Skip to content

[pull] main from TryGhost:main#1044

Merged
pull[bot] merged 18 commits into
code:mainfrom
TryGhost:main
Apr 9, 2026
Merged

[pull] main from TryGhost:main#1044
pull[bot] merged 18 commits into
code:mainfrom
TryGhost:main

Conversation

@pull
Copy link
Copy Markdown

@pull pull Bot commented Apr 9, 2026

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

minimaluminium and others added 18 commits April 9, 2026 18:19
…27288)

no issues 

- Moved the redemption link inside the gray data container so the gift
details and the link to share read as one block.
- Added a "Send to recipient" button below the link that opens the
buyer's default mail client with a friendly subject and body
prefilled. The visible link above remains as a fallback.
- Appended eligibility info to the expiration footnote so buyers know
upfront that gifts can only be redeemed by free or new members.
- Updated the intro paragraph color from #738A94 (chrome) to #3A464C
(body) to match the convention used in other transactional emails
like new-comment.hbs.
- Switched the tier/cadence separator from parens to a bullet, matching
    the rest of the email family.
no issue

Updated `@tryghost/*` SDK packages (from
[TryGhost/SDK](https://github.com/TryGhost/SDK)) to their latest
published versions across the monorepo. Also bumped
`@tryghost/announcement-bar` to 1.1.15.

### Updated packages

| Package | Previous | Updated | Changed in |
|---|---|---|---|
| `@tryghost/color-utils` | 0.2.10 | 0.2.16 | `ghost/core`,
`ghost/admin`, `admin-x-settings` |
| `@tryghost/config-url-helpers` | 1.0.17 | 1.0.23 | `ghost/core` |
| `@tryghost/content-api` | 1.12.0 | 1.12.6 | `announcement-bar` |
| `@tryghost/custom-fonts` | 1.0.2 | 1.0.8 | `ghost/core`,
`admin-x-settings` |
| `@tryghost/helpers` | 1.1.97 | 1.1.103 | `ghost/core`, `ghost/admin` |
| `@tryghost/html-to-plaintext` | 1.0.4 | 1.0.8 | `ghost/core` |
| `@tryghost/limit-service` | 1.4.1 | 1.5.2 | `ghost/core`,
`ghost/admin`, `admin-x-settings` |
| `@tryghost/members-csv` | 2.0.3 | 2.0.5 | `ghost/core`, `ghost/admin`
|
| `@tryghost/string` | 0.2.17 | 0.3.2 | `ghost/core`, `ghost/admin` |
| `@tryghost/timezone-data` | 0.4.12 | 0.4.18 | `ghost/admin`,
`admin-x-settings` |
)

no issues

The staff notification for gift subscription purchases previously only
showed the buyer name and amount. With this change it also shows the
tier
and cadence the buyer purchased (e.g. "Premium • 1 year"), so publishers
  can see at a glance what was actually bought.

---------

Co-authored-by: Michael Barrett <mike@ghost.org>
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
|
[@tryghost/email-mock-receiver](https://redirect.github.com/TryGhost/framework)
([source](https://redirect.github.com/TryGhost/framework/tree/HEAD/packages/email-mock-receiver))
| [`0.3.11` →
`0.3.16`](https://renovatebot.com/diffs/npm/@tryghost%2femail-mock-receiver/0.3.11/0.3.16)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@tryghost%2femail-mock-receiver/0.3.16?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@tryghost%2femail-mock-receiver/0.3.11/0.3.16?slim=true)
|
|
[@tryghost/express-test](https://redirect.github.com/TryGhost/framework)
([source](https://redirect.github.com/TryGhost/framework/tree/HEAD/packages/express-test))
| [`0.15.0` →
`0.15.5`](https://renovatebot.com/diffs/npm/@tryghost%2fexpress-test/0.15.0/0.15.5)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@tryghost%2fexpress-test/0.15.5?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@tryghost%2fexpress-test/0.15.0/0.15.5?slim=true)
|
|
[@tryghost/webhook-mock-receiver](https://redirect.github.com/TryGhost/framework)
([source](https://redirect.github.com/TryGhost/framework/tree/HEAD/packages/webhook-mock-receiver))
| [`0.2.17` →
`0.2.22`](https://renovatebot.com/diffs/npm/@tryghost%2fwebhook-mock-receiver/0.2.17/0.2.22)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@tryghost%2fwebhook-mock-receiver/0.2.22?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@tryghost%2fwebhook-mock-receiver/0.2.17/0.2.22?slim=true)
|

---

### Release Notes

<details>
<summary>TryGhost/framework
(@&#8203;tryghost/email-mock-receiver)</summary>

###
[`v0.3.16`](https://redirect.github.com/TryGhost/framework/compare/@tryghost/email-mock-receiver@0.3.15...@tryghost/email-mock-receiver@0.3.16)

[Compare
Source](https://redirect.github.com/TryGhost/framework/compare/@tryghost/email-mock-receiver@0.3.15...@tryghost/email-mock-receiver@0.3.16)

###
[`v0.3.15`](https://redirect.github.com/TryGhost/framework/compare/@tryghost/email-mock-receiver@0.3.14...@tryghost/email-mock-receiver@0.3.15)

[Compare
Source](https://redirect.github.com/TryGhost/framework/compare/@tryghost/email-mock-receiver@0.3.14...@tryghost/email-mock-receiver@0.3.15)

###
[`v0.3.14`](https://redirect.github.com/TryGhost/framework/compare/@tryghost/email-mock-receiver@0.3.13...@tryghost/email-mock-receiver@0.3.14)

[Compare
Source](https://redirect.github.com/TryGhost/framework/compare/@tryghost/email-mock-receiver@0.3.13...@tryghost/email-mock-receiver@0.3.14)

###
[`v0.3.13`](https://redirect.github.com/TryGhost/framework/compare/@tryghost/email-mock-receiver@0.3.12...@tryghost/email-mock-receiver@0.3.13)

[Compare
Source](https://redirect.github.com/TryGhost/framework/compare/@tryghost/email-mock-receiver@0.3.12...@tryghost/email-mock-receiver@0.3.13)

###
[`v0.3.12`](https://redirect.github.com/TryGhost/framework/compare/@tryghost/email-mock-receiver@0.3.11...@tryghost/email-mock-receiver@0.3.12)

[Compare
Source](https://redirect.github.com/TryGhost/framework/compare/@tryghost/email-mock-receiver@0.3.11...@tryghost/email-mock-receiver@0.3.12)

</details>

<details>
<summary>TryGhost/framework (@&#8203;tryghost/express-test)</summary>

###
[`v0.15.5`](https://redirect.github.com/TryGhost/framework/compare/@tryghost/express-test@0.15.4...@tryghost/express-test@0.15.5)

[Compare
Source](https://redirect.github.com/TryGhost/framework/compare/@tryghost/express-test@0.15.4...@tryghost/express-test@0.15.5)

###
[`v0.15.4`](https://redirect.github.com/TryGhost/framework/compare/@tryghost/express-test@0.15.3...@tryghost/express-test@0.15.4)

[Compare
Source](https://redirect.github.com/TryGhost/framework/compare/@tryghost/express-test@0.15.3...@tryghost/express-test@0.15.4)

###
[`v0.15.3`](https://redirect.github.com/TryGhost/framework/compare/@tryghost/express-test@0.15.2...@tryghost/express-test@0.15.3)

[Compare
Source](https://redirect.github.com/TryGhost/framework/compare/@tryghost/express-test@0.15.2...@tryghost/express-test@0.15.3)

###
[`v0.15.2`](https://redirect.github.com/TryGhost/framework/compare/@tryghost/express-test@0.15.1...@tryghost/express-test@0.15.2)

[Compare
Source](https://redirect.github.com/TryGhost/framework/compare/@tryghost/express-test@0.15.1...@tryghost/express-test@0.15.2)

###
[`v0.15.1`](https://redirect.github.com/TryGhost/framework/compare/@tryghost/express-test@0.15.0...@tryghost/express-test@0.15.1)

[Compare
Source](https://redirect.github.com/TryGhost/framework/compare/@tryghost/express-test@0.15.0...@tryghost/express-test@0.15.1)

</details>

<details>
<summary>TryGhost/framework
(@&#8203;tryghost/webhook-mock-receiver)</summary>

###
[`v0.2.22`](https://redirect.github.com/TryGhost/framework/compare/@tryghost/webhook-mock-receiver@0.2.21...@tryghost/webhook-mock-receiver@0.2.22)

[Compare
Source](https://redirect.github.com/TryGhost/framework/compare/@tryghost/webhook-mock-receiver@0.2.21...@tryghost/webhook-mock-receiver@0.2.22)

###
[`v0.2.21`](https://redirect.github.com/TryGhost/framework/compare/@tryghost/webhook-mock-receiver@0.2.20...@tryghost/webhook-mock-receiver@0.2.21)

[Compare
Source](https://redirect.github.com/TryGhost/framework/compare/@tryghost/webhook-mock-receiver@0.2.20...@tryghost/webhook-mock-receiver@0.2.21)

###
[`v0.2.20`](https://redirect.github.com/TryGhost/framework/compare/@tryghost/webhook-mock-receiver@0.2.19...@tryghost/webhook-mock-receiver@0.2.20)

[Compare
Source](https://redirect.github.com/TryGhost/framework/compare/@tryghost/webhook-mock-receiver@0.2.19...@tryghost/webhook-mock-receiver@0.2.20)

###
[`v0.2.19`](https://redirect.github.com/TryGhost/framework/compare/@tryghost/webhook-mock-receiver@0.2.18...@tryghost/webhook-mock-receiver@0.2.19)

[Compare
Source](https://redirect.github.com/TryGhost/framework/compare/@tryghost/webhook-mock-receiver@0.2.18...@tryghost/webhook-mock-receiver@0.2.19)

###
[`v0.2.18`](https://redirect.github.com/TryGhost/framework/compare/@tryghost/webhook-mock-receiver@0.2.17...@tryghost/webhook-mock-receiver@0.2.18)

[Compare
Source](https://redirect.github.com/TryGhost/framework/compare/@tryghost/webhook-mock-receiver@0.2.17...@tryghost/webhook-mock-receiver@0.2.18)

</details>

---

### Configuration

📅 **Schedule**: (in timezone Etc/UTC)

- Branch creation
  - Only on Sunday and Saturday (`* * * * 0,6`)
  - Between 12:00 AM and 12:59 PM, only on Monday (`* 0-12 * * 1`)
- Between 09:00 PM and 11:59 PM, Monday through Friday (`* 21-23 * *
1-5`)
- Between 12:00 AM and 04:59 AM, Tuesday through Saturday (`* 0-4 * *
2-6`)
- Automerge
  - Only on Sunday and Saturday (`* * * * 0,6`)
  - Between 12:00 AM and 12:59 PM, only on Monday (`* 0-12 * * 1`)
- Between 10:00 PM and 11:59 PM, Monday through Friday (`* 22-23 * *
1-5`)
- Between 12:00 AM and 04:59 AM, Tuesday through Saturday (`* 0-4 * *
2-6`)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/TryGhost/Ghost).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMTAuMiIsInVwZGF0ZWRJblZlciI6IjQzLjExMC4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [@playwright/test](https://playwright.dev)
([source](https://redirect.github.com/microsoft/playwright)) | [`1.58.2`
→
`1.59.1`](https://renovatebot.com/diffs/npm/@playwright%2ftest/1.58.2/1.59.1)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/@playwright%2ftest/1.59.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/@playwright%2ftest/1.58.2/1.59.1?slim=true)
|

---

### Release Notes

<details>
<summary>microsoft/playwright (@&#8203;playwright/test)</summary>

###
[`v1.59.1`](https://redirect.github.com/microsoft/playwright/compare/v1.59.0...d466ac5358cae058cdc75d2ae3ab3ad220042730)

[Compare
Source](https://redirect.github.com/microsoft/playwright/compare/v1.59.0...v1.59.1)

###
[`v1.59.0`](https://redirect.github.com/microsoft/playwright/compare/v1.58.2...01b2b1533e0bfa1c582117e3ec109fcb57657747)

[Compare
Source](https://redirect.github.com/microsoft/playwright/compare/v1.58.2...v1.59.0)

</details>

---

### Configuration

📅 **Schedule**: (in timezone Etc/UTC)

- Branch creation
  - Only on Sunday and Saturday (`* * * * 0,6`)
  - Between 12:00 AM and 12:59 PM, only on Monday (`* 0-12 * * 1`)
- Between 09:00 PM and 11:59 PM, Monday through Friday (`* 21-23 * *
1-5`)
- Between 12:00 AM and 04:59 AM, Tuesday through Saturday (`* 0-4 * *
2-6`)
- Automerge
  - Only on Sunday and Saturday (`* * * * 0,6`)
  - Between 12:00 AM and 12:59 PM, only on Monday (`* 0-12 * * 1`)
- Between 10:00 PM and 11:59 PM, Monday through Friday (`* 22-23 * *
1-5`)
- Between 12:00 AM and 04:59 AM, Tuesday through Saturday (`* 0-4 * *
2-6`)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/TryGhost/Ghost).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMTAuMiIsInVwZGF0ZWRJblZlciI6IjQzLjExMC4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Hannah Wolfe <github.erisds@gmail.com>
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [lint-staged](https://redirect.github.com/lint-staged/lint-staged) |
[`15.5.2` →
`16.4.0`](https://renovatebot.com/diffs/npm/lint-staged/15.5.2/16.4.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/lint-staged/16.4.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/lint-staged/15.5.2/16.4.0?slim=true)
|

---

### Release Notes

<details>
<summary>lint-staged/lint-staged (lint-staged)</summary>

###
[`v16.4.0`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1640)

[Compare
Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.3.4...v16.4.0)

##### Minor Changes

-
[#&#8203;1739](https://redirect.github.com/lint-staged/lint-staged/pull/1739)
[`687fc90`](https://redirect.github.com/lint-staged/lint-staged/commit/687fc9069a312ac83ca48f035a1bbf453db91814)
Thanks [@&#8203;hyperz111](https://redirect.github.com/hyperz111)! -
Replace `micromatch` with `picomatch` to reduce dependencies.

###
[`v16.3.4`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1634)

[Compare
Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.3.3...v16.3.4)

##### Patch Changes

-
[#&#8203;1742](https://redirect.github.com/lint-staged/lint-staged/pull/1742)
[`9d6e827`](https://redirect.github.com/lint-staged/lint-staged/commit/9d6e827b0c55da5b091c989111f6c55dd76539d9)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - Update
dependencies, including
[`tinyexec@1.0.4`](https://redirect.github.com/tinylibs/tinyexec/releases/tag/1.0.4)
to make sure local `node_modules/.bin` are preferred to global locations
(released in
[`tinyexec@1.0.3`](https://redirect.github.com/tinylibs/tinyexec/releases/tag/1.0.3)).

###
[`v16.3.3`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1633)

[Compare
Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.3.2...v16.3.3)

##### Patch Changes

-
[#&#8203;1740](https://redirect.github.com/lint-staged/lint-staged/pull/1740)
[`0109e8d`](https://redirect.github.com/lint-staged/lint-staged/commit/0109e8d1507409d950dab0d65ce27bd40b1137c7)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - Make sure
Git's warning about CRLF line-endings doesn't interfere with creating
initial backup stash.

###
[`v16.3.2`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1632)

[Compare
Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.3.1...v16.3.2)

##### Patch Changes

-
[#&#8203;1735](https://redirect.github.com/lint-staged/lint-staged/pull/1735)
[`2adaf6c`](https://redirect.github.com/lint-staged/lint-staged/commit/2adaf6c3a76152abddbf23b749dfa5d62982f3cf)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - Hide the
extra `cmd` window on Windows by spawning tasks without the `detached`
option.

###
[`v16.3.1`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1631)

[Compare
Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.3.0...v16.3.1)

##### Patch Changes

-
[#&#8203;1729](https://redirect.github.com/lint-staged/lint-staged/pull/1729)
[`cd5d762`](https://redirect.github.com/lint-staged/lint-staged/commit/cd5d762c288bcfe36274c32f018cea97dfe11280)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - Remove
`nano-spawn` as a dependency from `package.json` as it was replaced with
`tinyexec` and is no longer used.

###
[`v16.3.0`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1630)

[Compare
Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.2.7...v16.3.0)

##### Minor Changes

-
[#&#8203;1698](https://redirect.github.com/lint-staged/lint-staged/pull/1698)
[`feda37a`](https://redirect.github.com/lint-staged/lint-staged/commit/feda37aa590789e847f32a4aabc346af1d79c547)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - Run
external processes with
[`tinyexec`](https://redirect.github.com/tinylibs/tinyexec) instead of
[`nano-spawn`](https://redirect.github.com/sindresorhus/nano-spawn).
`nano-spawn` replaced
[`execa`](https://redirect.github.com/sindresorhus/execa) in
*lint-staged* version 16 to limit the amount of npm dependencies
required, but caused some unknown issues related to spawning tasks.
Let's hope `tinyexec` improves the situation.

-
[#&#8203;1699](https://redirect.github.com/lint-staged/lint-staged/pull/1699)
[`1346d16`](https://redirect.github.com/lint-staged/lint-staged/commit/1346d16387e188911ef64e8bad6b8a6252cb6d71)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - Remove
`pidtree` as a dependency. When a task fails, its sub-processes are
killed more efficiently via the process group on Unix systems, and the
`taskkill` command on Windows.

##### Patch Changes

-
[#&#8203;1726](https://redirect.github.com/lint-staged/lint-staged/pull/1726)
[`87467aa`](https://redirect.github.com/lint-staged/lint-staged/commit/87467aaa76e1edc2547f3f3d462a4495afa5337d)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - Incorrect
brace expansions like `*.{js}` (*nothing to expand*) are detected
exhaustively, instead of just a single pass.

###
[`v16.2.7`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1627)

[Compare
Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.2.6...v16.2.7)

##### Patch Changes

-
[#&#8203;1711](https://redirect.github.com/lint-staged/lint-staged/pull/1711)
[`ef74c8d`](https://redirect.github.com/lint-staged/lint-staged/commit/ef74c8d165d5acd3ce88567e02b891e0e9af8e0e)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - Do not
display a "*failed to spawn*" error message when a task fails normally.
This message is reserved for when the task didn't run because spawning
it failed.

###
[`v16.2.6`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1626)

[Compare
Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.2.5...v16.2.6)

##### Patch Changes

-
[#&#8203;1693](https://redirect.github.com/lint-staged/lint-staged/pull/1693)
[`33d4502`](https://redirect.github.com/lint-staged/lint-staged/commit/33d4502ef9c939a9c6f41fc630a34e0985220f8e)
Thanks
[@&#8203;Adrian-Baran-GY](https://redirect.github.com/Adrian-Baran-GY)!
- Fix problems with `--continue-on-error` option, where tasks might have
still been killed (`SIGINT`) when one of them failed.

###
[`v16.2.5`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1625)

[Compare
Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.2.4...v16.2.5)

##### Patch Changes

-
[#&#8203;1687](https://redirect.github.com/lint-staged/lint-staged/pull/1687)
[`9e02d9d`](https://redirect.github.com/lint-staged/lint-staged/commit/9e02d9dc8a84bfeb7995520f00f7080b07a2e839)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - Fix
unhandled promise rejection when spawning tasks (*instead of the tasks
themselves failing*). Previously when a task failed to spawn,
*lint-staged* also failed and the backup stash might not have been
automatically restored.

###
[`v16.2.4`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1624)

[Compare
Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.2.3...v16.2.4)

##### Patch Changes

-
[#&#8203;1682](https://redirect.github.com/lint-staged/lint-staged/pull/1682)
[`0176038`](https://redirect.github.com/lint-staged/lint-staged/commit/01760380e57080d136cc396455346c36aef5770e)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - Update
dependencies, including
[`nano-spawn@2.0.0`](https://redirect.github.com/sindresorhus/nano-spawn/releases/tag/v2.0.0)
with bug fixes.

-
[#&#8203;1671](https://redirect.github.com/lint-staged/lint-staged/pull/1671)
[`581a54e`](https://redirect.github.com/lint-staged/lint-staged/commit/581a54eea6ba3a3a1b715407c895f63a961903f3)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - Speed up
execution by only importing the `yaml` depedency if using YAML
configuration files.

###
[`v16.2.3`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1623)

[Compare
Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.2.2...v16.2.3)

##### Patch Changes

-
[#&#8203;1669](https://redirect.github.com/lint-staged/lint-staged/pull/1669)
[`27cd541`](https://redirect.github.com/lint-staged/lint-staged/commit/27cd5413d973baea6b4f3da704fb3bee8298e751)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - When using
`--fail-on-changes`, automatically hidden (partially) unstaged changes
are no longer counted to make *lint-staged* fail.

###
[`v16.2.2`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1622)

[Compare
Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.2.1...v16.2.2)

##### Patch Changes

-
[#&#8203;1667](https://redirect.github.com/lint-staged/lint-staged/pull/1667)
[`699f95d`](https://redirect.github.com/lint-staged/lint-staged/commit/699f95df8f89ac7f7d360bbf93740d19d5899ac5)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - The backup
stash will not be dropped when using `--fail-on-changes` and there are
errors. When reverting to original state is disabled (via `--no-revert`
or `--fail-on-changes`), hidden (partially) unstaged changes are still
restored automatically so that it's easier to resolve the situation
manually.

Additionally, the example for using the backup stash manually now uses
the correct backup hash, if available:

  ```shell
  % npx lint-staged --fail-on-changes
  ✔ Backed up original state in git stash (c18d55a3)
  ✔ Running tasks for staged files...
  ✖ Tasks modified files and --fail-on-changes was used!
  ↓ Cleaning up temporary files...

  ✖ lint-staged failed because `--fail-on-changes` was used.

  Any lost modifications can be restored from a git stash:

    > git stash list --format="%h %s"
    c18d55a3 On main: lint-staged automatic backup
    > git apply --index c18d55a3
  ```

###
[`v16.2.1`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1621)

[Compare
Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.2.0...v16.2.1)

##### Patch Changes

-
[#&#8203;1664](https://redirect.github.com/lint-staged/lint-staged/pull/1664)
[`8277b3b`](https://redirect.github.com/lint-staged/lint-staged/commit/8277b3b298421ebbb39c43d7e3538481e15c4659)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - The
built-in TypeScript types have been updated to more closely match the
implementation. Notably, the list of staged files supplied to task
functions is `readonly string[]` and can't be mutated. Thanks
[@&#8203;outslept](https://redirect.github.com/outslept)!

  ```diff
  export default {
  ---  "*": (files: string[]) => void console.log('staged files', files)
+++ "*": (files: readonly string[]) => void console.log('staged files',
files)
  }
  ```

-
[#&#8203;1654](https://redirect.github.com/lint-staged/lint-staged/pull/1654)
[`70b9af3`](https://redirect.github.com/lint-staged/lint-staged/commit/70b9af3ac3fd66af94936e55bb3e91381937b41f)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - This
version has been published from GitHub Actions using [Trusted Publishing
for npm packages](https://docs.npmjs.com/trusted-publishers).

-
[#&#8203;1659](https://redirect.github.com/lint-staged/lint-staged/pull/1659)
[`4996817`](https://redirect.github.com/lint-staged/lint-staged/commit/49968170abb3bab7ac8dc0a6bc5ea92850337baa)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - Fix
searching configuration files when the working directory is a
subdirectory of a git repository, and there are `package.json` files in
the working directory. This situation might happen when running
*lint-staged* for a single package in a monorepo.

-
[#&#8203;1654](https://redirect.github.com/lint-staged/lint-staged/pull/1654)
[`7021f0a`](https://redirect.github.com/lint-staged/lint-staged/commit/7021f0af40ac1d5787501894c0f2222980023703)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - Return the
caret semver range (`^`) to direct dependencies so that future patch and
minor versions are allowed. This enables projects to better maintain and
deduplicate their own transitive dependencies while not requiring direct
updates to *lint-staged*. This was changed in
[16.2.0](https://redirect.github.com/lint-staged/lint-staged/releases/tag/v16.2.0)
after the vulnerability issues with `chalk` and `debug`, which were also
removed in the same version.

Given the recent vulnerabilities in the *npm* ecosystem, it's best to be
very careful when updating dependencies.

###
[`v16.2.0`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1620)

[Compare
Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.1.6...v16.2.0)

##### Minor Changes

-
[#&#8203;1615](https://redirect.github.com/lint-staged/lint-staged/pull/1615)
[`99eb742`](https://redirect.github.com/lint-staged/lint-staged/commit/99eb74200e8db69e72dba45314025953b8b0794e)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - Added a new
option `--fail-on-changes` to make *lint-staged* exit with code 1 when
tasks modify any files, making the `precommit` hook fail. This is
similar to the `git diff --exit-code` option. Using this flag also
implies the `--no-revert` flag which means any changes made by tasks
will be left in the working tree after failing, so that they can be
manually staged and the commit tried again.

-
[#&#8203;1611](https://redirect.github.com/lint-staged/lint-staged/pull/1611)
[`cd05fd3`](https://redirect.github.com/lint-staged/lint-staged/commit/cd05fd349594baf586fbafb05588ff07d86060b7)
Thanks [@&#8203;rlorenzo](https://redirect.github.com/rlorenzo)! - Added
a new option `--continue-on-error` so that *lint-staged* will run all
tasks to completion even if some of them fail. By default, *lint-staded*
will exit early on the first failure.

-
[#&#8203;1637](https://redirect.github.com/lint-staged/lint-staged/pull/1637)
[`82fcc07`](https://redirect.github.com/lint-staged/lint-staged/commit/82fcc0789c17bf6b2ea2649147abec77fa619375)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - Internal
*lint-staged* errors are now thrown and visible in the console output.
Previously they were caught with the process exit code set to 1, but not
logged. This happens when, for example, there's a syntax error in the
*lint-staged* configuration file.

-
[#&#8203;1647](https://redirect.github.com/lint-staged/lint-staged/pull/1647)
[`a5ecc06`](https://redirect.github.com/lint-staged/lint-staged/commit/a5ecc0605d52756167417c84cb0007ea7bceaaa3)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - Remove
[debug](https://redirect.github.com/debug-js/debug) as a dependency due
to recent malware issue; read more at
[debug-js/debug#1005](https://redirect.github.com/debug-js/debug/issues/1005).
Because of this, the `DEBUG` environment variable is no longer supported
— use the `--debug` to enable debugging

-
[#&#8203;1636](https://redirect.github.com/lint-staged/lint-staged/pull/1636)
[`8db2717`](https://redirect.github.com/lint-staged/lint-staged/commit/8db2717574ebfa2b80e0fc4eb0b24d705fd264fc)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - Added a new
option `--hide-unstaged` so that *lint-staged* will hide all unstaged
changes to tracked files before running tasks. The changes will be
applied back after running the tasks. Note that the combination of flags
`--hide-unstaged --no-hide-partially-staged` isn't meaningful and
behaves the same as just `--hide-unstaged`.

Thanks to
[@&#8203;ItsNickBarry](https://redirect.github.com/ItsNickBarry) for the
idea and initial implementation in
[#&#8203;1552](https://redirect.github.com/lint-staged/lint-staged/pull/1552).

-
[#&#8203;1648](https://redirect.github.com/lint-staged/lint-staged/pull/1648)
[`7900b3b`](https://redirect.github.com/lint-staged/lint-staged/commit/7900b3b79c5e2e69662cb8b1bcbcae79c3549421)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - Remove
[lilconfig](https://redirect.github.com/antonk52/lilconfig) to reduce
reliance on third-party dependencies. It was used to find possible
config files outside of those tracked in Git, including from the parent
directories. This behavior has been moved directly into *lint-staged*
and should work about the same.

##### Patch Changes

-
[#&#8203;1633](https://redirect.github.com/lint-staged/lint-staged/pull/1633)
[`7f9e485`](https://redirect.github.com/lint-staged/lint-staged/commit/7f9e485a981707897e0d417f6a62008f0c098e00)
Thanks
[@&#8203;dependabot](https://redirect.github.com/apps/dependabot)! -
Bumps [listr2](https://redirect.github.com/listr2/listr2) from 9.0.3 to
9.0.4.

-
[#&#8203;1626](https://redirect.github.com/lint-staged/lint-staged/pull/1626)
[`99d5a9b`](https://redirect.github.com/lint-staged/lint-staged/commit/99d5a9b0ddcba7d471d39ff3969d37988f1e2705)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - Due to
recent phishing attacks, for example
[chalk@5.6.1](https://redirect.github.com/chalk/chalk/issues/656) was
released with malware. To avoid *lint-staged*'s users being at risk the
**direct dependencies are pinned to exact versions**, instead of
allowing future patch versions with the [caret (`^`)
range](https://docs.npmjs.com/cli/v6/using-npm/semver#caret-ranges-123-025-004).

-
[#&#8203;1588](https://redirect.github.com/lint-staged/lint-staged/pull/1588)
[`035bbf2`](https://redirect.github.com/lint-staged/lint-staged/commit/035bbf268ac47bbaf2cfa737c3b2240d38feb22e)
Thanks [@&#8203;outslept](https://redirect.github.com/outslept)! -
Increase performance by listing staged files and searching for
configuration concurrently.

-
[#&#8203;1645](https://redirect.github.com/lint-staged/lint-staged/pull/1645)
[`deba3ad`](https://redirect.github.com/lint-staged/lint-staged/commit/deba3ad83581938dd71b86b563e62827b5fc2a0a)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - Remove
[chalk](https://redirect.github.com/chalk/chalk) as a dependency due to
recent malware issue; read more at
[chalk/chalk#656](https://redirect.github.com/chalk/chalk/issues/656).

If you are having trouble with ANSI color codes when using
*lint-staged*, you can try setting either `FORCE_COLOR=true` or
`NO_COLOR=true` env variables.

###
[`v16.1.6`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1616)

[Compare
Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.1.5...v16.1.6)

##### Patch Changes

-
[#&#8203;1610](https://redirect.github.com/lint-staged/lint-staged/pull/1610)
[`e93578e`](https://redirect.github.com/lint-staged/lint-staged/commit/e93578e265a69ed6b02fcaa11486078c1bdbdaaa)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - Try to
improve terminating of subprocess of tasks by using `SIGKILL`, and only
calling `pidtree` when the the main task process has a known pid.

###
[`v16.1.5`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1615)

[Compare
Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.1.4...v16.1.5)

##### Patch Changes

-
[#&#8203;1608](https://redirect.github.com/lint-staged/lint-staged/pull/1608)
[`4e3ce22`](https://redirect.github.com/lint-staged/lint-staged/commit/4e3ce225b33f759f78a84d156189dc38e536cdc6)
Thanks [@&#8203;srsatt](https://redirect.github.com/srsatt)! - Detect
the git repo's top-level directory correctly when in a worktree.

###
[`v16.1.4`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1614)

[Compare
Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.1.3...v16.1.4)

##### Patch Changes

-
[#&#8203;1604](https://redirect.github.com/lint-staged/lint-staged/pull/1604)
[`90b37b0`](https://redirect.github.com/lint-staged/lint-staged/commit/90b37b00c2c30b9cacf6c080f6a0885e1151eb7a)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - Add another
`types` field to `package.json` to make even more sure NPM detects that
*lint-staged* includes built-in TypeScript type definitions.

###
[`v16.1.3`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1613)

[Compare
Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.1.2...v16.1.3)

##### Patch Changes

-
[#&#8203;1602](https://redirect.github.com/lint-staged/lint-staged/pull/1602)
[`7ea700b`](https://redirect.github.com/lint-staged/lint-staged/commit/7ea700bcf3d0078a01720a9c8dc13a271387afbd)
Thanks [@&#8203;dword-design](https://redirect.github.com/dword-design)!
- Add the `types` field to `package.json` to make sure NPM detects
*lint-staged* includes built-in TypeScript type definitions.

###
[`v16.1.2`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1612)

[Compare
Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.1.1...v16.1.2)

##### Patch Changes

-
[#&#8203;1570](https://redirect.github.com/lint-staged/lint-staged/pull/1570)
[`a7c0c88`](https://redirect.github.com/lint-staged/lint-staged/commit/a7c0c88bcfe94e695528cb33e69fea58586691fc)
Thanks [@&#8203;ItsNickBarry](https://redirect.github.com/ItsNickBarry)!
- When using `--diff-filter` with the `D` option to include deleted
staged files, *lint-staged* no longer tries to stage the deleted files,
unless they're no longer deleted. Previously this caused an error from
`git add` like `fatal: pathspec 'deleted-file' did not match any files`.

-
[`38f942e`](https://redirect.github.com/lint-staged/lint-staged/commit/38f942ecc456355d5f12af68db1696f3411f65c2)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - Removed an
extraneous log entry that printed `shouldHidePArtiallyStagedFiles` to
console output.

###
[`v16.1.1`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1611)

[Compare
Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.1.0...v16.1.1)

##### Patch Changes

-
[#&#8203;1565](https://redirect.github.com/lint-staged/lint-staged/pull/1565)
[`3686977`](https://redirect.github.com/lint-staged/lint-staged/commit/3686977ccdadf70b709c16c0346ef6c2b18e2376)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! -
*Lint-staged* now explicitly warns about potential data loss when using
`--no-stash`.

-
[#&#8203;1571](https://redirect.github.com/lint-staged/lint-staged/pull/1571)
[`02299a9`](https://redirect.github.com/lint-staged/lint-staged/commit/02299a9e4f98a05c13beb27f3596af73aaa8c150)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - Function
tasks (introduced in v16.0.0) only receive the staged files matching the
configured glob, instead of all staged files.

-
[#&#8203;1563](https://redirect.github.com/lint-staged/lint-staged/pull/1563)
[`bc61c74`](https://redirect.github.com/lint-staged/lint-staged/commit/bc61c74383b6d100c55b8d275b979d583ffbe5a1)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - This
version fixes incorrect behavior where unstaged changes were committed
when using the `--no-stash` option. This happened because `--no-stash`
implied `--no-hide-partially-staged`, meaning unstaged changes to files
which also had other staged changes were added to the commit by
*lint-staged*; this is no longer the case.

The previous (incorrect) behavior can still be achieved by using both
options `--no-stash --no-hide-partially-staged` at the same time.

###
[`v16.1.0`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1610)

[Compare
Source](https://redirect.github.com/lint-staged/lint-staged/compare/v16.0.0...v16.1.0)

##### Minor Changes

-
[#&#8203;1536](https://redirect.github.com/lint-staged/lint-staged/pull/1536)
[`e729daa`](https://redirect.github.com/lint-staged/lint-staged/commit/e729daa3b3ae28e613f63e730652dbfad5d1c594)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - A new flag
`--no-revert` has been introduced for when task modifications should be
applied to the index before aborting the commit in case of errors. By
default, *lint-staged* will clear all task modifications and revert to
the original state.

-
[#&#8203;1550](https://redirect.github.com/lint-staged/lint-staged/pull/1550)
[`b27fa3f`](https://redirect.github.com/lint-staged/lint-staged/commit/b27fa3fecb75bcdcaa4bcd483c9d5c0755a22607)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! -
*Lint-staged* now ignores symlinks and leaves them out from the list of
staged files.

##### Patch Changes

-
[#&#8203;1558](https://redirect.github.com/lint-staged/lint-staged/pull/1558)
[`c37dc38`](https://redirect.github.com/lint-staged/lint-staged/commit/c37dc38dddbdebc41df4dbd909d79c98c3f69eb3)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - The minimum
required Node.js version is lowered to `20.17` following
[nano-spawn@1.0.2](https://redirect.github.com/sindresorhus/nano-spawn/releases/tag/v1.0.2).

###
[`v16.0.0`](https://redirect.github.com/lint-staged/lint-staged/blob/HEAD/CHANGELOG.md#1600)

[Compare
Source](https://redirect.github.com/lint-staged/lint-staged/compare/v15.5.2...v16.0.0)

##### Major Changes

-
[#&#8203;1546](https://redirect.github.com/lint-staged/lint-staged/pull/1546)
[`158d15c`](https://redirect.github.com/lint-staged/lint-staged/commit/158d15c9aea0a3a87790ec3766442763cf387dba)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - Processes
are spawned using
[nano-spawn](https://redirect.github.com/sindresorhus/nano-spawn)
instead of [execa](https://redirect.github.com/sindresorhus/execa). If
you are using Node.js scripts as tasks, you might need to explicitly run
them with `node`, especially when using Windows:

  ```json
  {
    "*.js": "node my-js-linter.js"
  }
  ```

-
[#&#8203;1546](https://redirect.github.com/lint-staged/lint-staged/pull/1546)
[`158d15c`](https://redirect.github.com/lint-staged/lint-staged/commit/158d15c9aea0a3a87790ec3766442763cf387dba)
Thanks [@&#8203;iiroj](https://redirect.github.com/iiroj)! - The
`--shell` flag has been removed and *lint-staged* no longer supports
evaluating commands directly via a shell. To migrate existing commands,
you can create a shell script and invoke it instead. Lint-staged will
pass matched staged files as a list of arguments, accessible via
`"$@&#8203;"`:

  ```shell
  ```

</details>

---

### Configuration

📅 **Schedule**: (in timezone Etc/UTC)

- Branch creation
  - Only on Sunday and Saturday (`* * * * 0,6`)
  - Between 12:00 AM and 12:59 PM, only on Monday (`* 0-12 * * 1`)
- Between 09:00 PM and 11:59 PM, Monday through Friday (`* 21-23 * *
1-5`)
- Between 12:00 AM and 04:59 AM, Tuesday through Saturday (`* 0-4 * *
2-6`)
- Automerge
  - Only on Sunday and Saturday (`* * * * 0,6`)
  - Between 12:00 AM and 12:59 PM, only on Monday (`* 0-12 * * 1`)
- Between 10:00 PM and 11:59 PM, Monday through Friday (`* 22-23 * *
1-5`)
- Between 12:00 AM and 04:59 AM, Tuesday through Saturday (`* 0-4 * *
2-6`)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/TryGhost/Ghost).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMTAuMiIsInVwZGF0ZWRJblZlciI6IjQzLjExMC4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [lodash-es](https://lodash.com/custom-builds)
([source](https://redirect.github.com/lodash/lodash)) | [`4.17.21` →
`4.17.23`](https://renovatebot.com/diffs/npm/lodash-es/4.17.21/4.17.23)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/lodash-es/4.17.23?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/lodash-es/4.17.21/4.17.23?slim=true)
|

### GitHub Vulnerability Alerts

####
[CVE-2025-13465](https://redirect.github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg)

### Impact

Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype
pollution in the `_.unset` and `_.omit` functions. An attacker can pass
crafted paths which cause Lodash to delete methods from global
prototypes.

The issue permits deletion of properties but does not allow overwriting
their original behavior.

### Patches

This issue is patched on 4.17.23.

---

### Release Notes

<details>
<summary>lodash/lodash (lodash-es)</summary>

###
[`v4.17.23`](https://redirect.github.com/lodash/lodash/compare/0082be44648961341600e879042f74cd29d65d05...4.17.23)

[Compare
Source](https://redirect.github.com/lodash/lodash/compare/0082be44648961341600e879042f74cd29d65d05...4.17.23)

###
[`v4.17.22`](https://redirect.github.com/lodash/lodash/compare/4.17.21...0082be44648961341600e879042f74cd29d65d05)

[Compare
Source](https://redirect.github.com/lodash/lodash/compare/4.17.21...0082be44648961341600e879042f74cd29d65d05)

</details>

---

### Configuration

📅 **Schedule**: (in timezone Etc/UTC)

- Branch creation
  - ""
- Automerge
  - Only on Sunday and Saturday (`* * * * 0,6`)
  - Between 12:00 AM and 12:59 PM, only on Monday (`* 0-12 * * 1`)
- Between 10:00 PM and 11:59 PM, Monday through Friday (`* 22-23 * *
1-5`)
- Between 12:00 AM and 04:59 AM, Tuesday through Saturday (`* 0-4 * *
2-6`)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/TryGhost/Ghost).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMTAuMiIsInVwZGF0ZWRJblZlciI6IjQzLjExMC4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
## Summary

- remove nx cache step + unnecessary env var from setup job that hasn't
done anything since the Nx v22 update
- remove explicit TS package build step in favor of nx automatic build
tracking

## Why this change

As part of #27202, I was looking into ways to leverage the Nx build
cache across jobs in a given CI run, since I noticed that certain
packages (the frontend code in apps/* primarily) were being built
multiple times throughout the various CI jobs. What I ultimately
realized after a bit more investigation is that the Core Acceptance +
Legacy tests jobs are building more of the repo than they need to, since
the `--exclude=ghost-admin` doesn't actually prevent any work from being
done (ghost-admin is a dependency of `@tryghost/admin` so it gets built
anyways).

## What the fix does

By updating the nx config in ghost/core to dependent on the built target
for the test:ci:* scripts (and switching the jobs themselves to use
`yarn nx run ghost:test:ci:*`), Nx will automatically build the
dependencies it needs to. Overall, this should shave an average of 3-4
minutes off of all of the Acceptance/Legacy test builds.
## Summary

- Changed CI concurrency group from `github.run_id` to `github.ref` for
push events, so consecutive main branch pushes cancel earlier
in-progress runs instead of all running simultaneously
- PR concurrency is unaffected (`github.head_ref` takes precedence for
PRs)
- Observed 5 full CI runs triggered within 60 seconds on main today,
each consuming ~147 runner-minutes — this change would cancel all but
the latest

## Context

The concurrency group `${{ github.head_ref || github.run_id }}` works
well for PRs (groups by branch name, cancels stale runs). But for push
events `github.head_ref` is empty, so it fell back to `github.run_id` —
a unique value per run, meaning no cancellation ever happened on main.

During merge bursts (e.g. merging multiple Renovate PRs), this caused
4-5 full CI pipelines to compete for runners simultaneously, starving PR
CI runs and causing 15+ minute queue times.
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [storybook](https://storybook.js.org)
([source](https://redirect.github.com/storybookjs/storybook/tree/HEAD/code/core))
| [`8.6.14` →
`8.6.15`](https://renovatebot.com/diffs/npm/storybook/8.6.14/8.6.15) |
![age](https://developer.mend.io/api/mc/badges/age/npm/storybook/8.6.15?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/storybook/8.6.14/8.6.15?slim=true)
|

### GitHub Vulnerability Alerts

####
[CVE-2025-68429](https://redirect.github.com/storybookjs/storybook/security/advisories/GHSA-8452-54wp-rmv6)

On December 11th, the Storybook team received a responsible disclosure
alerting them to a potential vulnerability in certain built and
published Storybooks.

The vulnerability is a bug in how Storybook handles environment
variables defined in a `.env` file, which could, in specific
circumstances, lead to those variables being unexpectedly bundled into
the artifacts created by the `storybook build` command. When a built
Storybook is published to the web, the bundle’s source is viewable, thus
potentially exposing those variables to anyone with access. If those
variables contained secrets, they should be considered compromised.

## Who is impacted?

For a project to be vulnerable to this issue, it must:

- Build the Storybook (i.e. run `storybook build` directly or
indirectly) in a directory that contains a `.env` file (including
variants like `.env.local`)
- The `.env` file contains sensitive secrets
- Use Storybook version `7.0.0` or above
- Publish the built Storybook to the web

Storybooks built without a `.env` file at build time are not affected,
including common CI-based builds where secrets are provided via platform
environment variables rather than `.env` files.

Users' Storybook runtime environments (i.e. `storybook dev`) are not
affected. Deployed applications that share a repo with a project's
Storybook are not affected.

Storybook 6 and below are not affected.

## Recommended actions

First, Storybook recommends that everyone audit for any sensitive
secrets provided via `.env` files and rotate those keys.

Second, Storybook has released patched versions of all affected major
Storybook versions that no longer have this vulnerability. Projects
should upgrade their Storybook—on both local machines and CI
environments—to one of these versions **before publishing again**.

- `10.1.10+`
- `9.1.17+`
- `8.6.15+`
- `7.6.21+`

Finally, some projects may have been relying on the undocumented
behavior at the heart of this issue and will need to change how they
reference environment variables after this update. If a project can no
longer read necessary environmental variable values, it can either
prefix the variables with `STORYBOOK_` or use the [`env` property in
Storybook’s
configuration](https://storybook.js.org/docs/configure/environment-variables#using-storybook-configuration)
to manually specify values. In either case, **do not** include sensitive
secrets as they *will* be included in the built bundle.

## Further information

Details of the vulnerability can be found on the [Storybook
announcement](https://storybook.js.org/blog/security-advisory).

---

### Release Notes

<details>
<summary>storybookjs/storybook (storybook)</summary>

###
[`v8.6.15`](https://redirect.github.com/storybookjs/storybook/blob/HEAD/CHANGELOG.md#8615)

[Compare
Source](https://redirect.github.com/storybookjs/storybook/compare/v8.6.14...v8.6.15)

- Core: Fix .env-file parsing, thanks
[@&#8203;jreinhold](https://redirect.github.com/jreinhold)!

</details>

---

### Configuration

📅 **Schedule**: (in timezone Etc/UTC)

- Branch creation
  - ""
- Automerge
  - Only on Sunday and Saturday (`* * * * 0,6`)
  - Between 12:00 AM and 12:59 PM, only on Monday (`* 0-12 * * 1`)
- Between 10:00 PM and 11:59 PM, Monday through Friday (`* 22-23 * *
1-5`)
- Between 12:00 AM and 04:59 AM, Tuesday through Saturday (`* 0-4 * *
2-6`)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/TryGhost/Ghost).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDIuMTEiLCJ1cGRhdGVkSW5WZXIiOiI0My4xMTAuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Hannah Wolfe <github.erisds@gmail.com>
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [lodash](https://lodash.com/)
([source](https://redirect.github.com/lodash/lodash)) | [`4.17.21` →
`4.17.23`](https://renovatebot.com/diffs/npm/lodash/4.17.21/4.17.23) |
![age](https://developer.mend.io/api/mc/badges/age/npm/lodash/4.17.23?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/lodash/4.17.21/4.17.23?slim=true)
|

### GitHub Vulnerability Alerts

####
[CVE-2025-13465](https://redirect.github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg)

### Impact

Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype
pollution in the `_.unset` and `_.omit` functions. An attacker can pass
crafted paths which cause Lodash to delete methods from global
prototypes.

The issue permits deletion of properties but does not allow overwriting
their original behavior.

### Patches

This issue is patched on 4.17.23.

---

### Release Notes

<details>
<summary>lodash/lodash (lodash)</summary>

###
[`v4.17.23`](https://redirect.github.com/lodash/lodash/compare/0082be44648961341600e879042f74cd29d65d05...4.17.23)

[Compare
Source](https://redirect.github.com/lodash/lodash/compare/4.17.21...4.17.23)

</details>

---

### Configuration

📅 **Schedule**: (in timezone Etc/UTC)

- Branch creation
  - ""
- Automerge
  - Only on Sunday and Saturday (`* * * * 0,6`)
  - Between 12:00 AM and 12:59 PM, only on Monday (`* 0-12 * * 1`)
- Between 10:00 PM and 11:59 PM, Monday through Friday (`* 22-23 * *
1-5`)
- Between 12:00 AM and 04:59 AM, Tuesday through Saturday (`* 0-4 * *
2-6`)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/TryGhost/Ghost).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMTAuMiIsInVwZGF0ZWRJblZlciI6IjQzLjExMC4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [fs-extra](https://redirect.github.com/jprichardson/node-fs-extra) |
[`11.3.0` →
`11.3.4`](https://renovatebot.com/diffs/npm/fs-extra/11.3.0/11.3.4) |
![age](https://developer.mend.io/api/mc/badges/age/npm/fs-extra/11.3.4?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/fs-extra/11.3.0/11.3.4?slim=true)
|

---

### Release Notes

<details>
<summary>jprichardson/node-fs-extra (fs-extra)</summary>

###
[`v11.3.4`](https://redirect.github.com/jprichardson/node-fs-extra/blob/HEAD/CHANGELOG.md#1134--2026-03-03)

[Compare
Source](https://redirect.github.com/jprichardson/node-fs-extra/compare/11.3.3...11.3.4)

- Fix bug where calling `ensureSymlink`/`ensureSymlinkSync` with a
relative `srcPath` would fail if the symlink already existed
([#&#8203;1038](https://redirect.github.com/jprichardson/node-fs-extra/issues/1038),
[#&#8203;1064](https://redirect.github.com/jprichardson/node-fs-extra/pull/1064))

###
[`v11.3.3`](https://redirect.github.com/jprichardson/node-fs-extra/blob/HEAD/CHANGELOG.md#1133--2025-12-18)

[Compare
Source](https://redirect.github.com/jprichardson/node-fs-extra/compare/11.3.2...11.3.3)

- Fix copying symlink when destination is a symlink to the same target
([#&#8203;1019](https://redirect.github.com/jprichardson/node-fs-extra/issues/1019),
[#&#8203;1060](https://redirect.github.com/jprichardson/node-fs-extra/pull/1060))

###
[`v11.3.2`](https://redirect.github.com/jprichardson/node-fs-extra/blob/HEAD/CHANGELOG.md#1132--2025-09-15)

[Compare
Source](https://redirect.github.com/jprichardson/node-fs-extra/compare/11.3.1...11.3.2)

- Fix spurrious `UnhandledPromiseRejectionWarning` that could occur when
calling `.copy()` in some cases
([#&#8203;1056](https://redirect.github.com/jprichardson/node-fs-extra/issues/1056),
[#&#8203;1058](https://redirect.github.com/jprichardson/node-fs-extra/pull/1058))

###
[`v11.3.1`](https://redirect.github.com/jprichardson/node-fs-extra/blob/HEAD/CHANGELOG.md#1131--2025-08-05)

[Compare
Source](https://redirect.github.com/jprichardson/node-fs-extra/compare/11.3.0...11.3.1)

- Fix case where `move`/`moveSync` could incorrectly think files are
identical on Windows
([#&#8203;1050](https://redirect.github.com/jprichardson/node-fs-extra/pull/1050))

</details>

---

### Configuration

📅 **Schedule**: (in timezone Etc/UTC)

- Branch creation
  - Only on Sunday and Saturday (`* * * * 0,6`)
  - Between 12:00 AM and 12:59 PM, only on Monday (`* 0-12 * * 1`)
- Between 09:00 PM and 11:59 PM, Monday through Friday (`* 21-23 * *
1-5`)
- Between 12:00 AM and 04:59 AM, Tuesday through Saturday (`* 0-4 * *
2-6`)
- Automerge
  - Only on Sunday and Saturday (`* * * * 0,6`)
  - Between 12:00 AM and 12:59 PM, only on Monday (`* 0-12 * * 1`)
- Between 10:00 PM and 11:59 PM, Monday through Friday (`* 22-23 * *
1-5`)
- Between 12:00 AM and 04:59 AM, Tuesday through Saturday (`* 0-4 * *
2-6`)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these
updates again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/TryGhost/Ghost).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMTAuMiIsInVwZGF0ZWRJblZlciI6IjQzLjExMC4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [gscan](https://ghost.org/)
([source](https://redirect.github.com/TryGhost/gscan)) | [`5.4.0` →
`5.4.1`](https://renovatebot.com/diffs/npm/gscan/5.4.0/5.4.1) |
![age](https://developer.mend.io/api/mc/badges/age/npm/gscan/5.4.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/gscan/5.4.0/5.4.1?slim=true)
|

---

### Release Notes

<details>
<summary>TryGhost/gscan (gscan)</summary>

###
[`v5.4.1`](https://redirect.github.com/TryGhost/gscan/compare/v5.4.0...v5.4.1)

[Compare
Source](https://redirect.github.com/TryGhost/gscan/compare/v5.4.0...v5.4.1)

</details>

---

### Configuration

📅 **Schedule**: (in timezone Etc/UTC)

- Branch creation
  - Only on Sunday and Saturday (`* * * * 0,6`)
  - Between 12:00 AM and 12:59 PM, only on Monday (`* 0-12 * * 1`)
- Between 09:00 PM and 11:59 PM, Monday through Friday (`* 21-23 * *
1-5`)
- Between 12:00 AM and 04:59 AM, Tuesday through Saturday (`* 0-4 * *
2-6`)
- Automerge
  - Only on Sunday and Saturday (`* * * * 0,6`)
  - Between 12:00 AM and 12:59 PM, only on Monday (`* 0-12 * * 1`)
- Between 10:00 PM and 11:59 PM, Monday through Friday (`* 22-23 * *
1-5`)
- Between 12:00 AM and 04:59 AM, Tuesday through Saturday (`* 0-4 * *
2-6`)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/TryGhost/Ghost).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMTAuMiIsInVwZGF0ZWRJblZlciI6IjQzLjExMC4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [nwsapi](https://javascript.nwbox.com/nwsapi/)
([source](https://redirect.github.com/dperini/nwsapi)) | [`2.2.12` →
`2.2.23`](https://renovatebot.com/diffs/npm/nwsapi/2.2.12/2.2.23) |
![age](https://developer.mend.io/api/mc/badges/age/npm/nwsapi/2.2.23?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/nwsapi/2.2.12/2.2.23?slim=true)
|

---

### Release Notes

<details>
<summary>dperini/nwsapi (nwsapi)</summary>

###
[`v2.2.23`](https://redirect.github.com/dperini/nwsapi/compare/4b06175e2c209b8c137f3dc1ed1b4748278b97f0...f1664d8d43e036e7d2bd1d179a5599863e25945d)

[Compare
Source](https://redirect.github.com/dperini/nwsapi/compare/4b06175e2c209b8c137f3dc1ed1b4748278b97f0...f1664d8d43e036e7d2bd1d179a5599863e25945d)

###
[`v2.2.22`](https://redirect.github.com/dperini/nwsapi/compare/47b31b7c559b3a1598a1584c8a57cf730d2ff88c...4b06175e2c209b8c137f3dc1ed1b4748278b97f0)

[Compare
Source](https://redirect.github.com/dperini/nwsapi/compare/47b31b7c559b3a1598a1584c8a57cf730d2ff88c...4b06175e2c209b8c137f3dc1ed1b4748278b97f0)

###
[`v2.2.21`](https://redirect.github.com/dperini/nwsapi/compare/10076e3987f7d754e5d694efd31ec713583827ef...47b31b7c559b3a1598a1584c8a57cf730d2ff88c)

[Compare
Source](https://redirect.github.com/dperini/nwsapi/compare/10076e3987f7d754e5d694efd31ec713583827ef...47b31b7c559b3a1598a1584c8a57cf730d2ff88c)

###
[`v2.2.20`](https://redirect.github.com/dperini/nwsapi/compare/300cbe2f625ef2217059e0d3df04dc6649a52037...10076e3987f7d754e5d694efd31ec713583827ef)

[Compare
Source](https://redirect.github.com/dperini/nwsapi/compare/300cbe2f625ef2217059e0d3df04dc6649a52037...10076e3987f7d754e5d694efd31ec713583827ef)

###
[`v2.2.19`](https://redirect.github.com/dperini/nwsapi/compare/f6f79df62eccece06c2ad0ac29d486e65c7e3bcc...300cbe2f625ef2217059e0d3df04dc6649a52037)

[Compare
Source](https://redirect.github.com/dperini/nwsapi/compare/f6f79df62eccece06c2ad0ac29d486e65c7e3bcc...300cbe2f625ef2217059e0d3df04dc6649a52037)

###
[`v2.2.18`](https://redirect.github.com/dperini/nwsapi/compare/37ad99b62941cc8421e682786a6118d774c2bfec...f6f79df62eccece06c2ad0ac29d486e65c7e3bcc)

[Compare
Source](https://redirect.github.com/dperini/nwsapi/compare/37ad99b62941cc8421e682786a6118d774c2bfec...f6f79df62eccece06c2ad0ac29d486e65c7e3bcc)

###
[`v2.2.16`](https://redirect.github.com/dperini/nwsapi/compare/ce1089c21c6c206b4951626ea5599f5ccece20a8...37ad99b62941cc8421e682786a6118d774c2bfec)

[Compare
Source](https://redirect.github.com/dperini/nwsapi/compare/ce1089c21c6c206b4951626ea5599f5ccece20a8...37ad99b62941cc8421e682786a6118d774c2bfec)

###
[`v2.2.15`](https://redirect.github.com/dperini/nwsapi/compare/3eedbf2dc3d0cd63a31962f18c76edebdb551c09...ce1089c21c6c206b4951626ea5599f5ccece20a8)

[Compare
Source](https://redirect.github.com/dperini/nwsapi/compare/3eedbf2dc3d0cd63a31962f18c76edebdb551c09...ce1089c21c6c206b4951626ea5599f5ccece20a8)

###
[`v2.2.14`](https://redirect.github.com/dperini/nwsapi/compare/ee69b43bfe979552161c4e4b7e73c7c70d2efc2b...3eedbf2dc3d0cd63a31962f18c76edebdb551c09)

[Compare
Source](https://redirect.github.com/dperini/nwsapi/compare/ee69b43bfe979552161c4e4b7e73c7c70d2efc2b...3eedbf2dc3d0cd63a31962f18c76edebdb551c09)

###
[`v2.2.13`](https://redirect.github.com/dperini/nwsapi/compare/088475fbbdefc9d10fbdd7f914d92bce96aa9d0f...ee69b43bfe979552161c4e4b7e73c7c70d2efc2b)

[Compare
Source](https://redirect.github.com/dperini/nwsapi/compare/088475fbbdefc9d10fbdd7f914d92bce96aa9d0f...ee69b43bfe979552161c4e4b7e73c7c70d2efc2b)

</details>

---

### Configuration

📅 **Schedule**: (in timezone Etc/UTC)

- Branch creation
  - Only on Sunday and Saturday (`* * * * 0,6`)
  - Between 12:00 AM and 12:59 PM, only on Monday (`* 0-12 * * 1`)
- Between 09:00 PM and 11:59 PM, Monday through Friday (`* 21-23 * *
1-5`)
- Between 12:00 AM and 04:59 AM, Tuesday through Saturday (`* 0-4 * *
2-6`)
- Automerge
  - Only on Sunday and Saturday (`* * * * 0,6`)
  - Between 12:00 AM and 12:59 PM, only on Monday (`* 0-12 * * 1`)
- Between 10:00 PM and 11:59 PM, Monday through Friday (`* 22-23 * *
1-5`)
- Between 12:00 AM and 04:59 AM, Tuesday through Saturday (`* 0-4 * *
2-6`)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Never, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/TryGhost/Ghost).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMTAuMiIsInVwZGF0ZWRJblZlciI6IjQzLjExMC4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [globals](https://redirect.github.com/sindresorhus/globals) |
[`16.5.0` →
`17.4.0`](https://renovatebot.com/diffs/npm/globals/16.5.0/17.4.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/globals/17.4.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/globals/16.5.0/17.4.0?slim=true)
|

---

### Release Notes

<details>
<summary>sindresorhus/globals (globals)</summary>

###
[`v17.4.0`](https://redirect.github.com/sindresorhus/globals/compare/v17.3.0...a9cfd7493fb701474d4dc946283c7b9d63d64134)

[Compare
Source](https://redirect.github.com/sindresorhus/globals/compare/v17.3.0...v17.4.0)

###
[`v17.3.0`](https://redirect.github.com/sindresorhus/globals/releases/tag/v17.3.0)

[Compare
Source](https://redirect.github.com/sindresorhus/globals/compare/v17.2.0...v17.3.0)

- Update globals (2026-02-01)
([#&#8203;336](https://redirect.github.com/sindresorhus/globals/issues/336))
[`295fba9`](https://redirect.github.com/sindresorhus/globals/commit/295fba9)

***

###
[`v17.2.0`](https://redirect.github.com/sindresorhus/globals/releases/tag/v17.2.0)

[Compare
Source](https://redirect.github.com/sindresorhus/globals/compare/v17.1.0...v17.2.0)

- `jasmine`: Add `throwUnless` and `throwUnlessAsync` globals
([#&#8203;335](https://redirect.github.com/sindresorhus/globals/issues/335))
[`97f23a7`](https://redirect.github.com/sindresorhus/globals/commit/97f23a7)

***

###
[`v17.1.0`](https://redirect.github.com/sindresorhus/globals/releases/tag/v17.1.0)

[Compare
Source](https://redirect.github.com/sindresorhus/globals/compare/v17.0.0...v17.1.0)

- Add `webpack` and `rspack` globals
([#&#8203;333](https://redirect.github.com/sindresorhus/globals/issues/333))
[`65cae73`](https://redirect.github.com/sindresorhus/globals/commit/65cae73)

***

###
[`v17.0.0`](https://redirect.github.com/sindresorhus/globals/releases/tag/v17.0.0)

[Compare
Source](https://redirect.github.com/sindresorhus/globals/compare/v16.5.0...v17.0.0)

##### Breaking

- Split `audioWorklet` environment from `browser`
([#&#8203;320](https://redirect.github.com/sindresorhus/globals/issues/320))
[`7bc293e`](https://redirect.github.com/sindresorhus/globals/commit/7bc293e)

##### Improvements

- Update globals
([#&#8203;329](https://redirect.github.com/sindresorhus/globals/issues/329))
[`ebe1063`](https://redirect.github.com/sindresorhus/globals/commit/ebe1063)
- Get all browser globals from both `chrome` and `firefox`
([#&#8203;321](https://redirect.github.com/sindresorhus/globals/issues/321))
[`59ceff8`](https://redirect.github.com/sindresorhus/globals/commit/59ceff8)
- Add `bunBuiltin` environment
([#&#8203;324](https://redirect.github.com/sindresorhus/globals/issues/324))
[`1bc6e3b`](https://redirect.github.com/sindresorhus/globals/commit/1bc6e3b)
- Add `denoBuiltin` environment
([#&#8203;324](https://redirect.github.com/sindresorhus/globals/issues/324))
[`1bc6e3b`](https://redirect.github.com/sindresorhus/globals/commit/1bc6e3b)
- Add `paintWorklet` environment
([#&#8203;323](https://redirect.github.com/sindresorhus/globals/issues/323))
[`4b78f56`](https://redirect.github.com/sindresorhus/globals/commit/4b78f56)
- Add `sharedWorker` environment
([#&#8203;322](https://redirect.github.com/sindresorhus/globals/issues/322))
[`4a02a85`](https://redirect.github.com/sindresorhus/globals/commit/4a02a85)

***

</details>

---

### Configuration

📅 **Schedule**: (in timezone Etc/UTC)

- Branch creation
  - Only on Sunday and Saturday (`* * * * 0,6`)
  - Between 12:00 AM and 12:59 PM, only on Monday (`* 0-12 * * 1`)
- Between 09:00 PM and 11:59 PM, Monday through Friday (`* 21-23 * *
1-5`)
- Between 12:00 AM and 04:59 AM, Tuesday through Saturday (`* 0-4 * *
2-6`)
- Automerge
  - Only on Sunday and Saturday (`* * * * 0,6`)
  - Between 12:00 AM and 12:59 PM, only on Monday (`* 0-12 * * 1`)
- Between 10:00 PM and 11:59 PM, Monday through Friday (`* 22-23 * *
1-5`)
- Between 12:00 AM and 04:59 AM, Tuesday through Saturday (`* 0-4 * *
2-6`)

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/TryGhost/Ghost).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMTAuMiIsInVwZGF0ZWRJblZlciI6IjQzLjExMC4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
ref
https://linear.app/ghost/issue/FEA-480/native-share-buttons-with-link-based-referral-param-for-attribution

Adds the newsletter email Share action link (opens the Portal share
modal in browser) and related template/tests updates.

A follow-up PR will add the ability to toggle this setting on in
newsletters from the admin area (defaults to false)
#27237

---------

Co-authored-by: Troy Ciesco <tmciesco@gmail.com>
closes  https://linear.app/tryghost/issue/NY-1213/

This field was overlooked in the initial implementation, but we do want
to include it as a customizable option for welcome emails. This PR is
just the minimal change to add the column to the `email_design_settings`
table; other changes to the frontend modal and the rendering are
forthcoming.
ref https://linear.app/ghost/issue/BER-3528

`gifts.expires_at` should always have a value set and never be `null`
@pull pull Bot locked and limited conversation to collaborators Apr 9, 2026
@pull pull Bot added the ⤵️ pull label Apr 9, 2026
@pull pull Bot merged commit 905379e into code:main Apr 9, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants