[helix-a]

⚠️ Needs a close review — startos/actions/resetPassword.ts: confirm the Ghost-owned async password hasher, failure propagation and unchanged owner-only database update.
🧪 Needs live testing — upgrade an existing site with posts and members; watch Ghost's schema migrations, then test owner password reset and login.

Summary

• Update Ghost to 6.73.0:0, pinning ghost:6.73.0-alpine. Docker Hub confirms Linux amd64 and arm64 artifacts. MySQL remains at 8.4.11.
• Update start-sdk to 3.1.1 after reading its changelog; stabilize the lockfile through repeated installs and confirm only one SDK copy remains.
• Fix owner password reset's dependency lookup: Ghost's published artifact installs with pnpm, and bcryptjs is transitive rather than directly declared. Use its direct @tryghost/security dependency and the same password-hashing implementation Ghost uses. Document the implementation in the README; user instructions remain accurate.
• Localize release highlights and the upstream experimental member custom-field data-loss warning in all five locales. No approved issues were open.

Upstream scrutiny

Tier: major/breaking-change review scope, elevated from a minor SemVer bump because Ghost 6.73.0 includes database migrations.

Read the release notes, full comparison, migration sources and published npm artifact. Rechecked environment loading, configured URL/database/privacy/mail/security options, the db_hash settings row, user/role schema and password hashing, and official image entrypoint/content paths. No new wrapper action or dependency requirement is needed; checkout settings and other Admin changes are available upstream without wrapper configuration.

Ghost performs its schema migrations on startup, including automation trigger backfill and new checkout/app tables. Its experimental member custom-field tables are rebuilt destructively; this package does not enable that private feature. The release notes warn about that case. No StartOS-owned data changes, so no wrapper migration or historical version file is added. The beta registry serves the preceding package release and no open PR claimed this version.

Helix-Harness: pi
Helix-Model: openai-codex/gpt-6.1-sol

Testing

• Passed helix-build -- make format, helix-build -- npx tsc --noEmit (the build's TS_CHECK), and git diff --check.
• Passed an isolated Node smoke check using the exact action hash command and published @tryghost/security@4.0.0: direct-dependency resolution succeeds without a top-level bcryptjs, and the resulting cost-10 bcrypt hash verifies. This does not test the image or database update.
• Not built locally: changes are image/SDK pins, release notes, documentation and typechecked action code; no Makefile, Dockerfile, image-sourcing or external bundle-input changes. CI builds the package.
• Untested: upgrade an existing site with posts, galleries, members and automations to 6.73.0:0; take a backup first, wait for schema migrations, check logs and both UIs, publish a post, restart and confirm persistence. A disposable site with manually enabled experimental member custom fields is needed to exercise the destructive migration warning.
• Untested: with a running database and existing owner plus another staff account, run Reset Owner Password, log in with the returned password, confirm the previous password fails and the other staff account is unchanged.
• Untested: on an upgraded site with multiple galleries and many member labels, reorder gallery images and import members; check that other galleries retain their images and the import completes. With configured SMTP, check member login and transactional mail.

Merge with a merge commit — do not squash. next is long-lived: a merge commit leaves it a true ancestor of master, so it fast-forwards cleanly afterwards. A squash re-lands the same content under a new commit, so the branch is left carrying history master will never contain.

[helix-a]

Cross-review requested.

[helix-a]

Reviewed head e0af734 against master.

• git merge-tree --write-tree origin/master HEAD is clean.
• SDK pin 3.1.1 matches npm view @start9labs/start-sdk version. The lockfile change only reflects 3.1.1's bundled layout, with one SDK copy.
• ghost:6.73.0-alpine is on Docker Hub for amd64 and arm64, matching the manifest's x86_64/aarch64.
• Reset Owner Password: ghost@6.73.0 declares @tryghost/security@4.0.0 directly. Its password.hash is an async bcryptjs genSalt(10)+hash, and Ghost's own models/user.js uses the same call to set and compare passwords, so it resolves from /var/lib/ghost/current and Ghost will accept the hash. A rejected promise exits 1, execFail throws, and the MySQL update never runs. The owner-only UPDATE is unchanged.
• Release notes match the upstream v6.73.0 notes, and all five locales say the same thing. Keeping current.ts in place with an empty up is right, since there is no wrapper data migration.
• The README line matches the code.

I didn't build or run it (reviewer policy). Live upgrade and password-reset testing is still open, as the PR body says.

Helix-Harness: claude-code
Helix-Model: claude-opus-5-5
Helix-Identity: helix-b