Hugo Updates & Release Notes

Notable new features

• New imaging.firstFrameOnly option (and a matching processing flag) to only decode/encode the first frame of animated images. Hugo now also only decodes the first frame when the target format doesn't support animation, and fails early with an informative error if processing all frames would exceed the WASM memory limit.
• New FrameCount method on images, e.g. to check if an image is animated.
• site.Language now has Translate and Format* methods, so you can e.g. range over site.Languages and translate into each language.
• New charset option for js.Build and css.Build.
• Basic support for the OSC 7501 program status (working/done/idle/error) in terminals that support it, alongside the existing OSC 9;4 progress.

Security fixes

This release is built with Go 1.27.2, which includes 15 security fixes. The most relevant for Hugo are:

• Two html/template escaping fixes, which also apply to Hugo's fork of the package: CVE-2026-94448 (context tracking not reset on consecutive expressions in JS template literals) and CVE-2026-97030 (yield not recognized as a regexp preceder keyword). Both could lead to incorrect escaping of inline JavaScript.
• Several net/http fixes (HTTP/2 server crash and memory exhaustion, connection desynchronization, unbounded Range header parsing), relevant for hugo server and remote resources. The corresponding HTTP/2 fixes are also included via the upgrade of golang.org/x/net to v0.61.0.
• CVE-2026-56857: os.Root.Mkdir(All) could follow junctions out of the root on Windows.

Also:

• github.com/tdewolff/minify is upgraded to v2.24.19, which fixes GHSA-3ppm-p7r9-c5w3: (and <!--) inside inline scripts was not properly escaped (case-insensitively) when minifying JS in HTML.
• Hugo now ignores module.replacements defined in themes; only the project can define replacements.

Changes

• Fix PAGE.IsNode warning in jsonify 0732ead @bep #15420
• hugolib: Fix rebuild when content is also mounted as assets ac62c80 @taekop #12838
• Fix deprecation issues in tests be8ffd6 @bep
• circleci: Update config.yml to version 2.1 285d0ef @bep
• warpc: Upgrade libavif, AOM, dav1d versions c94bdf9 @bep
• warpc: Upgrade to javy 9.1.0 63fb71c @bep
• warpc: Upgrade to wasi-sdk-34 2f2f33b @bep
• ci: Drop extended build tag on Windows tests 53aae44 @bep
• Add imaging.firstFrameOnly and some animation performance improvements 13ee7e9 @bep #15433
• js, css: Add charset option to js.Build and css.Build 0688a8c @bep #15435
• Add ImageResource.FrameCount c9f6e4d @bep #15430
• Add Translate and Format* methods to Language df8bade @bep #7844
• Add basic support for OSC 7501 program status d1024ae @bep #15425
• modules: Ignore module.replacements defined in themes 6883b55 @bep
• Upgrade to Go 1.27.2 f44c355 @bep #15427
• ci: Add temporary workaround for staticcheck vs Go 1.27.2 46123a6 @bep
• transform/metainject: Inject Hugo generator tag last in 31f5395 @toddy15
• Make tests run on GOARCH 386 6b3ba3a @bep #15403
• Update vulnerability reporting instructions ec69d0e @bep

Dependency Updates

• build(deps): bump golang.org/x/image from 0.46.0 to 0.47.0 2bbad50 @dependabot [bot]
• build(deps): bump golang.org/x/mod from 0.41.0 to 0.42.0 030619b @dependabot [bot]
• build(deps): bump golang.org/x/net from 0.59.0 to 0.61.0 13ef707 @dependabot [bot]
• build(deps): bump github.com/bits-and-blooms/bitset 846b1d7 @dependabot [bot]
• build(deps): bump github.com/tdewolff/minify/v2 from 2.24.17 to 2.24.19 16441d2 @dependabot [bot]

Build Setup

• snap: Update base to core26 8c88da3 @jmooring

This release brings relative partial references, slug support for branch pages, and a handful of security hardening fixes.

Relative partial references

A partial name starting with ./ or ../ is now resolved relative to the directory of the calling partial. This makes it much easier to write self-contained, movable partial trees, e.g. {{ partial "./item.html" . }} from within layouts/_partials/card/list.html. Relative paths are only allowed from within partials, and paths resolving outside the partials directory is an error. See #15373 and the documentation.

Slugs for section, taxonomy and term pages

The slug front matter now works for branch pages, not just regular pages, and it cascades to descendants. This is particularly useful in multilingual sites, where e.g. content/help/_index.es.md with slug: ayuda gives /es/ayuda/, /es/ayuda/avanzado/ etc. See #14352.

Other notable improvements include the new build.cleanDestinationDir config with keepFiles/keepDirs Glob patterns (#14937, docs), hugo now builds without a config file (#15393), exact numeric comparisons in eq, where, in and the set functions (#15322, #15358), and automatic summaries that no longer end inside an open list or blockquote (#14044).

Security

This release contains several hardening fixes. None of them are known to be exploited, but if you build sites with untrusted themes or modules, you should upgrade.

• Sass imports not found in Hugo's file systems were resolved by the Sass compiler itself, which follows symlinks and knows nothing about the project root. A theme could import a file outside the project and get its content into the published CSS. These imports are now resolved by Hugo and checked against the same security.allowRead roots as the Node.js tools and js.Build. 41040cc (thanks to @Hama1cco)

• Likewise, imports not found in /assets were resolved and read by ESBuild itself. The resolved path is now checked against the allowed read paths before ESBuild loads it. 2aa51f3 (thanks to @Hama1cco)

• A symlinked directory in a theme at the parent of a nested mount could expose files outside the module. 2fe9bab

• Explicit heading IDs (e.g. ## Foo {id="..."}) were written unescaped into the table of contents href, allowing attribute breakout. 671fbf2

Note

• The default baseURL is now https://example.org/ (it was empty). Hugo has always required a valid URL to work properly, so this mostly affects new and test sites, but if you relied on the empty default for relative URLs, set baseURL explicitly. bc68654

• The root cleanDestinationDir config key is deprecated in favour of build.cleanDestinationDir.enable. The --cleanDestinationDir flag maps to the new key. Note that .git files in the publish dir are now kept by default. 9086193

• eq now compares numeric values the same way as lt, le etc., so e.g. eq 1 1.0 is now true. Also, in, intersect, union, uniq, symdiff, complement and where's in/not in now compare numbers exactly rather than via float64, and no longer require the Go types to match. 4d628bb 366377b @bep #15322 #15358

• A user table render hook is now preferred over the embedded one. 140d936 @jmooring #15389

• Automatic summaries are expanded past summaryLength when needed so they don't end inside an open container element. This may change the summary for some pages. d692a24 @bep #14044

Bug fixes

• hugolib: Fix failing integration test fdbba5a @jmooring

• Fix build with Go 1.26 on Fedora 44 Beta 2782bfd @flyn-org

• Fix smartcrop with rotation (#15371) 5edd05b @bep #11266 #15369

• ci: Fix broken magefile 1d87ee5 @bep

• tpl/collections: Fix union of slices with different numeric element types ffbcdba @hktitof #15323

• Fix stale page content when several files in the same dir change in one batch a374b86 @bep #15330

Improvements

• Update .gitignore f6606f1 @bep

• tocss: Confine Sass import fallbacks to the allowed read paths 41040cc @bep

• js: Confine ESBuild's fallback resolver to the allowed read paths 2aa51f3 @bep

• commands: Allow building without a config file c7f9999 @bep #15393

• collections: Preserve slice type when appending an empty slice dd16df1 @jakezwang #11131

• tpl/tplimpl: Prefer user table render hook over embedded 140d936 @jmooring #15389

• Avoid allocating in SitesMatrix.MatchSiteVector 83ab799 @bep

• Add slug support for section, taxonomy and term pages 5d43ab7 @bep #14352

• tpl: Avoid reflect.Value.Call for common signatures 806a62e @bep #15385

• ci: Disable vet when running tests 8bac4de @bep

• tpl/partials: Support relative partial paths from within partials (#15376) bd1588b @bep #15373

• config: Add build.cleanDestinationDir config 9086193 @bep #14937

• commands: Make testscripts/commands/hugo__clean_destination_dir.txt portable a74b753 @bep #8433

• commands: Handle missing staticDir in cleanDestinationDir 07b9fba @jmooring #8433

• hugofs: Cache symlink checks 09fa49b @bep

• hugofs: Drop symlinks in virtual ancestor dirs of nested mounts 2fe9bab @bep

• markup/tableofcontents: Escape heading IDs in ToC HTML 671fbf2 @bep

• hugofs: Allow symlinked mount roots in the main project 25f2856 @bep #15367

• Expand and consolidate BOM trimming cb6a707 @bep #15355 #15361

• tpl/collections: Compare numbers exactly in set operations and where 366377b @bep #15358 #15359

• ci: Skip vet on Windows 10bb97b @bep

• Revert "parser/metadecoders: Strip BOM from data prior to unmarshalling" 51cd9e6 @bep

• parser/metadecoders: Strip BOM from data prior to unmarshalling ec578f0 @jmooring #15355

• tpl: Reformat templates with new formatter version 5698de9 @bep

• resources/page: Balance container tags in automatic summaries d692a24 @bep #14044 #14927

• config/security: Add an integration test 3be817e @bep

• tpl/compare: Consolidate numeric comparisions 4d628bb @bep #15322 #15347

• tpl/strings: Add a strings.FirstLower function aaacd12 @jmooring #15332

• Update brevity guideline in AGENTS.md 881c0ec @bep

Dependency Updates

• build(deps): bump github.com/olekukonko/tablewriter from 1.1.4 to 1.1.5 1567bde @dependabot [bot]

• build(deps): bump github.com/dustin/go-humanize from 1.0.1 to 1.1.0 9e4059c @dependabot [bot]

• build(deps): bump golang.org/x/tools from 0.49.0 to 0.50.0 8e3bbe6 @dependabot [bot]

• build(deps): bump golang.org/x/image from 0.45.0 to 0.46.0 753c5fc @dependabot [bot]

• build(deps): bump golang.org/x/text from 0.41.0 to 0.42.0 facde8a @dependabot [bot]

• build(deps): bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.45.0 c7e1a8e @dependabot [bot]

• deps: Bump github.com/bep/imagemeta from 1.0.0 to 1.0.1 (#15338) ec57bb7 @dependabot [bot]

Documentation

• readme: Bump minimum Go version 7a46cd2 @mikoxyz

Build Setup

• Update release image to Go 1.27.1 (#15342) 34d8cdb @bep

Note

• tpl/transform: Bump fileCacheEntryVersion in transform.ToMath (note) 8d88b8b @bep #15267
• resources/images: Bump formatVersionNumbers.PNG and fix version cache busting for images.Filter (note) d19e0a4 @bep #12536 #12543 #15266
• warpc/js: Upgrade katex to 0.18.4 (note) ec52e63 @bep #15254
• hexec: Fail on symlinks that escape the Node.js permission paths c05c012 @bep
• config/security: Deny text/org content by default e6abb9c @bep
• config/security: Add http.proxyFromEnvironment and document the resolved address check 6a2a955 @bep #15301 #15302

When upgrading to Hugo v0.166.0, sites using transform.ToMath with the output option set to html or htmlAndMathml must update the KaTeX stylesheet referenced in their template(s) to version 0.18.4 or higher. Using older CSS versions like 0.16.21 will cause certain mathematical or chemical expressions to render incorrectly.

Example update:

- <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/[email protected]/dist/katex.min.css">
+ <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/[email protected]/dist/katex.min.css">

See these examples:

• https://gohugo.io/functions/transform/tomath/#step-3
• https://gohugo.io/render-hooks/passthrough/#example

Bug fixes

• tpl/strings: Fix replaceRE with zero-width assertions ae07063 @youdie006
• common/hreflect: Fix the off-by-one in the float to int overflow guards 5130d00 @youdie006
• resources/images: Fix filters on transparent colors and paletted images 7785668 @bep #12536 #12543
• github: Fix workflow for stale issues efe5cbc @jmooring #15261
• all: Run modernize -fix ./... 7b5199f @bep
• commands: Fix lang flag description in config command 87260e4 @jmooring #15223
• hugolib: Fix slice bounds panic when deleting multiple nodes at same path 49dceb1 @bep #15207
• hugolib: Fix ReadingTime and FuzzyWordCount calculations 5e70992 @jmooring #15206

Improvements

• js: Add es2025 as supported build target 857120b @bep #15307
• hugofs: Drop symlinked mount roots 938c820 @bep
• markup/highlight: Escape lineAnchors before passing it to Chroma 3b2d3b8 @bep
• tpl/partials: Slight performance improvement of the common partialCached case 9c2527f @bep
• Add internalExternal.IgnoreTailwindCSSSecurityError config option a36bd27 @bep
• config/security: Harden the default http.urls and resolved address checks ( #15285 ) 24d5e42 @bep
• resources/images: Preserve the source palette for geometric filter chains 9e7c978 @bep #12543
• resources/images: Add golden test cases for geometric filter chains on paletted images 6b5b7d8 @bep #12543
• resources/images: Add some golden test cases 62e24b7 @bep #12536 #12543
• related: Speed up index creation f61346e @bep
• related: Add tokenize option for index values 850f11c @jmooring #7515 #15199
• resources/page: Don't let a title's "/" split an auto-derived slug 39507d5 @ipince #4092 #3577 #5571 #4090
• config/allconfig: Improve resilience of hugo mod init 90fe506 @jmooring #15253
• tpl: Separate deferred templates by escaping mode 49835f8 @Soundcreates #15234
• resources: Validate the resolved address on remote fetches d6e6f9e @bep #15247
• markup: Escape code-fence attribute values in the default renderer e4dc48c @bep #15247
• hugolib: Make .Render take an optional context argument bcde806 @bep #15077
• modules/npm: Make the generated workspace package private with a stable name df4ac34 @bep #15245
• common/hstore: Keep read lock while sorting map values 166d3ee @Soundcreates #15237
• metrics: Improve template metrics duration formatting a25af7f @Shiwang0-0 #15027
• Remove comments from rebuild test functions 723579f @bep
• hugolib: Add some fast render mode integration tests 85ad5e4 @bep
• Upgrade to Go 1.27 e31ff54 @bep #15228
• tpl: Improve the return keyword in templates 8405b80 @bep #15212
• page: Add IndexOf method to Pages bf05832 @Shiwang0-0 #13589
• tpl/resources: Add resources.Publish a05736c @bep #15208
• markup/pandoc: Support pandoc 3.11 and later 423e9ce @jmooring #15271 #15280

Dependency Updates

• build(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 3fbfd27 @dependabot [bot]
• build(deps): bump golang.org/x/sync from 0.22.0 to 0.23.0 393de58 @dependabot [bot]
• build(deps): bump golang.org/x/mod from 0.40.0 to 0.41.0 870f746 @dependabot [bot]
• build(deps): bump github.com/getkin/kin-openapi from 0.146.0 to 0.149.0 6152e22 @dependabot [bot]
• build(deps): bump github.com/bits-and-blooms/bitset 5b6e7c2 @dependabot [bot]
• build(deps): bump github.com/bep/lazycache from 0.8.1 to 0.9.0 dc03bb2 @dependabot [bot]
• build(deps): bump github.com/bep/tmc from 0.6.0 to 0.7.0 701dd33 @dependabot [bot]
• build(deps): bump github.com/yuin/goldmark from 1.8.5 to 1.8.6 b4062c8 @dependabot [bot]
• build(deps): bump golang.org/x/image from 0.44.0 to 0.45.0 cdd1627 @dependabot [bot]
• deps: Upgrade github.com/gobwas/glob v0.2.3 => v1.0.0 efd2456 @bep #15273
• build(deps): bump golang.org/x/mod from 0.39.0 to 0.40.0 d462968 @dependabot [bot]
• build(deps): bump github.com/tdewolff/minify/v2 from 2.24.16 to 2.24.17 fd5f7c6 @dependabot [bot]
• build(deps): bump github.com/gohugoio/httpcache from 0.8.0 to 0.9.0 6b33517 @dependabot [bot]
• build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 5f0d88b @dependabot [bot]
• build(deps): bump golang.org/x/tools from 0.48.0 to 0.49.0 9171dae @dependabot [bot]
• build(deps): bump software.sslmate.com/src/go-pkcs12 from 0.7.0 to 0.7.2 d1ee825 @dependabot [bot]

The two main new things is the new css.ChromaStyles template func and the new importContext option demonstrated below.

{{
$light := css.ChromaStyles(
dict
"targetPath"
"css/components/chroma-light.css"
"style"
"github"
"mode"
"light"
)
}}
{{
$dark := css.ChromaStyles(
dict
"targetPath"
"css/components/chroma-dark.css"
"style"
"github"
"mode"
"dark"
)
}}
{{
$opts := dict
"minify"
true
"importContext"
(slice $light $dark)
}}
{{
$css := resources.Get
"css/main.css"
|
css.Build $opts
}}

The importContext is relevant for css.Build, js.Build, css.Sass, and css.PostCSS. and it allows you to make resources (e.g. built from resources.FromString) resolvable in e.g. CSS @import statements.

Note

• Remove tailwindcss from the default security.exec.allow list (note) 8a55df7 @bep #15178 #15171

Bug fixes

• Fix resource transformation chaining after content access f772998 @bep #15189
• Fix server static file detection for deleted files/directories in the static syncer 2ffaf1f @bep
• Fix server errors when deleting static files or directories a808f6e @bep #15174
• Fix panic on server atomic save edits on MacOS 6bf1524 @bep #15130
• markup/asciidocext: Fix TOC parsing for asciidoctor-html5s f961093 @jmooring #15121
• snap: Fix snap home environment 984358f @jmooring #15114

Improvements

• resources: Resume chained resource transformations 995a215 @bep #15189 #15189
• resources/jsconfig: Drop source root mapping for the current source root f88f0a9 @bep #15169
• circleci: Upgrade to Go 1.26.5 52c9bd7 @bep
• Add Data.Artifacts to css.Build and js.Build 44da086 @bep #15173
• css: Add classDark and classLight options to css.ChromaStyles and gen chromastyles 33d1f2c @bep #15167
• markup/highlight: Re-emit token colors dropped by Chroma's minifier 64da6d7 @bep #15161
• Add importContext option to css.Build, js.Build, css.Sass and css.TailwindCSS 70db201 @bep #15103
• Remove some old deprecations 8a468df @bep
• Add css.ChromaStyles 615e45d @bep #15112
• check.sh: Handle staticcheck not installed/in PATH a243a61 @Soundcreates
• warpc: Improve AVIF error message on memory allocation failure 7d90277 @bep
• cache/filecache: Don't prune used cache entries with mixed-case dir names 861ede6 @bep #15101
• Drop symlinks in parent directories f228c87 @bep
• Delete .gemini 7df45f6 @bep
• common/hugo: Include non-go dependencies in go env output 89b8c32 @jmooring #15116

Dependency Updates

• build(deps): bump github.com/bep/imagemeta from 0.17.3 to 1.0.0 0bb337b @dependabot [bot]
• build(deps): bump github.com/evanw/esbuild from 0.28.1 to 0.28.2 03dc917 @dependabot [bot]
• build(deps): bump github.com/tdewolff/minify/v2 from 2.24.14 to 2.24.16 c829b73 @dependabot [bot]
• build(deps): bump github.com/getkin/kin-openapi from 0.145.0 to 0.146.0 94f3908 @dependabot [bot]
• build(deps): bump github.com/rogpeppe/go-internal from 1.15.0 to 1.16.0 75fcc75 @dependabot [bot]
• build(deps): bump github.com/mattn/go-isatty from 0.0.22 to 0.0.24 b5fa03d @dependabot [bot]
• build(deps): bump github.com/yuin/goldmark from 1.8.4 to 1.8.5 9da472d @dependabot [bot]
• build(deps): bump golang.org/x/tools from 0.47.0 to 0.48.0 635532a @dependabot [bot]
• build(deps): bump github.com/kyokomi/emoji/v2 from 2.2.13 to 2.2.14 9c71f60 @dependabot [bot]
• build(deps): bump github.com/getkin/kin-openapi from 0.144.0 to 0.145.0 420527f @dependabot [bot]
• build(deps): bump golang.org/x/image from 0.43.0 to 0.44.0 7fe786e @dependabot [bot]
• build(deps): bump github.com/bep/imagemeta from 0.17.2 to 0.17.3 03b244f @dependabot [bot]
• build(deps): bump github.com/tdewolff/minify/v2 from 2.24.13 to 2.24.14 9611813 @dependabot [bot]
• build(deps): bump github.com/yuin/goldmark from 1.8.2 to 1.8.4 e35b7f0 @dependabot [bot]
• build(deps): bump golang.org/x/net from 0.56.0 to 0.57.0 0796fa7 @dependabot [bot]
• build(deps): bump golang.org/x/text from 0.38.0 to 0.40.0 1b701b7 @dependabot [bot]
• build(deps): bump github.com/getkin/kin-openapi from 0.140.0 to 0.144.0 a32d70b @dependabot [bot]
• build(deps): bump google.golang.org/grpc from 1.80.0 to 1.82.1 948cfb9 @dependabot [bot]
• build(deps): bump golang.org/x/mod from 0.37.0 to 0.38.0 8930802 @dependabot [bot]

Documentation

• Remove Star History from README dd3f273 @bep #15190
• Update README.md d1f191c @jmooring

Notable new features in this release are:

• The Chroma highlighter styles now introduces dark/light pairs. See also the new flags on the hugo gen chromastyles command.
• New template funcs encoding.HexEncode, encoding.HexDecode, and crypto.Hash.
• New markup.rst.syntaxHighlight option.
• We added Pandoc citation support.
• We now spport sub paths in layouts passed to Page.Render.
• This release also fixes a performance regression introduced in Hugo v0.128.0. This should mostly be prominent in bigger sites. See this discussion for some background.

Notes

• tpl/resources: Deprecate resources.PostProcess in favour of templates.Defer 29ed932 @bep #15086

Changes

• all: Rewrite deprecated constructs in tests 5a5f4a5 @bep
• tpl/tplimpl: Support sub paths in layouts passed to .Render d83ce27 @bep #15056
• Add markup.rst.syntaxHighlight option c6acc24 @bep #5349
• tpl/resources: Deprecate resources.PostProcess in favour of templates.Defer 29ed932 @bep #15086
• tpl/collections: Include key in IsSet unsupported-type warning 671897a @bejaratommy #11794
• create: Keep new content placeholders buildable 499794d @sjh9714 #15078
• hugio: Speedup hasBytesWriter 65c8217 @bep
• tpl/crypto: Add crypto.Hash dfb35dc @bep #15072
• Add encoding.HexDecode/Encode a5ec542 @bep #15068 #15060
• tpl/tplimpl: Make template name lookup case-insensitive e46d37a @jmooring #15057
• hugolib: Return error from .Render when template not found fe06735 @jmooring #15052
• markup/pandoc: Add citation support 128fb17 @jmooring #15062

Dependency Updates

• build(deps): bump github.com/JohannesKaufmann/html-to-markdown/v2 921db7b @dependabot [bot]
• build(deps): bump golang.org/x/tools from 0.45.0 to 0.47.0 786ce71 @dependabot [bot]
• build(deps): bump golang.org/x/image from 0.42.0 to 0.43.0 5ad2846 @dependabot [bot]
• build(deps): bump golang.org/x/net from 0.55.0 to 0.56.0 36ad9f5 @dependabot [bot]
• build(deps): bump github.com/pelletier/go-toml/v2 from 2.4.2 to 2.4.3 7c0a0bc @dependabot [bot]
• build(deps): bump github.com/getkin/kin-openapi from 0.139.0 to 0.140.0 a879ebf @dependabot [bot]
• build(deps): bump golang.org/x/mod from 0.36.0 to 0.37.0 332d5ec @dependabot [bot]
• build(deps): bump github.com/pelletier/go-toml/v2 from 2.3.1 to 2.4.2 212cc11 @dependabot [bot]
• deps: Upgrade github.com/evanw/esbuild v0.28.0 => v0.28.1 884439b @bep #15033
• deps: Add Chroma dark/light mode support 790a8aa @bep #15017

The majority of the fixes in this release are security related (including the upstream fix in golang.org/x/image). Thanks to @vnth4nhnt for finding the issues fixed in a00b5c7 and cf9c8f9 (I will do the CVE work on this later). There has been a uptick in security reports lately, which doesn't mean that Hugo has gotten less secure, this is mostly the work of the new and powerful AI tools using Hugo's restrictive security model as their baseline. Just take a look at Go's recent security issue list to see a demonstration of this.

What's Changed

• build(deps): bump golang.org/x/image from 0.41.0 to 0.42.0 93c8c7d @dependabot [bot]
• Fix multi --renderSegments merge behavior 95e5e9f @bep #15024
• security: Normalize integer IPv4 host encodings in http.urls check a00b5c7 @bep
• Drop symlinks in os.ReadDir, os.ReadFile, os.Stat and os.FileExists cf9c8f9 @bep #15019
• commands: Fix convert command 2602796 @jmooring #15012

The main topic in this release is improvements to the AVIF image handling that we introduced in v0.162.0. See the docs for details, but:

• We have turned down the default quality for AVIF to 60. Turns out, JPEG/WebP with quality 75 is comparable to AVIF with quality 60. You can now also set quality per image format in your project config (and also per image processed if needed).
• We have added a hint to the AVIF with the same values as for WEBP. For lossy compression, the photo/picture hints (and the default) encodes with YUV420 chroma subsampling instead of YUV444, keeping 444 for text/icon/drawing. This greatly reduces the memory needed to encode these images.

Improvements

• resources/jsconfig: Remove deprecated baseUrl setting ff2903a #14991 #14996
• all: Adjust tests for deprecated link and image render hook settings ca68936 @jmooring
• all: Run go fix ./... 781fabf @bep
• pagesfromdata: Use relative path for content adapter template metrics 1d018ef @anupamojha-eng #14999
• ci: Re-add macos-latest to the test matrix 121bc6c @bep
• images: Deprecate Imaging.Compression and move it down to webp and avif configs cf18b82 @bep #14998
• Only support the latest Go version 98ad9b3 @bep #14997
• page: Add IsBranch and deprecate IsNode b89e7fe @bep #11574
• images: Force cache invalidation for AVIF target e8fefc8 @bep #14990
• images: Add a per-format AVIF hint setting a043d3e @bep #14992
• images: Make AVIF chroma subsampling content-aware via the hint 341f575 @bep #14987
• Cap AVIF lossy quality at 99 248241b @bep #14981
• config: Deprecate the glogal imaging quality setting 4e47d95 @bep #14979
• images: Make 60 the default quality for AVIF 03b4b54 @bep #14979
• livereload: Disconnect from websocket server on pageswap 79be053 @bep #14983
• tpl/tplimpl/embedded: Prevent leading newline in sitemap template 0f44046 @bep #14977
• images: Recover from memory alloc errors in WASM image processors 4e17421 @bep #14985
• images: Add quality setting per image format b01ecd4 @bep #14957
• misc: Remove duplicate words in comments 45c00b7 @jmooring #14936 #14950 #14965
• Add some PNG to AVIF golden test cases 28d882a @bep

Dependency Updates

• build(deps): bump github.com/bits-and-blooms/bitset 0d29fc8 @dependabot [bot]
• build(deps): bump github.com/tetratelabs/wazero bb57404 @dependabot [bot]
• build(deps): bump github.com/rogpeppe/go-internal from 1.14.1 to 1.15.0 7d1b1fb @dependabot [bot]
• build(deps): bump github.com/getkin/kin-openapi from 0.138.0 to 0.139.0 77a1147 @dependabot [bot]

The notable new feature in this release is support for AVIF images (both encoder and decoder). There's a demo site set up that demonstrates the difference between HDR AVIF and SDR JPEG images. Note that that demo is only really interesting if viewed on an HDR capable screen (e.g. Apple Retina).

Security fixes

There are some notable security fixes in this release.

Security fixes in Go

This release upgrades from Go 1.26.1 to 126.3, which brings a set of security fixes. Some relevant for Hugo are:

• XSS in html/template (CVE-2026-39826 & CVE-2026-39823): Two separate vulnerabilities where escaper bypasses in html/template could lead to Cross-Site Scripting (XSS).
• html/template: Fixes an issue where JS template literal contexts were incorrectly tracked across template branches, which could lead to improper content escaping.

Security fixes and hardening in Hugo

The following changes either fix a concrete issue or reduce the default attack surface of hugo builds.

• Disallow text/html content files by default (e41a064). A new security.allowContent policy gates which content media types may be used for pages under /content. text/html is denied by default; sites that rely on hand-authored or adapter-emitted HTML content can opt back in with security.allowContent = ['.*'].
• Re-check security.http.urls on every redirect hop in resources.GetRemote (86fbb0f).
• Reject symlinked entries in resources.Get (f8b5fa0).

We will update this section later with links to CVEs where applicable.

All changes

• hugolib: Fix Page.GitInfo for modules with go.mod in a repo subdirectory df54219 @bep #14942
• Fix typo in CONTRIBUTING.md 4bc7cae @bep
• resources: Fix the :counter placeholder 5d51b82 @jmooring #14921
• commands: Fix import from Jekyll 81d7762 @jmooring #14795 #14906
• Fix prevention of direct symlink reads in resources.Get f8b5fa0 @bep
• commands: Fix github-dark chromastyles 88d838a @xndvaz #14831
• Disallow HTML content by default e41a064 @bep
• Add image processing support for AVIF 90d9f81 @bep #7837
• config: Preserve intentionally empty maps 80e6084 @jmooring #14944
• hugolib: Merge existing hugo_stats.json when renderSegments is set aeb9a5c @bep #14939
• all: Replace RWMutex struct caches with ConcurrentMap c4bbc28 @bep
• tpl/tplimpl: Consolidate and improve embedded template integration tests d8c7021 @jmooring #14932
• parser: Drop empty sub maps from hugo config output ee4f1ac @bep #14855
• markup/highlight: Allow overriding type and code via options b613365 @bep #11872
• Update AI assistance disclosure requirements d2c821b @bep
• hugolib: Use AllTranslated in IsTranslated 4ed7600 @bep
• tpl: Simplify sitemap template cbe4339 @bep #14912
• tpl: Use AllTranslations in sitemap template 6475d30 @bep #14912 #14917
• tpl/collections: Make dict return nil when no values are provided 67aede4 @bep
• Sync Go template package to 1.26.3 87f194b @bep #14897
• Upgrade to Go 1.26.3 d81e3c2 @bep #14897
• ci: Check embedded template formatting with gotmplfmt 7c65a4d @bep
• tpl: Run gotmplfmt -w . d31a927 @bep
• markup/goldmark/codeblocks: Always split Chroma options into .Options c36608c @jmooring #14909
• hugolib: Allow empty params front matter 2f361a8 @xndvaz #14886
• common/hmaps: Merge slice-valued module config into site config 5559263 @jmooring #13869
• tpl: Use GetMatch for both local and global image resources 656fc04 @bep #14062
• Revert "markup/tableofcontents: Skip empty TOC levels" a20cb5b @bep #14898
• tpl/templates: Reject Defer inside partialCached 4d775cb @bep #13492
• common/hexec: Make NODE_PATH a fallback for ESM bare imports ae7bf74 @bep #13987
• config: Allow repeating the root key in /config files ba5d812 @bep #12899 #14882
• Revise test naming guidelines in AGENTS.md be4a0df @bep
• Update AGENTS.md e4cf565 @bep
• js: Return error for missing batch imports 9e64953 @xndvaz #13737
• resources/images: Keep smart crop target size f0cfc28 @xndvaz #13688
• testing: Use synctest where relevant 16e854a @bep
• security: Validate redirects against security.http.urls 86fbb0f @bep #14871
• markup/tableofcontents: Skip empty TOC levels 7d4af7a @xndvaz #7128
• Fall back to hugo.buildDate in hugo.BuildDate() in non-vcs builds 28147cb @bep #14862
• css: Make css.Build's file-loader URLs absolute to web context root e51e761 @bep #14849
• hugolib: Don't warn about lang/kind/path coming from cascade.params 7011239 @bep #14848
• markup/goldmark: Unwrap inner HTML for plain code blocks 694906f @cyphercodes #14820
• tpl/tplimpl: Extend page image lookup to include global resources d27b9c0 @ogulcanaydogan #14062
• security: Allow hostnames starting with digits in default http.urls 62cef36 @bep #14837
• commands: Improve description of command flags ff22c62 @jmooring #14817
• build(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 4f444c8 @dependabot [bot]
• build(deps): bump golang.org/x/image from 0.40.0 to 0.41.0 fe6c726 @dependabot [bot]
• build(deps): bump github.com/getkin/kin-openapi from 0.137.0 to 0.138.0 6a2a038 @dependabot [bot]
• build(deps): bump github.com/JohannesKaufmann/html-to-markdown/v2 cf1de59 @dependabot [bot]
• build(deps): bump golang.org/x/image from 0.39.0 to 0.40.0 97f990c @dependabot [bot]
• build(deps): bump golang.org/x/tools from 0.44.0 to 0.45.0 b99634e @dependabot [bot]
• build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 fdd977e @dependabot [bot]
• build(deps): bump github.com/pelletier/go-toml/v2 from 2.3.0 to 2.3.1 123018d @dependabot [bot]
• deps: Upgrade to Chroma v2.24.1 b88fa8c @bep #14839

This release contains two security hardening fixes:

• We now run the Node tools PostCSS, Babel and TailwindCSS, by default, with the --permission flag with the permissions defined in security.node.permissions. This means that you need Node >= 22 installed and that css.TailwindCSS now requires that the Tailwind CSS CLI must be installed as a Node.js package. The standalone executable is no longer supported
• We have made the defaults in security.http.urls more restrictive.

But there are some notable new features, as well:

Nested vars support in css.Build and css.Sass

A practical example in css.Build would be to have something like this in hugo.toml :

[params.style]
primary = "#000000"
background = "#ffffff"
[params.style.dark]
primary = "#ffffff"
background = "#000000"

And in the stylesheet:

@import "hugo:vars";
@import "hugo:vars/dark" (prefers-color-scheme: dark): root {
color-scheme: light dark;
}

Slice-based permalinks config

The permalinks configuration is now much more flexible (the old setup still works). It uses the same target matchers as in the cascade config, meaning you can now do:

permalinks:

• target:
  kind: page
  path: "/books/**"
  pattern: /books/:year/:slug/
• target:
  kind: section
  path: "/{books,books/**}"
  pattern: /libros/:sections[1:]
• target:
  kind: page
  pattern: /other/:slug/

The above example isn't great, but it at least shows the gist of it.

A more flexible scheme for identifiers in filenames

What we had before was e.g. content/mypost.en.md which told Hugo that the content files was in English. With the new setup you could also name the file content/mypost.language_en.md. This alone doesn't sound very useful, but this allows you to use more prefixes:

Prefix | Description | Relevant for
language_ | Language | Content and layout files.
role_ | Role | Content and layout files.
version_ | Version | Content and layout files.
outputformat_ | Output format | Layout files.
mediatype_ | Media type | Layout files.
kind_ | Page kind | Layout files.
layout_ | Layout | Layout files.

All Changes

• langs/i18n: Fix translation lookup when using language variants
• create: Fix non-deterministic conflict detection in hugo new content
• commands: Fix environment isolation for configuration settings
• Fix filename dimension identifiers (role_X, version_X) to replace mount config
• Fix it so we never auto-fallback to page resources in other roles/versions
• css: Support nested hugo:vars/ imports
• github: Update GitHub actions versions
• hugolib: Do not render aliases if the page is not rendered
• langs/i18n: Improve default content language fallback
• helpers: Remove unused code
• common/constants: Remove unused consts
• common/paths: Remove unused code
• tests: Update Ruby setup action to v1.305.0
• langs: Use Language.Locale as primary localization key
• config/security: Add "! " negation to Whitelist, harden default http.urls
• Harden Node tool execution with --permission flag
• tpl/collections: Honor the Eqer interface in where comparisons
• modules: Ignore non-require blocks in go.mod rewrite
• Replace the concurrent map with an identical upstream version
• Add slice-based permalinks config with PageMatcher target
• commands: Add missing import
• Revert "common/hugo: Deprecate extended and extended_withdeploy editions"
• Adjust the SECURITY.md slightly
• resources/page: Add passing test for Issue
• Add a more flexible filename identifier scheme that also allows setting roles and versions
• common/hugo: Deprecate extended and extended_withdeploy editions
• parser/pageparser: Add a parser fuzz test
• Replace deprecated .Site.Sites/.Page.Sites with hugo.Sites intests
• agents: Add a note about having the issue ID in test names
• build(deps): bump github.com/getkin/kin-openapi from 0.135.0 to 0.137.0
• build(deps): bump github.com/mattn/go-isatty from 0.0.21 to 0.0.22
• build(deps): bump github.com/tdewolff/minify/v2 from 2.24.12 to 2.24.13
• build(deps): bump github.com/magefile/mage from 1.17.1 to 1.17.2
• deps: Upgrade github.com/bep/imagemeta v0.17.1 => v0.17.2
• build(deps): bump github.com/aws/aws-sdk-go-v2/service/cloudfront
• build(deps): bump github.com/mattn/go-isatty from 0.0.20 to 0.0.21
• build(deps): bump github.com/bep/mclib
• build(deps): bump google.golang.org/api from 0.267.0 to 0.276.0
• build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.41.5 to 1.41.6
• build(deps): bump github.com/getkin/kin-openapi from 0.134.0 to 0.135.0
• build(deps): bump github.com/bep/goportabletext from 0.1.0 to 0.2.0
• build(deps): bump golang.org/x/image from 0.38.0 to 0.39.0
• deps: Upgrade github.com/bep/imagemeta v0.17.0 => v0.17.1
• build(deps): bump golang.org/x/tools from 0.43.0 to 0.44.0
• build(deps): bump github.com/evanw/esbuild from 0.27.4 to 0.28.0
• build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.41.1 to 1.41.5
• build(deps): bump github.com/pelletier/go-toml/v2 from 2.2.4 to 2.3.0
• build(deps): bump github.com/tdewolff/minify/v2 from 2.24.11 to 2.24.12

What's Changed

• Fix panic when passthrough elements are used in headings #14677
• Fix panic on edit of legacy mapped template names that's also a valid path in the new setup #14740
• Fix RenderShortcodes leaking context markers when indented #12457
• Strip nested page context markers from standalone RenderShortcodes #14732
• Rename deprecated cascade._target to cascade.target in tests
• Fix auto-creation of root sections in multilingual sites #14681
• readme: Fix links

Contributors

bep and chicks-net

Now you can inject CSS vars, e.g. from the configuration, into your stylesheets when building with css.Build. Also, now all the render hooks has a .Position method, now also more accurate and effective.

Bug fixes

• Fix some recently introduced Position issues #14710
• markup/goldmark: Fix double-escaping of ampersands in link URLs #14715
• tpl: Fix stray quotes from partial decorator in script context #14711

Improvements

• all: Replace NewIntegrationTestBuilder with Test/TestE/TestRunning
• tpl/css: Support @import "hugo:vars" for CSS custom properties in css.Build #14699
• Improve and extend .Position handling in Goldmark render hooks #14663
• markup/goldmark: Clean up test

Dependency Updates

• build(deps): bump github.com/magefile/mage from 1.16.1 to 1.17.1
• build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4
• build(deps): bump golang.org/x/image from 0.37.0 to 0.38.0

Documentation

• readme: Revise edition descriptions and installation instructions