from parameter and support custom text content.

Upgrade Recommendations

CAUTION: DO NOT UPGRADE TO THIS VERSION

This release contains a critical bug that could result in lost content when editing content with markdown cards. It is recommended to:

1. Skip this version and wait for a patched release
2. If you've already upgraded, avoid editing content with markdown cards until a fix is available
3. Consider downgrading to the previous stable version (2.35.0) if you frequently work with markdown cards

For those who don't use markdown cards or can work around this issue, the other improvements in this release primarily benefit sites with member functionality.

Bug Fixes

• Fixed styling issues in member email templates
• Removed text-transform: capitalize from buttons to ensure proper sentence case instead of title case
• Fixed regression test for canary content API to account for the new visibility field

New Features

Enhanced Members Email System

• Customizable 'From' Address: Added support for customizing the sender address in member emails
• Custom Email Subjects: Implemented functionality to customize email subjects for member communications
• Plaintext Email Support: Added proper support for plaintext versions of member emails
• Email Templates: Introduced new member email templates with improved styling
• Better Magic Links: Implemented HS256 signed tokens for magic links, resulting in much smaller links
• New Email Auth Secret: Added members_email_auth_secret setting for signing HS256 JWTs (requires a 256-bit/64-byte hex string)

API Improvements

• Post Visibility Property: Exposed visibility property for posts on the canary API, allowing theme developers to style member-only content differently

Security Updates

No specific security fixes were mentioned in this release.

Performance Improvements

• Implemented smaller magic links for members by using HS256 signed tokens instead of the previous implementation
• Improved settings model tests to make them less brittle and less reliant on correctly indexing arrays

Impact Summary

Ghost 2.36.0 significantly enhances the members email system with customization options for sender addresses, subjects, and content formatting. It also improves the API to better support member-only content in themes. However, these improvements are overshadowed by a critical bug affecting markdown cards that could result in content loss.

The email enhancements provide site administrators with more flexibility in how they communicate with members, while the API changes give theme developers better tools for creating distinctive experiences for member-only content. The renamed member signup setting (requirePaymentForSignup → allowSelfSignup) better reflects its actual function.

Despite these positive changes, the critical markdown card bug makes this release unsuitable for production use, especially for sites that rely heavily on markdown cards for content creation. Users should wait for a patched version before upgrading.

Full Release Notes