4c40c6d5ca
helpers: Remove unused code
2026-04-23 20:05:09 +02:00
d2594db670
common/constants: Remove unused consts
2026-04-23 20:05:09 +02:00
ab2de51e07
common/paths: Remove unused code
...
Identified with:
```
punused "common/paths/**.go"
````
2026-04-23 20:05:09 +02:00
72b85d5f9c
langs/i18n: Fix translation lookup when using language variants
...
Closes #7982
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-04-23 18:47:12 +02:00
75f61832c2
tests: Update Ruby setup action to v1.305.0
2026-04-23 18:46:49 +02:00
4c03129fcf
build(deps): bump github.com/magefile/mage from 1.17.1 to 1.17.2
...
Bumps [github.com/magefile/mage](https://github.com/magefile/mage ) from 1.17.1 to 1.17.2.
- [Release notes](https://github.com/magefile/mage/releases )
- [Commits](https://github.com/magefile/mage/compare/v1.17.1...v1.17.2 )
---
updated-dependencies:
- dependency-name: github.com/magefile/mage
dependency-version: 1.17.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-04-23 15:02:42 +02:00
080970bc6b
deps: Upgrade github.com/bep/imagemeta v0.17.1 => v0.17.2
2026-04-23 15:02:28 +02:00
1b7495bc49
langs: Use Language.Locale as primary localization key
...
Localization now uses Language.Locale as the golocales lookup key,
falling back to Language.Lang, then defaultContentLanguage, then "en".
Closes #9109
2026-04-22 22:41:51 +02:00
79f030be5b
config/security: Add "! " negation to Whitelist, harden default http.urls
...
Whitelist now treats any pattern prefixed with "! " (the same negation
prefix used by hglob/predicate) as a deny rule. Deny matches take
precedence over allow, and a whitelist made up exclusively of deny
rules implicitly allows everything it does not deny.
The default security.http.urls now reads:
urls = ['(?i)^https?://[a-z]', '! (?i)localhost', '! @']
i.e. allow URLs whose host starts with a letter (the common
"https://example.com " shape), deny anything that looks like localhost,
and deny URLs with userinfo to foil "http://user@127.0.0.1/ " bypasses.
Public IP literals are collateral blocks; users who need them (or their
own private hosts) override security.http.urls as before, mixing allow
and deny rules with the same "! " prefix, e.g.
[security.http]
urls = ['.*', '! ^https?://evil\.example\.com']
Fixes #14792
2026-04-22 20:15:19 +02:00
896bc89ab8
build(deps): bump github.com/aws/aws-sdk-go-v2/service/cloudfront ( #14789 )
...
Bumps [github.com/aws/aws-sdk-go-v2/service/cloudfront](https://github.com/aws/aws-sdk-go-v2 ) from 1.59.0 to 1.61.1.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases )
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/service/s3/v1.59.0...service/s3/v1.61.1 )
---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/service/cloudfront
dependency-version: 1.61.1
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-22 15:51:30 +02:00
100dde53ad
build(deps): bump github.com/mattn/go-isatty from 0.0.20 to 0.0.21 ( #14788 )
...
Bumps [github.com/mattn/go-isatty](https://github.com/mattn/go-isatty ) from 0.0.20 to 0.0.21.
- [Commits](https://github.com/mattn/go-isatty/compare/v0.0.20...v0.0.21 )
---
updated-dependencies:
- dependency-name: github.com/mattn/go-isatty
dependency-version: 0.0.21
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-22 15:51:14 +02:00
bdebb79705
build(deps): bump github.com/bep/mclib ( #14787 )
...
Bumps [github.com/bep/mclib](https://github.com/bep/mclib ) from 1.20400.20402 to 1.20401.20400.
- [Release notes](https://github.com/bep/mclib/releases )
- [Commits](https://github.com/bep/mclib/compare/v1.20400.20402...v1.20401.20400 )
---
updated-dependencies:
- dependency-name: github.com/bep/mclib
dependency-version: 1.20401.20400
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-22 15:51:00 +02:00
a54c398b93
Harden Node tool execution with --permission flag
...
Add security.node.permissions config to run Node tools (PostCSS, Babel,
TailwindCSS) under Node's permission model, restricting file system access
to the working directory by default.
The binary resolution is simplified to node_modules/.bin → PATH (npx removed).
For both locations, the actual JS entry point is resolved via symlinks (macOS/Linux)
or by parsing npm wrapper scripts (Windows .cmd), then executed as
"node --permission --allow-fs-read=<path> --allow-fs-write=<path> <script>".
Users can opt out by removing "node" from security.exec.allow.
Closes #7287
2026-04-22 15:47:34 +02:00
f5fce935e7
tpl/collections: Honor the Eqer interface in where comparisons
...
The where function previously fell through to a no-op when comparing
two values whose kinds were not handled by the primitive type switches
(e.g. two Page interface values). This made `where pages "Parent" $page`
return an empty list, while the equivalent `range pages` + `if eq` worked.
Use compare.Eqer for equality operators when either side implements it,
matching the behavior of the eq/ne template funcs.
Fixes #14777
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com >
2026-04-20 19:45:06 +02:00
52123ae23f
build(deps): bump google.golang.org/api from 0.267.0 to 0.276.0
...
Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client ) from 0.267.0 to 0.276.0.
- [Release notes](https://github.com/googleapis/google-api-go-client/releases )
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md )
- [Commits](https://github.com/googleapis/google-api-go-client/compare/v0.267.0...v0.276.0 )
---
updated-dependencies:
- dependency-name: google.golang.org/api
dependency-version: 0.276.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-04-20 19:12:24 +02:00
38b8afdc90
build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.41.5 to 1.41.6
...
Bumps [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2 ) from 1.41.5 to 1.41.6.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases )
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/v1.41.5...v1.41.6 )
---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2
dependency-version: 1.41.6
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-04-20 19:12:13 +02:00
4169c1f70f
modules: Ignore non-require blocks in go.mod rewrite
...
The Go 1.24 tool directive uses single-token entries inside a
tool ( ... ) block. The previous splitter treated any tab-indented
line as a require entry, causing an index out of range panic when
running hugo mod tidy on a module with a tool block.
Track the require block state explicitly so other blocks (tool,
replace, exclude, retract) are left untouched.
Fixes #14783
2026-04-20 19:11:41 +02:00
7574e35b40
Replace the concurrent map with an identical upstream version
2026-04-20 18:33:59 +02:00
927666005c
build(deps): bump github.com/getkin/kin-openapi from 0.134.0 to 0.135.0 ( #14781 )
...
Bumps [github.com/getkin/kin-openapi](https://github.com/getkin/kin-openapi ) from 0.134.0 to 0.135.0.
- [Release notes](https://github.com/getkin/kin-openapi/releases )
- [Commits](https://github.com/getkin/kin-openapi/compare/v0.134.0...v0.135.0 )
---
updated-dependencies:
- dependency-name: github.com/getkin/kin-openapi
dependency-version: 0.135.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-20 17:45:53 +02:00
790f4084a1
build(deps): bump github.com/bep/goportabletext from 0.1.0 to 0.2.0 ( #14779 )
...
Bumps [github.com/bep/goportabletext](https://github.com/bep/goportabletext ) from 0.1.0 to 0.2.0.
- [Release notes](https://github.com/bep/goportabletext/releases )
- [Commits](https://github.com/bep/goportabletext/compare/v0.1.0...v0.2.0 )
---
updated-dependencies:
- dependency-name: github.com/bep/goportabletext
dependency-version: 0.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-20 17:45:36 +02:00
de6955bab3
build(deps): bump golang.org/x/image from 0.38.0 to 0.39.0 ( #14780 )
...
Bumps [golang.org/x/image](https://github.com/golang/image ) from 0.38.0 to 0.39.0.
- [Commits](https://github.com/golang/image/compare/v0.38.0...v0.39.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/image
dependency-version: 0.39.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-20 15:19:28 +02:00
a77bd527fd
deps: Upgrade github.com/bep/imagemeta v0.17.0 => v0.17.1 ( #14775 )
...
Close #14758
2026-04-20 10:35:22 +02:00
017a7cd63a
Add slice-based permalinks config with PageMatcher target
...
Closes #14744
Clses #4641
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
2026-04-19 19:45:45 +02:00
e3413d927f
commands: Add missing import
2026-04-19 15:35:46 +02:00
b01cc14703
Revert "common/hugo: Deprecate extended and extended_withdeploy editions"
...
This reverts commit a17bdbc5faClose #14771
2026-04-19 11:15:49 +02:00
8ee19ff9a3
Adjust the SECURITY.md slightly
2026-04-18 23:05:27 +02:00
6436deb3e1
create: Fix non-deterministic conflict detection in hugo new content
...
The contentInclusionFilter used strings.Contains to match filenames
against the target path. Because strings.Contains is a substring check,
a directory entry like "content/about" matches "content/about.md",
causing unrelated files to be pulled into the mini-build. Whether the
conflict was then detected depended on whether the filesystem walker
delivered a directory entry or a full file path.
Also adds an upfront check for the directory-conflict case, since
a corrected filter alone would allow about.md to be created alongside
an existing about/ directory.
Closes #12602
Closes #12786
Closes #14112
Closes #14769
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-04-18 15:06:28 +02:00
547ab29ced
build(deps): bump golang.org/x/tools from 0.43.0 to 0.44.0
...
Bumps [golang.org/x/tools](https://github.com/golang/tools ) from 0.43.0 to 0.44.0.
- [Release notes](https://github.com/golang/tools/releases )
- [Commits](https://github.com/golang/tools/compare/v0.43.0...v0.44.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/tools
dependency-version: 0.44.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-04-18 15:03:47 +02:00
0d58e4286f
resources/page: Add passing test for Issue #14325
2026-04-18 15:02:47 +02:00
bbb42b5a6a
agents: Add a note about having the issue ID in test names
2026-04-17 21:59:11 +02:00
1eea9fba0b
commands: Fix environment isolation for configuration settings
...
Closes #14763
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-04-17 09:40:23 +02:00
9a5c7e0d24
build(deps): bump github.com/evanw/esbuild from 0.27.4 to 0.28.0
...
Bumps [github.com/evanw/esbuild](https://github.com/evanw/esbuild ) from 0.27.4 to 0.28.0.
- [Release notes](https://github.com/evanw/esbuild/releases )
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md )
- [Commits](https://github.com/evanw/esbuild/compare/v0.27.4...v0.28.0 )
---
updated-dependencies:
- dependency-name: github.com/evanw/esbuild
dependency-version: 0.28.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-04-16 19:56:49 +02:00
6613b08eb6
build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.41.1 to 1.41.5
...
Bumps [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2 ) from 1.41.1 to 1.41.5.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases )
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/v1.41.1...v1.41.5 )
---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2
dependency-version: 1.41.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-04-16 19:55:55 +02:00
582c26ef42
build(deps): bump github.com/pelletier/go-toml/v2 from 2.2.4 to 2.3.0
...
Bumps [github.com/pelletier/go-toml/v2](https://github.com/pelletier/go-toml ) from 2.2.4 to 2.3.0.
- [Release notes](https://github.com/pelletier/go-toml/releases )
- [Commits](https://github.com/pelletier/go-toml/compare/v2.2.4...v2.3.0 )
---
updated-dependencies:
- dependency-name: github.com/pelletier/go-toml/v2
dependency-version: 2.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-04-16 19:55:18 +02:00
a4f2a8a579
build(deps): bump github.com/tdewolff/minify/v2 from 2.24.11 to 2.24.12
...
Bumps [github.com/tdewolff/minify/v2](https://github.com/tdewolff/minify ) from 2.24.11 to 2.24.12.
- [Release notes](https://github.com/tdewolff/minify/releases )
- [Commits](https://github.com/tdewolff/minify/compare/v2.24.11...v2.24.12 )
---
updated-dependencies:
- dependency-name: github.com/tdewolff/minify/v2
dependency-version: 2.24.12
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-04-16 13:57:04 +02:00
8d6145f3c3
Fix filename dimension identifiers (_role_X_, _version_X_) to replace mount config
...
Filename identifiers for roles and versions were parsed but never applied
to the SitesMatrix. Now they replace the mount's configuration for that
dimension, matching how language identifiers already worked.
Fixes #14756
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
2026-04-15 20:34:34 +02:00
ce2a156a4e
Add a more flexible filename identifier scheme that also allows setting roles and versions ( #14754 )
...
Fixes #14750
2026-04-15 16:44:19 +02:00
9747724222
Fix it so we never auto-fallback to page resources in other roles/versions
...
This is some logic that's left behind from when we had only one dimension (language) where the common case would be to have one resource set (e.g. an image) and many content translation.
After this commit:
* For sites matrix defined in the content filename (e.g. data.en.js) or in its mount definition, we may use that as a fallback for e.g. German languages if we don't find a better match.
* For content adapters, this is not relevant: Here you must be explicit about this.
* We never auto-fallback on resources from a role/version to another.
* When a page bundle spans multiple roles (e.g. via roles = "*"), we clone its resources to all roles so each gets role-specific paths.
Fixes #14749
Fixes #14752
2026-04-14 16:33:38 +02:00
a17bdbc5fa
common/hugo: Deprecate extended and extended_withdeploy editions
...
Closes #14696
2026-04-13 23:18:23 +02:00
8f94d65cac
parser/pageparser: Add a parser fuzz test
...
Ran it for 40 minutes on my MacBook Pro, and it found no issues.
2026-04-09 12:25:19 +02:00
d6bc8165e6
releaser: Bump versions for release of 0.160.1
...
[ci skip]
2026-04-08 14:02:42 +00:00
8b00030b34
Fix panic when passthrough elements are used in headings
...
Fixes #14677
Co-Authored-By: xingzihai <1315258019@qq.com >
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
2026-04-08 15:03:05 +02:00
c48551677c
Fix panic on edit of legacy mapped template names that's also a valid path in the new setup
...
This mapping was added in Hugo `v0.146.0`.
Fixes #14740
2026-04-08 13:19:45 +02:00
161d0d4757
Fix RenderShortcodes leaking context markers when indented
...
Strip leading whitespace from Hugo context marker lines before
Goldmark parsing to prevent them from being treated as indented
code blocks.
Fixes #12457
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
2026-04-07 22:05:42 +02:00
45e4596630
Strip nested page context markers from standalone RenderShortcodes
...
Fixes #14732
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
2026-04-07 19:27:40 +02:00
58927aa14a
Rename deprecated cascade._target to cascade.target in tests
2026-04-07 13:58:06 +02:00
ce009e3aa9
Fix auto-creation of root sections in multilingual sites
...
Fixes #14681
Co-authored-by: Joe Mooring <joe@mooring.com >
2026-04-07 13:58:06 +02:00
0755872424
readme: Fix links
...
* docs: fix broken links in top README.md
* point at the docs site instead of github
* fix typo
Co-authored-by: Joe Mooring <joe@mooring.com >
---------
Co-authored-by: Joe Mooring <joe@mooring.com >
2026-04-06 08:48:45 -07:00
6b5554bac9
releaser: Prepare repository for 0.161.0-DEV
...
[ci skip]
2026-04-04 13:53:16 +00:00
652fc5acdd
releaser: Bump versions for release of 0.160.0
...
[ci skip]
2026-04-04 13:32:34 +00:00
Bjørn Erik Pedersen