shivering-isles/infrastructure-gitops

Watch

Fork 0

chore(deps): update dependency gohugoio/hugo to v0.169.0 #470

Open

botaniker wants to merge 1 commit from renovate/gohugoio-hugo-0.x into main

botaniker commented

2026-10-28 06:14:35 +00:00

Member

This PR contains the following updates:

Package	Update	Change	OpenSSF
gohugoio/hugo	minor	`v0.168.0` → `v0.169.0`

⚠️ Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

gohugoio/hugo

`v0.169.0`

Compare Source

The main motivation behind this release is to get out a build with Go 1.27.3, which blocks trust in a small set of intermediate certificates due to specific security concerns around their operation. See the eMudhra incident for more information. This affects Hugo features that fetch remote resources over HTTPS, e.g. resources.GetRemote.

This release also contains some security hardening of the template functions and menu entries that can render content as HTML (see below), a deprecation of looking up reserved front matter fields via .Params (also below), a faster and more robust plainify, and a set of bug fixes.

Security notes

Templates are trusted in Hugo, but content (including front matter) is not necessarily. This release tightens a few places where values from content could end up rendered as unescaped HTML:

pre and post values in menu entries defined in front matter are now HTML escaped, unless text/html is allowed in security.allowContent, which already marks HTML in /content as trusted. A warning (warning-menu-pre-post-html-escaped) is logged when a value containing HTML markup is escaped. Menu entries defined in the project configuration are not affected. f63482b
emojify and plainify now return a string unless the input is template.HTML, in which case the result is also template.HTML. Previously both always returned template.HTML, so e.g. {{ .Title | emojify }} would mark a potentially unsafe title as safe HTML. If you relied on the old behavior with trusted input, pipe the result through safeHTML. Thanks to @Reload3d for reporting this. #15452

Deprecations

Reserved front matter fields such as title, date and summary are currently also stored in .Params. Lookups such as .Params.title (and ByParam "title", where .Pages "Params.title" ... etc.) are now redirected to the corresponding Page method and logged as deprecated, unless the field was set in the params section of front matter. The content of .Params is unchanged for now. 53e1fef

Deprecated	Use instead
`.Params.date`	`.Date`
`.Params.description`	`.Description`
`.Params.draft`	`.Draft`
`.Params.expirydate`	`.ExpiryDate`
`.Params.keywords`	`.Keywords`
`.Params.lastmod`	`.Lastmod`
`.Params.layout`	`.Layout`
`.Params.linktitle`	`.LinkTitle`
`.Params.publishdate`	`.PublishDate`
`.Params.slug`	`.Slug`
`.Params.summary`	`.RawSummary` (new)
`.Params.title`	`.Title`
`.Params.translationkey`	`.TranslationKey`
`.Params.type`	`.Type`
`.Params.weight`	`.Weight`

Bug fixes

hugolib: Fix template change detection when saving via temp file and rename 46e51f3 @bep #15484
markup/goldmark: Fix auto heading ID when link text starts with a bracket c22158c @chanellebingham #15472
urls: Fix JoinPath panic with empty slice ce5d232 @Ferdinand-MZ #15473
js: Fix js.Build with browser-disabled extensionless requires 2efee51 @bep #15481
Fix Site.Key used in e.g. partialCached b86e0ca @bep #15466
ci: Fix Windows running out of disk space and simplify test runs 77230eb @bep
hugolib: Fix build hang after too many page render errors 85fb23f @bep #15449
tpl/cast: Fix nil pointer panic in hugo gen docshelper 8df3180 @jmooring #15444

Improvements

Redirect .Params.title etc. to .Title etc. and deprecate it 53e1fef @bep
ci: Revert to plain go install honnef.co/go/tools/cmd/staticcheck@latest 3e67572 @bep
navigation: Escape pre/post in front matter menu entries f63482b @bep
Upgrade to Go 1.27.3 7343fc9 @bep
resources: Make processed image key stable across builds ff4eab7 @bep #15467
tpl: Make StripHTML (plainify) more robust and faster 7ec3a36 @bep #15462
tpl/transform: Make emojify and plainify preserve template.HTML input type 895f583 @bep #15452
Make emojify return a string 87bf585 @bep #15452
Skip staticcheck in check.sh unless --full is set 9d50291 @bep #15453
Delete CLAUDE.md 683a877 @bep

Dependency Updates

build(deps): bump github.com/getkin/kin-openapi from 0.151.0 to 0.152.0 6e494d0 @dependabot[bot]
build(deps): bump github.com/tdewolff/minify/v2 from 2.24.19 to 2.24.22 8c1fdca @dependabot[bot]
build(deps): bump github.com/tdewolff/parse/v2 from 2.8.16 to 2.8.18 ed22b85 @dependabot[bot]
build(deps): bump github.com/getkin/kin-openapi from 0.149.0 to 0.151.0 4102d1a @dependabot[bot]
build(deps): bump golang.org/x/tools from 0.51.0 to 0.52.0 ac5af66 @dependabot[bot]

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot. The local configuration can be found in the SI Renovate Bot repository.

This PR contains the following updates: | Package | Update | Change | OpenSSF | |---|---|---|---| | [gohugoio/hugo](https://github.com/gohugoio/hugo) | minor | `v0.168.0` → `v0.169.0` | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/gohugoio/hugo/badge)](https://securityscorecards.dev/viewer/?uri=github.com/gohugoio/hugo) | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/30) for more information. --- ### Release Notes <details> <summary>gohugoio/hugo</summary> ### [`v0.169.0`](https://github.com/gohugoio/hugo/releases/tag/v0.169.0) [Compare Source](https://github.com/gohugoio/hugo/compare/v0.168.0...v0.169.0) The main motivation behind this release is to get out a build with [Go 1.27.3](https://github.com/golang/go/issues?q=milestone%3AGo1.27.3+label%3ACherryPickApproved), which blocks trust in a small set of intermediate certificates due to specific security concerns around their operation. See the [eMudhra incident](https://go.dev/blog/emudhra-incident) for more information. This affects Hugo features that fetch remote resources over HTTPS, e.g. `resources.GetRemote`. This release also contains some security hardening of the template functions and menu entries that can render content as HTML (see below), a deprecation of looking up reserved front matter fields via `.Params` (also below), a faster and more robust `plainify`, and a set of bug fixes. ##### Security notes Templates are trusted in Hugo, but content (including front matter) is not necessarily. This release tightens a few places where values from content could end up rendered as unescaped HTML: - `pre` and `post` values in menu entries defined in **front matter** are now HTML escaped, unless `text/html` is allowed in [`security.allowContent`](https://gohugo.io/configuration/security/), which already marks HTML in `/content` as trusted. A warning (`warning-menu-pre-post-html-escaped`) is logged when a value containing HTML markup is escaped. Menu entries defined in the project configuration are not affected. [`f63482b`](https://github.com/gohugoio/hugo/commit/f63482bf) - `emojify` and `plainify` now return a `string` unless the input is `template.HTML`, in which case the result is also `template.HTML`. Previously both always returned `template.HTML`, so e.g. `{{ .Title | emojify }}` would mark a potentially unsafe title as safe HTML. If you relied on the old behavior with trusted input, pipe the result through `safeHTML`. Thanks to [@Reload3d](https://github.com/Reload3d) for reporting this. [#15452](https://github.com/gohugoio/hugo/issues/15452) ##### Deprecations Reserved front matter fields such as `title`, `date` and `summary` are currently also stored in `.Params`. Lookups such as `.Params.title` (and `ByParam "title"`, `where .Pages "Params.title" ...` etc.) are now redirected to the corresponding `Page` method and logged as deprecated, unless the field was set in the `params` section of front matter. The content of `.Params` is unchanged for now. [`53e1fef`](https://github.com/gohugoio/hugo/commit/53e1fef9) | Deprecated | Use instead | | ------------------------ | ------------------- | | `.Params.date` | `.Date` | | `.Params.description` | `.Description` | | `.Params.draft` | `.Draft` | | `.Params.expirydate` | `.ExpiryDate` | | `.Params.keywords` | `.Keywords` | | `.Params.lastmod` | `.Lastmod` | | `.Params.layout` | `.Layout` | | `.Params.linktitle` | `.LinkTitle` | | `.Params.publishdate` | `.PublishDate` | | `.Params.slug` | `.Slug` | | `.Params.summary` | `.RawSummary` (new) | | `.Params.title` | `.Title` | | `.Params.translationkey` | `.TranslationKey` | | `.Params.type` | `.Type` | | `.Params.weight` | `.Weight` | ##### Bug fixes - hugolib: Fix template change detection when saving via temp file and rename [`46e51f3`](https://github.com/gohugoio/hugo/commit/46e51f30) [@bep](https://github.com/bep) [#15484](https://github.com/gohugoio/hugo/issues/15484) - markup/goldmark: Fix auto heading ID when link text starts with a bracket [`c22158c`](https://github.com/gohugoio/hugo/commit/c22158c1) [@chanellebingham](https://github.com/chanellebingham) [#15472](https://github.com/gohugoio/hugo/issues/15472) - urls: Fix JoinPath panic with empty slice [`ce5d232`](https://github.com/gohugoio/hugo/commit/ce5d232b) [@Ferdinand-MZ](https://github.com/Ferdinand-MZ) [#15473](https://github.com/gohugoio/hugo/issues/15473) - js: Fix js.Build with browser-disabled extensionless requires [`2efee51`](https://github.com/gohugoio/hugo/commit/2efee511) [@bep](https://github.com/bep) [#15481](https://github.com/gohugoio/hugo/issues/15481) - Fix Site.Key used in e.g. partialCached [`b86e0ca`](https://github.com/gohugoio/hugo/commit/b86e0caa) [@bep](https://github.com/bep) [#15466](https://github.com/gohugoio/hugo/issues/15466) - ci: Fix Windows running out of disk space and simplify test runs [`77230eb`](https://github.com/gohugoio/hugo/commit/77230eba) [@bep](https://github.com/bep) - hugolib: Fix build hang after too many page render errors [`85fb23f`](https://github.com/gohugoio/hugo/commit/85fb23f1) [@bep](https://github.com/bep) [#15449](https://github.com/gohugoio/hugo/issues/15449) - tpl/cast: Fix nil pointer panic in hugo gen docshelper [`8df3180`](https://github.com/gohugoio/hugo/commit/8df31809) [@jmooring](https://github.com/jmooring) [#15444](https://github.com/gohugoio/hugo/issues/15444) ##### Improvements - Redirect .Params.title etc. to .Title etc. and deprecate it [`53e1fef`](https://github.com/gohugoio/hugo/commit/53e1fef9) [@bep](https://github.com/bep) - ci: Revert to plain go install honnef.co/go/tools/cmd/staticcheck\@latest [`3e67572`](https://github.com/gohugoio/hugo/commit/3e67572c) [@bep](https://github.com/bep) - navigation: Escape pre/post in front matter menu entries [`f63482b`](https://github.com/gohugoio/hugo/commit/f63482bf) [@bep](https://github.com/bep) - Upgrade to Go 1.27.3 [`7343fc9`](https://github.com/gohugoio/hugo/commit/7343fc9c) [@bep](https://github.com/bep) - resources: Make processed image key stable across builds [`ff4eab7`](https://github.com/gohugoio/hugo/commit/ff4eab75) [@bep](https://github.com/bep) [#15467](https://github.com/gohugoio/hugo/issues/15467) - tpl: Make StripHTML (plainify) more robust and faster [`7ec3a36`](https://github.com/gohugoio/hugo/commit/7ec3a366) [@bep](https://github.com/bep) [#15462](https://github.com/gohugoio/hugo/issues/15462) - tpl/transform: Make emojify and plainify preserve template.HTML input type [`895f583`](https://github.com/gohugoio/hugo/commit/895f5837) [@bep](https://github.com/bep) [#15452](https://github.com/gohugoio/hugo/issues/15452) - Make emojify return a string [`87bf585`](https://github.com/gohugoio/hugo/commit/87bf5858) [@bep](https://github.com/bep) [#15452](https://github.com/gohugoio/hugo/issues/15452) - Skip staticcheck in check.sh unless --full is set [`9d50291`](https://github.com/gohugoio/hugo/commit/9d502917) [@bep](https://github.com/bep) [#15453](https://github.com/gohugoio/hugo/issues/15453) - Delete CLAUDE.md [`683a877`](https://github.com/gohugoio/hugo/commit/683a877f) [@bep](https://github.com/bep) ##### Dependency Updates - build(deps): bump github.com/getkin/kin-openapi from 0.151.0 to 0.152.0 [`6e494d0`](https://github.com/gohugoio/hugo/commit/6e494d01) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump github.com/tdewolff/minify/v2 from 2.24.19 to 2.24.22 [`8c1fdca`](https://github.com/gohugoio/hugo/commit/8c1fdcac) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump github.com/tdewolff/parse/v2 from 2.8.16 to 2.8.18 [`ed22b85`](https://github.com/gohugoio/hugo/commit/ed22b85c) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump github.com/getkin/kin-openapi from 0.149.0 to 0.151.0 [`4102d1a`](https://github.com/gohugoio/hugo/commit/4102d1af) [@dependabot](https://github.com/dependabot)\[bot] - build(deps): bump golang.org/x/tools from 0.51.0 to 0.52.0 [`ac5af66`](https://github.com/gohugoio/hugo/commit/ac5af664) [@dependabot](https://github.com/dependabot)\[bot] </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). The local configuration can be found in the [SI Renovate Bot repository](https://git.shivering-isles.com/shivering-isles/infrastructure-gitops/src/branch/main/apps/k8s01/renovate).

botaniker added 1 commit

2026-10-28 06:14:35 +00:00

chore(deps): update dependency gohugoio/hugo to v0.169.0 add498cce1

sheogorath was assigned by botaniker

2026-10-28 06:14:35 +00:00

Some required checks are missing.

This branch is out-of-date with the base branch

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin 'renovate/gohugoio-hugo-0.x:renovate/gohugoio-hugo-0.x'

git switch 'renovate/gohugoio-hugo-0.x'

No reviewers

No labels

No milestone

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

shivering-isles/infrastructure-gitops!470

No description provided.

Rows
Columns