Skip to content

Update hugo - #638

Draft
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/hugo
Draft

Update hugo#638
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/hugo

Conversation

@renovate

@renovate renovate Bot commented Jul 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Update Change
gohugoio/hugo minor 0.113.0 → 0.170.0
hugomods/hugo minor 0.113.0 → 0.165.0

Release Notes

gohugoio/hugo

v0.170.0

Compare Source

The big change in this release is that the extended edition of Hugo is gone. LibSass has been deprecated for a long time, and it was the only remaining reason we needed a CGO-enabled extended build. There is now only one Hugo binary, and apart from LibSass it has all the features the extended build had.

Notes

  • Setting transpiler to libsass in css.Sass now returns an error. Dart Sass is now the default and the only transpiler, so you need to install it if you use Sass.
  • We no longer publish hugo_extended_* archives. To avoid breaking existing CI setups, we publish aliases for the most downloaded extended archives (e.g. hugo_extended_<version>_linux-amd64.tar.gz, hugo_extended_<version>_Linux-64bit.tar.gz, the linux-amd64.deb, linux-arm64.tar.gz and windows-amd64.zip), but you should update your scripts to use the standard archives. The extended_withdeploy builds are also removed. See Installation.
  • hugo.IsExtended now always returns false, and the module config setting hugoVersion.extended is deprecated and has no effect.
  • Command-line flags (e.g. --buildDrafts) now override OS environment variables (e.g. HUGO_BUILDDRAFTS). This also fixes HUGO_ENVIRONMENT=qa hugo build -e staging loading the staging config but reporting qa in hugo.Environment.
  • strings.Truncate has been rewritten on top of a proper HTML scanner. It now handles comments, void elements, quoted attributes with > and raw text elements such as script correctly, and it's faster and allocates less. On a curious note, the old version was implemented by Mathias Biilmann, the Netlify CEO.
  • time.Time values now keep their named time zone, and eq, ne, in and uniq compare time.Time values by instant.
  • resources.Match and friends now preserve the directory casing in the matched paths, so e.g. resources.Match "gallery/Travel/Iceland/*" now works on case-sensitive file systems.
  • Syncing of static files is much faster for big unchanged files, as we now skip the content check for files with the same size and modification time.
  • Several fixes and hardening of the WASM based image codecs (AVIF crash at encoderSpeed 6 and lower, recovering from broken WASM instances in the server).

Security

Hugo
  • Passthrough content is now HTML escaped when no passthrough render hook is set, unless markup.goldmark.renderer.unsafe is enabled. Before this, e.g. \(<img src=x onerror=alert(1)>\) in a content file emitted raw HTML.
  • The wrapperClass option, settable from the highlight shortcode and transform.Highlight, is now escaped.
  • Vendored module paths are now restricted to the _vendor directory (symlinks pointing outside are rejected).

Thanks to @​R0X4R for finding and reporting the last two issues.

Go

This release is built with Go 1.27.4, which includes 12 security fixes. The one most relevant for Hugo is a crash in the net/http HTTP/1 server (used by hugo server) caused by a race in MaxBytesReader. The other 11 are in the cmd/go toolchain (cgo flag and linker injection at build time) and mainly matter if you build Hugo from source with untrusted dependencies.

Dependencies
  • golang.org/x/net v0.62.0 fixes two issues in the html package: quadratic complexity when coalescing text nodes, and a namespace issue when rendering raw text. Hugo uses this package when collecting HTML elements for hugo_stats.json and in the AsciiDoc integration.
  • github.com/go-jose/go-jose/v4 v4.1.6 (indirect dependency) contains a number of security fixes, among them GHSA-mgcc-cww5-fp2q (RSA modulus size limit when parsing JWKs) and a stack depth limit in the JSON decoder.

Changes

Dependency Updates

Documentation

v0.169.0

Compare Source

The main motivation behind this release is to get out a build with Go 1.27.3, which blocks trust in a small set of intermediate certificates due to specific security concerns around their operation. See the eMudhra incident for more information. This affects Hugo features that fetch remote resources over HTTPS, e.g. resources.GetRemote.

This release also contains some security hardening of the template functions and menu entries that can render content as HTML (see below), a deprecation of looking up reserved front matter fields via .Params (also below), a faster and more robust plainify, and a set of bug fixes.

Security notes

Templates are trusted in Hugo, but content (including front matter) is not necessarily. This release tightens a few places where values from content could end up rendered as unescaped HTML:

  • pre and post values in menu entries defined in front matter are now HTML escaped, unless text/html is allowed in security.allowContent, which already marks HTML in /content as trusted. A warning (warning-menu-pre-post-html-escaped) is logged when a value containing HTML markup is escaped. Menu entries defined in the project configuration are not affected. f63482b
  • emojify and plainify now return a string unless the input is template.HTML, in which case the result is also template.HTML. Previously both always returned template.HTML, so e.g. {{ .Title | emojify }} would mark a potentially unsafe title as safe HTML. If you relied on the old behavior with trusted input, pipe the result through safeHTML. Thanks to @​Reload3d for reporting this. #​15452

Deprecations

Reserved front matter fields such as title, date and summary are currently also stored in .Params. Lookups such as .Params.title (and ByParam "title", where .Pages "Params.title" ... etc.) are now redirected to the corresponding Page method and logged as deprecated, unless the field was set in the params section of front matter. The content of .Params is unchanged for now. 53e1fef

Deprecated Use instead
.Params.date .Date
.Params.description .Description
.Params.draft .Draft
.Params.expirydate .ExpiryDate
.Params.keywords .Keywords
.Params.lastmod .Lastmod
.Params.layout .Layout
.Params.linktitle .LinkTitle
.Params.publishdate .PublishDate
.Params.slug .Slug
.Params.summary .RawSummary (new)
.Params.title .Title
.Params.translationkey .TranslationKey
.Params.type .Type
.Params.weight .Weight

Bug fixes

Improvements

Dependency Updates

v0.168.0

Compare Source

Notable new features

  • New imaging.firstFrameOnly option (and a matching processing flag) to only decode/encode the first frame of animated images. Hugo now also only decodes the first frame when the target format doesn't support animation, and fails early with an informative error if processing all frames would exceed the WASM memory limit.
  • New FrameCount method on images, e.g. to check if an image is animated.
  • site.Language now has Translate and Format* methods, so you can e.g. range over site.Languages and translate into each language.
  • New charset option for js.Build and css.Build.
  • Basic support for the OSC 7501 program status (working/done/idle/error) in terminals that support it, alongside the existing OSC 9;4 progress.

Security fixes

This release is built with Go 1.27.2, which includes 15 security fixes. The most relevant for Hugo are:

  • Two html/template escaping fixes, which also apply to Hugo's fork of the package: CVE-2026-94448 (context tracking not reset on consecutive expressions in JS template literals) and CVE-2026-97030 (yield not recognized as a regexp preceder keyword). Both could lead to incorrect escaping of inline JavaScript.
  • Several net/http fixes (HTTP/2 server crash and memory exhaustion, connection desynchronization, unbounded Range header parsing), relevant for hugo server and remote resources. The corresponding HTTP/2 fixes are also included via the upgrade of golang.org/x/net to v0.61.0.
  • CVE-2026-56857: os.Root.Mkdir(All) could follow junctions out of the root on Windows.

Also:

  • github.com/tdewolff/minify is upgraded to v2.24.19, which fixes GHSA-3ppm-p7r9-c5w3: </script> (and <!--) inside inline scripts was not properly escaped (case-insensitively) when minifying JS in HTML.
  • Hugo now ignores module.replacements defined in themes; only the project can define replacements.

Changes

Dependency Updates

Build Setup

v0.167.0

Compare Source

This release brings relative partial references, slug support for branch pages, and a handful of security hardening fixes.

Relative partial references. A partial name starting with ./ or ../ is now resolved relative to the directory of the calling partial. This makes it much easier to write self-contained, movable partial trees, e.g. {{ partial "./item.html" . }} from within layouts/_partials/card/list.html. Relative paths are only allowed from within partials, and paths resolving outside the partials directory is an error. See #​15373 and the documentation.

Slugs for section, taxonomy and term pages. The slug front matter now works for branch pages, not just regular pages, and it cascades to descendants. This is particularly useful in multilingual sites, where e.g. content/help/_index.es.md with slug: ayuda gives /es/ayuda/, /es/ayuda/avanzado/ etc. See #​14352.

Other notable improvements include the new build.cleanDestinationDir config with keepFiles/keepDirs Glob patterns (#​14937, docs), hugo now builds without a config file (#​15393), exact numeric comparisons in eq, where, in and the set functions (#​15322, #​15358), and automatic summaries that no longer end inside an open list or blockquote (#​14044).

Security

This release contains several hardening fixes. None of them are known to be exploited, but if you build sites with untrusted themes or modules, you should upgrade.

  • Sass imports not found in Hugo's file systems were resolved by the Sass compiler itself, which follows symlinks and knows nothing about the project root. A theme could import a file outside the project and get its content into the published CSS. These imports are now resolved by Hugo and checked against the same security.allowRead roots as the Node.js tools and js.Build. 41040cc (thanks to @​Hama1cco)
  • Likewise, imports not found in /assets were resolved and read by ESBuild itself. The resolved path is now checked against the allowed read paths before ESBuild loads it. 2aa51f3 (thanks to @​Hama1cco)
  • A symlinked directory in a theme at the parent of a nested mount could expose files outside the module. 2fe9bab
  • Explicit heading IDs (e.g. ## Foo {id="..."}) were written unescaped into the table of contents href, allowing attribute breakout. 671fbf2

Note

  • The default baseURL is now https://example.org/ (it was empty). Hugo has always required a valid URL to work properly, so this mostly affects new and test sites, but if you relied on the empty default for relative URLs, set baseURL explicitly. bc68654 @​bep #​14625 #​15384
  • The root cleanDestinationDir config key is deprecated in favour of build.cleanDestinationDir.enable. The --cleanDestinationDir flag maps to the new key. Note that .git files in the publish dir are now kept by default. 9086193 @​bep #​14937
  • eq now compares numeric values the same way as lt, le etc., so e.g. eq 1 1.0 is now true. Also, in, intersect, union, uniq, symdiff, complement and where's in/not in now compare numbers exactly rather than via float64, and no longer require the Go types to match. 4d628bb 366377b @​bep #​15322 #​15358
  • A user table render hook is now preferred over the embedded one. 140d936 @​jmooring #​15389
  • Automatic summaries are expanded past summaryLength when needed so they don't end inside an open container element. This may change the summary for some pages. d692a24 @​bep #​14044

Bug fixes

Improvements

Dependency Updates

Documentation

Build Setup

v0.166.0

Compare Source

This release is mostly about hardening and bug fixes, but there are some notable changes:

  • .Render now takes an optional context argument: {{ .Render "view" $ctx }}, mirroring the partial API. This makes it possible to pass e.g. a dict to a content view. See #​15077.
  • The return keyword in templates has been reimplemented. It now works in any template (not just partials) and can be used anywhere, e.g. inside if or range blocks. See #​15212.
  • New resources.Publish template function and IndexOf method on Pages.
  • related config: new tokenize option for index values, and index creation is faster.
  • Several security fixes; see the notes below.

Note

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/hugo branch from 26724ef to 76d8506 Compare July 15, 2026 13:49
cwhite911
cwhite911 reviewed Jul 18, 2026
View reviewed changes

@cwhite911 cwhite911 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

DO NOT MERGE. Updating Hugo has breaking changes that need to be addressed in coordination to the update.

@echoix
echoix marked this pull request as draft July 18, 2026 12:28
@cwhite911 cwhite911 added the blocker Breaks the website label Jul 26, 2026
This was referenced Aug 3, 2026
Merged
Closed
Merged
Open
Merged
@renovate renovate Bot changed the title Update hugo to v0.164.0 Update hugo Oct 10, 2026
@renovate
renovate Bot force-pushed the renovate/hugo branch 2 times, most recently from 747dbc3 to f4ddd17 Compare October 27, 2026 19:55

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cwhite911 cwhite911 cwhite911 left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

blocker Breaks the website

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@cwhite911