On case-insensitive filesystems, entries created before we started lowercasing
the content paths in v0.123 are the same file as today's lowercased cache key,
and were removed on every hugo --gc.
Fixes#15101
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Lstat only refrains from following the last element of a path, so a symlink
in an intermediate directory was still resolved, and reads could escape the
mount via e.g. resources.Get "symlinkdir/secret.txt".
Walk the directories up to the mount root and reject any that is a symlink.
Follow-up to cf9c8f93c and f8b5fa09a.
* Note for themes, this is only an issue for themes stored locally, e.g. below `themes/...`. Themes mounted as modules from GitHub gets symlinks stripped away.
* Thas was also not an issue for file reading walking one or more directories.
* This is an regression introduced in `v0.123.0`.
The Go 1.24 tool directive uses single-token entries inside a
tool ( ... ) block. The previous splitter treated any tab-indented
line as a require entry, causing an index out of range panic when
running hugo mod tidy on a module with a tool block.
Track the require block state explicitly so other blocks (tool,
replace, exclude, retract) are left untouched.
Fixes#14783
The contentInclusionFilter used strings.Contains to match filenames
against the target path. Because strings.Contains is a substring check,
a directory entry like "content/about" matches "content/about.md",
causing unrelated files to be pulled into the mini-build. Whether the
conflict was then detected depended on whether the filesystem walker
delivered a directory entry or a full file path.
Also adds an upfront check for the directory-conflict case, since
a corrected filter alone would allow about.md to be created alongside
an existing about/ directory.
Closes#12602Closes#12786Closes#14112Closes#14769
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
When running `hugo convert` with `--output`, copy the content tree first so non-content bundle resources are kept in the destination, then overwrite converted content files.
Also avoid recursive self-copy when the output path points inside the content tree by skipping output directories during copy.
Fixes#4621
Rewrite `hugo mod npm pack` to use npm workspaces. Module deps are now
written to packages/hugoautogen/package.json and the root package.json
gets a "workspaces" reference. A hugo_packagemeta.json sidecar stores a
hash of all input package files so regular commands can warn when npm
deps are out of sync.
Other changes:
- Workspace glob patterns (*, **, {a,b}) are resolved via gobwas/glob.
- Workspaces defined in package.hugo.json are supported.
- package.hugo.json is only recognised at module roots, not in workspaces.
- When package.hugo.json exists, package.json is not mounted or vendored.
- packages/hugoautogen is not mounted or vendored from dependencies.
- Add usePackageJSON import option (auto/always/never) to control whether
a module's npm deps are included. "auto" checks for Hugo config files
or package.hugo.json.
- The staleness check is skipped when running `hugo mod npm pack` itself.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Use blobless git clone (--filter=blob:none --no-checkout) to fetch
commit history for content from Git modules, then map it using the
existing gitmap library. Cloned repos are cached in the modulegitinfo file cache.
Closes#14431Fixes#5533
The --panicOnWarning flag was not wired into the root command's logger,
so warnings emitted during config loading (such as module version
incompatibility warnings) would not trigger a panic.
Bind the panicOnWarning flag to the rootCommand struct and set the
PanicOnWarningHook on the logger created in createLogger.
Fixes#14524
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This change is mainly motivated to support sites built by HTML fragments with e.g. a JS framework.
Now we don't inject the script if we don't find any of `doctype` (the only one required by the HTML 5 spec), `html` or `head`.
Co-authored-by: bep <bjorn.erik.pedersen@gmail.com>
- Update the skeleton structure to match the new template system.
- Add a --format flag to the `hugo new theme` command to control the
format of the site configuration and default archetype files.
- Remove theme.toml. This file's presence can be confusing for new
users, and the README in the themes repository already has an example.
- Remove the LICENSE and README files from the skeleton. These files
are not needed for a theme to work, and they can be added later by
the user if desired.
Closes#13489Closes#13544
This may still happen, though, in low memory situations or very big sites, but I'm not sure it's worth spending time on fixing that. Writing the same file more than once isn't harmful, the negative effect is the false path warning.
We may find a way to detect that situation if this becomes a real problem.
Fixes#13164
The old setup tried to log >= warning to stderr, the rest to stdout.
However, that logic was flawed, so warnings ended up in stdout, which makes `hugo list all` etc. hard to reason about from scripts.
This commit fixes this by making all logging (info, warn, error) log to stderr and let stdout be reserved for program output.
Fixes#13074
Build tags setup changed to:
* !nodeploy => withdeploy
* nodeploy => !withdeploy
Also move the deploy feature out into its own release archives.
See #12994 for the primary motivation for this change. But this also greatly reduces the number of dependencies in Hugo when you don't need this feature and cuts the binary size greatly.
Fixes#12994
Bjørn Erik Pedersen