Ghost Release: 4.3.0

TL;DR

Ghost 4.3.0 introduces significant infrastructure for custom products and membership tiers, along with bulk member deletion capabilities. This release lays the groundwork for more flexible monetization options while improving member management. Note that there is a known bug affecting member signup settings that will require manual adjustment after updating.

Highlight of the Release

• Added bulk member deletion capability via the Admin API
• Laid foundation for custom products/membership tiers with new database tables and models
• Migrated member signup settings from binary option to more flexible access levels
• Added configurable limits to theme management
• Fixed markdown for linked images that were being mangled in some cases

Migration Guide

Upgrading to v4.3.0

1. Member Signup Settings: After upgrading, check your member signup settings as there is a known bug that may enable free signup on sites that were previously paid or invite-only. You'll need to manually toggle the "Allow free member signup" button to disabled again.

2. Theme Developers: If you've built custom themes that interact with the theme service directly, be aware that the theme service is being reorganized. While this release shouldn't break existing functionality, it's the beginning of a larger refactoring effort.

3. API Integrations: If you have custom integrations using the API key authentication, note that the code has been refactored to use async/await syntax. While this shouldn't affect external behavior, it's worth testing your integrations after upgrading.

4. Database Changes: This release adds several new tables (products, members_products, stripe_products, and stripe_prices) and modifies the subscriptions table. If you have any custom code that interacts directly with the database, you'll need to account for these changes.

Upgrade Recommendations

Priority: Medium

This release introduces important infrastructure for future monetization features and includes useful member management improvements. However, due to the known bug affecting member signup settings, site owners should plan for a brief maintenance window to verify and correct these settings after upgrading.

Who should upgrade immediately:

• Sites that want to use the new bulk member deletion feature
• Developers working on integrations that will leverage the upcoming product/membership tier functionality

Who can wait:

• Sites with critical member signup configurations that cannot risk the known bug
• Production sites that prefer to wait for the bugfix release (likely v4.3.1)

When upgrading, make sure to back up your database first and test the upgrade in a staging environment if possible.

Bug Fixes

Image Markdown Fix

Fixed an issue where markdown for linked images was still being mangled in some cases. This was caused by dependency versioning issues with @tryghost/url-utils in the yarn.lock file.

Limits Reloading Fix

Fixed an issue with limits not properly reloading during soft Ghost restarts.

Known Issue

⚠️ This release contains a bug that enables free signup on sites that were previously paid or invite-only. Until a fix is released, site owners will need to manually toggle the "Allow free member signup" button to disabled again after updating.

New Features

Bulk Member Deletion

Added a new DELETE /members/ endpoint to the Admin API that supports filtering which members to delete using the ?filter and ?search query parameters. For safety, the ?all=true parameter is required if no other filter or query is provided.

Products Infrastructure

This release lays the groundwork for custom products/membership tiers with:

• New database tables: products, members_products, stripe_products, and stripe_prices
• New models and relationships between these tables
• Permissions for the Products resource in the Admin API
• Initial Product API endpoints
• Automatic population of tables with existing membership data

Member Signup Access Levels

Migrated from the binary members_allow_free_signup setting to a more flexible members_signup_access setting with options for:

• all: Allow anyone to sign up (previously "yes")
• invite: Only allow invited members (previously "no")
• none: Completely disable members functionality

OAuth Settings Storage

Added settings keys (oauth_client_id and oauth_client_secret) to store OAuth-related data, with security measures to hide these secret settings once they're set.

Security Updates

Secret Settings Protection

Added functionality to hide secret settings (like OAuth credentials) once they are set, improving security by preventing these values from being exposed in the admin interface.

Performance Improvements

Code Refactoring

Several components were refactored to improve code quality and maintainability:

• API key authentication refactored to use async/await syntax for better clarity and reduced nesting
• Theme service code reorganization begun, moving the HBS engine into a new theme engine service
• This separation of theme storage components from rendering components will reduce tight coupling between the API and frontend

Dependency Updates

Multiple dependencies were updated to their latest versions, including:

• eslint to v7.24.0
• jwks-rsa to v2
• sqlite3 to v5
• Various @tryghost packages to unpin dependencies and avoid duplicate versions

Impact Summary

Ghost 4.3.0 represents a significant step toward more flexible monetization options through the introduction of product infrastructure. While most of these changes are foundational and not yet exposed in the user interface, they set the stage for upcoming features that will allow site owners to create custom membership tiers and products.

The most immediately useful feature is the new bulk member deletion capability, which will make member management much more efficient for sites with large member bases. This is particularly valuable for cleaning up inactive members or reorganizing member segments.

The migration from a binary free signup setting to a more nuanced access level system provides greater control over how members can join a site, though site owners should be aware of the known bug that may reset these settings during the upgrade.

For developers, this release includes significant database schema changes and new API endpoints that will enable building more sophisticated membership and monetization features. The ongoing refactoring of the theme service also signals Ghost's continued commitment to improving code quality and maintainability.

Overall, while this release contains an important bug to be aware of, it represents meaningful progress toward Ghost's vision of providing powerful monetization tools for creators and publishers.

Full Release Notes