gohugoio/hugo v0.170.0

on GitHub

The big change in this release is that the extended edition of Hugo is gone. LibSass has been deprecated for a long time, and it was the main reason we needed a CGO-enabled extended build. There is now only one Hugo binary, and apart from LibSass it has all the features the extended build had.

Notes

• Setting transpiler to libsass in css.Sass now returns an error. Dart Sass is now the default and the only transpiler, so you need to install it if you use Sass.
• We no longer publish hugo_extended_* archives. To avoid breaking existing CI setups, we publish aliases for the most downloaded extended archives (e.g. hugo_extended_<version>_linux-amd64.tar.gz, hugo_extended_<version>_Linux-64bit.tar.gz, the linux-amd64.deb, linux-arm64.tar.gz and windows-amd64.zip), but you should update your scripts to use the standard archives. The extended_withdeploy builds are also removed. See Installation.
• hugo.IsExtended now always returns false, and the module config setting hugoVersion.extended is deprecated and has no effect.
• Command-line flags (e.g. --buildDrafts) now override OS environment variables (e.g. HUGO_BUILDDRAFTS). This also fixes HUGO_ENVIRONMENT=qa hugo build -e staging loading the staging config but reporting qa in hugo.Environment.
• strings.Truncate has been rewritten on top of a proper HTML scanner. It now handles comments, void elements, quoted attributes with > and raw text elements such as script correctly, and it's faster and allocates less. On a curious note, the old version was implemented by Mathias Biilmann, the Netlify CEO.
• time.Time values now keep their named time zone, and eq, ne, in and uniq compare time.Time values by instant.
• resources.Match and friends now preserve the directory casing in the matched paths, so e.g. resources.Match "gallery/Travel/Iceland/*" now works on case-sensitive file systems.
• Syncing of static files is much faster for big unchanged files, as we now skip the content check for files with the same size and modification time.
• Several fixes and hardening of the WASM based image codecs (AVIF crash at encoderSpeed 6 and lower, recovering from broken WASM instances in the server).

Security

Hugo

• Passthrough content is now HTML escaped when no passthrough render hook is set, unless markup.goldmark.renderer.unsafe is enabled. Before this, e.g. \(<img src=x onerror=alert(1)>\) in a content file emitted raw HTML.
• The wrapperClass option, settable from the highlight shortcode and transform.Highlight, is now escaped.
• Vendored module paths are now restricted to the _vendor directory (symlinks pointing outside are rejected).

Thanks to @R0X4R for finding and reporting the last two issues.

Go

This release is built with Go 1.27.4, which includes 12 security fixes. The one most relevant for Hugo is a crash in the net/http HTTP/1 server (used by hugo server) caused by a race in MaxBytesReader. The other 11 are in the cmd/go toolchain (cgo flag and linker injection at build time) and mainly matter if you build Hugo from source with untrusted dependencies.

Dependencies

• golang.org/x/net v0.62.0 fixes two issues in the html package: quadratic complexity when coalescing text nodes, and a namespace issue when rendering raw text. Hugo uses this package when collecting HTML elements for hugo_stats.json and in the AsciiDoc integration.
• github.com/go-jose/go-jose/v4 v4.1.6 (indirect dependency) contains a number of security fixes, among them GHSA-mgcc-cww5-fp2q (RSA modulus size limit when parsing JWKs) and a stack depth limit in the JSON decoder.

Changes

• Remove libsass and the extended build tag c2f9cb8 @bep #15405
• Remove the extended build from the release 0b66ebd @bep #15502
• Fix typo in AGENTS.md 588241b @pei711
• tpl/collections: Fix sort when some items lack the sort key a8a8e97 @bep #15523
• warpc, commands: Fix Close of image dispatchers, recover in fast render 3c2f52d @bep #15522
• warpc: Fix AVIF encode crashing at encoderSpeed 6 and lower 4742565 @bep #15522
• Fix misc layout lookup issues f3875ec @bep #15538 #15540
• tpl/collections: Fix merge of maps with concrete element types b76fde2 @bep #15499
• tpl/tplimpl: Fix shortcode layout lookup in non-default output formats 87e6e14 @jmooring #15536
• langs/i18n: Fix project translations losing to module translations fa5a3d4 @jmooring #15518
• Adjust Exif test to fix now failing deprecation tests 471d0fb @bep
• markup/goldmark: Escape passthrough content when no render hook is set e2f66a2 @raghu45345
• tpl: Compare time.Time values by instant in eq, ne, in and uniq 3519196 @jmooring #15577
• Skip content check for static files with the same size and modification time afb2d9a @bep #15572
• commands: Rebuild assets also mounted as static b755c9d @xndvaz #15567
• hugolib: Keep npm installs in their test directory 2056ed6 @xndvaz #15568
• Upgrade to Go 1.27.4 bca2cec @bep
• common/htime: Preserve location of time.Time values 5922421 @jmooring #8895 #15565
• markup/highlight: Escape wrapperClass bdde5aa @bep
• modules: Restrict vendor module paths to the _vendor directory d41a8a1 @bep
• hugofs: Preserve directory casing in resource matches 5b44cfc @xndvaz #7686 #10112
• config: Make command-line flags override OS environment variables d5ba1aa @bep #15549 #15550
• tpl/resources: Accept []any of resources in Concat e6a470c @jmooring #15546
• warpc: Keep function names in WASM binaries, set WebP stack size 1a014e5 @bep #15522
• warpc, commands: Recover from broken WASM instances in the server 5086d5f @bep #15522
• resources: Resolve remote media type from Hugo's media types 3a1985b @AnaTejeda1 #11601
• langs/i18n: Add failing test for project translation precedence 2b0e1e1 @jmooring #15518
• ci: Upgrade setup-ruby and Ruby 185a609 @jmooring
• tpl/strings: Rewrite truncate using the hhtml scanner 6b0c89c @bep #15505 #15509

Dependency Updates

• build(deps): bump golang.org/x/image from 0.47.0 to 0.48.0 29bcc86 @dependabot[bot]
• build(deps): bump golang.org/x/text from 0.43.0 to 0.44.0 4f8354e @dependabot[bot]
• build(deps): bump github.com/spf13/pflag from 1.0.10 to 1.1.0 6aebad4 @dependabot[bot]
• build(deps): bump github.com/getkin/kin-openapi from 0.152.0 to 0.153.0 8846854 @dependabot[bot]
• build(deps): bump github.com/bits-and-blooms/bitset 0586add @dependabot[bot]
• build(deps): bump github.com/tdewolff/minify/v2 from 2.24.24 to 2.24.25 45dfa4e @dependabot[bot]
• build(deps): bump github.com/yuin/goldmark from 1.8.6 to 1.8.7 d2010fc @dependabot[bot]
• deps: Upgrade github.com/gohugoio/hugo-goldmark-extensions/passthrough v0.5.0 => v0.6.0 2d6cf3a @bep
• deps: Upgrade github.com/bep/imagemeta v1.1.0 => v1.1.1 b6fa2fe @bep
• build(deps): bump golang.org/x/net from 0.61.0 to 0.62.0 fe34313 @dependabot[bot]
• build(deps): bump github.com/tdewolff/minify/v2 from 2.24.22 to 2.24.24 7ff95e0 @dependabot[bot]
• build(deps): bump github.com/gobwas/glob from 1.0.0 to 1.1.0 98ab2ff @dependabot[bot]
• build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.4 to 4.1.6 a1668da @dependabot[bot]

Documentation

• Update README.md 8502b60 @jmooring #15512