The autogenerated packages/hugoautogen/package.json got its name from the
project directory basename and had no "private" field, making it publishable
under checkout-dependent names. Use the stable default name "hugoautogen",
set "private": true, and preserve hand-set name/version/private on
regeneration.
Fixes#15245
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
On case-insensitive filesystems, entries created before we started lowercasing
the content paths in v0.123 are the same file as today's lowercased cache key,
and were removed on every hugo --gc.
Fixes#15101
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Lstat only refrains from following the last element of a path, so a symlink
in an intermediate directory was still resolved, and reads could escape the
mount via e.g. resources.Get "symlinkdir/secret.txt".
Walk the directories up to the mount root and reject any that is a symlink.
Follow-up to cf9c8f93c and f8b5fa09a.
* Note for themes, this is only an issue for themes stored locally, e.g. below `themes/...`. Themes mounted as modules from GitHub gets symlinks stripped away.
* Thas was also not an issue for file reading walking one or more directories.
* This is an regression introduced in `v0.123.0`.
The Go 1.24 tool directive uses single-token entries inside a
tool ( ... ) block. The previous splitter treated any tab-indented
line as a require entry, causing an index out of range panic when
running hugo mod tidy on a module with a tool block.
Track the require block state explicitly so other blocks (tool,
replace, exclude, retract) are left untouched.
Fixes#14783
The contentInclusionFilter used strings.Contains to match filenames
against the target path. Because strings.Contains is a substring check,
a directory entry like "content/about" matches "content/about.md",
causing unrelated files to be pulled into the mini-build. Whether the
conflict was then detected depended on whether the filesystem walker
delivered a directory entry or a full file path.
Also adds an upfront check for the directory-conflict case, since
a corrected filter alone would allow about.md to be created alongside
an existing about/ directory.
Closes#12602Closes#12786Closes#14112Closes#14769
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
When running `hugo convert` with `--output`, copy the content tree first so non-content bundle resources are kept in the destination, then overwrite converted content files.
Also avoid recursive self-copy when the output path points inside the content tree by skipping output directories during copy.
Fixes#4621
Rewrite `hugo mod npm pack` to use npm workspaces. Module deps are now
written to packages/hugoautogen/package.json and the root package.json
gets a "workspaces" reference. A hugo_packagemeta.json sidecar stores a
hash of all input package files so regular commands can warn when npm
deps are out of sync.
Other changes:
- Workspace glob patterns (*, **, {a,b}) are resolved via gobwas/glob.
- Workspaces defined in package.hugo.json are supported.
- package.hugo.json is only recognised at module roots, not in workspaces.
- When package.hugo.json exists, package.json is not mounted or vendored.
- packages/hugoautogen is not mounted or vendored from dependencies.
- Add usePackageJSON import option (auto/always/never) to control whether
a module's npm deps are included. "auto" checks for Hugo config files
or package.hugo.json.
- The staleness check is skipped when running `hugo mod npm pack` itself.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Use blobless git clone (--filter=blob:none --no-checkout) to fetch
commit history for content from Git modules, then map it using the
existing gitmap library. Cloned repos are cached in the modulegitinfo file cache.
Closes#14431Fixes#5533
The --panicOnWarning flag was not wired into the root command's logger,
so warnings emitted during config loading (such as module version
incompatibility warnings) would not trigger a panic.
Bind the panicOnWarning flag to the rootCommand struct and set the
PanicOnWarningHook on the logger created in createLogger.
Fixes#14524
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This change is mainly motivated to support sites built by HTML fragments with e.g. a JS framework.
Now we don't inject the script if we don't find any of `doctype` (the only one required by the HTML 5 spec), `html` or `head`.
Co-authored-by: bep <bjorn.erik.pedersen@gmail.com>
- Update the skeleton structure to match the new template system.
- Add a --format flag to the `hugo new theme` command to control the
format of the site configuration and default archetype files.
- Remove theme.toml. This file's presence can be confusing for new
users, and the README in the themes repository already has an example.
- Remove the LICENSE and README files from the skeleton. These files
are not needed for a theme to work, and they can be added later by
the user if desired.
Closes#13489Closes#13544
Bjørn Erik Pedersen