From ba6e66b4332a9fa4fba536da44fb0193a2634bee Mon Sep 17 00:00:00 2001
From: Evan Hahn <evan@ghost.org>
Date: Sun, 23 Aug 2026 20:03:00 -0500
Subject: [PATCH 1/4] TypeScriptified open redirect utility (#30197)

no ref
---
 .../core/server/web/shared/{utils.js => utils.ts}  | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)
 rename ghost/core/core/server/web/shared/{utils.js => utils.ts} (65%)

diff --git a/ghost/core/core/server/web/shared/utils.js b/ghost/core/core/server/web/shared/utils.ts
similarity index 65%
rename from ghost/core/core/server/web/shared/utils.js
rename to ghost/core/core/server/web/shared/utils.ts
index 5a064576c09..18e267a66de 100644
--- a/ghost/core/core/server/web/shared/utils.js
+++ b/ghost/core/core/server/web/shared/utils.ts
@@ -1,8 +1,6 @@
-const url = require('url');
+import * as url from 'node:url';
 
-const _private = {};
-
-_private.removeDoubleCharacters = (character, string) => {
+function removeDoubleCharacters(character: string, string: string) {
   const stringArray = string.split('');
 
   return stringArray.reduce((newString, currentCharacter, index) => {
@@ -12,9 +10,9 @@ _private.removeDoubleCharacters = (character, string) => {
 
     return `${newString}${currentCharacter}`;
   }, '');
-};
+}
 
-module.exports.removeOpenRedirectFromUrl = function removeOpenRedirectFromUrl(urlString) {
+export function removeOpenRedirectFromUrl(urlString: string): string {
   const parsedUrl = url.parse(urlString);
 
   return (
@@ -22,7 +20,7 @@ module.exports.removeOpenRedirectFromUrl = function removeOpenRedirectFromUrl(ur
     (parsedUrl.protocol ? parsedUrl.protocol + '//' : '') +
     (parsedUrl.auth || '') +
     (parsedUrl.host || '') +
-    _private.removeDoubleCharacters('/', parsedUrl.path) +
+    removeDoubleCharacters('/', parsedUrl.path ?? '') +
     (parsedUrl.hash || '')
   );
-};
+}

From 0a18938eee11e8911748fe6ebc1f2dd91a1bb19a Mon Sep 17 00:00:00 2001
From: Evan Hahn <evan@ghost.org>
Date: Sun, 23 Aug 2026 20:03:11 -0500
Subject: [PATCH 2/4] TypeScriptified admin file test helper (#30198)

no ref
---
 ghost/core/test/utils/{admin-utils.js => admin-utils.ts} | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)
 rename ghost/core/test/utils/{admin-utils.js => admin-utils.ts} (71%)

diff --git a/ghost/core/test/utils/admin-utils.js b/ghost/core/test/utils/admin-utils.ts
similarity index 71%
rename from ghost/core/test/utils/admin-utils.js
rename to ghost/core/test/utils/admin-utils.ts
index 1d961fd2acf..033fd32afc0 100644
--- a/ghost/core/test/utils/admin-utils.js
+++ b/ghost/core/test/utils/admin-utils.ts
@@ -1,5 +1,5 @@
-const fs = require('fs-extra');
-const path = require('path');
+import * as fs from 'fs-extra';
+import * as path from 'node:path';
 
 const adminFiles = [
   'built/admin/index.html',
@@ -9,14 +9,14 @@ const adminFiles = [
   'built/admin/assets/vendor.css',
 ];
 
-module.exports.stubAdminFiles = () => {
+export const stubAdminFiles = (): void => {
   adminFiles.forEach((file) => {
     const filePath = path.resolve(__dirname, '../../core/', file);
     fs.ensureFileSync(filePath);
   });
 };
 
-module.exports.stubAuthFrameFiles = (publicPath) => {
+export const stubAuthFrameFiles = (publicPath: string): void => {
   const filePath = path.resolve(publicPath, 'admin-auth/index.html');
   fs.ensureFileSync(filePath);
 };

From d29a01479365fdba7e69a91c13cd019ad1243f58 Mon Sep 17 00:00:00 2001
From: Evan Hahn <evan@ghost.org>
Date: Sun, 23 Aug 2026 20:03:20 -0500
Subject: [PATCH 3/4] TypeScriptified test redirects helper (#30199)

no ref
---
 ghost/core/test/utils/{redirects.js => redirects.ts} | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)
 rename ghost/core/test/utils/{redirects.js => redirects.ts} (81%)

diff --git a/ghost/core/test/utils/redirects.js b/ghost/core/test/utils/redirects.ts
similarity index 81%
rename from ghost/core/test/utils/redirects.js
rename to ghost/core/test/utils/redirects.ts
index 0670eafc986..7f3f0d89681 100644
--- a/ghost/core/test/utils/redirects.js
+++ b/ghost/core/test/utils/redirects.ts
@@ -1,10 +1,13 @@
-const fs = require('fs-extra');
-const path = require('path');
+import * as fs from 'fs-extra';
+import * as path from 'node:path';
 
 /**
  * Set up the redirects file with the extension you want.
  */
-module.exports.setupFile = async (contentFolderForTests, ext) => {
+export const setupFile = async (
+  contentFolderForTests: string,
+  ext: null | string,
+): Promise<void> => {
   const yamlPath = path.join(contentFolderForTests, 'data', 'redirects.yaml');
   const jsonPath = path.join(contentFolderForTests, 'data', 'redirects.json');
 

From 7abac61fd80233ff60e65866bc7f3e791cfb6228 Mon Sep 17 00:00:00 2001
From: "tryghost-renovate[bot]"
 <269725441+tryghost-renovate[bot]@users.noreply.github.com>
Date: Mon, 24 Aug 2026 01:18:53 +0000
Subject: [PATCH 4/4] Pin dependency moment-timezone to 0.5.48

---
 apps/shade/package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/shade/package.json b/apps/shade/package.json
index b315af544f9..9a4810bab12 100644
--- a/apps/shade/package.json
+++ b/apps/shade/package.json
@@ -113,7 +113,7 @@
     "color": "5.0.3",
     "country-flag-icons": "catalog:",
     "lucide-react": "catalog:",
-    "moment-timezone": "^0.5.48",
+    "moment-timezone": "0.5.48",
     "react": "catalog:",
     "react-day-picker": "9.14.0",
     "react-dom": "catalog:",