Hugo Release Notes

Now you can inject CSS vars, e.g. from the configuration, into your stylesheets when building with css.Build. Also, now all the render hooks has a .Position method, now also more accurate and effective.

Bug fixes

• Fix some recently introduced Position issues #14710
• markup/goldmark: Fix double-escaping of ampersands in link URLs #14715
• tpl: Fix stray quotes from partial decorator in script context #14711

Improvements

• all: Replace NewIntegrationTestBuilder with Test/TestE/TestRunning
• tpl/css: Support @import "hugo:vars" for CSS custom properties in css.Build #14699
• Improve and extend .Position handling in Goldmark render hooks #14663
• markup/goldmark: Clean up test

Dependency Updates

• build(deps): bump github.com/magefile/mage from 1.16.1 to 1.17.1
• build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4
• build(deps): bump golang.org/x/image from 0.37.0 to 0.38.0

Documentation

• readme: Revise edition descriptions and installation instructions

Original source Report a problem

Note that the security fix below is not a potential threat if you either:

• Trust your Markdown content files.
• Have custom render hook template for links and images.

EDIT IN: This release also adds release archives for non-extended-withdeploy builds.

What's Changed

• Fix potential content XSS by escaping dangerous URLs in Markdown links and images 479fe6c @bep
• resources/page: Fix shared reader in Source.ValueAsOpenReadSeekCloser df520e3 @jmooring #14684

Contributors

jmooring and bep

Original source Report a problem

The regression fixed in this release isn't new, but it's so subtle that we thought we'd release this sooner rather than later. For some time now, the minifier we use have stripped namespaced attributes in SVGs, which broke dynamic constructs using e.g. AlpineJS' x-bind: namespace (library used by Hugo's documentation site).

To fix this, the upstream library has hadded a keepNamespaces slice option. It was not possible to find a default that would make all happy, so we opted for an option that at least would make AlpineJS sites work out of the box:

[minify.tdewolff.svg] keepNamespaces = ['' , 'x-bind']

What's Changed

• minifiers: Keep x-bind and blank namespace in SVG minification 42289d7 @bep #14669

Contributors

bep

Assets 31

• hugo_0.159.1_checksums.txt sha256:8cc9333f340afa9a734e07d69a9d89e78044b9d9a156bf84d270409b9cc0ceaa 2.87 KB 14 hours ago
• hugo_0.159.1_darwin-universal.pkg sha256:a539929efc1042c7a6637e3b005be22b1ee6787bb2ccf5f363e5aaec89d440f0 34.2 MB 14 hours ago
• hugo_0.159.1_dragonfly-amd64.tar.gz sha256:6b2c5fe9412a14fdbf2949d64fe67227f11c8fa9cdef9b4fbf2fc8383a4f498e 17.5 MB 14 hours ago
• hugo_0.159.1_freebsd-amd64.tar.gz sha256:9ab3c8078a0dc623e06da3556a75a9269edfa7b82c3ef438d7da6e462ee60e6c 17.5 MB 14 hours ago
• hugo_0.159.1_Linux-64bit.tar.gz sha256:297e18fa21e4796d80a3270c1234873f5a979cb9a329a0c93d9888a1b39f106c 17.6 MB 14 hours ago
• hugo_0.159.1_linux-amd64.deb sha256:aeb4a3fdb5835fcce75be34193ad95faf4809645222b5fd74c500125960fc050 18.3 MB 14 hours ago
• hugo_0.159.1_linux-amd64.tar.gz sha256:297e18fa21e4796d80a3270c1234873f5a979cb9a329a0c93d9888a1b39f106c 17.6 MB 14 hours ago
• hugo_0.159.1_linux-arm.tar.gz sha256:e84f1ed44cc8f31e02df1fd2dfc5a282e13f2badf8fd84eafb8a2684df387b8e 16.3 MB 14 hours ago
• hugo_0.159.1_linux-arm64.deb sha256:6c9dd58a6a19d942c48a691ddbac42fb64eb5738adb69639b58788d95d4d9c44 16.8 MB 14 hours ago
• hugo_0.159.1_linux-arm64.tar.gz sha256:9786a2ec695b607560a3bf7dbfe1666db6ea320bb1cdabffdb7a4c191fd6a8d8 16.2 MB 14 hours ago
• hugo_0.159.1_netbsd-amd64.tar.gz sha256:0d23252a06744b6edd29a8fd08b85af646934711050e262b133bb3732b931295 17.5 MB 14 hours ago
• hugo_0.159.1_openbsd-amd64.tar.gz sha256:35abfff4e5d8c4da6faa712f8aee9033e05c07c161a0145660dff051d5aba408 17.5 MB 14 hours ago
• hugo_0.159.1_solaris-amd64.tar.gz sha256:60230f525cdc9ed9104641cf93f92f2ff48b6318ec96d20dbd0f7efa2eed93c7 17.5 MB 14 hours ago
• hugo_0.159.1_windows-amd64.zip sha256:13ab323475cb2719a264b93f0daaa39db21100a922f51dee018df487020797b0 18.2 MB 14 hours ago
• hugo_0.159.1_windows-arm64.zip sha256:3912cd9ed262c7a14c414e9ff368da013bd3aaaedbc9b8c4178f48486eb1e237 16.5 MB 14 hours ago
• hugo_extended_0.159.1_darwin-universal.pkg sha256:8f8d93ac3562e688b2a86af3d0b07685e2d54993c5451d7b594571975692ab6f 35.7 MB 14 hours ago
• hugo_extended_0.159.1_Linux-64bit.tar.gz sha256:cded0ffbc7540c5cee330c2ad24d678a0d4a693e9c590cc05c1d1d5556a21aa4 18.3 MB 14 hours ago
• hugo_extended_0.159.1_linux-amd64.deb sha256:55eacfba3a71c3e847850ce0be31a31130fa4ecd71f8136bffa7dc80cf9c5313 19.1 MB 14 hours ago
• hugo_extended_0.159.1_linux-amd64.tar.gz sha256:cded0ffbc7540c5cee330c2ad24d678a0d4a693e9c590cc05c1d1d5556a21aa4 18.3 MB 14 hours ago
• hugo_extended_0.159.1_linux-arm64.deb sha256:184f8dc27afb48200a2cfd6ee2b5e38680d56ad9484595e7e1b1cba2bf43719a 17.5 MB 14 hours ago
• hugo_extended_0.159.1_linux-arm64.tar.gz sha256:210c5e22631fa6a6bad3b6c623f8997a70d2ac306d61ca326d5f31753165779d 16.9 MB 14 hours ago
• hugo_extended_0.159.1_windows-amd64.zip sha256:8d3df3a3ad0cb23fd567dc5b6c2ad63f56e6894042bf4d40806b5c2d4614de89 19.2 MB 14 hours ago
• hugo_extended_withdeploy_0.159.1_darwin-universal.pkg sha256:cfe14978b9233a6ddad4aeca514d062cc4b4aa9565fb82e49d5d15d9234bc119 52.6 MB 14 hours ago
• hugo_extended_withdeploy_0.159.1_Linux-64bit.tar.gz sha256:81de435b65a06f2879c0fd158412822cbcfcd638dcc36256da5e002067b40975 27 MB 14 hours ago
• hugo_extended_withdeploy_0.159.1_linux-amd64.deb sha256:e42ca72f2f138e0970926779551f88a9d8dcc4cdd4fc7575b41b93adbdb3a172 28.1 MB 14 hours ago
• hugo_extended_withdeploy_0.159.1_linux-amd64.tar.gz sha256:81de435b65a06f2879c0fd158412822cbcfcd638dcc36256da5e002067b40975 27 MB 14 hours ago
• hugo_extended_withdeploy_0.159.1_linux-arm64.deb sha256:10b439cb3882e3496d7ea8db83fadaca1fe2b0486694dda90a74036cb2858ce1 25.6 MB 14 hours ago
• hugo_extended_withdeploy_0.159.1_linux-arm64.tar.gz sha256:5c3a3198fb47945b2743ba34d9a63b8d9241314a45fc88735735a942868401a5 24.7 MB 14 hours ago
• hugo_extended_withdeploy_0.159.1_windows-amd64.zip sha256:05c6a4b0c79be0485c5cb3c8ed8b098f26feafd55ae53cede68055e4677c49fb 28.2 MB 14 hours ago
• Source code (zip) 15 hours ago
• Source code (tar.gz) 15 hours ago

8 people reacted: 👍 5 🎉 1 ❤️ 2

Original source Report a problem

This release greatly improves and simplifies management of Node.js/npm dependencies in a multi-module setup. See this page for more information.

Note

• Replace deprecated site.Data with hugo.Data in tests a8fca59 @bep
• Replace deprecated excludeFiles and includeFiles with files in tests 182b104 @bep
• Replace deprecated :filename with :contentbasename in the permalinks test eb11c3d @bep

Bug fixes

• tpl/tplimpl: Fix Vimeo shortcode test eaf4c75 @jmooring #14649

Improvements

• create: Return error instead of panic when page not found 807cae1 @mango766 #14112
• commands: Preserve non-content files in convert output c4fb61d @xndvaz #4621
• npm: Use workspaces to simplify hugo mod npm pack d88a29e @bep
• commands: Close cpu profile file when StartCPUProfile fails 9dd9c76 @buley
• Remove the AI Watchdog workflow for now 3315a86 @bep
• Remove 'bep' from PR user logins skip list 3824484 @bep
• tpl/tplimpl: Comment out the Vimeo simple shortcode tests 7813c5c @bep #14649

Dependency Updates

• build(deps): bump github.com/olekukonko/tablewriter from 1.1.3 to 1.1.4 (#14641) 3ff9b7f @dependabot [bot]
• build(deps): bump github.com/yuin/goldmark from 1.7.16 to 1.7.17 be93ccd @dependabot [bot]
• build(deps): bump github.com/magefile/mage from 1.15.0 to 1.16.1 2669bca @dependabot [bot]
• build(deps): bump golang.org/x/image from 0.36.0 to 0.37.0 753d447 @dependabot [bot]
• build(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.3 4f39d72 @dependabot [bot]

Documentation

• docs: Update docs.yaml d2043cf @bep
• commands: Update docs linke to Node.js docs 4f3c398 @bep

Original source Report a problem

Notes

• Upgrade to to Go 1.26.1 (#14597) (note) 1f578f1 @bep #14595. This fixes a security issue in Go's template package used by Hugo: https://www.cve.org/CVERecord?id=CVE-2026-27142

Deprecations

The methods and config options are deprecated and will be removed in a future Hugo release.

Also see this article

Language configuration

• languageCode → Use locale instead.
• languages..languageCode → Use languages..locale instead.
• languages..languageName → Use languages..label instead.
• languages..languageDirection → Use languages..direction instead.

Language methods

• .Site.LanguageCode → Use .Site.Language.Locale instead.
• .Language.LanguageCode → Use .Language.Locale instead.
• .Language.LanguageName → Use .Language.Label instead.
• .Language.LanguageDirection → Use .Language.Direction instead.

Bug fixes

• tpl/css: Fix external source maps e431f90 @bep #14620
• hugolib: Fix server no watch 59e0446 @jmooring #14615
• resources: Fix context canceled on GetRemote with per-request timeout 842d8f1 @bep #14611
• tpl/tplimpl: Prefer early suffixes when media type matches 4eafd9e @bep #13877 #14601
• all: Run go fix ./... e310822 @bep
• internal/warpc: Fix SIGSEGV in Close() when dispatcher fails to start c9b88e4 @bep #14536
• Fix index out of range panic in fileEventsContentPaths f797f84 @bep #14573

Improvements

• resources: Re-publish on transformation cache hit 3c980c0 @bep #14629
• create/skeletons: Use css.Build in theme skeleton 404ac00 @jmooring #14626
• tpl/css: Add a test case for rebuilds on CSS options changes 06fcb72 @bep
• hugolib: Allow regular pages to cascade to self 9b5f1d4 @jmooring #14627
• tpl/css: Allow the user to override single loader entries 623722b @bep #14623
• tpl/css: Make default loader resolution for CSS @import and url() always behave the same a7cbcf1 @bep #14619
• internal/js: Add default mainFields for CSS builds 36cdb2c @jmooring #14614
• Add css.Build 3e3b849 @bep #14609 #14613
• resources: Use full path for Exif etc. decoding error/warning messages c47ec23 @bep #12693
• Move to new locales library and upgrade CLDR from v36.1 to v48.1 4652ae4 @bep
• tpl/strings: Add strings.ReplacePairs function 13a95b9 @jmooring #14594
• github: Remove pull_request_template.md 54c8048 @bep
• testing: Make commands tests pass in Go 1.26.1 157bfdd @bep
• refactor: Deprecate language configuration and template methods d4f2122 @jmooring #14269
• Replace Exif with Meta in tests 991d2f9 @bep
• resources: Improve getImageOps error message e857777 @jmooring #14571
• resources/images: Add IsImageResourceWithMeta etc. tests for bmp and gif 44dc384 @bep #14568

Dependency Updates

• deps: Upgrade github.com/evanw/esbuild v0.27.3 => v0.27.4 0e46a97 @bep
• build(deps): bump github.com/getkin/kin-openapi from 0.133.0 to 0.134.0 c27d9e8 @dependabot [bot]
• build(deps): bump golang.org/x/tools from 0.42.0 to 0.43.0 098eac5 @dependabot [bot]
• build(deps): bump gocloud.dev from 0.44.0 to 0.45.0 87f8de8 @dependabot [bot]
• build(deps): bump golang.org/x/sync from 0.19.0 to 0.20.0 67ef6c6 @dependabot [bot]
• build(deps): bump golang.org/x/net from 0.50.0 to 0.51.0 (#14569) b29c2f7 @dependabot [bot]
• build(deps): bump github.com/tdewolff/minify/v2 from 2.24.9 to 2.24.10 (#14585) e91d191 @dependabot [bot]
• build(deps): bump github.com/bep/imagemeta from 0.15.0 to 0.17.0 (#14584) a8a54bd @dependabot [bot]

Original source Report a problem

The notable new feature is GitInfo support for Hugo Modules. See this repo for a runnable demo where multiple versions of the same content is mounted into different versions.

Bug fixes

• Fix menu pageRef resolution in multidimensional setups
• docs: Regen and fix the imaging docshelper output
• hugolib: Fix automatic section pages not replaced by sites.complements

Improvements

• Handle GitInfo for modules where Origin is not set when running go list
• commands: Update link to highlighting style examples
• Add AVIF, HEIF and HEIC partial support (only metadata for now)
• resources/images: Adjust WebP processing defaults
• Add Page.GitInfo support for content from Git modules
• Add per-request timeout option to resources.GetRemote
• Update AI Watchdog action version in workflow
• config: Skip taxonomy entries with empty keys or values
• Add guideline for brevity in code and comments
• modules: Include JSON error info from go mod download in error messages

Dependency Updates

• build(deps): bump github.com/tdewolff/minify/v2 from 2.24.8 to 2.24.9
• build(deps): bump github.com/bep/imagemeta from 0.14.0 to 0.15.0

Original source Report a problem

Deprecated

• Site.AllPages is Deprecated
• Site.BuildDrafts is Deprecated
• Site.Languages is Deprecated
• Site.Data is deprecated, use hugo.Data
• Page.Sites and Site.Sites is Deprecated, use hugo.Sites

See this topic for more info.

Removed

These have all been deprecated at least since v0.136.0 and any usage have been logged as an error for a long time:

Template functions

• data.GetCSV / getCSV (use resources.GetRemote)
• data.GetJSON / getJSON (use resources.GetRemote)
• crypto.FNV32a (use hash.FNV32a)
• resources.Babel (use js.Babel)
• resources.PostCSS (use css.PostCSS)
• resources.ToCSS (use css.Sass)

Page methods:

• .Page.NextPage (use .Page.Next)
• .Page.PrevPage (use .Page.Prev)

Paginator:

• .Paginator.PageSize (use .Paginator.PagerSize)

Site methods:

• .Site.LastChange (use .Site.Lastmod)
• .Site.Author (use .Site.Params.Author)
• .Site.Authors (use .Site.Params.Authors)
• .Site.Social (use .Site.Params.Social)
• .Site.IsMultiLingual (use hugo.IsMultilingual)
• .Sites.First (use .Sites.Default)

Site config:

• paginate (use pagination.pagerSize)
• paginatePath (use pagination.path)

File caches:

• getjson cache
• getcsv cache

Notes

• Remove items deprecated <= v0.136.0 (note) af5051e @bep
• hugolib: Move site.Data to hugo.Data, deprecate Site.AllPages/BuildDrafts/Languages 86aa625 @bep #14521
• hugolib: Add Page.Sites to Site.Sites deprecation notice 4148ede @jmooring #14532
• resources/page: Deprecate cascade._target in favor of cascade.target 828ee72 @jmooring #14341
• tpl/tplimpl: Throw error when calling gist shortcode 4384f9b @jmooring #14491
• tpl/tplimpl: Throw error when calling twitter/twitter_simple shortcodes 55d136d @jmooring #14488

Bug fixes

• tpl/internal: Replace deprecated parser.ParseDir and doc.New 4a641d1 @bep #14513
• commands: Fix --panicOnWarning flag having no effect with module version warnings 3f9d0ad @bep #14524
• paths: Fix handling of _ as a path name 32027e5 @khayyamsaleem #14344
• docs: Fix lineNos default value in docs.yaml 498431d @jmooring
• hugolib: Fix term title when taxonomy name contains spaces 773664b @bep #13422

Improvements

• hugolib: Simplify sites collection bba2aed @bep
• hugolib: Adjust hugo.Sites.Default 29b8e17 @bep #14531
• Move common/hugo/HugoInfo to resources/page 3c82340 @bep
• hugolib: Add hugo.Sites and .Site.IsDefault(), modify .Site.Sites ab62320 @jmooring #14479 #14481
• output: Remove unused method 8d19f5a @bep #14522
• Update AI assistance guidelines in CONTRIBUTING.md 7729473 @bep
• tpl/collections: Speed up where and sort performance 47e39af @bep
• commands: Skip chmod for files without owner-write permission 7850e7c @jmooring #14507
• tpl/collections: Add some more benchmarks for where and sort 2e5132d @bep
• all: Change site to project where appropriate 19ab3f5 @jmooring #14504
• markup/highlight: Allow lineNos to be true, false, "inline", or "table" 3158a51 @jmooring #13481
• Upgrade to Go 1.26 b358a65 @bep
• tpl: Move from md5 to xxhash for some in memory keys 8ae5e1a @bep
• testscripts/commands: Update 'future' date to far future e277659 @toddy15 #14486

Dependency Updates

• build(deps): bump google.golang.org/api from 0.255.0 to 0.267.0 d8ec0ee @dependabot [bot]
• build(deps): bump github.com/bep/textandbinarywriter 21be4af @dependabot [bot]
• build(deps): bump github.com/bep/simplecobra from 0.6.1 to 0.7.0 e549016 @dependabot [bot]
• build(deps): bump github.com/bep/tmc from 0.5.1 to 0.6.0 a392906 @dependabot [bot]
• build(deps): bump github.com/gohugoio/hugo-goldmark-extensions/extras 86786c9 @dependabot [bot]
• build(deps): bump github.com/gohugoio/hugo-goldmark-extensions/passthrough 7a7308a @dependabot [bot]
• build(deps): bump golang.org/x/tools from 0.41.0 to 0.42.0 2d1d731 @dependabot [bot]
• build(deps): bump github.com/bep/helpers from 0.6.0 to 0.7.0 b26fbf8 @dependabot [bot]
• build(deps): bump golang.org/x/image from 0.35.0 to 0.36.0 7358309 @dependabot [bot]

Build Setup

• snap: Stop building for ppc64el and s390x e6f01bb @jmooring #14519
• Reapply "release: Support alpha, beta, and RC releases" de0c9f3 @jmooring #14466

Documentation

• docs: Regenerate docs.yaml 8b7b6af @bep
• docker: Add full tar and openssh-client to support GitHub Actions 7137714 @jmooring #14502

Contributors

jmooring, bep, and 3 other contributors

Assets 31

11 people reacted

Original source Report a problem