Ghost Release: 3.23.1

TL;DR

Ghost 3.23.1 is a minor patch release that includes several dependency updates, fixes for the members magic link authentication, corrects the default Twitter social profile value, and optimizes the loading of the members JavaScript script. This release primarily focuses on maintenance and bug fixes rather than introducing new features.

⚠️ Important: There is an issue updating to 3.23.1 from earlier versions. It is recommended to update directly to 3.24.0 instead.

Highlight of the Release

• Fixed incorrect payload creation for magic link authentication tokens
• Updated default Twitter social profile value from 'tryghost' to 'ghost'
• Optimized members JavaScript script loading behind development flag
• Updated several dependencies including lodash to v4.17.19 and Sentry to v5.19.1

Migration Guide

No specific migration steps are required for this patch release. However, due to an identified issue when updating to 3.23.1 from earlier versions, it is strongly recommended to skip this version and update directly to Ghost 3.24.0 instead.

Upgrade Recommendations

⚠️ Important: There is an issue when updating to Ghost 3.23.1 from earlier versions. It is strongly recommended to skip this version and update directly to Ghost 3.24.0 instead.

If you are already running Ghost 3.23.1 without issues, you can continue using it until you're ready to upgrade to a newer version.

Bug Fixes

• Magic Link Authentication: Fixed incorrect payload creation for magic link tokens, improving the reliability of the email-based authentication system.
• Twitter Social Profile: Updated the default Twitter profile value from tryghost to the correct ghost value.
• Members JavaScript Loading: Fixed an issue where both old and new members JavaScript scripts were being loaded when the development flag was enabled. The redundant script loading has been removed in favor of using only the new script, which handles all required functionality.

New Features

No new features were introduced in this release. Ghost 3.23.1 is primarily a maintenance release focused on bug fixes and dependency updates.

Security Updates

• Dependency Updates: Updated lodash to v4.17.19 to address potential security vulnerabilities in earlier versions.
• Sentry Update: Updated @sentry/node to v5.19.1, which may include security improvements for error tracking and monitoring.

Performance Improvements

• Optimized Script Loading: Removed redundant loading of the old members JavaScript script when the development flag is enabled, as the new script already handles all the required functionality. This reduces unnecessary network requests and script processing.

Impact Summary

Ghost 3.23.1 is a minor patch release with minimal user-visible changes. The most significant improvements are behind-the-scenes fixes for magic link authentication, correction of the default Twitter profile value, and optimization of script loading for developers using the platform with the development flag enabled.

The release includes important dependency updates, particularly for lodash (updated to v4.17.19) to address potential security vulnerabilities. While these changes are not directly visible to end users, they contribute to the overall security and stability of the Ghost platform.

Due to an identified issue with updating to this version from earlier releases, administrators should be aware that it's recommended to skip this version and update directly to Ghost 3.24.0 instead.

Full Release Notes