Ghost Release: 4.4.0

TL;DR

Ghost 4.4.0 introduces significant improvements to member management with a new @site.signup_url data property for themes, enhanced signup access controls, and OAuth login capabilities. This release also fixes a critical bug from v4.3.0 that incorrectly set all sites to allow free member signups. The theme service architecture has been substantially refactored for better separation between frontend and server components, laying groundwork for future improvements.

Highlight of the Release

• New @site.signup_url data property for themes simplifies subscription button implementation
• Enhanced member signup access controls with options for all, invite-only, or no signups
• OAuth login support for members with automatic password disabling
• Major refactoring of theme service architecture for better separation between frontend and server
• Fixed critical bug from v4.3.0 that incorrectly set all sites to allow free member signups

Migration Guide

For Theme Developers

• You can now use the new @site.signup_url data property in your themes to create subscription buttons without conditionals:

  <a href="{{@site.signup_url}}">Subscribe</a>
  

  This will automatically point to the correct URL based on whether members signup is enabled.

For Developers

• If you're using bson-objectid library, update your code to match API changes in v2:
  • The library now exports the function to generate an ObjectID directly
  • Use .toHexString() to get the 24 character hex string
  • Remove all uses of .generate() and replace with the new pattern

For Site Owners

• The member signup access settings have been updated with more granular control:
  • all: Allows both free and paid signups (default)
  • invite: Forces invite-only mode for all signups
  • none: Disables all member functionality
• If your site was affected by the v4.3.0 bug that incorrectly set all sites to allow free member signups, this release will automatically restore your correct settings

Upgrade Recommendations

This is a recommended upgrade for all Ghost users, especially those who:

1. Use the members feature and want more control over signup options
2. Were affected by the v4.3.0 bug that incorrectly set all sites to allow free member signups
3. Want to implement OAuth login for members
4. Are theme developers who want to simplify subscription button implementation

The upgrade process should be straightforward with no breaking changes for most users. The automatic fix for the v4.3.0 bug will restore correct member signup settings without manual intervention.

For developers with custom code that interacts with the theme service, review the architectural changes to ensure compatibility.

Bug Fixes

• Fixed critical bug from Ghost 4.3.0 migration that incorrectly set all sites to "allow free members signup" by:
  • Correcting the migration to properly handle string values instead of raw boolean values
  • Adding a restoration mechanism that finds the earliest backup file created during a 4.3 migration and uses the members_allow_free_signup value from there to correct members_signup_access if necessary
• Migrated 'invite' to 'all' for sites that were not truly invite-only, ensuring proper behavior for sites where signup should still be possible
• Updated members allowSelfSignup() function to take portal plans into account for proper access control
• Fixed broken require path for bridge in tests
• Fixed linting error

New Features

Member Management Enhancements

• Added @site.signup_url data property for themes that returns #/portal when members signup is enabled or a Feedly subscription URL otherwise
• Added option to disable member subscriptions entirely
• Enhanced member signup access controls with options for all, invite-only, or no signups
• Added OAuth login support for members:
  • Users with passwords can directly sign in via OAuth
  • Password is automatically disabled for users who log in via OAuth
  • Password is disabled for users accepting invitations

Configuration Improvements

• Added default API version to config to centralize version management
• Added read-only public OAuth enabled/disabled configuration
• Enabled "emails" limit configuration for newsletter functionality control

Subscription Management

• Added support for creating subscriptions via the Members Admin API
• Updated subscriptions to link to products in the Members Admin API

Security Updates

No specific security fixes were mentioned in this release.

Performance Improvements

• Refactored theme service architecture for better separation between frontend and server components
• Removed unnecessary cross-dependencies between server and frontend code
• Added a new bridge component that manages the flow of data from server/boot process to the frontend
• Simplified theme activation flows by centralizing logic

Impact Summary

Ghost 4.4.0 significantly enhances member management capabilities with new signup controls, OAuth login support, and a simplified theme data property for subscription buttons. The release fixes a critical bug from v4.3.0 that incorrectly configured member signup settings, automatically restoring the correct configuration for affected sites.

Behind the scenes, this version includes a major architectural refactoring of the theme service, creating better separation between frontend and server components through a new bridge pattern. This lays important groundwork for future improvements while maintaining backward compatibility.

For site owners, the enhanced member signup controls provide more granular options (all, invite-only, none), giving greater flexibility in how they manage their audience. Theme developers benefit from the new @site.signup_url data property that simplifies subscription button implementation without requiring conditional logic.

Overall, this release balances user-facing improvements with important architectural enhancements that strengthen Ghost's foundation for future development.

Full Release Notes