mikebell/mikebell.io

Watch

Fork 0

chore(deps): update dependency hugo to v0.167.0 #63

Open

renovate-bot wants to merge 1 commit from renovate/hugo-0.x into main

renovate-bot commented

2026-09-15 14:38:04 +00:00

Collaborator

This PR contains the following updates:

Package	Type	Update	Change
hugo	uses-with	minor	`0.161.1` → `0.167.0`

Release Notes

gohugoio/hugo (hugo)

`v0.167.0`

Compare Source

This release brings relative partial references, slug support for branch pages, and a handful of security hardening fixes.

Relative partial references. A partial name starting with ./ or ../ is now resolved relative to the directory of the calling partial. This makes it much easier to write self-contained, movable partial trees, e.g. {{ partial "./item.html" . }} from within layouts/_partials/card/list.html. Relative paths are only allowed from within partials, and paths resolving outside the partials directory is an error. See #15373 and the documentation.

Slugs for section, taxonomy and term pages. The slug front matter now works for branch pages, not just regular pages, and it cascades to descendants. This is particularly useful in multilingual sites, where e.g. content/help/_index.es.md with slug: ayuda gives /es/ayuda/, /es/ayuda/avanzado/ etc. See #14352.

Other notable improvements include the new build.cleanDestinationDir config with keepFiles/keepDirs Glob patterns (#14937, docs), hugo now builds without a config file (#15393), exact numeric comparisons in eq, where, in and the set functions (#15322, #15358), and automatic summaries that no longer end inside an open list or blockquote (#14044).

Security

This release contains several hardening fixes. None of them are known to be exploited, but if you build sites with untrusted themes or modules, you should upgrade.

Sass imports not found in Hugo's file systems were resolved by the Sass compiler itself, which follows symlinks and knows nothing about the project root. A theme could import a file outside the project and get its content into the published CSS. These imports are now resolved by Hugo and checked against the same security.allowRead roots as the Node.js tools and js.Build. 41040cc (thanks to @Hama1cco)
Likewise, imports not found in /assets were resolved and read by ESBuild itself. The resolved path is now checked against the allowed read paths before ESBuild loads it. 2aa51f3 (thanks to @Hama1cco)
A symlinked directory in a theme at the parent of a nested mount could expose files outside the module. 2fe9bab
Explicit heading IDs (e.g. ## Foo {id="..."}) were written unescaped into the table of contents href, allowing attribute breakout. 671fbf2

Note

The default baseURL is now https://example.org/ (it was empty). Hugo has always required a valid URL to work properly, so this mostly affects new and test sites, but if you relied on the empty default for relative URLs, set baseURL explicitly. bc68654 @bep #14625 #15384
The root cleanDestinationDir config key is deprecated in favour of build.cleanDestinationDir.enable. The --cleanDestinationDir flag maps to the new key. Note that .git files in the publish dir are now kept by default. 9086193 @bep #14937
eq now compares numeric values the same way as lt, le etc., so e.g. eq 1 1.0 is now true. Also, in, intersect, union, uniq, symdiff, complement and where's in/not in now compare numbers exactly rather than via float64, and no longer require the Go types to match. 4d628bb 366377b @bep #15322 #15358
A user table render hook is now preferred over the embedded one. 140d936 @jmooring #15389
Automatic summaries are expanded past summaryLength when needed so they don't end inside an open container element. This may change the summary for some pages. d692a24 @bep #14044

Bug fixes

hugolib: Fix failing integration test fdbba5a @jmooring
Fix build with Go 1.26 on Fedora 44 Beta 2782bfd @flyn-org
Fix smartcrop with rotation (#15371) 5edd05b @bep #11266 #15369
ci: Fix broken magefile 1d87ee5 @bep
tpl/collections: Fix union of slices with different numeric element types ffbcdba @hktitof #15323
Fix stale page content when several files in the same dir change in one batch a374b86 @bep #15330

Improvements

Update .gitignore f6606f1 @bep
tocss: Confine Sass import fallbacks to the allowed read paths 41040cc @bep
js: Confine ESBuild's fallback resolver to the allowed read paths 2aa51f3 @bep
commands: Allow building without a config file c7f9999 @bep #15393
collections: Preserve slice type when appending an empty slice dd16df1 @jakezwang #11131
tpl/tplimpl: Prefer user table render hook over embedded 140d936 @jmooring #15389
Avoid allocating in SitesMatrix.MatchSiteVector 83ab799 @bep
Add slug support for section, taxonomy and term pages 5d43ab7 @bep #14352
tpl: Avoid reflect.Value.Call for common signatures 806a62e @bep #15385
ci: Disable vet when running tests 8bac4de @bep
tpl/partials: Support relative partial paths from within partials (#15376) bd1588b @bep #15373
config: Add build.cleanDestinationDir config 9086193 @bep #14937
commands: Make testscripts/commands/hugo__clean_destination_dir.txt portable a74b753 @bep #8433
commands: Handle missing staticDir in cleanDestinationDir 07b9fba @jmooring #8433
hugofs: Cache symlink checks 09fa49b @bep
hugofs: Drop symlinks in virtual ancestor dirs of nested mounts 2fe9bab @bep
markup/tableofcontents: Escape heading IDs in ToC HTML 671fbf2 @bep
hugofs: Allow symlinked mount roots in the main project 25f2856 @bep #15367
Expand and consolidate BOM trimming cb6a707 @bep #15355 #15361
tpl/collections: Compare numbers exactly in set operations and where 366377b @bep #15358 #15359
ci: Skip vet on Windows 10bb97b @bep
Revert "parser/metadecoders: Strip BOM from data prior to unmarshalling" 51cd9e6 @bep
parser/metadecoders: Strip BOM from data prior to unmarshalling ec578f0 @jmooring #15355
tpl: Reformat templates with new formatter version 5698de9 @bep
resources/page: Balance container tags in automatic summaries d692a24 @bep #14044 #14927
config/security: Add an integration test 3be817e @bep
tpl/compare: Consolidate numeric comparisions 4d628bb @bep #15322 #15347
tpl/strings: Add a strings.FirstLower function aaacd12 @jmooring #15332
Update brevity guideline in AGENTS.md 881c0ec @bep

Dependency Updates

build(deps): bump github.com/olekukonko/tablewriter from 1.1.4 to 1.1.5 1567bde @dependabot[bot]
build(deps): bump github.com/dustin/go-humanize from 1.0.1 to 1.1.0 9e4059c @dependabot[bot]
build(deps): bump golang.org/x/tools from 0.49.0 to 0.50.0 8e3bbe6 @dependabot[bot]
build(deps): bump golang.org/x/image from 0.45.0 to 0.46.0 753c5fc @dependabot[bot]
build(deps): bump golang.org/x/text from 0.41.0 to 0.42.0 facde8a @dependabot[bot]
build(deps): bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.45.0 c7e1a8e @dependabot[bot]
deps: Bump github.com/bep/imagemeta from 1.0.0 to 1.0.1 (#15338) ec57bb7 @dependabot[bot] #15324

Documentation

readme: Bump minimum Go version 7a46cd2 @mikoxyz

Build Setup

Update release image to Go 1.27.1 (#15342) 34d8cdb @bep

`v0.166.0`

Compare Source

This release is mostly about hardening and bug fixes, but there are some notable changes:

.Render now takes an optional context argument: {{ .Render "view" $ctx }}, mirroring the partial API. This makes it possible to pass e.g. a dict to a content view. See #15077.
The return keyword in templates has been reimplemented. It now works in any template (not just partials) and can be used anywhere, e.g. inside if or range blocks. See #15212.
New resources.Publish template function and IndexOf method on Pages.
related config: new tokenize option for index values, and index creation is faster.
Several security fixes; see the notes below.

Note

tpl/transform: Bump fileCacheEntryVersion in transform.ToMath (note) 8d88b8b @bep #15267
resources/images: Bump formatVersionNumbers.PNG and fix version cache busting for images.Filter (note) d19e0a4 @bep #12536 #12543 #15266
warpc/js: Upgrade katex to 0.18.4 (note) ec52e63 @bep #15254
hexec: Fail on symlinks that escape the Node.js permission paths c05c012 @bep
config/security: Deny text/org content by default e6abb9c @bep
config/security: Add http.proxyFromEnvironment and document the resolved address check 6a2a955 @bep #15301 #15302
deps: Upgrade github.com/gobwas/glob v0.2.3 => v1.0.0 efd2456 @bep #15273
hugofs: Drop symlinked mount roots 938c820 @bep
tpl: Improve the return keyword in templates 8405b80 @bep #15212
resources/page: Don't let a title's "/" split an auto-derived slug 39507d5 @ipince #4092 #3577 #5571 #4090

Glob patterns

The glob library used for e.g. module mounts (includeFiles, excludeFiles), cascade targets, segments, deployment matchers and noVendor has been upgraded to v1.0.0. This is a complete rewrite of the matching engine that fixes a long list of correctness bugs, but it also means that some patterns may behave differently:

Malformed patterns (e.g. an unclosed {, an empty [] class) now fail with a syntax error instead of being silently accepted.
** matches any sequence of characters including separators, but it is not the **/ "globstar" of shells: **/x requires the literal / and does not match x, and a/**/b does not match a/b. Use {**/,}x if you need both.
\ is the escape character, so a literal backslash must be written as \\.

If a pattern that used to match no longer does (or vice versa), it was most likely relying on a bug in the old engine.

Security

text/org content is now denied by default, as Org mode's export blocks and @@html:...@@ snippets pass raw HTML through unescaped, making it the same XSS sink as text/html. Sites with Org content can opt back in via security.allowContent.
Remote fetches (resources.GetRemote etc.) now validate the resolved address at dial time and reject loopback, private, link-local, CGNAT and similar ranges. This only applies under the default security.http.urls allowlist; if you have customized it, you have opted into your own hosts and the check stands down. Proxies from HTTP_PROXY/HTTPS_PROXY hide the destination address from this check and are now ignored unless you set security.http.proxyFromEnvironment = true.
Node.js tools (PostCSS, Tailwind CSS etc.) now fail before invocation if a symlink inside the project resolves outside the allowed read/write roots. If you have a legitimate link, add its target to security.node.permissions.allowRead.
Mount roots that are themselves symlinks (e.g. themes/mytheme/assets -> /somewhere/else) are now dropped. This closes a gap in the themes/ confinement; absolute mount source values are still allowed.

Other

{{ return <value> }} outside a partial is now an error; it was previously silently ignored.
A page without an explicit slug whose title contains a / (e.g. Watch/listen to this) now gets a single URL segment (.../watch-listen-to-this/) instead of a nested one (.../watch/listen-to-this/). Taxonomy and term pages are not affected.
Hugo is now built with Go 1.27.

KaTeX

When upgrading to Hugo v0.166.0, sites using transform.ToMath with the output option set to html or htmlAndMathml must update the KaTeX stylesheet referenced in their template(s) to version 0.18.4 or higher. Using older CSS versions like 0.16.21 will cause certain mathematical or chemical expressions to render incorrectly.

Example update:

- <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.16.21/dist/katex.min.css">
+ <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.18.4/dist/katex.min.css">

See these examples:

Bug fixes

tpl/strings: Fix replaceRE with zero-width assertions ae07063 @youdie006
common/hreflect: Fix the off-by-one in the float to int overflow guards 5130d00 @youdie006
resources/images: Fix filters on transparent colors and paletted images 7785668 @bep #12536 #12543
github: Fix workflow for stale issues efe5cbc @jmooring #15261
all: Run modernize -fix ./... 7b5199f @bep
commands: Fix lang flag description in config command 87260e4 @jmooring #15223
hugolib: Fix slice bounds panic when deleting multiple nodes at same path 49dceb1 @bep #15207
hugolib: Fix ReadingTime and FuzzyWordCount calculations 5e70992 @jmooring #15206

Improvements

js: Add es2025 as supported build target 857120b @bep #15307
hugofs: Drop symlinked mount roots 938c820 @bep
markup/highlight: Escape lineAnchors before passing it to Chroma 3b2d3b8 @bep
tpl/partials: Slight performance improvement of the common partialCached case 9c2527f @bep
Add internalExternal.IgnoreTailwindCSSSecurityError config option a36bd27 @bep
config/security: Harden the default http.urls and resolved address checks (#15285) 24d5e42 @bep
resources/images: Preserve the source palette for geometric filter chains 9e7c978 @bep #12543
resources/images: Add golden test cases for geometric filter chains on paletted images 6b5b7d8 @bep #12543
resources/images: Add some golden test cases 62e24b7 @bep #12536 #12543
related: Speed up index creation f61346e @bep
related: Add tokenize option for index values 850f11c @jmooring #7515 #15199
resources/page: Don't let a title's "/" split an auto-derived slug 39507d5 @ipince #4092 #3577 #5571 #4090
config/allconfig: Improve resilience of hugo mod init 90fe506 @jmooring #15253
tpl: Separate deferred templates by escaping mode 49835f8 @Soundcreates #15234
resources: Validate the resolved address on remote fetches d6e6f9e @bep #15247
markup: Escape code-fence attribute values in the default renderer e4dc48c @bep #15247
hugolib: Make .Render take an optional context argument bcde806 @bep #15077
modules/npm: Make the generated workspace package private with a stable name df4ac34 @bep #15245
common/hstore: Keep read lock while sorting map values 166d3ee @Soundcreates #15237
metrics: Improve template metrics duration formatting a25af7f @Shiwang0-0 #15027
Remove comments from rebuild test functions 723579f @bep
hugolib: Add some fast render mode integration tests 85ad5e4 @bep
Upgrade to Go 1.27 e31ff54 @bep #15228
tpl: Improve the return keyword in templates 8405b80 @bep #15212
page: Add IndexOf method to Pages bf05832 @Shiwang0-0 #13589
tpl/resources: Add resources.Publish a05736c @bep #15208
markup/pandoc: Support pandoc 3.11 and later 423e9ce @jmooring #15271 #15280

Dependency Updates

build(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 3fbfd27 @dependabot[bot]
build(deps): bump golang.org/x/sync from 0.22.0 to 0.23.0 393de58 @dependabot[bot]
build(deps): bump golang.org/x/mod from 0.40.0 to 0.41.0 870f746 @dependabot[bot]
build(deps): bump github.com/getkin/kin-openapi from 0.146.0 to 0.149.0 6152e22 @dependabot[bot]
build(deps): bump github.com/bits-and-blooms/bitset 5b6e7c2 @dependabot[bot]
build(deps): bump github.com/bep/lazycache from 0.8.1 to 0.9.0 dc03bb2 @dependabot[bot]
build(deps): bump github.com/bep/tmc from 0.6.0 to 0.7.0 701dd33 @dependabot[bot]
build(deps): bump github.com/yuin/goldmark from 1.8.5 to 1.8.6 b4062c8 @dependabot[bot]
build(deps): bump golang.org/x/image from 0.44.0 to 0.45.0 cdd1627 @dependabot[bot]
deps: Upgrade github.com/gobwas/glob v0.2.3 => v1.0.0 efd2456 @bep #15273
build(deps): bump golang.org/x/mod from 0.39.0 to 0.40.0 d462968 @dependabot[bot]
build(deps): bump github.com/tdewolff/minify/v2 from 2.24.16 to 2.24.17 fd5f7c6 @dependabot[bot]
build(deps): bump github.com/gohugoio/httpcache from 0.8.0 to 0.9.0 6b33517 @dependabot[bot]
build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 5f0d88b @dependabot[bot]
build(deps): bump golang.org/x/tools from 0.48.0 to 0.49.0 9171dae @dependabot[bot]
build(deps): bump software.sslmate.com/src/go-pkcs12 from 0.7.0 to 0.7.2 d1ee825 @dependabot[bot]

`v0.165.0`

Compare Source

The two main new things is the new css.ChromaStyles template func and the new importContext option demonstrated below.

{{ $light := css.ChromaStyles (dict "targetPath" "css/components/chroma-light.css" "style" "github" "mode" "light") }}
{{ $dark := css.ChromaStyles (dict "targetPath" "css/components/chroma-dark.css" "style" "github" "mode" "dark") }}
{{ $opts := dict "minify" true "importContext" (slice $light $dark) }}
{{ $css := resources.Get "css/main.css" | css.Build $opts }}

The importContext is relevant for css.Build, js.Build, css.Sass, and css.PostCSS. and it allows you to make resources (e.g. built from resources.FromString) resolvable in e.g. CSS @import statements.

Note

Remove tailwindcss from the default security.exec.allow list (note) 8a55df7 @bep #15178 #15171

Bug fixes

Fix resource transformation chaining after content access f772998 @bep #15189
Fix server static file detection for deleted files/directories in the static syncer 2ffaf1f @bep
Fix server errors when deleting static files or directories a808f6e @bep #15174
Fix panic on server atomic save edits on MacOS 6bf1524 @bep #15130
markup/asciidocext: Fix TOC parsing for asciidoctor-html5s f961093 @jmooring #15121
snap: Fix snap home environment 984358f @jmooring #15114

Improvements

resources: Resume chained resource transformations 995a215 @bep #15189 #15189
resources/jsconfig: Drop source root mapping for the current source root f88f0a9 @bep #15169
circleci: Upgrade to Go 1.26.5 52c9bd7 @bep
Add Data.Artifacts to css.Build and js.Build 44da086 @bep #15173
css: Add classDark and classLight options to css.ChromaStyles and gen chromastyles 33d1f2c @bep #15167
markup/highlight: Re-emit token colors dropped by Chroma's minifier 64da6d7 @bep #15161
Add importContext option to css.Build, js.Build, css.Sass and css.TailwindCSS 70db201 @bep #15103
Remove some old deprecations 8a468df @bep
Add css.ChromaStyles 615e45d @bep #15112
check.sh: Handle staticcheck not installed/in PATH a243a61 @Soundcreates
warpc: Improve AVIF error message on memory allocation failure 7d90277 @bep
cache/filecache: Don't prune used cache entries with mixed-case dir names 861ede6 @bep #15101
Drop symlinks in parent directories f228c87 @bep
Delete .gemini 7df45f6 @bep
common/hugo: Include non-go dependencies in go env output 89b8c32 @jmooring #15116

Dependency Updates

build(deps): bump github.com/bep/imagemeta from 0.17.3 to 1.0.0 0bb337b @dependabot[bot]
build(deps): bump github.com/evanw/esbuild from 0.28.1 to 0.28.2 03dc917 @dependabot[bot]
build(deps): bump github.com/tdewolff/minify/v2 from 2.24.14 to 2.24.16 c829b73 @dependabot[bot]
build(deps): bump github.com/getkin/kin-openapi from 0.145.0 to 0.146.0 94f3908 @dependabot[bot]
build(deps): bump github.com/rogpeppe/go-internal from 1.15.0 to 1.16.0 75fcc75 @dependabot[bot]
build(deps): bump github.com/mattn/go-isatty from 0.0.22 to 0.0.24 b5fa03d @dependabot[bot]
build(deps): bump github.com/yuin/goldmark from 1.8.4 to 1.8.5 9da472d @dependabot[bot]
build(deps): bump golang.org/x/tools from 0.47.0 to 0.48.0 635532a @dependabot[bot]
build(deps): bump github.com/kyokomi/emoji/v2 from 2.2.13 to 2.2.14 9c71f60 @dependabot[bot]
build(deps): bump github.com/getkin/kin-openapi from 0.144.0 to 0.145.0 420527f @dependabot[bot]
build(deps): bump golang.org/x/image from 0.43.0 to 0.44.0 7fe786e @dependabot[bot]
build(deps): bump github.com/bep/imagemeta from 0.17.2 to 0.17.3 03b244f @dependabot[bot]
build(deps): bump github.com/tdewolff/minify/v2 from 2.24.13 to 2.24.14 9611813 @dependabot[bot]
build(deps): bump github.com/yuin/goldmark from 1.8.2 to 1.8.4 e35b7f0 @dependabot[bot]
build(deps): bump golang.org/x/net from 0.56.0 to 0.57.0 0796fa7 @dependabot[bot]
build(deps): bump golang.org/x/text from 0.38.0 to 0.40.0 1b701b7 @dependabot[bot]
build(deps): bump github.com/getkin/kin-openapi from 0.140.0 to 0.144.0 a32d70b @dependabot[bot]
build(deps): bump google.golang.org/grpc from 1.80.0 to 1.82.1 948cfb9 @dependabot[bot]
build(deps): bump golang.org/x/mod from 0.37.0 to 0.38.0 8930802 @dependabot[bot]

Documentation

Remove Star History from README dd3f273 @bep #15190
Update README.md d1f191c @jmooring

`v0.164.0`

Compare Source

Notable new features in this release are:

The Chroma highlighter styles now introduces dark/light pairs. See also the new flags on the hugo gen chromastyles command.
New template funcs encoding.HexEncode, encoding.HexDecode, and crypto.Hash.
New markup.rst.syntaxHighlight option.
We added Pandoc citation support.
We now spport sub paths in layouts passed to Page.Render.
This release also fixes a performance regression introduced in Hugo v0.128.0. This should mostly be prominent in bigger sites. See this discussion for some background.

Notes

tpl/resources: Deprecate resources.PostProcess in favour of templates.Defer 29ed932 @bep #15086

Changes

all: Rewrite deprecated constructs in tests 5a5f4a5 @bep
tpl/tplimpl: Support sub paths in layouts passed to .Render d83ce27 @bep #15056
Add markup.rst.syntaxHighlight option c6acc24 @bep #5349
tpl/resources: Deprecate resources.PostProcess in favour of templates.Defer 29ed932 @bep #15086
tpl/collections: Include key in IsSet unsupported-type warning 671897a @bejaratommy #11794
create: Keep new content placeholders buildable 499794d @sjh9714 #15078
hugio: Speedup hasBytesWriter 65c8217 @bep
tpl/crypto: Add crypto.Hash dfb35dc @bep #15072
Add encoding.HexDecode/Encode a5ec542 @bep #15068 #15060
tpl/tplimpl: Make template name lookup case-insensitive e46d37a @jmooring #15057
hugolib: Return error from .Render when template not found fe06735 @jmooring #15052
markup/pandoc: Add citation support 128fb17 @jmooring #15062

Dependency Updates

build(deps): bump github.com/JohannesKaufmann/html-to-markdown/v2 921db7b @dependabot[bot]
build(deps): bump golang.org/x/tools from 0.45.0 to 0.47.0 786ce71 @dependabot[bot]
build(deps): bump golang.org/x/image from 0.42.0 to 0.43.0 5ad2846 @dependabot[bot]
build(deps): bump golang.org/x/net from 0.55.0 to 0.56.0 36ad9f5 @dependabot[bot]
build(deps): bump github.com/pelletier/go-toml/v2 from 2.4.2 to 2.4.3 7c0a0bc @dependabot[bot]
build(deps): bump github.com/getkin/kin-openapi from 0.139.0 to 0.140.0 a879ebf @dependabot[bot]
build(deps): bump golang.org/x/mod from 0.36.0 to 0.37.0 332d5ec @dependabot[bot]
build(deps): bump github.com/pelletier/go-toml/v2 from 2.3.1 to 2.4.2 212cc11 @dependabot[bot]
deps: Upgrade github.com/evanw/esbuild v0.28.0 => v0.28.1 884439b @bep #15033
deps: Add Chroma dark/light mode support 790a8aa @bep #15017

`v0.163.3`

Compare Source

What's Changed

markup/highlight: Escape lang in default code block rendering ce1a7e0 @bep thanks to @k0ngj1 for reporting this issue.
parser/pageparser: Preserve non-ASCII whitespace after e.g. summary divider 70a9068 @bep
resources: Support babel/postcss config variants 9d66d51 @jmooring #15039 #15040 #15043
hugolib: Fix page/section name collision regression f013346 @jmooring #15046

`v0.163.2`

Compare Source

What's Changed

Continue resolving on ERR_ACCESS_DENIED in Node's resolver 134674f @bep #15041
markup: Standardize behavior when external converters are missing 147f605 @jmooring #14222

`v0.163.1`

Compare Source

The majority of the fixes in this release are security related (including the upstream fix in 93c8c7d (golang.org/x/image)). Thanks to @vnth4nhnt for finding the issues fixed in a00b5c7 and cf9c8f9 (I will do the CVE work on this later). There has been a uptick in security reports lately, which doesn't mean that Hugo has gotten less secure, this is mostly the work of the new and powerful AI tools using Hugo's restrictive security model as their baseline. Just take a look at Go's recent security issue list to see a demonstration of this.

What's Changed

build(deps): bump golang.org/x/image from 0.41.0 to 0.42.0 93c8c7d @dependabot[bot]
Fix multi --renderSegments merge behavior 95e5e9f @bep #15024
security: Normalize integer IPv4 host encodings in http.urls check a00b5c7 @bep
Drop symlinks in os.ReadDir, os.ReadFile, os.Stat and os.FileExists cf9c8f9 @bep #15019
commands: Fix convert command 2602796 @jmooring #15012

`v0.163.0`

Compare Source

The main topic in this release is improvements to the AVIF image handling that we introduced in v0.162.0. See the docs for details, but:

We have turned down the default quality for AVIF to 60. Turns out, JPEG/WebP with quality 75 is comparable to AVIF with quality 60. You can now also set quality per image format in your project config (and also per image processed if needed).
We have added a hint to the AVIF with the same values as for WEBP. For lossy compression, the photo/picture hints (and the default) encodes with YUV420 chroma subsampling instead of YUV444, keeping 444 for text/icon/drawing. This greatly reduces the memory needed to encode these images.

Improvements

resources/jsconfig: Remove deprecated baseUrl setting ff2903a @bep #14991 #14996
all: Adjust tests for deprecated link and image render hook settings ca68936 @jmooring
all: Run go fix ./... 781fabf @bep
pagesfromdata: Use relative path for content adapter template metrics 1d018ef @anupamojha-eng #14999
ci: Re-add macos-latest to the test matrix 121bc6c @bep
images: Deprecate Imaging.Compression and move it down to webp and avif configs cf18b82 @bep #14998
Only support the latest Go version 98ad9b3 @bep #14997
page: Add IsBranch and deprecate IsNode b89e7fe @bep #11574
images: Force cache invalidation for AVIF target e8fefc8 @bep #14990
images: Add a per-format AVIF hint setting a043d3e @bep #14992
images: Make AVIF chroma subsampling content-aware via the hint 341f575 @bep #14987
Cap AVIF lossy quality at 99 248241b @bep #14981
config: Deprecate the glogal imaging quality setting 4e47d95 @bep #14979
images: Make 60 the default quality for AVIF 03b4b54 @bep #14979
livereload: Disconnect from websocket server on pageswap 79be053 @bep #14983
tpl/tplimpl/embedded: Prevent leading newline in sitemap template 0f44046 @bep #14977
images: Recover from memory alloc errors in WASM image processors 4e17421 @bep #14985
images: Add quality setting per image format b01ecd4 @bep #14957
misc: Remove duplicate words in comments 45c00b7 @jmooring #14936 #14950 #14965
Add some PNG to AVIF golden test cases 28d882a @bep

Dependency Updates

build(deps): bump github.com/bits-and-blooms/bitset 0d29fc8 @dependabot[bot]
build(deps): bump github.com/tetratelabs/wazero bb57404 @dependabot[bot]
build(deps): bump github.com/rogpeppe/go-internal from 1.14.1 to 1.15.0 7d1b1fb @dependabot[bot]
build(deps): bump github.com/getkin/kin-openapi from 0.138.0 to 0.139.0 77a1147 @dependabot[bot]

`v0.162.1`

Compare Source

What's Changed

modules/npm: Fix false stale warning after npm pack 59f35cd @jmooring #14959
Revert "tpl/collections: Make dict return nil when no values are provided" c270975 @bep #14958
tpl/time: Fix locale-specific month abbreviations ea8b48a @jmooring #14948

`v0.162.0`

Compare Source

The notable new feature in this release is support for AVIF images (both encoder and decoder). There's a demo site set up that demonstrates the difference between HDR AVIF and SDR JPEG images. Note that that demo is only really interesting if viewed on an HDR capable screen (e.g. Apple Retina).

Security fixes

There are some notable security fixes in this release.

Security fixes in Go

This release upgrades from Go 1.26.1 to 126.3, which brings a set of security fixes. Some relevant for Hugo are:

XSS in html/template (CVE-2026-39826 & CVE-2026-39823): Two separate vulnerabilities where escaper bypasses in html/template could lead to Cross-Site Scripting (XSS).
html/template: Fixes an issue where JS template literal contexts were incorrectly tracked across template branches, which could lead to improper content escaping.

Security fixes and hardening in Hugo

The following changes either fix a concrete issue or reduce the default attack surface of hugo builds.

Disallow text/html content files by default (e41a064). A new security.allowContent policy gates which content media types may be used for pages under /content. text/html is denied by default; sites that rely on hand-authored or adapter-emitted HTML content can opt back in with security.allowContent = ['.*'].
Re-check security.http.urls on every redirect hop in resources.GetRemote (86fbb0f).
Reject symlinked entries in resources.Get (f8b5fa0).

We will update this section later with links to CVEs where applicable.

All changes

hugolib: Fix Page.GitInfo for modules with go.mod in a repo subdirectory df54219 @bep #14942
Fix typo in CONTRIBUTING.md 4bc7cae @bep
resources: Fix the :counter placeholder 5d51b82 @jmooring #14921
commands: Fix import from Jekyll 81d7762 @jmooring #14795 #14906
Fix prevention of direct symlink reads in resources.Get f8b5fa0 @bep
commands: Fix github-dark chromastyles 88d838a @xndvaz #14831
Disallow HTML content by default e41a064 @bep
Add image processing support for AVIF 90d9f81 @bep #7837
config: Preserve intentionally empty maps 80e6084 @jmooring #14944
hugolib: Merge existing hugo_stats.json when renderSegments is set aeb9a5c @bep #14939
all: Replace RWMutex struct caches with ConcurrentMap c4bbc28 @bep
tpl/tplimpl: Consolidate and improve embedded template integration tests d8c7021 @jmooring #14932
parser: Drop empty sub maps from hugo config output ee4f1ac @bep #14855
markup/highlight: Allow overriding type and code via options b613365 @bep #11872
Update AI assistance disclosure requirements d2c821b @bep
hugolib: Use AllTranslated in IsTranslated 4ed7600 @bep
tpl: Simplify sitemap template cbe4339 @bep #14912
tpl: Use AllTranslations in sitemap template 6475d30 @bep #14912 #14917
tpl/collections: Make dict return nil when no values are provided 67aede4 @bep
Sync Go template package to 1.26.3 87f194b @bep #14897
Upgrade to Go 1.26.3 d81e3c2 @bep #14897
ci: Check embedded template formatting with gotmplfmt 7c65a4d @bep
tpl: Run gotmplfmt -w . d31a927 @bep
markup/goldmark/codeblocks: Always split Chroma options into .Options c36608c @jmooring #14909
hugolib: Allow empty params front matter 2f361a8 @xndvaz #14886
common/hmaps: Merge slice-valued module config into site config 5559263 @jmooring #13869
tpl: Use GetMatch for both local and global image resources 656fc04 @bep #14062
Revert "markup/tableofcontents: Skip empty TOC levels" a20cb5b @bep #14898
tpl/templates: Reject Defer inside partialCached 4d775cb @bep #13492
common/hexec: Make NODE_PATH a fallback for ESM bare imports ae7bf74 @bep #13987
config: Allow repeating the root key in /config files ba5d812 @bep #12899 #14882
Revise test naming guidelines in AGENTS.md be4a0df @bep
Update AGENTS.md e4cf565 @bep
js: Return error for missing batch imports 9e64953 @xndvaz #13737
resources/images: Keep smart crop target size f0cfc28 @xndvaz #13688
testing: Use synctest where relevant 16e854a @bep
security: Validate redirects against security.http.urls 86fbb0f @bep #14871
markup/tableofcontents: Skip empty TOC levels 7d4af7a @xndvaz #7128
Fall back to hugo.buildDate in hugo.BuildDate() in non-vcs builds 28147cb @bep #14862
css: Make css.Build's file-loader URLs absolute to web context root e51e761 @bep #14849
hugolib: Don't warn about lang/kind/path coming from cascade.params 7011239 @bep #14848
markup/goldmark: Unwrap inner HTML for plain code blocks 694906f @cyphercodes #14820
tpl/tplimpl: Extend page image lookup to include global resources d27b9c0 @ogulcanaydogan #14062
security: Allow hostnames starting with digits in default http.urls 62cef36 @bep #14837
commands: Improve description of command flags ff22c62 @jmooring #14817
build(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 4f444c8 @dependabot[bot]
build(deps): bump golang.org/x/image from 0.40.0 to 0.41.0 fe6c726 @dependabot[bot]
build(deps): bump github.com/getkin/kin-openapi from 0.137.0 to 0.138.0 6a2a038 @dependabot[bot]
build(deps): bump github.com/JohannesKaufmann/html-to-markdown/v2 cf1de59 @dependabot[bot]
build(deps): bump golang.org/x/image from 0.39.0 to 0.40.0 97f990c @dependabot[bot]
build(deps): bump golang.org/x/tools from 0.44.0 to 0.45.0 b99634e @dependabot[bot]
build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 fdd977e @dependabot[bot]
build(deps): bump github.com/pelletier/go-toml/v2 from 2.3.0 to 2.3.1 123018d @dependabot[bot]
deps: Upgrade to Chroma v2.24.1 b88fa8c @bep #14839

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [hugo](https://github.com/gohugoio/hugo) | uses-with | minor | `0.161.1` → `0.167.0` | --- ### Release Notes <details> <summary>gohugoio/hugo (hugo)</summary> ### [`v0.167.0`](https://github.com/gohugoio/hugo/releases/tag/v0.167.0) [Compare Source](https://github.com/gohugoio/hugo/compare/v0.166.0...v0.167.0) This release brings relative partial references, slug support for branch pages, and a handful of security hardening fixes. **Relative partial references.** A partial name starting with `./` or `../` is now resolved relative to the directory of the calling partial. This makes it much easier to write self-contained, movable partial trees, e.g. `{{ partial "./item.html" . }}` from within `layouts/_partials/card/list.html`. Relative paths are only allowed from within partials, and paths resolving outside the partials directory is an error. See [#15373](https://github.com/gohugoio/hugo/issues/15373) and the [documentation](https://gohugo.io/functions/partials/include/#relative-paths). **Slugs for section, taxonomy and term pages.** The `slug` front matter now works for branch pages, not just regular pages, and it cascades to descendants. This is particularly useful in multilingual sites, where e.g. `content/help/_index.es.md` with `slug: ayuda` gives `/es/ayuda/`, `/es/ayuda/avanzado/` etc. See [#14352](https://github.com/gohugoio/hugo/issues/14352). **Other notable improvements** include the new `build.cleanDestinationDir` config with `keepFiles`/`keepDirs` Glob patterns ([#14937](https://github.com/gohugoio/hugo/issues/14937), [docs](https://gohugo.io/configuration/build/#clean-destination-directory)), `hugo` now builds without a config file ([#15393](https://github.com/gohugoio/hugo/issues/15393)), exact numeric comparisons in `eq`, `where`, `in` and the set functions ([#15322](https://github.com/gohugoio/hugo/issues/15322), [#15358](https://github.com/gohugoio/hugo/issues/15358)), and automatic summaries that no longer end inside an open list or blockquote ([#14044](https://github.com/gohugoio/hugo/issues/14044)). ##### Security This release contains several hardening fixes. None of them are known to be exploited, but if you build sites with untrusted themes or modules, you should upgrade. - Sass imports not found in Hugo's file systems were resolved by the Sass compiler itself, which follows symlinks and knows nothing about the project root. A theme could import a file outside the project and get its content into the published CSS. These imports are now resolved by Hugo and checked against the same `security.allowRead` roots as the Node.js tools and `js.Build`. [`41040cc`](https://github.com/gohugoio/hugo/commit/41040cc7) (thanks to [@Hama1cco](https://github.com/Hama1cco)) - Likewise, imports not found in `/assets` were resolved and read by ESBuild itself. The resolved path is now checked against the allowed read paths before ESBuild loads it. [`2aa51f3`](https://github.com/gohugoio/hugo/commit/2aa51f34) (thanks to [@Hama1cco](https://github.com/Hama1cco)) - A symlinked directory in a theme at the parent of a nested mount could expose files outside the module. [`2fe9bab`](https://github.com/gohugoio/hugo/commit/2fe9bab7) - Explicit heading IDs (e.g. `## Foo {id="..."}`) were written unescaped into the table of contents `href`, allowing attribute breakout. [`671fbf2`](https://github.com/gohugoio/hugo/commit/671fbf2c) ##### Note - The default `baseURL` is now `https://example.org/` (it was empty). Hugo has always required a valid URL to work properly, so this mostly affects new and test sites, but if you relied on the empty default for relative URLs, set `baseURL` explicitly. [`bc68654`](https://github.com/gohugoio/hugo/commit/bc686541) [@bep](https://github.com/bep) [#14625](https://github.com/gohugoio/hugo/issues/14625) [#15384](https://github.com/gohugoio/hugo/issues/15384) - The root `cleanDestinationDir` config key is deprecated in favour of `build.cleanDestinationDir.enable`. The `--cleanDestinationDir` flag maps to the new key. Note that `.git` files in the publish dir are now kept by default. [`9086193`](https://github.com/gohugoio/hugo/commit/90861931) [@bep](https://github.com/bep) [#14937](https://github.com/gohugoio/hugo/issues/14937) - `eq` now compares numeric values the same way as `lt`, `le` etc., so e.g. `eq 1 1.0` is now `true`. Also, `in`, `intersect`, `union`, `uniq`, `symdiff`, `complement` and `where`'s `in`/`not in` now compare numbers exactly rather than via `float64`, and no longer require the Go types to match. [`4d628bb`](https://github.com/gohugoio/hugo/commit/4d628bbd) [`366377b`](https://github.com/gohugoio/hugo/commit/366377b6) [@bep](https://github.com/bep) [#15322](https://github.com/gohugoio/hugo/issues/15322) [#15358](https://github.com/gohugoio/hugo/issues/15358) - A user table render hook is now preferred over the embedded one. [`140d936`](https://github.com/gohugoio/hugo/commit/140d9362) [@jmooring](https://github.com/jmooring) [#15389](https://github.com/gohugoio/hugo/issues/15389) - Automatic summaries are expanded past `summaryLength` when needed so they don't end inside an open container element. This may change the summary for some pages. [`d692a24`](https://github.com/gohugoio/hugo/commit/d692a243) [@bep](https://github.com/bep) [#14044](https://github.com/gohugoio/hugo/issues/14044) ##### Bug fixes - hugolib: Fix failing integration test [`fdbba5a`](https://github.com/gohugoio/hugo/commit/fdbba5a6) [@jmooring](https://github.com/jmooring) - Fix build with Go 1.26 on Fedora 44 Beta [`2782bfd`](https://github.com/gohugoio/hugo/commit/2782bfd3) [@flyn-org](https://github.com/flyn-org) - Fix smartcrop with rotation ([#15371](https://github.com/gohugoio/hugo/issues/15371)) [`5edd05b`](https://github.com/gohugoio/hugo/commit/5edd05bb) [@bep](https://github.com/bep) [#11266](https://github.com/gohugoio/hugo/issues/11266) [#15369](https://github.com/gohugoio/hugo/issues/15369) - ci: Fix broken magefile [`1d87ee5`](https://github.com/gohugoio/hugo/commit/1d87ee5b) [@bep](https://github.com/bep) - tpl/collections: Fix union of slices with different numeric element types [`ffbcdba`](https://github.com/gohugoio/hugo/commit/ffbcdba9) [@hktitof](https://github.com/hktitof) [#15323](https://github.com/gohugoio/hugo/issues/15323) - Fix stale page content when several files in the same dir change in one batch [`a374b86`](https://github.com/gohugoio/hugo/commit/a374b865) [@bep](https://github.com/bep) [#15330](https://github.com/gohugoio/hugo/issues/15330) ##### Improvements - Update .gitignore [`f6606f1`](https://github.com/gohugoio/hugo/commit/f6606f1f) [@bep](https://github.com/bep) - tocss: Confine Sass import fallbacks to the allowed read paths [`41040cc`](https://github.com/gohugoio/hugo/commit/41040cc7) [@bep](https://github.com/bep) - js: Confine ESBuild's fallback resolver to the allowed read paths [`2aa51f3`](https://github.com/gohugoio/hugo/commit/2aa51f34) [@bep](https://github.com/bep) - commands: Allow building without a config file [`c7f9999`](https://github.com/gohugoio/hugo/commit/c7f99993) [@bep](https://github.com/bep) [#15393](https://github.com/gohugoio/hugo/issues/15393) - collections: Preserve slice type when appending an empty slice [`dd16df1`](https://github.com/gohugoio/hugo/commit/dd16df14) [@jakezwang](https://github.com/jakezwang) [#11131](https://github.com/gohugoio/hugo/issues/11131) - tpl/tplimpl: Prefer user table render hook over embedded [`140d936`](https://github.com/gohugoio/hugo/commit/140d9362) [@jmooring](https://github.com/jmooring) [#15389](https://github.com/gohugoio/hugo/issues/15389) - Avoid allocating in SitesMatrix.MatchSiteVector [`83ab799`](https://github.com/gohugoio/hugo/commit/83ab7999) [@bep](https://github.com/bep) - Add slug support for section, taxonomy and term pages [`5d43ab7`](https://github.com/gohugoio/hugo/commit/5d43ab70) [@bep](https://github.com/bep) [#14352](https://github.com/gohugoio/hugo/issues/14352) - tpl: Avoid reflect.Value.Call for common signatures [`806a62e`](https://github.com/gohugoio/hugo/commit/806a62e8) [@bep](https://github.com/bep) [#15385](https://github.com/gohugoio/hugo/issues/15385) - ci: Disable vet when running tests [`8bac4de`](https://github.com/gohugoio/hugo/commit/8bac4de7) [@bep](https://github.com/bep) - tpl/partials: Support relative partial paths from within partials ([#15376](https://github.com/gohugoio/hugo/issues/15376)) [`bd1588b`](https://github.com/gohugoio/hugo/commit/bd1588bd) [@bep](https://github.com/bep) [#15373](https://github.com/gohugoio/hugo/issues/15373) - config: Add build.cleanDestinationDir config [`9086193`](https://github.com/gohugoio/hugo/commit/90861931) [@bep](https://github.com/bep) [#14937](https://github.com/gohugoio/hugo/issues/14937) - commands: Make testscripts/commands/hugo\_\_clean\_destination\_dir.txt portable [`a74b753`](https://github.com/gohugoio/hugo/commit/a74b7539) [@bep](https://github.com/bep) [#8433](https://github.com/gohugoio/hugo/issues/8433) - commands: Handle missing staticDir in cleanDestinationDir [`07b9fba`](https://github.com/gohugoio/hugo/commit/07b9fba1) [@jmooring](https://github.com/jmooring) [#8433](https://github.com/gohugoio/hugo/issues/8433) - hugofs: Cache symlink checks [`09fa49b`](https://github.com/gohugoio/hugo/commit/09fa49be) [@bep](https://github.com/bep) - hugofs: Drop symlinks in virtual ancestor dirs of nested mounts [`2fe9bab`](https://github.com/gohugoio/hugo/commit/2fe9bab7) [@bep](https://github.com/bep) - markup/tableofcontents: Escape heading IDs in ToC HTML [`671fbf2`](https://github.com/gohugoio/hugo/commit/671fbf2c) [@bep](https://github.com/bep) - hugofs: Allow symlinked mount roots in the main project [`25f2856`](https://github.com/gohugoio/hugo/commit/25f2856a) [@bep](https://github.com/bep) [#15367](https://github.com/gohugoio/hugo/issues/15367) - Expand and consolidate BOM trimming [`cb6a707`](https://github.com/gohugoio/hugo/commit/cb6a7072) [@bep](https://github.com/bep) [#15355](https://github.com/gohugoio/hugo/issues/15355) [#15361](https://github.com/gohugoio/hugo/issues/15361) - tpl/collections: Compare numbers exactly in set operations and where [`366377b`](https://github.com/gohugoio/hugo/commit/366377b6) [@bep](https://github.com/bep) [#15358](https://github.com/gohugoio/hugo/issues/15358) [#15359](https://github.com/gohugoio/hugo/issues/15359) - ci: Skip vet on Windows [`10bb97b`](https://github.com/gohugoio/hugo/commit/10bb97ba) [@bep](https://github.com/bep) - Revert "parser/metadecoders: Strip BOM from data prior to unmarshalling" [`51cd9e6`](https://github.com/gohugoio/hugo/commit/51cd9e6c) [@bep](https://github.com/bep) - parser/metadecoders: Strip BOM from data prior to unmarshalling [`ec578f0`](https://github.com/gohugoio/hugo/commit/ec578f0c) [@jmooring](https://github.com/jmooring) [#15355](https://github.com/gohugoio/hugo/issues/15355) - tpl: Reformat templates with new formatter version [`5698de9`](https://github.com/gohugoio/hugo/commit/5698de94) [@bep](https://github.com/bep) - resources/page: Balance container tags in automatic summaries [`d692a24`](https://github.com/gohugoio/hugo/commit/d692a243) [@bep](https://github.com/bep) [#14044](https://github.com/gohugoio/hugo/issues/14044) [#14927](https://github.com/gohugoio/hugo/issues/14927) - config/security: Add an integration test [`3be817e`](https://github.com/gohugoio/hugo/commit/3be817ed) [@bep](https://github.com/bep) - tpl/compare: Consolidate numeric comparisions [`4d628bb`](https://github.com/gohugoio/hugo/commit/4d628bbd) [@bep](https://github.com/bep) [#15322](https://github.com/gohugoio/hugo/issues/15322) [#15347](https://github.com/gohugoio/hugo/issues/15347) - tpl/strings: Add a strings.FirstLower function [`aaacd12`](https://github.com/gohugoio/hugo/commit/aaacd12c) [@jmooring](https://github.com/jmooring) [#15332](https://github.com/gohugoio/hugo/issues/15332) - Update brevity guideline in AGENTS.md [`881c0ec`](https://github.com/gohugoio/hugo/commit/881c0ec7) [@bep](https://github.com/bep) ##### Dependency Updates - build(deps): bump github.com/olekukonko/tablewriter from 1.1.4 to 1.1.5 [`1567bde`](https://github.com/gohugoio/hugo/commit/1567bdef) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump github.com/dustin/go-humanize from 1.0.1 to 1.1.0 [`9e4059c`](https://github.com/gohugoio/hugo/commit/9e4059cf) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump golang.org/x/tools from 0.49.0 to 0.50.0 [`8e3bbe6`](https://github.com/gohugoio/hugo/commit/8e3bbe67) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump golang.org/x/image from 0.45.0 to 0.46.0 [`753c5fc`](https://github.com/gohugoio/hugo/commit/753c5fc1) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump golang.org/x/text from 0.41.0 to 0.42.0 [`facde8a`](https://github.com/gohugoio/hugo/commit/facde8aa) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.45.0 [`c7e1a8e`](https://github.com/gohugoio/hugo/commit/c7e1a8e6) [@dependabot](https://github.com/dependabot)\[bot] - deps: Bump github.com/bep/imagemeta from 1.0.0 to 1.0.1 ([#15338](https://github.com/gohugoio/hugo/issues/15338)) [`ec57bb7`](https://github.com/gohugoio/hugo/commit/ec57bb7d) [@dependabot](https://github.com/dependabot)\[bot] [#15324](https://github.com/gohugoio/hugo/issues/15324) ##### Documentation - readme: Bump minimum Go version [`7a46cd2`](https://github.com/gohugoio/hugo/commit/7a46cd2b) [@mikoxyz](https://github.com/mikoxyz) ##### Build Setup - Update release image to Go 1.27.1 ([#15342](https://github.com/gohugoio/hugo/issues/15342)) [`34d8cdb`](https://github.com/gohugoio/hugo/commit/34d8cdb1) [@bep](https://github.com/bep) ### [`v0.166.0`](https://github.com/gohugoio/hugo/releases/tag/v0.166.0) [Compare Source](https://github.com/gohugoio/hugo/compare/v0.165.0...v0.166.0) This release is mostly about hardening and bug fixes, but there are some notable changes: - [`.Render`](https://gohugo.io/methods/page/render/) now takes an optional context argument: `{{ .Render "view" $ctx }}`, mirroring the `partial` API. This makes it possible to pass e.g. a dict to a content view. See [#15077](https://github.com/gohugoio/hugo/issues/15077). - The [`return`](https://gohugo.io/functions/go-template/return/) keyword in templates has been reimplemented. It now works in any template (not just partials) and can be used anywhere, e.g. inside `if` or `range` blocks. See [#15212](https://github.com/gohugoio/hugo/issues/15212). - New [`resources.Publish`](https://gohugo.io/functions/resources/publish/) template function and [`IndexOf`](https://gohugo.io/methods/pages/indexof/) method on `Pages`. - [`related`](https://gohugo.io/configuration/related-content/) config: new `tokenize` option for index values, and index creation is faster. - Several [security](https://gohugo.io/configuration/security/) fixes; see the notes below. ##### Note - tpl/transform: Bump fileCacheEntryVersion in transform.ToMath (note) [`8d88b8b`](https://github.com/gohugoio/hugo/commit/8d88b8b4) [@bep](https://github.com/bep) [#15267](https://github.com/gohugoio/hugo/issues/15267) - resources/images: Bump formatVersionNumbers.PNG and fix version cache busting for images.Filter (note) [`d19e0a4`](https://github.com/gohugoio/hugo/commit/d19e0a4b) [@bep](https://github.com/bep) [#12536](https://github.com/gohugoio/hugo/issues/12536) [#12543](https://github.com/gohugoio/hugo/issues/12543) [#15266](https://github.com/gohugoio/hugo/issues/15266) - warpc/js: Upgrade katex to 0.18.4 (note) [`ec52e63`](https://github.com/gohugoio/hugo/commit/ec52e638) [@bep](https://github.com/bep) [#15254](https://github.com/gohugoio/hugo/issues/15254) - hexec: Fail on symlinks that escape the Node.js permission paths [`c05c012`](https://github.com/gohugoio/hugo/commit/c05c012a) [@bep](https://github.com/bep) - config/security: Deny text/org content by default [`e6abb9c`](https://github.com/gohugoio/hugo/commit/e6abb9c3) [@bep](https://github.com/bep) - config/security: Add http.proxyFromEnvironment and document the resolved address check [`6a2a955`](https://github.com/gohugoio/hugo/commit/6a2a955d) [@bep](https://github.com/bep) [#15301](https://github.com/gohugoio/hugo/issues/15301) [#15302](https://github.com/gohugoio/hugo/issues/15302) - deps: Upgrade github.com/gobwas/glob v0.2.3 => v1.0.0 [`efd2456`](https://github.com/gohugoio/hugo/commit/efd24562) [@bep](https://github.com/bep) [#15273](https://github.com/gohugoio/hugo/issues/15273) - hugofs: Drop symlinked mount roots [`938c820`](https://github.com/gohugoio/hugo/commit/938c8206) [@bep](https://github.com/bep) - tpl: Improve the return keyword in templates [`8405b80`](https://github.com/gohugoio/hugo/commit/8405b802) [@bep](https://github.com/bep) [#15212](https://github.com/gohugoio/hugo/issues/15212) - resources/page: Don't let a title's "/" split an auto-derived slug [`39507d5`](https://github.com/gohugoio/hugo/commit/39507d51) [@ipince](https://github.com/ipince) [#4092](https://github.com/gohugoio/hugo/issues/4092) [#3577](https://github.com/gohugoio/hugo/issues/3577) [#5571](https://github.com/gohugoio/hugo/issues/5571) [#4090](https://github.com/gohugoio/hugo/issues/4090) ##### Glob patterns The glob library used for e.g. module mounts (`includeFiles`, `excludeFiles`), `cascade` targets, `segments`, `deployment` matchers and `noVendor` has been upgraded to v1.0.0. This is a complete rewrite of the matching engine that fixes a long list of correctness bugs, but it also means that some patterns may behave differently: - Malformed patterns (e.g. an unclosed `{`, an empty `[]` class) now fail with a syntax error instead of being silently accepted. - `**` matches any sequence of characters including separators, but it is not the `**/` "globstar" of shells: `**/x` requires the literal `/` and does not match `x`, and `a/**/b` does not match `a/b`. Use `{**/,}x` if you need both. - `\` is the escape character, so a literal backslash must be written as `\\`. If a pattern that used to match no longer does (or vice versa), it was most likely relying on a bug in the old engine. ##### Security - `text/org` content is now denied by default, as Org mode's export blocks and `@@html:...@@` snippets pass raw HTML through unescaped, making it the same XSS sink as `text/html`. Sites with Org content can opt back in via `security.allowContent`. - Remote fetches (`resources.GetRemote` etc.) now validate the resolved address at dial time and reject loopback, private, link-local, CGNAT and similar ranges. This only applies under the default `security.http.urls` allowlist; if you have customized it, you have opted into your own hosts and the check stands down. Proxies from `HTTP_PROXY`/`HTTPS_PROXY` hide the destination address from this check and are now ignored unless you set `security.http.proxyFromEnvironment = true`. - Node.js tools (PostCSS, Tailwind CSS etc.) now fail before invocation if a symlink inside the project resolves outside the allowed read/write roots. If you have a legitimate link, add its target to `security.node.permissions.allowRead`. - Mount roots that are themselves symlinks (e.g. `themes/mytheme/assets -> /somewhere/else`) are now dropped. This closes a gap in the `themes/` confinement; absolute mount `source` values are still allowed. ##### Other - `{{ return <value> }}` outside a partial is now an error; it was previously silently ignored. - A page without an explicit `slug` whose title contains a `/` (e.g. `Watch/listen to this`) now gets a single URL segment (`.../watch-listen-to-this/`) instead of a nested one (`.../watch/listen-to-this/`). Taxonomy and term pages are not affected. - Hugo is now built with Go 1.27. ##### KaTeX When upgrading to Hugo v0.166.0, sites using `transform.ToMath` with the `output` option set to `html` or `htmlAndMathml` must update the KaTeX stylesheet referenced in their template(s) to version 0.18.4 or higher. Using older CSS versions like 0.16.21 will cause certain mathematical or chemical expressions to render incorrectly. Example update: ```diff - <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.16.21/dist/katex.min.css"> + <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.18.4/dist/katex.min.css"> ``` See these examples: - <https://gohugo.io/functions/transform/tomath/#step-3> - <https://gohugo.io/render-hooks/passthrough/#example> ##### Bug fixes - tpl/strings: Fix replaceRE with zero-width assertions [`ae07063`](https://github.com/gohugoio/hugo/commit/ae07063f) [@youdie006](https://github.com/youdie006) - common/hreflect: Fix the off-by-one in the float to int overflow guards [`5130d00`](https://github.com/gohugoio/hugo/commit/5130d000) [@youdie006](https://github.com/youdie006) - resources/images: Fix filters on transparent colors and paletted images [`7785668`](https://github.com/gohugoio/hugo/commit/77856683) [@bep](https://github.com/bep) [#12536](https://github.com/gohugoio/hugo/issues/12536) [#12543](https://github.com/gohugoio/hugo/issues/12543) - github: Fix workflow for stale issues [`efe5cbc`](https://github.com/gohugoio/hugo/commit/efe5cbc7) [@jmooring](https://github.com/jmooring) [#15261](https://github.com/gohugoio/hugo/issues/15261) - all: Run modernize -fix ./... [`7b5199f`](https://github.com/gohugoio/hugo/commit/7b5199fd) [@bep](https://github.com/bep) - commands: Fix lang flag description in config command [`87260e4`](https://github.com/gohugoio/hugo/commit/87260e4a) [@jmooring](https://github.com/jmooring) [#15223](https://github.com/gohugoio/hugo/issues/15223) - hugolib: Fix slice bounds panic when deleting multiple nodes at same path [`49dceb1`](https://github.com/gohugoio/hugo/commit/49dceb19) [@bep](https://github.com/bep) [#15207](https://github.com/gohugoio/hugo/issues/15207) - hugolib: Fix ReadingTime and FuzzyWordCount calculations [`5e70992`](https://github.com/gohugoio/hugo/commit/5e709925) [@jmooring](https://github.com/jmooring) [#15206](https://github.com/gohugoio/hugo/issues/15206) ##### Improvements - js: Add es2025 as supported build target [`857120b`](https://github.com/gohugoio/hugo/commit/857120b7) [@bep](https://github.com/bep) [#15307](https://github.com/gohugoio/hugo/issues/15307) - hugofs: Drop symlinked mount roots [`938c820`](https://github.com/gohugoio/hugo/commit/938c8206) [@bep](https://github.com/bep) - markup/highlight: Escape lineAnchors before passing it to Chroma [`3b2d3b8`](https://github.com/gohugoio/hugo/commit/3b2d3b82) [@bep](https://github.com/bep) - tpl/partials: Slight performance improvement of the common partialCached case [`9c2527f`](https://github.com/gohugoio/hugo/commit/9c2527f8) [@bep](https://github.com/bep) - Add internalExternal.IgnoreTailwindCSSSecurityError config option [`a36bd27`](https://github.com/gohugoio/hugo/commit/a36bd274) [@bep](https://github.com/bep) - config/security: Harden the default http.urls and resolved address checks ([#15285](https://github.com/gohugoio/hugo/issues/15285)) [`24d5e42`](https://github.com/gohugoio/hugo/commit/24d5e42f) [@bep](https://github.com/bep) - resources/images: Preserve the source palette for geometric filter chains [`9e7c978`](https://github.com/gohugoio/hugo/commit/9e7c978e) [@bep](https://github.com/bep) [#12543](https://github.com/gohugoio/hugo/issues/12543) - resources/images: Add golden test cases for geometric filter chains on paletted images [`6b5b7d8`](https://github.com/gohugoio/hugo/commit/6b5b7d82) [@bep](https://github.com/bep) [#12543](https://github.com/gohugoio/hugo/issues/12543) - resources/images: Add some golden test cases [`62e24b7`](https://github.com/gohugoio/hugo/commit/62e24b7e) [@bep](https://github.com/bep) [#12536](https://github.com/gohugoio/hugo/issues/12536) [#12543](https://github.com/gohugoio/hugo/issues/12543) - related: Speed up index creation [`f61346e`](https://github.com/gohugoio/hugo/commit/f61346ed) [@bep](https://github.com/bep) - related: Add tokenize option for index values [`850f11c`](https://github.com/gohugoio/hugo/commit/850f11c0) [@jmooring](https://github.com/jmooring) [#7515](https://github.com/gohugoio/hugo/issues/7515) [#15199](https://github.com/gohugoio/hugo/issues/15199) - resources/page: Don't let a title's "/" split an auto-derived slug [`39507d5`](https://github.com/gohugoio/hugo/commit/39507d51) [@ipince](https://github.com/ipince) [#4092](https://github.com/gohugoio/hugo/issues/4092) [#3577](https://github.com/gohugoio/hugo/issues/3577) [#5571](https://github.com/gohugoio/hugo/issues/5571) [#4090](https://github.com/gohugoio/hugo/issues/4090) - config/allconfig: Improve resilience of hugo mod init [`90fe506`](https://github.com/gohugoio/hugo/commit/90fe5068) [@jmooring](https://github.com/jmooring) [#15253](https://github.com/gohugoio/hugo/issues/15253) - tpl: Separate deferred templates by escaping mode [`49835f8`](https://github.com/gohugoio/hugo/commit/49835f8f) [@Soundcreates](https://github.com/Soundcreates) [#15234](https://github.com/gohugoio/hugo/issues/15234) - resources: Validate the resolved address on remote fetches [`d6e6f9e`](https://github.com/gohugoio/hugo/commit/d6e6f9e5) [@bep](https://github.com/bep) [#15247](https://github.com/gohugoio/hugo/issues/15247) - markup: Escape code-fence attribute values in the default renderer [`e4dc48c`](https://github.com/gohugoio/hugo/commit/e4dc48cf) [@bep](https://github.com/bep) [#15247](https://github.com/gohugoio/hugo/issues/15247) - hugolib: Make .Render take an optional context argument [`bcde806`](https://github.com/gohugoio/hugo/commit/bcde8063) [@bep](https://github.com/bep) [#15077](https://github.com/gohugoio/hugo/issues/15077) - modules/npm: Make the generated workspace package private with a stable name [`df4ac34`](https://github.com/gohugoio/hugo/commit/df4ac348) [@bep](https://github.com/bep) [#15245](https://github.com/gohugoio/hugo/issues/15245) - common/hstore: Keep read lock while sorting map values [`166d3ee`](https://github.com/gohugoio/hugo/commit/166d3ee1) [@Soundcreates](https://github.com/Soundcreates) [#15237](https://github.com/gohugoio/hugo/issues/15237) - metrics: Improve template metrics duration formatting [`a25af7f`](https://github.com/gohugoio/hugo/commit/a25af7fa) [@Shiwang0-0](https://github.com/Shiwang0-0) [#15027](https://github.com/gohugoio/hugo/issues/15027) - Remove comments from rebuild test functions [`723579f`](https://github.com/gohugoio/hugo/commit/723579ff) [@bep](https://github.com/bep) - hugolib: Add some fast render mode integration tests [`85ad5e4`](https://github.com/gohugoio/hugo/commit/85ad5e48) [@bep](https://github.com/bep) - Upgrade to Go 1.27 [`e31ff54`](https://github.com/gohugoio/hugo/commit/e31ff547) [@bep](https://github.com/bep) [#15228](https://github.com/gohugoio/hugo/issues/15228) - tpl: Improve the return keyword in templates [`8405b80`](https://github.com/gohugoio/hugo/commit/8405b802) [@bep](https://github.com/bep) [#15212](https://github.com/gohugoio/hugo/issues/15212) - page: Add IndexOf method to Pages [`bf05832`](https://github.com/gohugoio/hugo/commit/bf05832d) [@Shiwang0-0](https://github.com/Shiwang0-0) [#13589](https://github.com/gohugoio/hugo/issues/13589) - tpl/resources: Add resources.Publish [`a05736c`](https://github.com/gohugoio/hugo/commit/a05736cb) [@bep](https://github.com/bep) [#15208](https://github.com/gohugoio/hugo/issues/15208) - markup/pandoc: Support pandoc 3.11 and later [`423e9ce`](https://github.com/gohugoio/hugo/commit/423e9cea) [@jmooring](https://github.com/jmooring) [#15271](https://github.com/gohugoio/hugo/issues/15271) [#15280](https://github.com/gohugoio/hugo/issues/15280) ##### Dependency Updates - build(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 [`3fbfd27`](https://github.com/gohugoio/hugo/commit/3fbfd273) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump golang.org/x/sync from 0.22.0 to 0.23.0 [`393de58`](https://github.com/gohugoio/hugo/commit/393de587) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump golang.org/x/mod from 0.40.0 to 0.41.0 [`870f746`](https://github.com/gohugoio/hugo/commit/870f7464) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump github.com/getkin/kin-openapi from 0.146.0 to 0.149.0 [`6152e22`](https://github.com/gohugoio/hugo/commit/6152e22e) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump github.com/bits-and-blooms/bitset [`5b6e7c2`](https://github.com/gohugoio/hugo/commit/5b6e7c23) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump github.com/bep/lazycache from 0.8.1 to 0.9.0 [`dc03bb2`](https://github.com/gohugoio/hugo/commit/dc03bb27) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump github.com/bep/tmc from 0.6.0 to 0.7.0 [`701dd33`](https://github.com/gohugoio/hugo/commit/701dd337) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump github.com/yuin/goldmark from 1.8.5 to 1.8.6 [`b4062c8`](https://github.com/gohugoio/hugo/commit/b4062c84) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump golang.org/x/image from 0.44.0 to 0.45.0 [`cdd1627`](https://github.com/gohugoio/hugo/commit/cdd16273) [@dependabot](https://github.com/dependabot)\[bot] - deps: Upgrade github.com/gobwas/glob v0.2.3 => v1.0.0 [`efd2456`](https://github.com/gohugoio/hugo/commit/efd24562) [@bep](https://github.com/bep) [#15273](https://github.com/gohugoio/hugo/issues/15273) - build(deps): bump golang.org/x/mod from 0.39.0 to 0.40.0 [`d462968`](https://github.com/gohugoio/hugo/commit/d4629682) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump github.com/tdewolff/minify/v2 from 2.24.16 to 2.24.17 [`fd5f7c6`](https://github.com/gohugoio/hugo/commit/fd5f7c6e) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump github.com/gohugoio/httpcache from 0.8.0 to 0.9.0 [`6b33517`](https://github.com/gohugoio/hugo/commit/6b335176) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 [`5f0d88b`](https://github.com/gohugoio/hugo/commit/5f0d88b8) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump golang.org/x/tools from 0.48.0 to 0.49.0 [`9171dae`](https://github.com/gohugoio/hugo/commit/9171daeb) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump software.sslmate.com/src/go-pkcs12 from 0.7.0 to 0.7.2 [`d1ee825`](https://github.com/gohugoio/hugo/commit/d1ee825b) [@dependabot](https://github.com/dependabot)\[bot] ### [`v0.165.0`](https://github.com/gohugoio/hugo/releases/tag/v0.165.0) [Compare Source](https://github.com/gohugoio/hugo/compare/v0.164.0...v0.165.0) The two main new things is the new `css.ChromaStyles` template func and the new `importContext` option demonstrated below. ```handlebars {{ $light := css.ChromaStyles (dict "targetPath" "css/components/chroma-light.css" "style" "github" "mode" "light") }} {{ $dark := css.ChromaStyles (dict "targetPath" "css/components/chroma-dark.css" "style" "github" "mode" "dark") }} {{ $opts := dict "minify" true "importContext" (slice $light $dark) }} {{ $css := resources.Get "css/main.css" | css.Build $opts }} ``` The `importContext` is relevant for `css.Build`, `js.Build`, `css.Sass`, and `css.PostCSS`. and it allows you to make resources (e.g. built from `resources.FromString`) resolvable in e.g. CSS `@import` statements. ##### Note - Remove tailwindcss from the default security.exec.allow list (note) [`8a55df7`](https://github.com/gohugoio/hugo/commit/8a55df7a) [@bep](https://github.com/bep) [#15178](https://github.com/gohugoio/hugo/issues/15178) [#15171](https://github.com/gohugoio/hugo/issues/15171) ##### Bug fixes - Fix resource transformation chaining after content access [`f772998`](https://github.com/gohugoio/hugo/commit/f772998f) [@bep](https://github.com/bep) [#15189](https://github.com/gohugoio/hugo/issues/15189) - Fix server static file detection for deleted files/directories in the static syncer [`2ffaf1f`](https://github.com/gohugoio/hugo/commit/2ffaf1fc) [@bep](https://github.com/bep) - Fix server errors when deleting static files or directories [`a808f6e`](https://github.com/gohugoio/hugo/commit/a808f6e4) [@bep](https://github.com/bep) [#15174](https://github.com/gohugoio/hugo/issues/15174) - Fix panic on server atomic save edits on MacOS [`6bf1524`](https://github.com/gohugoio/hugo/commit/6bf15241) [@bep](https://github.com/bep) [#15130](https://github.com/gohugoio/hugo/issues/15130) - markup/asciidocext: Fix TOC parsing for asciidoctor-html5s [`f961093`](https://github.com/gohugoio/hugo/commit/f961093e) [@jmooring](https://github.com/jmooring) [#15121](https://github.com/gohugoio/hugo/issues/15121) - snap: Fix snap home environment [`984358f`](https://github.com/gohugoio/hugo/commit/984358f0) [@jmooring](https://github.com/jmooring) [#15114](https://github.com/gohugoio/hugo/issues/15114) ##### Improvements - resources: Resume chained resource transformations [`995a215`](https://github.com/gohugoio/hugo/commit/995a2159) [@bep](https://github.com/bep) [#15189](https://github.com/gohugoio/hugo/issues/15189) [#15189](https://github.com/gohugoio/hugo/issues/15189) - resources/jsconfig: Drop source root mapping for the current source root [`f88f0a9`](https://github.com/gohugoio/hugo/commit/f88f0a9f) [@bep](https://github.com/bep) [#15169](https://github.com/gohugoio/hugo/issues/15169) - circleci: Upgrade to Go 1.26.5 [`52c9bd7`](https://github.com/gohugoio/hugo/commit/52c9bd79) [@bep](https://github.com/bep) - Add Data.Artifacts to css.Build and js.Build [`44da086`](https://github.com/gohugoio/hugo/commit/44da0860) [@bep](https://github.com/bep) [#15173](https://github.com/gohugoio/hugo/issues/15173) - css: Add classDark and classLight options to css.ChromaStyles and gen chromastyles [`33d1f2c`](https://github.com/gohugoio/hugo/commit/33d1f2c8) [@bep](https://github.com/bep) [#15167](https://github.com/gohugoio/hugo/issues/15167) - markup/highlight: Re-emit token colors dropped by Chroma's minifier [`64da6d7`](https://github.com/gohugoio/hugo/commit/64da6d7c) [@bep](https://github.com/bep) [#15161](https://github.com/gohugoio/hugo/issues/15161) - Add importContext option to css.Build, js.Build, css.Sass and css.TailwindCSS [`70db201`](https://github.com/gohugoio/hugo/commit/70db201e) [@bep](https://github.com/bep) [#15103](https://github.com/gohugoio/hugo/issues/15103) - Remove some old deprecations [`8a468df`](https://github.com/gohugoio/hugo/commit/8a468df0) [@bep](https://github.com/bep) - Add css.ChromaStyles [`615e45d`](https://github.com/gohugoio/hugo/commit/615e45d6) [@bep](https://github.com/bep) [#15112](https://github.com/gohugoio/hugo/issues/15112) - check.sh: Handle staticcheck not installed/in PATH [`a243a61`](https://github.com/gohugoio/hugo/commit/a243a615) [@Soundcreates](https://github.com/Soundcreates) - warpc: Improve AVIF error message on memory allocation failure [`7d90277`](https://github.com/gohugoio/hugo/commit/7d90277a) [@bep](https://github.com/bep) - cache/filecache: Don't prune used cache entries with mixed-case dir names [`861ede6`](https://github.com/gohugoio/hugo/commit/861ede6d) [@bep](https://github.com/bep) [#15101](https://github.com/gohugoio/hugo/issues/15101) - Drop symlinks in parent directories [`f228c87`](https://github.com/gohugoio/hugo/commit/f228c87d) [@bep](https://github.com/bep) - Delete .gemini [`7df45f6`](https://github.com/gohugoio/hugo/commit/7df45f61) [@bep](https://github.com/bep) - common/hugo: Include non-go dependencies in go env output [`89b8c32`](https://github.com/gohugoio/hugo/commit/89b8c322) [@jmooring](https://github.com/jmooring) [#15116](https://github.com/gohugoio/hugo/issues/15116) ##### Dependency Updates - build(deps): bump github.com/bep/imagemeta from 0.17.3 to 1.0.0 [`0bb337b`](https://github.com/gohugoio/hugo/commit/0bb337b2) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump github.com/evanw/esbuild from 0.28.1 to 0.28.2 [`03dc917`](https://github.com/gohugoio/hugo/commit/03dc9170) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump github.com/tdewolff/minify/v2 from 2.24.14 to 2.24.16 [`c829b73`](https://github.com/gohugoio/hugo/commit/c829b736) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump github.com/getkin/kin-openapi from 0.145.0 to 0.146.0 [`94f3908`](https://github.com/gohugoio/hugo/commit/94f3908e) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump github.com/rogpeppe/go-internal from 1.15.0 to 1.16.0 [`75fcc75`](https://github.com/gohugoio/hugo/commit/75fcc752) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump github.com/mattn/go-isatty from 0.0.22 to 0.0.24 [`b5fa03d`](https://github.com/gohugoio/hugo/commit/b5fa03d3) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump github.com/yuin/goldmark from 1.8.4 to 1.8.5 [`9da472d`](https://github.com/gohugoio/hugo/commit/9da472dd) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump golang.org/x/tools from 0.47.0 to 0.48.0 [`635532a`](https://github.com/gohugoio/hugo/commit/635532a2) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump github.com/kyokomi/emoji/v2 from 2.2.13 to 2.2.14 [`9c71f60`](https://github.com/gohugoio/hugo/commit/9c71f600) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump github.com/getkin/kin-openapi from 0.144.0 to 0.145.0 [`420527f`](https://github.com/gohugoio/hugo/commit/420527fc) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump golang.org/x/image from 0.43.0 to 0.44.0 [`7fe786e`](https://github.com/gohugoio/hugo/commit/7fe786e3) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump github.com/bep/imagemeta from 0.17.2 to 0.17.3 [`03b244f`](https://github.com/gohugoio/hugo/commit/03b244fc) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump github.com/tdewolff/minify/v2 from 2.24.13 to 2.24.14 [`9611813`](https://github.com/gohugoio/hugo/commit/96118133) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump github.com/yuin/goldmark from 1.8.2 to 1.8.4 [`e35b7f0`](https://github.com/gohugoio/hugo/commit/e35b7f04) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump golang.org/x/net from 0.56.0 to 0.57.0 [`0796fa7`](https://github.com/gohugoio/hugo/commit/0796fa7a) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump golang.org/x/text from 0.38.0 to 0.40.0 [`1b701b7`](https://github.com/gohugoio/hugo/commit/1b701b72) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump github.com/getkin/kin-openapi from 0.140.0 to 0.144.0 [`a32d70b`](https://github.com/gohugoio/hugo/commit/a32d70b7) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump google.golang.org/grpc from 1.80.0 to 1.82.1 [`948cfb9`](https://github.com/gohugoio/hugo/commit/948cfb98) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump golang.org/x/mod from 0.37.0 to 0.38.0 [`8930802`](https://github.com/gohugoio/hugo/commit/8930802e) [@dependabot](https://github.com/dependabot)\[bot] ##### Documentation - Remove Star History from README [`dd3f273`](https://github.com/gohugoio/hugo/commit/dd3f2731) [@bep](https://github.com/bep) [#15190](https://github.com/gohugoio/hugo/issues/15190) - Update README.md [`d1f191c`](https://github.com/gohugoio/hugo/commit/d1f191c5) [@jmooring](https://github.com/jmooring) ### [`v0.164.0`](https://github.com/gohugoio/hugo/releases/tag/v0.164.0) [Compare Source](https://github.com/gohugoio/hugo/compare/v0.163.3...v0.164.0) Notable new features in this release are: - The Chroma highlighter styles now introduces [dark/light pairs](https://gohugo.io/quick-reference/syntax-highlighting-styles/#modes). See also the new flags on the [hugo gen chromastyles](/commands/hugo_gen_chromastyles/) command. - New template funcs [encoding.HexEncode](https://gohugo.io/functions/encoding/hexencode/), [encoding.HexDecode](https://gohugo.io/functions/encoding/hexdecode/), and [crypto.Hash](https://gohugo.io/functions/crypto/hash/). - New [markup.rst.syntaxHighlight](https://gohugo.io/configuration/markup/#syntaxhighlight) option. - We added Pandoc citation support. - We now spport sub paths in layouts passed to [Page.Render](https://gohugo.io/methods/page/render/#article). - This release also fixes a performance regression introduced in Hugo v0.128.0. This should mostly be prominent in bigger sites. See [this discussion](https://discourse.gohugo.io/t/hugo-building-slowly-from-release-0-128-0/57314/20) for some background. ##### Notes - tpl/resources: Deprecate resources.PostProcess in favour of templates.Defer [`29ed932`](https://github.com/gohugoio/hugo/commit/29ed9325) [@bep](https://github.com/bep) [#15086](https://github.com/gohugoio/hugo/issues/15086) ##### Changes - all: Rewrite deprecated constructs in tests [`5a5f4a5`](https://github.com/gohugoio/hugo/commit/5a5f4a54) [@bep](https://github.com/bep) - tpl/tplimpl: Support sub paths in layouts passed to .Render [`d83ce27`](https://github.com/gohugoio/hugo/commit/d83ce27a) [@bep](https://github.com/bep) [#15056](https://github.com/gohugoio/hugo/issues/15056) - Add markup.rst.syntaxHighlight option [`c6acc24`](https://github.com/gohugoio/hugo/commit/c6acc246) [@bep](https://github.com/bep) [#5349](https://github.com/gohugoio/hugo/issues/5349) - tpl/resources: Deprecate resources.PostProcess in favour of templates.Defer [`29ed932`](https://github.com/gohugoio/hugo/commit/29ed9325) [@bep](https://github.com/bep) [#15086](https://github.com/gohugoio/hugo/issues/15086) - tpl/collections: Include key in IsSet unsupported-type warning [`671897a`](https://github.com/gohugoio/hugo/commit/671897ae) [@bejaratommy](https://github.com/bejaratommy) [#11794](https://github.com/gohugoio/hugo/issues/11794) - create: Keep new content placeholders buildable [`499794d`](https://github.com/gohugoio/hugo/commit/499794d1) [@sjh9714](https://github.com/sjh9714) [#15078](https://github.com/gohugoio/hugo/issues/15078) - hugio: Speedup hasBytesWriter [`65c8217`](https://github.com/gohugoio/hugo/commit/65c82178) [@bep](https://github.com/bep) - tpl/crypto: Add crypto.Hash [`dfb35dc`](https://github.com/gohugoio/hugo/commit/dfb35dcd) [@bep](https://github.com/bep) [#15072](https://github.com/gohugoio/hugo/issues/15072) - Add encoding.HexDecode/Encode [`a5ec542`](https://github.com/gohugoio/hugo/commit/a5ec5423) [@bep](https://github.com/bep) [#15068](https://github.com/gohugoio/hugo/issues/15068) [#15060](https://github.com/gohugoio/hugo/issues/15060) - tpl/tplimpl: Make template name lookup case-insensitive [`e46d37a`](https://github.com/gohugoio/hugo/commit/e46d37a9) [@jmooring](https://github.com/jmooring) [#15057](https://github.com/gohugoio/hugo/issues/15057) - hugolib: Return error from .Render when template not found [`fe06735`](https://github.com/gohugoio/hugo/commit/fe067352) [@jmooring](https://github.com/jmooring) [#15052](https://github.com/gohugoio/hugo/issues/15052) - markup/pandoc: Add citation support [`128fb17`](https://github.com/gohugoio/hugo/commit/128fb17c) [@jmooring](https://github.com/jmooring) [#15062](https://github.com/gohugoio/hugo/issues/15062) ##### Dependency Updates - build(deps): bump github.com/JohannesKaufmann/html-to-markdown/v2 [`921db7b`](https://github.com/gohugoio/hugo/commit/921db7b5) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump golang.org/x/tools from 0.45.0 to 0.47.0 [`786ce71`](https://github.com/gohugoio/hugo/commit/786ce71e) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump golang.org/x/image from 0.42.0 to 0.43.0 [`5ad2846`](https://github.com/gohugoio/hugo/commit/5ad28461) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump golang.org/x/net from 0.55.0 to 0.56.0 [`36ad9f5`](https://github.com/gohugoio/hugo/commit/36ad9f58) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump github.com/pelletier/go-toml/v2 from 2.4.2 to 2.4.3 [`7c0a0bc`](https://github.com/gohugoio/hugo/commit/7c0a0bc9) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump github.com/getkin/kin-openapi from 0.139.0 to 0.140.0 [`a879ebf`](https://github.com/gohugoio/hugo/commit/a879ebfa) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump golang.org/x/mod from 0.36.0 to 0.37.0 [`332d5ec`](https://github.com/gohugoio/hugo/commit/332d5ec8) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump github.com/pelletier/go-toml/v2 from 2.3.1 to 2.4.2 [`212cc11`](https://github.com/gohugoio/hugo/commit/212cc11a) [@dependabot](https://github.com/dependabot)\[bot] - deps: Upgrade github.com/evanw/esbuild v0.28.0 => v0.28.1 [`884439b`](https://github.com/gohugoio/hugo/commit/884439b9) [@bep](https://github.com/bep) [#15033](https://github.com/gohugoio/hugo/issues/15033) - deps: Add Chroma dark/light mode support [`790a8aa`](https://github.com/gohugoio/hugo/commit/790a8aa4) [@bep](https://github.com/bep) [#15017](https://github.com/gohugoio/hugo/issues/15017) ### [`v0.163.3`](https://github.com/gohugoio/hugo/releases/tag/v0.163.3) [Compare Source](https://github.com/gohugoio/hugo/compare/v0.163.2...v0.163.3) ##### What's Changed - markup/highlight: Escape lang in default code block rendering [`ce1a7e0`](https://github.com/gohugoio/hugo/commit/ce1a7e0b) [@bep](https://github.com/bep) thanks to [@k0ngj1](https://github.com/k0ngj1) for reporting this issue. - parser/pageparser: Preserve non-ASCII whitespace after e.g. summary divider [`70a9068`](https://github.com/gohugoio/hugo/commit/70a9068a) [@bep](https://github.com/bep) - resources: Support babel/postcss config variants [`9d66d51`](https://github.com/gohugoio/hugo/commit/9d66d513) [@jmooring](https://github.com/jmooring) [#15039](https://github.com/gohugoio/hugo/issues/15039) [#15040](https://github.com/gohugoio/hugo/issues/15040) [#15043](https://github.com/gohugoio/hugo/issues/15043) - hugolib: Fix page/section name collision regression [`f013346`](https://github.com/gohugoio/hugo/commit/f0133466) [@jmooring](https://github.com/jmooring) [#15046](https://github.com/gohugoio/hugo/issues/15046) ### [`v0.163.2`](https://github.com/gohugoio/hugo/releases/tag/v0.163.2) [Compare Source](https://github.com/gohugoio/hugo/compare/v0.163.1...v0.163.2) ##### What's Changed - Continue resolving on ERR\_ACCESS\_DENIED in Node's resolver [`134674f`](https://github.com/gohugoio/hugo/commit/134674f0) [@bep](https://github.com/bep) [#15041](https://github.com/gohugoio/hugo/issues/15041) - markup: Standardize behavior when external converters are missing [`147f605`](https://github.com/gohugoio/hugo/commit/147f605f) [@jmooring](https://github.com/jmooring) [#14222](https://github.com/gohugoio/hugo/issues/14222) ### [`v0.163.1`](https://github.com/gohugoio/hugo/releases/tag/v0.163.1) [Compare Source](https://github.com/gohugoio/hugo/compare/v0.163.0...v0.163.1) The majority of the fixes in this release are security related (including the upstream fix in [`93c8c7d`](https://github.com/gohugoio/hugo/commit/93c8c7d3) (golang.org/x/image)). Thanks to [@vnth4nhnt](https://github.com/vnth4nhnt) for finding the issues fixed in [`a00b5c7`](https://github.com/gohugoio/hugo/commit/a00b5c72) and [`cf9c8f9`](https://github.com/gohugoio/hugo/commit/cf9c8f93) (I will do the CVE work on this later). There has been a uptick in security reports lately, which doesn't mean that Hugo has gotten less secure, this is mostly the work of the new and powerful AI tools using Hugo's restrictive [security model](https://gohugo.io/about/security/) as their baseline. Just take a look at Go's recent [security issue list](https://github.com/golang/go/issues?q=is%3Aissue%20label%3ASecurity) to see a demonstration of this. ##### What's Changed - build(deps): bump golang.org/x/image from 0.41.0 to 0.42.0 [`93c8c7d`](https://github.com/gohugoio/hugo/commit/93c8c7d3) [@dependabot](https://github.com/dependabot)\[bot] - Fix multi --renderSegments merge behavior [`95e5e9f`](https://github.com/gohugoio/hugo/commit/95e5e9f4) [@bep](https://github.com/bep) [#15024](https://github.com/gohugoio/hugo/issues/15024) - security: Normalize integer IPv4 host encodings in http.urls check [`a00b5c7`](https://github.com/gohugoio/hugo/commit/a00b5c72) [@bep](https://github.com/bep) - Drop symlinks in os.ReadDir, os.ReadFile, os.Stat and os.FileExists [`cf9c8f9`](https://github.com/gohugoio/hugo/commit/cf9c8f93) [@bep](https://github.com/bep) [#15019](https://github.com/gohugoio/hugo/issues/15019) - commands: Fix convert command [`2602796`](https://github.com/gohugoio/hugo/commit/2602796c) [@jmooring](https://github.com/jmooring) [#15012](https://github.com/gohugoio/hugo/issues/15012) ### [`v0.163.0`](https://github.com/gohugoio/hugo/releases/tag/v0.163.0) [Compare Source](https://github.com/gohugoio/hugo/compare/v0.162.1...v0.163.0) The main topic in this release is improvements to the AVIF image handling that we introduced in `v0.162.0`. See [the docs](https://gohugo.io/configuration/imaging/#avif) for details, but: - We have turned down the default `quality` for AVIF to 60. Turns out, JPEG/WebP with quality 75 is comparable to AVIF with quality 60. You can now also set quality per image format in your project config (and also per image processed if needed). - We have added a `hint` to the AVIF with the same values as for `WEBP`. For `lossy` compression, the photo/picture hints (and the default) encodes with YUV420 chroma subsampling instead of YUV444, keeping 444 for text/icon/drawing. This greatly reduces the memory needed to encode these images. ##### Improvements - resources/jsconfig: Remove deprecated baseUrl setting [`ff2903a`](https://github.com/gohugoio/hugo/commit/ff2903a9) [@bep](https://github.com/bep) [#14991](https://github.com/gohugoio/hugo/issues/14991) [#14996](https://github.com/gohugoio/hugo/issues/14996) - all: Adjust tests for deprecated link and image render hook settings [`ca68936`](https://github.com/gohugoio/hugo/commit/ca68936d) [@jmooring](https://github.com/jmooring) - all: Run go fix ./... [`781fabf`](https://github.com/gohugoio/hugo/commit/781fabf4) [@bep](https://github.com/bep) - pagesfromdata: Use relative path for content adapter template metrics [`1d018ef`](https://github.com/gohugoio/hugo/commit/1d018ef8) [@anupamojha-eng](https://github.com/anupamojha-eng) [#14999](https://github.com/gohugoio/hugo/issues/14999) - ci: Re-add macos-latest to the test matrix [`121bc6c`](https://github.com/gohugoio/hugo/commit/121bc6ce) [@bep](https://github.com/bep) - images: Deprecate Imaging.Compression and move it down to webp and avif configs [`cf18b82`](https://github.com/gohugoio/hugo/commit/cf18b827) [@bep](https://github.com/bep) [#14998](https://github.com/gohugoio/hugo/issues/14998) - Only support the latest Go version [`98ad9b3`](https://github.com/gohugoio/hugo/commit/98ad9b3c) [@bep](https://github.com/bep) [#14997](https://github.com/gohugoio/hugo/issues/14997) - page: Add IsBranch and deprecate IsNode [`b89e7fe`](https://github.com/gohugoio/hugo/commit/b89e7fe6) [@bep](https://github.com/bep) [#11574](https://github.com/gohugoio/hugo/issues/11574) - images: Force cache invalidation for AVIF target [`e8fefc8`](https://github.com/gohugoio/hugo/commit/e8fefc83) [@bep](https://github.com/bep) [#14990](https://github.com/gohugoio/hugo/issues/14990) - images: Add a per-format AVIF hint setting [`a043d3e`](https://github.com/gohugoio/hugo/commit/a043d3ec) [@bep](https://github.com/bep) [#14992](https://github.com/gohugoio/hugo/issues/14992) - images: Make AVIF chroma subsampling content-aware via the hint [`341f575`](https://github.com/gohugoio/hugo/commit/341f575d) [@bep](https://github.com/bep) [#14987](https://github.com/gohugoio/hugo/issues/14987) - Cap AVIF lossy quality at 99 [`248241b`](https://github.com/gohugoio/hugo/commit/248241b6) [@bep](https://github.com/bep) [#14981](https://github.com/gohugoio/hugo/issues/14981) - config: Deprecate the glogal imaging quality setting [`4e47d95`](https://github.com/gohugoio/hugo/commit/4e47d95d) [@bep](https://github.com/bep) [#14979](https://github.com/gohugoio/hugo/issues/14979) - images: Make 60 the default quality for AVIF [`03b4b54`](https://github.com/gohugoio/hugo/commit/03b4b542) [@bep](https://github.com/bep) [#14979](https://github.com/gohugoio/hugo/issues/14979) - livereload: Disconnect from websocket server on pageswap [`79be053`](https://github.com/gohugoio/hugo/commit/79be0532) [@bep](https://github.com/bep) [#14983](https://github.com/gohugoio/hugo/issues/14983) - tpl/tplimpl/embedded: Prevent leading newline in sitemap template [`0f44046`](https://github.com/gohugoio/hugo/commit/0f440460) [@bep](https://github.com/bep) [#14977](https://github.com/gohugoio/hugo/issues/14977) - images: Recover from memory alloc errors in WASM image processors [`4e17421`](https://github.com/gohugoio/hugo/commit/4e17421e) [@bep](https://github.com/bep) [#14985](https://github.com/gohugoio/hugo/issues/14985) - images: Add quality setting per image format [`b01ecd4`](https://github.com/gohugoio/hugo/commit/b01ecd4c) [@bep](https://github.com/bep) [#14957](https://github.com/gohugoio/hugo/issues/14957) - misc: Remove duplicate words in comments [`45c00b7`](https://github.com/gohugoio/hugo/commit/45c00b7c) [@jmooring](https://github.com/jmooring) [#14936](https://github.com/gohugoio/hugo/issues/14936) [#14950](https://github.com/gohugoio/hugo/issues/14950) [#14965](https://github.com/gohugoio/hugo/issues/14965) - Add some PNG to AVIF golden test cases [`28d882a`](https://github.com/gohugoio/hugo/commit/28d882ab) [@bep](https://github.com/bep) ##### Dependency Updates - build(deps): bump github.com/bits-and-blooms/bitset [`0d29fc8`](https://github.com/gohugoio/hugo/commit/0d29fc81) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump github.com/tetratelabs/wazero [`bb57404`](https://github.com/gohugoio/hugo/commit/bb57404f) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump github.com/rogpeppe/go-internal from 1.14.1 to 1.15.0 [`7d1b1fb`](https://github.com/gohugoio/hugo/commit/7d1b1fb3) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump github.com/getkin/kin-openapi from 0.138.0 to 0.139.0 [`77a1147`](https://github.com/gohugoio/hugo/commit/77a11470) [@dependabot](https://github.com/dependabot)\[bot] ### [`v0.162.1`](https://github.com/gohugoio/hugo/releases/tag/v0.162.1) [Compare Source](https://github.com/gohugoio/hugo/compare/v0.162.0...v0.162.1) ##### What's Changed - modules/npm: Fix false stale warning after npm pack [`59f35cd`](https://github.com/gohugoio/hugo/commit/59f35cd9) [@jmooring](https://github.com/jmooring) [#14959](https://github.com/gohugoio/hugo/issues/14959) - Revert "tpl/collections: Make dict return nil when no values are provided" [`c270975`](https://github.com/gohugoio/hugo/commit/c2709750) [@bep](https://github.com/bep) [#14958](https://github.com/gohugoio/hugo/issues/14958) - tpl/time: Fix locale-specific month abbreviations [`ea8b48a`](https://github.com/gohugoio/hugo/commit/ea8b48af) [@jmooring](https://github.com/jmooring) [#14948](https://github.com/gohugoio/hugo/issues/14948) ### [`v0.162.0`](https://github.com/gohugoio/hugo/releases/tag/v0.162.0) [Compare Source](https://github.com/gohugoio/hugo/compare/v0.161.1...v0.162.0) The notable new feature in this release is support for [AVIF images](https://gohugo.io/configuration/imaging/#avif-images) (both encoder and decoder). There's a [demo site](https://github.com/bep/hdrsdr.com) set up that demonstrates the difference between HDR AVIF and SDR JPEG images. Note that that demo is only really interesting if viewed on an HDR capable screen (e.g. Apple Retina). ##### Security fixes There are some notable security fixes in this release. ##### Security fixes in Go This release upgrades from Go 1.26.1 to 126.3, which brings a set of security fixes. Some relevant for Hugo are: - XSS in html/template (CVE-2026-39826 & CVE-2026-39823): Two separate vulnerabilities where escaper bypasses in html/template could lead to Cross-Site Scripting (XSS). - html/template: Fixes an issue where JS template literal contexts were incorrectly tracked across template branches, which could lead to improper content escaping. ##### Security fixes and hardening in Hugo The following changes either fix a concrete issue or reduce the default attack surface of `hugo` builds. - **Disallow `text/html` content files by default** ([e41a064](https://github.com/gohugoio/hugo/commit/e41a06447d)). A new `security.allowContent` policy gates which content media types may be used for pages under `/content`. `text/html` is denied by default; sites that rely on hand-authored or adapter-emitted HTML content can opt back in with `security.allowContent = ['.*']`. - **Re-check `security.http.urls` on every redirect hop in `resources.GetRemote`** ([86fbb0f](https://github.com/gohugoio/hugo/commit/86fbb0f7a8)). - **Reject symlinked entries in `resources.Get`** ([f8b5fa0](https://github.com/gohugoio/hugo/commit/f8b5fa09a6)). **We will update this section later with links to CVEs where applicable.** ##### All changes - hugolib: Fix Page.GitInfo for modules with go.mod in a repo subdirectory [`df54219`](https://github.com/gohugoio/hugo/commit/df542191) [@bep](https://github.com/bep) [#14942](https://github.com/gohugoio/hugo/issues/14942) - Fix typo in CONTRIBUTING.md [`4bc7cae`](https://github.com/gohugoio/hugo/commit/4bc7caea) [@bep](https://github.com/bep) - resources: Fix the :counter placeholder [`5d51b82`](https://github.com/gohugoio/hugo/commit/5d51b82a) [@jmooring](https://github.com/jmooring) [#14921](https://github.com/gohugoio/hugo/issues/14921) - commands: Fix import from Jekyll [`81d7762`](https://github.com/gohugoio/hugo/commit/81d77620) [@jmooring](https://github.com/jmooring) [#14795](https://github.com/gohugoio/hugo/issues/14795) [#14906](https://github.com/gohugoio/hugo/issues/14906) - Fix prevention of direct symlink reads in resources.Get [`f8b5fa0`](https://github.com/gohugoio/hugo/commit/f8b5fa09) [@bep](https://github.com/bep) - commands: Fix github-dark chromastyles [`88d838a`](https://github.com/gohugoio/hugo/commit/88d838a9) [@xndvaz](https://github.com/xndvaz) [#14831](https://github.com/gohugoio/hugo/issues/14831) - Disallow HTML content by default [`e41a064`](https://github.com/gohugoio/hugo/commit/e41a0644) [@bep](https://github.com/bep) - Add image processing support for AVIF [`90d9f81`](https://github.com/gohugoio/hugo/commit/90d9f812) [@bep](https://github.com/bep) [#7837](https://github.com/gohugoio/hugo/issues/7837) - config: Preserve intentionally empty maps [`80e6084`](https://github.com/gohugoio/hugo/commit/80e60847) [@jmooring](https://github.com/jmooring) [#14944](https://github.com/gohugoio/hugo/issues/14944) - hugolib: Merge existing hugo\_stats.json when renderSegments is set [`aeb9a5c`](https://github.com/gohugoio/hugo/commit/aeb9a5cc) [@bep](https://github.com/bep) [#14939](https://github.com/gohugoio/hugo/issues/14939) - all: Replace RWMutex struct caches with ConcurrentMap [`c4bbc28`](https://github.com/gohugoio/hugo/commit/c4bbc280) [@bep](https://github.com/bep) - tpl/tplimpl: Consolidate and improve embedded template integration tests [`d8c7021`](https://github.com/gohugoio/hugo/commit/d8c70218) [@jmooring](https://github.com/jmooring) [#14932](https://github.com/gohugoio/hugo/issues/14932) - parser: Drop empty sub maps from hugo config output [`ee4f1ac`](https://github.com/gohugoio/hugo/commit/ee4f1acd) [@bep](https://github.com/bep) [#14855](https://github.com/gohugoio/hugo/issues/14855) - markup/highlight: Allow overriding type and code via options [`b613365`](https://github.com/gohugoio/hugo/commit/b6133657) [@bep](https://github.com/bep) [#11872](https://github.com/gohugoio/hugo/issues/11872) - Update AI assistance disclosure requirements [`d2c821b`](https://github.com/gohugoio/hugo/commit/d2c821b5) [@bep](https://github.com/bep) - hugolib: Use AllTranslated in IsTranslated [`4ed7600`](https://github.com/gohugoio/hugo/commit/4ed7600f) [@bep](https://github.com/bep) - tpl: Simplify sitemap template [`cbe4339`](https://github.com/gohugoio/hugo/commit/cbe4339a) [@bep](https://github.com/bep) [#14912](https://github.com/gohugoio/hugo/issues/14912) - tpl: Use AllTranslations in sitemap template [`6475d30`](https://github.com/gohugoio/hugo/commit/6475d308) [@bep](https://github.com/bep) [#14912](https://github.com/gohugoio/hugo/issues/14912) [#14917](https://github.com/gohugoio/hugo/issues/14917) - tpl/collections: Make dict return nil when no values are provided [`67aede4`](https://github.com/gohugoio/hugo/commit/67aede43) [@bep](https://github.com/bep) - Sync Go template package to 1.26.3 [`87f194b`](https://github.com/gohugoio/hugo/commit/87f194b2) [@bep](https://github.com/bep) [#14897](https://github.com/gohugoio/hugo/issues/14897) - Upgrade to Go 1.26.3 [`d81e3c2`](https://github.com/gohugoio/hugo/commit/d81e3c29) [@bep](https://github.com/bep) [#14897](https://github.com/gohugoio/hugo/issues/14897) - ci: Check embedded template formatting with gotmplfmt [`7c65a4d`](https://github.com/gohugoio/hugo/commit/7c65a4db) [@bep](https://github.com/bep) - tpl: Run gotmplfmt -w . [`d31a927`](https://github.com/gohugoio/hugo/commit/d31a9275) [@bep](https://github.com/bep) - markup/goldmark/codeblocks: Always split Chroma options into .Options [`c36608c`](https://github.com/gohugoio/hugo/commit/c36608c5) [@jmooring](https://github.com/jmooring) [#14909](https://github.com/gohugoio/hugo/issues/14909) - hugolib: Allow empty params front matter [`2f361a8`](https://github.com/gohugoio/hugo/commit/2f361a8e) [@xndvaz](https://github.com/xndvaz) [#14886](https://github.com/gohugoio/hugo/issues/14886) - common/hmaps: Merge slice-valued module config into site config [`5559263`](https://github.com/gohugoio/hugo/commit/55592633) [@jmooring](https://github.com/jmooring) [#13869](https://github.com/gohugoio/hugo/issues/13869) - tpl: Use GetMatch for both local and global image resources [`656fc04`](https://github.com/gohugoio/hugo/commit/656fc040) [@bep](https://github.com/bep) [#14062](https://github.com/gohugoio/hugo/issues/14062) - Revert "markup/tableofcontents: Skip empty TOC levels" [`a20cb5b`](https://github.com/gohugoio/hugo/commit/a20cb5b1) [@bep](https://github.com/bep) [#14898](https://github.com/gohugoio/hugo/issues/14898) - tpl/templates: Reject Defer inside partialCached [`4d775cb`](https://github.com/gohugoio/hugo/commit/4d775cbe) [@bep](https://github.com/bep) [#13492](https://github.com/gohugoio/hugo/issues/13492) - common/hexec: Make NODE\_PATH a fallback for ESM bare imports [`ae7bf74`](https://github.com/gohugoio/hugo/commit/ae7bf74b) [@bep](https://github.com/bep) [#13987](https://github.com/gohugoio/hugo/issues/13987) - config: Allow repeating the root key in /config files [`ba5d812`](https://github.com/gohugoio/hugo/commit/ba5d8126) [@bep](https://github.com/bep) [#12899](https://github.com/gohugoio/hugo/issues/12899) [#14882](https://github.com/gohugoio/hugo/issues/14882) - Revise test naming guidelines in AGENTS.md [`be4a0df`](https://github.com/gohugoio/hugo/commit/be4a0df3) [@bep](https://github.com/bep) - Update AGENTS.md [`e4cf565`](https://github.com/gohugoio/hugo/commit/e4cf565c) [@bep](https://github.com/bep) - js: Return error for missing batch imports [`9e64953`](https://github.com/gohugoio/hugo/commit/9e649533) [@xndvaz](https://github.com/xndvaz) [#13737](https://github.com/gohugoio/hugo/issues/13737) - resources/images: Keep smart crop target size [`f0cfc28`](https://github.com/gohugoio/hugo/commit/f0cfc28c) [@xndvaz](https://github.com/xndvaz) [#13688](https://github.com/gohugoio/hugo/issues/13688) - testing: Use synctest where relevant [`16e854a`](https://github.com/gohugoio/hugo/commit/16e854a4) [@bep](https://github.com/bep) - security: Validate redirects against security.http.urls [`86fbb0f`](https://github.com/gohugoio/hugo/commit/86fbb0f7) [@bep](https://github.com/bep) [#14871](https://github.com/gohugoio/hugo/issues/14871) - markup/tableofcontents: Skip empty TOC levels [`7d4af7a`](https://github.com/gohugoio/hugo/commit/7d4af7a1) [@xndvaz](https://github.com/xndvaz) [#7128](https://github.com/gohugoio/hugo/issues/7128) - Fall back to hugo.buildDate in hugo.BuildDate() in non-vcs builds [`28147cb`](https://github.com/gohugoio/hugo/commit/28147cb0) [@bep](https://github.com/bep) [#14862](https://github.com/gohugoio/hugo/issues/14862) - css: Make css.Build's file-loader URLs absolute to web context root [`e51e761`](https://github.com/gohugoio/hugo/commit/e51e761d) [@bep](https://github.com/bep) [#14849](https://github.com/gohugoio/hugo/issues/14849) - hugolib: Don't warn about lang/kind/path coming from cascade.params [`7011239`](https://github.com/gohugoio/hugo/commit/70112392) [@bep](https://github.com/bep) [#14848](https://github.com/gohugoio/hugo/issues/14848) - markup/goldmark: Unwrap inner HTML for plain code blocks [`694906f`](https://github.com/gohugoio/hugo/commit/694906f6) [@cyphercodes](https://github.com/cyphercodes) [#14820](https://github.com/gohugoio/hugo/issues/14820) - tpl/tplimpl: Extend page image lookup to include global resources [`d27b9c0`](https://github.com/gohugoio/hugo/commit/d27b9c06) [@ogulcanaydogan](https://github.com/ogulcanaydogan) [#14062](https://github.com/gohugoio/hugo/issues/14062) - security: Allow hostnames starting with digits in default http.urls [`62cef36`](https://github.com/gohugoio/hugo/commit/62cef367) [@bep](https://github.com/bep) [#14837](https://github.com/gohugoio/hugo/issues/14837) - commands: Improve description of command flags [`ff22c62`](https://github.com/gohugoio/hugo/commit/ff22c62a) [@jmooring](https://github.com/jmooring) [#14817](https://github.com/gohugoio/hugo/issues/14817) - build(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 [`4f444c8`](https://github.com/gohugoio/hugo/commit/4f444c81) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump golang.org/x/image from 0.40.0 to 0.41.0 [`fe6c726`](https://github.com/gohugoio/hugo/commit/fe6c7265) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump github.com/getkin/kin-openapi from 0.137.0 to 0.138.0 [`6a2a038`](https://github.com/gohugoio/hugo/commit/6a2a0380) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump github.com/JohannesKaufmann/html-to-markdown/v2 [`cf1de59`](https://github.com/gohugoio/hugo/commit/cf1de598) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump golang.org/x/image from 0.39.0 to 0.40.0 [`97f990c`](https://github.com/gohugoio/hugo/commit/97f990cc) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump golang.org/x/tools from 0.44.0 to 0.45.0 [`b99634e`](https://github.com/gohugoio/hugo/commit/b99634e2) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 [`fdd977e`](https://github.com/gohugoio/hugo/commit/fdd977e9) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump github.com/pelletier/go-toml/v2 from 2.3.0 to 2.3.1 [`123018d`](https://github.com/gohugoio/hugo/commit/123018de) [@dependabot](https://github.com/dependabot)\[bot] - deps: Upgrade to Chroma v2.24.1 [`b88fa8c`](https://github.com/gohugoio/hugo/commit/b88fa8cc) [@bep](https://github.com/bep) [#14839](https://github.com/gohugoio/hugo/issues/14839) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

renovate-bot added 1 commit

2026-09-15 14:38:05 +00:00

chore(deps): update dependency hugo to v0.166.0

Tests / test (pull_request) Successful in 30s

Details

1dc7bcff81

renovate-bot force-pushed renovate/hugo-0.x from 1dc7bcff81

Tests / test (pull_request) Successful in 30s

Details

to cf43ffa2d8

Tests / test (pull_request) Successful in 30s

Details

2026-09-28 16:01:06 +00:00

Compare

renovate-bot changed title from ~~chore(deps): update dependency hugo to v0.166.0~~ to chore(deps): update dependency hugo to v0.167.0

2026-09-28 16:01:10 +00:00

Tests / test (pull_request) Successful in 30s

Details

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/hugo-0.x:renovate/hugo-0.x

git switch renovate/hugo-0.x

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff renovate/hugo-0.x

git switch renovate/hugo-0.x

git rebase main

git switch main

git merge --ff-only renovate/hugo-0.x

git switch renovate/hugo-0.x

git rebase main

git switch main

git merge --no-ff renovate/hugo-0.x

git switch main

git merge --squash renovate/hugo-0.x

git switch main

git merge --ff-only renovate/hugo-0.x

git switch main

git merge renovate/hugo-0.x

git push origin main

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

mikebell/mikebell.io!63

No description provided.

Rows
Columns