Hugo Updates & Release Notes

Notable new features in this release are:

• The Chroma highlighter styles now introduces dark/light pairs. See also the new flags on the hugo gen chromastyles command.
• New template funcs encoding.HexEncode, encoding.HexDecode, and crypto.Hash.
• New markup.rst.syntaxHighlight option.
• We added Pandoc citation support.
• We now spport sub paths in layouts passed to Page.Render.
• This release also fixes a performance regression introduced in Hugo v0.128.0. This should mostly be prominent in bigger sites. See this discussion for some background.

Notes

• tpl/resources: Deprecate resources.PostProcess in favour of templates.Defer 29ed932 @bep #15086

Changes

• all: Rewrite deprecated constructs in tests 5a5f4a5 @bep
• tpl/tplimpl: Support sub paths in layouts passed to .Render d83ce27 @bep #15056
• Add markup.rst.syntaxHighlight option c6acc24 @bep #5349
• tpl/resources: Deprecate resources.PostProcess in favour of templates.Defer 29ed932 @bep #15086
• tpl/collections: Include key in IsSet unsupported-type warning 671897a @bejaratommy #11794
• create: Keep new content placeholders buildable 499794d @sjh9714 #15078
• hugio: Speedup hasBytesWriter 65c8217 @bep
• tpl/crypto: Add crypto.Hash dfb35dc @bep #15072
• Add encoding.HexDecode/Encode a5ec542 @bep #15068 #15060
• tpl/tplimpl: Make template name lookup case-insensitive e46d37a @jmooring #15057
• hugolib: Return error from .Render when template not found fe06735 @jmooring #15052
• markup/pandoc: Add citation support 128fb17 @jmooring #15062

Dependency Updates

• build(deps): bump github.com/JohannesKaufmann/html-to-markdown/v2 921db7b @dependabot [bot]
• build(deps): bump golang.org/x/tools from 0.45.0 to 0.47.0 786ce71 @dependabot [bot]
• build(deps): bump golang.org/x/image from 0.42.0 to 0.43.0 5ad2846 @dependabot [bot]
• build(deps): bump golang.org/x/net from 0.55.0 to 0.56.0 36ad9f5 @dependabot [bot]
• build(deps): bump github.com/pelletier/go-toml/v2 from 2.4.2 to 2.4.3 7c0a0bc @dependabot [bot]
• build(deps): bump github.com/getkin/kin-openapi from 0.139.0 to 0.140.0 a879ebf @dependabot [bot]
• build(deps): bump golang.org/x/mod from 0.36.0 to 0.37.0 332d5ec @dependabot [bot]
• build(deps): bump github.com/pelletier/go-toml/v2 from 2.3.1 to 2.4.2 212cc11 @dependabot [bot]
• deps: Upgrade github.com/evanw/esbuild v0.28.0 => v0.28.1 884439b @bep #15033
• deps: Add Chroma dark/light mode support 790a8aa @bep #15017

The majority of the fixes in this release are security related (including the upstream fix in golang.org/x/image). Thanks to @vnth4nhnt for finding the issues fixed in a00b5c7 and cf9c8f9 (I will do the CVE work on this later). There has been a uptick in security reports lately, which doesn't mean that Hugo has gotten less secure, this is mostly the work of the new and powerful AI tools using Hugo's restrictive security model as their baseline. Just take a look at Go's recent security issue list to see a demonstration of this.

What's Changed

• build(deps): bump golang.org/x/image from 0.41.0 to 0.42.0 93c8c7d @dependabot [bot]
• Fix multi --renderSegments merge behavior 95e5e9f @bep #15024
• security: Normalize integer IPv4 host encodings in http.urls check a00b5c7 @bep
• Drop symlinks in os.ReadDir, os.ReadFile, os.Stat and os.FileExists cf9c8f9 @bep #15019
• commands: Fix convert command 2602796 @jmooring #15012

The main topic in this release is improvements to the AVIF image handling that we introduced in v0.162.0. See the docs for details, but:

• We have turned down the default quality for AVIF to 60. Turns out, JPEG/WebP with quality 75 is comparable to AVIF with quality 60. You can now also set quality per image format in your project config (and also per image processed if needed).
• We have added a hint to the AVIF with the same values as for WEBP. For lossy compression, the photo/picture hints (and the default) encodes with YUV420 chroma subsampling instead of YUV444, keeping 444 for text/icon/drawing. This greatly reduces the memory needed to encode these images.

Improvements

• resources/jsconfig: Remove deprecated baseUrl setting ff2903a #14991 #14996
• all: Adjust tests for deprecated link and image render hook settings ca68936 @jmooring
• all: Run go fix ./... 781fabf @bep
• pagesfromdata: Use relative path for content adapter template metrics 1d018ef @anupamojha-eng #14999
• ci: Re-add macos-latest to the test matrix 121bc6c @bep
• images: Deprecate Imaging.Compression and move it down to webp and avif configs cf18b82 @bep #14998
• Only support the latest Go version 98ad9b3 @bep #14997
• page: Add IsBranch and deprecate IsNode b89e7fe @bep #11574
• images: Force cache invalidation for AVIF target e8fefc8 @bep #14990
• images: Add a per-format AVIF hint setting a043d3e @bep #14992
• images: Make AVIF chroma subsampling content-aware via the hint 341f575 @bep #14987
• Cap AVIF lossy quality at 99 248241b @bep #14981
• config: Deprecate the glogal imaging quality setting 4e47d95 @bep #14979
• images: Make 60 the default quality for AVIF 03b4b54 @bep #14979
• livereload: Disconnect from websocket server on pageswap 79be053 @bep #14983
• tpl/tplimpl/embedded: Prevent leading newline in sitemap template 0f44046 @bep #14977
• images: Recover from memory alloc errors in WASM image processors 4e17421 @bep #14985
• images: Add quality setting per image format b01ecd4 @bep #14957
• misc: Remove duplicate words in comments 45c00b7 @jmooring #14936 #14950 #14965
• Add some PNG to AVIF golden test cases 28d882a @bep

Dependency Updates

• build(deps): bump github.com/bits-and-blooms/bitset 0d29fc8 @dependabot [bot]
• build(deps): bump github.com/tetratelabs/wazero bb57404 @dependabot [bot]
• build(deps): bump github.com/rogpeppe/go-internal from 1.14.1 to 1.15.0 7d1b1fb @dependabot [bot]
• build(deps): bump github.com/getkin/kin-openapi from 0.138.0 to 0.139.0 77a1147 @dependabot [bot]

The notable new feature in this release is support for AVIF images (both encoder and decoder). There's a demo site set up that demonstrates the difference between HDR AVIF and SDR JPEG images. Note that that demo is only really interesting if viewed on an HDR capable screen (e.g. Apple Retina).

Security fixes

There are some notable security fixes in this release.

Security fixes in Go

This release upgrades from Go 1.26.1 to 126.3, which brings a set of security fixes. Some relevant for Hugo are:

• XSS in html/template (CVE-2026-39826 & CVE-2026-39823): Two separate vulnerabilities where escaper bypasses in html/template could lead to Cross-Site Scripting (XSS).
• html/template: Fixes an issue where JS template literal contexts were incorrectly tracked across template branches, which could lead to improper content escaping.

Security fixes and hardening in Hugo

The following changes either fix a concrete issue or reduce the default attack surface of hugo builds.

• Disallow text/html content files by default (e41a064). A new security.allowContent policy gates which content media types may be used for pages under /content. text/html is denied by default; sites that rely on hand-authored or adapter-emitted HTML content can opt back in with security.allowContent = ['.*'].
• Re-check security.http.urls on every redirect hop in resources.GetRemote (86fbb0f).
• Reject symlinked entries in resources.Get (f8b5fa0).

We will update this section later with links to CVEs where applicable.

All changes

• hugolib: Fix Page.GitInfo for modules with go.mod in a repo subdirectory df54219 @bep #14942
• Fix typo in CONTRIBUTING.md 4bc7cae @bep
• resources: Fix the :counter placeholder 5d51b82 @jmooring #14921
• commands: Fix import from Jekyll 81d7762 @jmooring #14795 #14906
• Fix prevention of direct symlink reads in resources.Get f8b5fa0 @bep
• commands: Fix github-dark chromastyles 88d838a @xndvaz #14831
• Disallow HTML content by default e41a064 @bep
• Add image processing support for AVIF 90d9f81 @bep #7837
• config: Preserve intentionally empty maps 80e6084 @jmooring #14944
• hugolib: Merge existing hugo_stats.json when renderSegments is set aeb9a5c @bep #14939
• all: Replace RWMutex struct caches with ConcurrentMap c4bbc28 @bep
• tpl/tplimpl: Consolidate and improve embedded template integration tests d8c7021 @jmooring #14932
• parser: Drop empty sub maps from hugo config output ee4f1ac @bep #14855
• markup/highlight: Allow overriding type and code via options b613365 @bep #11872
• Update AI assistance disclosure requirements d2c821b @bep
• hugolib: Use AllTranslated in IsTranslated 4ed7600 @bep
• tpl: Simplify sitemap template cbe4339 @bep #14912
• tpl: Use AllTranslations in sitemap template 6475d30 @bep #14912 #14917
• tpl/collections: Make dict return nil when no values are provided 67aede4 @bep
• Sync Go template package to 1.26.3 87f194b @bep #14897
• Upgrade to Go 1.26.3 d81e3c2 @bep #14897
• ci: Check embedded template formatting with gotmplfmt 7c65a4d @bep
• tpl: Run gotmplfmt -w . d31a927 @bep
• markup/goldmark/codeblocks: Always split Chroma options into .Options c36608c @jmooring #14909
• hugolib: Allow empty params front matter 2f361a8 @xndvaz #14886
• common/hmaps: Merge slice-valued module config into site config 5559263 @jmooring #13869
• tpl: Use GetMatch for both local and global image resources 656fc04 @bep #14062
• Revert "markup/tableofcontents: Skip empty TOC levels" a20cb5b @bep #14898
• tpl/templates: Reject Defer inside partialCached 4d775cb @bep #13492
• common/hexec: Make NODE_PATH a fallback for ESM bare imports ae7bf74 @bep #13987
• config: Allow repeating the root key in /config files ba5d812 @bep #12899 #14882
• Revise test naming guidelines in AGENTS.md be4a0df @bep
• Update AGENTS.md e4cf565 @bep
• js: Return error for missing batch imports 9e64953 @xndvaz #13737
• resources/images: Keep smart crop target size f0cfc28 @xndvaz #13688
• testing: Use synctest where relevant 16e854a @bep
• security: Validate redirects against security.http.urls 86fbb0f @bep #14871
• markup/tableofcontents: Skip empty TOC levels 7d4af7a @xndvaz #7128
• Fall back to hugo.buildDate in hugo.BuildDate() in non-vcs builds 28147cb @bep #14862
• css: Make css.Build's file-loader URLs absolute to web context root e51e761 @bep #14849
• hugolib: Don't warn about lang/kind/path coming from cascade.params 7011239 @bep #14848
• markup/goldmark: Unwrap inner HTML for plain code blocks 694906f @cyphercodes #14820
• tpl/tplimpl: Extend page image lookup to include global resources d27b9c0 @ogulcanaydogan #14062
• security: Allow hostnames starting with digits in default http.urls 62cef36 @bep #14837
• commands: Improve description of command flags ff22c62 @jmooring #14817
• build(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 4f444c8 @dependabot [bot]
• build(deps): bump golang.org/x/image from 0.40.0 to 0.41.0 fe6c726 @dependabot [bot]
• build(deps): bump github.com/getkin/kin-openapi from 0.137.0 to 0.138.0 6a2a038 @dependabot [bot]
• build(deps): bump github.com/JohannesKaufmann/html-to-markdown/v2 cf1de59 @dependabot [bot]
• build(deps): bump golang.org/x/image from 0.39.0 to 0.40.0 97f990c @dependabot [bot]
• build(deps): bump golang.org/x/tools from 0.44.0 to 0.45.0 b99634e @dependabot [bot]
• build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 fdd977e @dependabot [bot]
• build(deps): bump github.com/pelletier/go-toml/v2 from 2.3.0 to 2.3.1 123018d @dependabot [bot]
• deps: Upgrade to Chroma v2.24.1 b88fa8c @bep #14839

This release contains two security hardening fixes:

• We now run the Node tools PostCSS, Babel and TailwindCSS, by default, with the --permission flag with the permissions defined in security.node.permissions. This means that you need Node >= 22 installed and that css.TailwindCSS now requires that the Tailwind CSS CLI must be installed as a Node.js package. The standalone executable is no longer supported
• We have made the defaults in security.http.urls more restrictive.

But there are some notable new features, as well:

Nested vars support in css.Build and css.Sass

A practical example in css.Build would be to have something like this in hugo.toml :

[params.style]
primary = "#000000"
background = "#ffffff"
[params.style.dark]
primary = "#ffffff"
background = "#000000"

And in the stylesheet:

@import "hugo:vars";
@import "hugo:vars/dark" (prefers-color-scheme: dark): root {
color-scheme: light dark;
}

Slice-based permalinks config

The permalinks configuration is now much more flexible (the old setup still works). It uses the same target matchers as in the cascade config, meaning you can now do:

permalinks:

• target:
  kind: page
  path: "/books/**"
  pattern: /books/:year/:slug/
• target:
  kind: section
  path: "/{books,books/**}"
  pattern: /libros/:sections[1:]
• target:
  kind: page
  pattern: /other/:slug/

The above example isn't great, but it at least shows the gist of it.

A more flexible scheme for identifiers in filenames

What we had before was e.g. content/mypost.en.md which told Hugo that the content files was in English. With the new setup you could also name the file content/mypost.language_en.md. This alone doesn't sound very useful, but this allows you to use more prefixes:

Prefix | Description | Relevant for
language_ | Language | Content and layout files.
role_ | Role | Content and layout files.
version_ | Version | Content and layout files.
outputformat_ | Output format | Layout files.
mediatype_ | Media type | Layout files.
kind_ | Page kind | Layout files.
layout_ | Layout | Layout files.

All Changes

• langs/i18n: Fix translation lookup when using language variants
• create: Fix non-deterministic conflict detection in hugo new content
• commands: Fix environment isolation for configuration settings
• Fix filename dimension identifiers (role_X, version_X) to replace mount config
• Fix it so we never auto-fallback to page resources in other roles/versions
• css: Support nested hugo:vars/ imports
• github: Update GitHub actions versions
• hugolib: Do not render aliases if the page is not rendered
• langs/i18n: Improve default content language fallback
• helpers: Remove unused code
• common/constants: Remove unused consts
• common/paths: Remove unused code
• tests: Update Ruby setup action to v1.305.0
• langs: Use Language.Locale as primary localization key
• config/security: Add "! " negation to Whitelist, harden default http.urls
• Harden Node tool execution with --permission flag
• tpl/collections: Honor the Eqer interface in where comparisons
• modules: Ignore non-require blocks in go.mod rewrite
• Replace the concurrent map with an identical upstream version
• Add slice-based permalinks config with PageMatcher target
• commands: Add missing import
• Revert "common/hugo: Deprecate extended and extended_withdeploy editions"
• Adjust the SECURITY.md slightly
• resources/page: Add passing test for Issue
• Add a more flexible filename identifier scheme that also allows setting roles and versions
• common/hugo: Deprecate extended and extended_withdeploy editions
• parser/pageparser: Add a parser fuzz test
• Replace deprecated .Site.Sites/.Page.Sites with hugo.Sites intests
• agents: Add a note about having the issue ID in test names
• build(deps): bump github.com/getkin/kin-openapi from 0.135.0 to 0.137.0
• build(deps): bump github.com/mattn/go-isatty from 0.0.21 to 0.0.22
• build(deps): bump github.com/tdewolff/minify/v2 from 2.24.12 to 2.24.13
• build(deps): bump github.com/magefile/mage from 1.17.1 to 1.17.2
• deps: Upgrade github.com/bep/imagemeta v0.17.1 => v0.17.2
• build(deps): bump github.com/aws/aws-sdk-go-v2/service/cloudfront
• build(deps): bump github.com/mattn/go-isatty from 0.0.20 to 0.0.21
• build(deps): bump github.com/bep/mclib
• build(deps): bump google.golang.org/api from 0.267.0 to 0.276.0
• build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.41.5 to 1.41.6
• build(deps): bump github.com/getkin/kin-openapi from 0.134.0 to 0.135.0
• build(deps): bump github.com/bep/goportabletext from 0.1.0 to 0.2.0
• build(deps): bump golang.org/x/image from 0.38.0 to 0.39.0
• deps: Upgrade github.com/bep/imagemeta v0.17.0 => v0.17.1
• build(deps): bump golang.org/x/tools from 0.43.0 to 0.44.0
• build(deps): bump github.com/evanw/esbuild from 0.27.4 to 0.28.0
• build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.41.1 to 1.41.5
• build(deps): bump github.com/pelletier/go-toml/v2 from 2.2.4 to 2.3.0
• build(deps): bump github.com/tdewolff/minify/v2 from 2.24.11 to 2.24.12

What's Changed

• Fix panic when passthrough elements are used in headings #14677
• Fix panic on edit of legacy mapped template names that's also a valid path in the new setup #14740
• Fix RenderShortcodes leaking context markers when indented #12457
• Strip nested page context markers from standalone RenderShortcodes #14732
• Rename deprecated cascade._target to cascade.target in tests
• Fix auto-creation of root sections in multilingual sites #14681
• readme: Fix links

Contributors

bep and chicks-net

Now you can inject CSS vars, e.g. from the configuration, into your stylesheets when building with css.Build. Also, now all the render hooks has a .Position method, now also more accurate and effective.

Bug fixes

• Fix some recently introduced Position issues #14710
• markup/goldmark: Fix double-escaping of ampersands in link URLs #14715
• tpl: Fix stray quotes from partial decorator in script context #14711

Improvements

• all: Replace NewIntegrationTestBuilder with Test/TestE/TestRunning
• tpl/css: Support @import "hugo:vars" for CSS custom properties in css.Build #14699
• Improve and extend .Position handling in Goldmark render hooks #14663
• markup/goldmark: Clean up test

Dependency Updates

• build(deps): bump github.com/magefile/mage from 1.16.1 to 1.17.1
• build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4
• build(deps): bump golang.org/x/image from 0.37.0 to 0.38.0

Documentation

• readme: Revise edition descriptions and installation instructions

Note that the security fix below is not a potential threat if you either:

• Trust your Markdown content files.
• Have custom render hook template for links and images.

EDIT IN: This release also adds release archives for non-extended-withdeploy builds.

What's Changed

• Fix potential content XSS by escaping dangerous URLs in Markdown links and images 479fe6c @bep
• resources/page: Fix shared reader in Source.ValueAsOpenReadSeekCloser df520e3 @jmooring #14684

Contributors

jmooring and bep

The regression fixed in this release isn't new, but it's so subtle that we thought we'd release this sooner rather than later. For some time now, the minifier we use have stripped namespaced attributes in SVGs, which broke dynamic constructs using e.g. AlpineJS' x-bind: namespace (library used by Hugo's documentation site).

To fix this, the upstream library has hadded a keepNamespaces slice option. It was not possible to find a default that would make all happy, so we opted for an option that at least would make AlpineJS sites work out of the box:

[minify.tdewolff.svg] keepNamespaces = ['' , 'x-bind']

What's Changed

• minifiers: Keep x-bind and blank namespace in SVG minification 42289d7 @bep #14669

Contributors

bep

Assets 31

• hugo_0.159.1_checksums.txt sha256:8cc9333f340afa9a734e07d69a9d89e78044b9d9a156bf84d270409b9cc0ceaa 2.87 KB 14 hours ago
• hugo_0.159.1_darwin-universal.pkg sha256:a539929efc1042c7a6637e3b005be22b1ee6787bb2ccf5f363e5aaec89d440f0 34.2 MB 14 hours ago
• hugo_0.159.1_dragonfly-amd64.tar.gz sha256:6b2c5fe9412a14fdbf2949d64fe67227f11c8fa9cdef9b4fbf2fc8383a4f498e 17.5 MB 14 hours ago
• hugo_0.159.1_freebsd-amd64.tar.gz sha256:9ab3c8078a0dc623e06da3556a75a9269edfa7b82c3ef438d7da6e462ee60e6c 17.5 MB 14 hours ago
• hugo_0.159.1_Linux-64bit.tar.gz sha256:297e18fa21e4796d80a3270c1234873f5a979cb9a329a0c93d9888a1b39f106c 17.6 MB 14 hours ago
• hugo_0.159.1_linux-amd64.deb sha256:aeb4a3fdb5835fcce75be34193ad95faf4809645222b5fd74c500125960fc050 18.3 MB 14 hours ago
• hugo_0.159.1_linux-amd64.tar.gz sha256:297e18fa21e4796d80a3270c1234873f5a979cb9a329a0c93d9888a1b39f106c 17.6 MB 14 hours ago
• hugo_0.159.1_linux-arm.tar.gz sha256:e84f1ed44cc8f31e02df1fd2dfc5a282e13f2badf8fd84eafb8a2684df387b8e 16.3 MB 14 hours ago
• hugo_0.159.1_linux-arm64.deb sha256:6c9dd58a6a19d942c48a691ddbac42fb64eb5738adb69639b58788d95d4d9c44 16.8 MB 14 hours ago
• hugo_0.159.1_linux-arm64.tar.gz sha256:9786a2ec695b607560a3bf7dbfe1666db6ea320bb1cdabffdb7a4c191fd6a8d8 16.2 MB 14 hours ago
• hugo_0.159.1_netbsd-amd64.tar.gz sha256:0d23252a06744b6edd29a8fd08b85af646934711050e262b133bb3732b931295 17.5 MB 14 hours ago
• hugo_0.159.1_openbsd-amd64.tar.gz sha256:35abfff4e5d8c4da6faa712f8aee9033e05c07c161a0145660dff051d5aba408 17.5 MB 14 hours ago
• hugo_0.159.1_solaris-amd64.tar.gz sha256:60230f525cdc9ed9104641cf93f92f2ff48b6318ec96d20dbd0f7efa2eed93c7 17.5 MB 14 hours ago
• hugo_0.159.1_windows-amd64.zip sha256:13ab323475cb2719a264b93f0daaa39db21100a922f51dee018df487020797b0 18.2 MB 14 hours ago
• hugo_0.159.1_windows-arm64.zip sha256:3912cd9ed262c7a14c414e9ff368da013bd3aaaedbc9b8c4178f48486eb1e237 16.5 MB 14 hours ago
• hugo_extended_0.159.1_darwin-universal.pkg sha256:8f8d93ac3562e688b2a86af3d0b07685e2d54993c5451d7b594571975692ab6f 35.7 MB 14 hours ago
• hugo_extended_0.159.1_Linux-64bit.tar.gz sha256:cded0ffbc7540c5cee330c2ad24d678a0d4a693e9c590cc05c1d1d5556a21aa4 18.3 MB 14 hours ago
• hugo_extended_0.159.1_linux-amd64.deb sha256:55eacfba3a71c3e847850ce0be31a31130fa4ecd71f8136bffa7dc80cf9c5313 19.1 MB 14 hours ago
• hugo_extended_0.159.1_linux-amd64.tar.gz sha256:cded0ffbc7540c5cee330c2ad24d678a0d4a693e9c590cc05c1d1d5556a21aa4 18.3 MB 14 hours ago
• hugo_extended_0.159.1_linux-arm64.deb sha256:184f8dc27afb48200a2cfd6ee2b5e38680d56ad9484595e7e1b1cba2bf43719a 17.5 MB 14 hours ago
• hugo_extended_0.159.1_linux-arm64.tar.gz sha256:210c5e22631fa6a6bad3b6c623f8997a70d2ac306d61ca326d5f31753165779d 16.9 MB 14 hours ago
• hugo_extended_0.159.1_windows-amd64.zip sha256:8d3df3a3ad0cb23fd567dc5b6c2ad63f56e6894042bf4d40806b5c2d4614de89 19.2 MB 14 hours ago
• hugo_extended_withdeploy_0.159.1_darwin-universal.pkg sha256:cfe14978b9233a6ddad4aeca514d062cc4b4aa9565fb82e49d5d15d9234bc119 52.6 MB 14 hours ago
• hugo_extended_withdeploy_0.159.1_Linux-64bit.tar.gz sha256:81de435b65a06f2879c0fd158412822cbcfcd638dcc36256da5e002067b40975 27 MB 14 hours ago
• hugo_extended_withdeploy_0.159.1_linux-amd64.deb sha256:e42ca72f2f138e0970926779551f88a9d8dcc4cdd4fc7575b41b93adbdb3a172 28.1 MB 14 hours ago
• hugo_extended_withdeploy_0.159.1_linux-amd64.tar.gz sha256:81de435b65a06f2879c0fd158412822cbcfcd638dcc36256da5e002067b40975 27 MB 14 hours ago
• hugo_extended_withdeploy_0.159.1_linux-arm64.deb sha256:10b439cb3882e3496d7ea8db83fadaca1fe2b0486694dda90a74036cb2858ce1 25.6 MB 14 hours ago
• hugo_extended_withdeploy_0.159.1_linux-arm64.tar.gz sha256:5c3a3198fb47945b2743ba34d9a63b8d9241314a45fc88735735a942868401a5 24.7 MB 14 hours ago
• hugo_extended_withdeploy_0.159.1_windows-amd64.zip sha256:05c6a4b0c79be0485c5cb3c8ed8b098f26feafd55ae53cede68055e4677c49fb 28.2 MB 14 hours ago
• Source code (zip) 15 hours ago
• Source code (tar.gz) 15 hours ago

8 people reacted: 👍 5 🎉 1 ❤️ 2

This release greatly improves and simplifies management of Node.js/npm dependencies in a multi-module setup. See this page for more information.

Note

• Replace deprecated site.Data with hugo.Data in tests a8fca59 @bep
• Replace deprecated excludeFiles and includeFiles with files in tests 182b104 @bep
• Replace deprecated :filename with :contentbasename in the permalinks test eb11c3d @bep

Bug fixes

• tpl/tplimpl: Fix Vimeo shortcode test eaf4c75 @jmooring #14649

Improvements

• create: Return error instead of panic when page not found 807cae1 @mango766 #14112
• commands: Preserve non-content files in convert output c4fb61d @xndvaz #4621
• npm: Use workspaces to simplify hugo mod npm pack d88a29e @bep
• commands: Close cpu profile file when StartCPUProfile fails 9dd9c76 @buley
• Remove the AI Watchdog workflow for now 3315a86 @bep
• Remove 'bep' from PR user logins skip list 3824484 @bep
• tpl/tplimpl: Comment out the Vimeo simple shortcode tests 7813c5c @bep #14649

Dependency Updates

• build(deps): bump github.com/olekukonko/tablewriter from 1.1.3 to 1.1.4 (#14641) 3ff9b7f @dependabot [bot]
• build(deps): bump github.com/yuin/goldmark from 1.7.16 to 1.7.17 be93ccd @dependabot [bot]
• build(deps): bump github.com/magefile/mage from 1.15.0 to 1.16.1 2669bca @dependabot [bot]
• build(deps): bump golang.org/x/image from 0.36.0 to 0.37.0 753d447 @dependabot [bot]
• build(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.3 4f39d72 @dependabot [bot]

Documentation

• docs: Update docs.yaml d2043cf @bep
• commands: Update docs linke to Node.js docs 4f3c398 @bep

Notes

• Upgrade to to Go 1.26.1 (#14597) (note) 1f578f1 @bep #14595. This fixes a security issue in Go's template package used by Hugo: https://www.cve.org/CVERecord?id=CVE-2026-27142

Deprecations

The methods and config options are deprecated and will be removed in a future Hugo release.

Also see this article

Language configuration

• languageCode → Use locale instead.
• languages..languageCode → Use languages..locale instead.
• languages..languageName → Use languages..label instead.
• languages..languageDirection → Use languages..direction instead.

Language methods

• .Site.LanguageCode → Use .Site.Language.Locale instead.
• .Language.LanguageCode → Use .Language.Locale instead.
• .Language.LanguageName → Use .Language.Label instead.
• .Language.LanguageDirection → Use .Language.Direction instead.

Bug fixes

• tpl/css: Fix external source maps e431f90 @bep #14620
• hugolib: Fix server no watch 59e0446 @jmooring #14615
• resources: Fix context canceled on GetRemote with per-request timeout 842d8f1 @bep #14611
• tpl/tplimpl: Prefer early suffixes when media type matches 4eafd9e @bep #13877 #14601
• all: Run go fix ./... e310822 @bep
• internal/warpc: Fix SIGSEGV in Close() when dispatcher fails to start c9b88e4 @bep #14536
• Fix index out of range panic in fileEventsContentPaths f797f84 @bep #14573

Improvements

• resources: Re-publish on transformation cache hit 3c980c0 @bep #14629
• create/skeletons: Use css.Build in theme skeleton 404ac00 @jmooring #14626
• tpl/css: Add a test case for rebuilds on CSS options changes 06fcb72 @bep
• hugolib: Allow regular pages to cascade to self 9b5f1d4 @jmooring #14627
• tpl/css: Allow the user to override single loader entries 623722b @bep #14623
• tpl/css: Make default loader resolution for CSS @import and url() always behave the same a7cbcf1 @bep #14619
• internal/js: Add default mainFields for CSS builds 36cdb2c @jmooring #14614
• Add css.Build 3e3b849 @bep #14609 #14613
• resources: Use full path for Exif etc. decoding error/warning messages c47ec23 @bep #12693
• Move to new locales library and upgrade CLDR from v36.1 to v48.1 4652ae4 @bep
• tpl/strings: Add strings.ReplacePairs function 13a95b9 @jmooring #14594
• github: Remove pull_request_template.md 54c8048 @bep
• testing: Make commands tests pass in Go 1.26.1 157bfdd @bep
• refactor: Deprecate language configuration and template methods d4f2122 @jmooring #14269
• Replace Exif with Meta in tests 991d2f9 @bep
• resources: Improve getImageOps error message e857777 @jmooring #14571
• resources/images: Add IsImageResourceWithMeta etc. tests for bmp and gif 44dc384 @bep #14568

Dependency Updates

• deps: Upgrade github.com/evanw/esbuild v0.27.3 => v0.27.4 0e46a97 @bep
• build(deps): bump github.com/getkin/kin-openapi from 0.133.0 to 0.134.0 c27d9e8 @dependabot [bot]
• build(deps): bump golang.org/x/tools from 0.42.0 to 0.43.0 098eac5 @dependabot [bot]
• build(deps): bump gocloud.dev from 0.44.0 to 0.45.0 87f8de8 @dependabot [bot]
• build(deps): bump golang.org/x/sync from 0.19.0 to 0.20.0 67ef6c6 @dependabot [bot]
• build(deps): bump golang.org/x/net from 0.50.0 to 0.51.0 (#14569) b29c2f7 @dependabot [bot]
• build(deps): bump github.com/tdewolff/minify/v2 from 2.24.9 to 2.24.10 (#14585) e91d191 @dependabot [bot]
• build(deps): bump github.com/bep/imagemeta from 0.15.0 to 0.17.0 (#14584) a8a54bd @dependabot [bot]