Impact Score: 5/10
Ghost: MSR1: 0.5.9
Source available — automated, not human-reviewed
Component: ghost · Channel: stable. Automated analysis, not a compatibility certification. How this works.
Analysis updated: 2026-11-01.
⚡ Executive Summary (TL;DR)
Ghost 0.5.9. Source highlight: This release contains the new navigation builder and several security and bug fixes. Please read the release blog post for more details.
Who Does This Impact? (Role-Based Analysis)
💻 Software Engineers & Devs
Check the source notes against the package and APIs you use before upgrading.
📊 Product & Engineering Leads
Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.
⚙️ DevOps & Security
Verify the target version, runtime requirements and rollback procedure in the official documentation.
🔧 Bug Fixes & Patches (3)
- **[Fixed]** Incorrect user role shown on profile
- **[Fixed]** Re-authentication modal not accepting passwords
- **[Fixed]** Post published_by can be overridden via the API
📄 View Raw Release Notes (Original Developer Log)
This release contains the new navigation builder and several security and bug fixes. Please read the [release blog post](http://dev.ghost.org/ghost-0-5-9) for more details.
Note that 0.5.9 is only compatible with **Node v0.10.x**.
## Release Highlights
- **[New]** Navigation builder
- **[New]** `{{navigation}}` helper
- **[New]** Image in RSS feed
- **[Fixed]** Incorrect user role shown on profile
- **[Fixed]** Re-authentication modal not accepting passwords
- **[Fixed]** Post published_by can be overridden via the API
- **[Security]** Users can edit objects they don't have permissions for via the API
- **[Security]** XSS vulnerability when deleting tags
- **[Security]** XSS vulnerability when using URLs for blog & user images
---
The full [change log](https://gist.github.com/ErisDS/6111e30e006ed34cf9f6) contains a list of all changes.