gohugoio/hugo v0.169.0

on GitHub

The main motivation behind this release is to get out a build with Go 1.27.3, which blocks trust in a small set of intermediate certificates due to specific security concerns around their operation. See the eMudhra incident for more information. This affects Hugo features that fetch remote resources over HTTPS, e.g. resources.GetRemote.

This release also contains some security hardening of the template functions and menu entries that can render content as HTML (see below), a deprecation of looking up reserved front matter fields via .Params (also below), a faster and more robust plainify, and a set of bug fixes.

Security notes

Templates are trusted in Hugo, but content (including front matter) is not necessarily. This release tightens a few places where values from content could end up rendered as unescaped HTML:

• pre and post values in menu entries defined in front matter are now HTML escaped, unless text/html is allowed in security.allowContent, which already marks HTML in /content as trusted. A warning (warning-menu-pre-post-html-escaped) is logged when a value containing HTML markup is escaped. Menu entries defined in the project configuration are not affected. f63482b
• emojify and plainify now return a string unless the input is template.HTML, in which case the result is also template.HTML. Previously both always returned template.HTML, so e.g. {{ .Title | emojify }} would mark a potentially unsafe title as safe HTML. If you relied on the old behavior with trusted input, pipe the result through safeHTML. Thanks to @Reload3d for reporting this. #15452

Deprecations

Reserved front matter fields such as title, date and summary are currently also stored in .Params. Lookups such as .Params.title (and ByParam "title", where .Pages "Params.title" ... etc.) are now redirected to the corresponding Page method and logged as deprecated, unless the field was set in the params section of front matter. The content of .Params is unchanged for now. 53e1fef

Bug fixes

• hugolib: Fix template change detection when saving via temp file and rename 46e51f3 @bep #15484
• markup/goldmark: Fix auto heading ID when link text starts with a bracket c22158c @chanellebingham #15472
• urls: Fix JoinPath panic with empty slice ce5d232 @Ferdinand-MZ #15473
• js: Fix js.Build with browser-disabled extensionless requires 2efee51 @bep #15481
• Fix Site.Key used in e.g. partialCached b86e0ca @bep #15466
• ci: Fix Windows running out of disk space and simplify test runs 77230eb @bep
• hugolib: Fix build hang after too many page render errors 85fb23f @bep #15449
• tpl/cast: Fix nil pointer panic in hugo gen docshelper 8df3180 @jmooring #15444

Improvements

• Redirect .Params.title etc. to .Title etc. and deprecate it 53e1fef @bep
• ci: Revert to plain go install honnef.co/go/tools/cmd/staticcheck@latest 3e67572 @bep
• navigation: Escape pre/post in front matter menu entries f63482b @bep
• Upgrade to Go 1.27.3 7343fc9 @bep
• resources: Make processed image key stable across builds ff4eab7 @bep #15467
• tpl: Make StripHTML (plainify) more robust and faster 7ec3a36 @bep #15462
• tpl/transform: Make emojify and plainify preserve template.HTML input type 895f583 @bep #15452
• Make emojify return a string 87bf585 @bep #15452
• Skip staticcheck in check.sh unless --full is set 9d50291 @bep #15453
• Delete CLAUDE.md 683a877 @bep

Dependency Updates

• build(deps): bump github.com/getkin/kin-openapi from 0.151.0 to 0.152.0 6e494d0 @dependabot[bot]
• build(deps): bump github.com/tdewolff/minify/v2 from 2.24.19 to 2.24.22 8c1fdca @dependabot[bot]
• build(deps): bump github.com/tdewolff/parse/v2 from 2.8.16 to 2.8.18 ed22b85 @dependabot[bot]
• build(deps): bump github.com/getkin/kin-openapi from 0.149.0 to 0.151.0 4102d1a @dependabot[bot]
• build(deps): bump golang.org/x/tools from 0.51.0 to 0.52.0 ac5af66 @dependabot[bot]