blogs/hugo
1
0
Fork 0
mirror of https://github.com/gohugoio/hugo.git synced 2026-08-24 15:28:54 +00:00
Code Issues Packages Projects Releases Wiki Activity
9,688 Commits 242 Branches 381 Tags
7622dd86ced9ac2ef3c15b5d0740bf9634bb60ac
Commit Graph

9688 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Bjørn Erik Pedersen 7622dd86ce css: Support nested hugo:vars/<name> imports 
Allow CSS variables to be grouped under sub-paths and imported via
@import "hugo:vars/mobile" (or @use for Dart Sass), so callers can pass
nested dicts like:

    {{ dict "primary-color" "blue" "mobile" (dict "primary-color" "red") }}

Top-level "hugo:vars" now skips nested map entries instead of emitting
garbage for them.

Fixes #14705

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-27 19:42:50 +02:00
Bjørn Erik Pedersen 0814059bb6 github: Update GitHub actions versions 
By running:

```
ghat swot --stable 7 -d .github
```

Closes #14810
 2026-04-27 19:15:56 +02:00
Joe Mooring 8920d56e95 hugolib: Do not render aliases if the page is not rendered 
Closes #14807
 2026-04-25 18:41:27 +02:00
Joe Mooring 633cc772e0 langs/i18n: Improve default content language fallback 
The fallback order for translations is now:

1. Current language's locale (e.g., pt-BR → pt-br.toml)
2. Current language's key (e.g., pt → pt.toml)
3. Default language's locale (e.g., es-AR → es-ar.toml) ← new
4. Default language's key (e.g., es → es.toml)

Closes #14243

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-25 10:43:37 +02:00
Bjørn Erik Pedersen 90d8bf34ae Replace deprecated .Site.Sites/.Page.Sites with hugo.Sites intests 2026-04-24 19:02:46 +02:00
Bjørn Erik Pedersen 4c40c6d5ca helpers: Remove unused code 2026-04-23 20:05:09 +02:00
Bjørn Erik Pedersen d2594db670 common/constants: Remove unused consts 2026-04-23 20:05:09 +02:00
Bjørn Erik Pedersen ab2de51e07 common/paths: Remove unused code 
Identified with:

```
punused "common/paths/**.go"
 ````
 2026-04-23 20:05:09 +02:00
Joe Mooring 72b85d5f9c langs/i18n: Fix translation lookup when using language variants 
Closes #7982

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-23 18:47:12 +02:00
Joe Mooring 75f61832c2 tests: Update Ruby setup action to v1.305.0 2026-04-23 18:46:49 +02:00
dependabot[bot] 4c03129fcf build(deps): bump github.com/magefile/mage from 1.17.1 to 1.17.2 
Bumps [github.com/magefile/mage](https://github.com/magefile/mage) from 1.17.1 to 1.17.2.
- [Release notes](https://github.com/magefile/mage/releases)
- [Commits](https://github.com/magefile/mage/compare/v1.17.1...v1.17.2)

---
updated-dependencies:
- dependency-name: github.com/magefile/mage
  dependency-version: 1.17.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-23 15:02:42 +02:00
Bjørn Erik Pedersen 080970bc6b deps: Upgrade github.com/bep/imagemeta v0.17.1 => v0.17.2 2026-04-23 15:02:28 +02:00
Joe Mooring 1b7495bc49 langs: Use Language.Locale as primary localization key 
Localization now uses Language.Locale as the golocales lookup key,
falling back to Language.Lang, then defaultContentLanguage, then "en".

Closes #9109
 2026-04-22 22:41:51 +02:00
Bjørn Erik Pedersen 79f030be5b config/security: Add "! " negation to Whitelist, harden default http.urls 
Whitelist now treats any pattern prefixed with "! " (the same negation
prefix used by hglob/predicate) as a deny rule. Deny matches take
precedence over allow, and a whitelist made up exclusively of deny
rules implicitly allows everything it does not deny.

The default security.http.urls now reads:

    urls = ['(?i)^https?://[a-z]', '! (?i)localhost', '! @']

i.e. allow URLs whose host starts with a letter (the common
"https://example.com" shape), deny anything that looks like localhost,
and deny URLs with userinfo to foil "http://user@127.0.0.1/" bypasses.
Public IP literals are collateral blocks; users who need them (or their
own private hosts) override security.http.urls as before, mixing allow
and deny rules with the same "! " prefix, e.g.

    [security.http]
    urls = ['.*', '! ^https?://evil\.example\.com']

Fixes #14792
 2026-04-22 20:15:19 +02:00
dependabot[bot] 896bc89ab8 build(deps): bump github.com/aws/aws-sdk-go-v2/service/cloudfront (#14789) 
Bumps [github.com/aws/aws-sdk-go-v2/service/cloudfront](https://github.com/aws/aws-sdk-go-v2) from 1.59.0 to 1.61.1.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/service/s3/v1.59.0...service/s3/v1.61.1)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/service/cloudfront
  dependency-version: 1.61.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-22 15:51:30 +02:00
dependabot[bot] 100dde53ad build(deps): bump github.com/mattn/go-isatty from 0.0.20 to 0.0.21 (#14788) 
Bumps [github.com/mattn/go-isatty](https://github.com/mattn/go-isatty) from 0.0.20 to 0.0.21.
- [Commits](https://github.com/mattn/go-isatty/compare/v0.0.20...v0.0.21)

---
updated-dependencies:
- dependency-name: github.com/mattn/go-isatty
  dependency-version: 0.0.21
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-22 15:51:14 +02:00
dependabot[bot] bdebb79705 build(deps): bump github.com/bep/mclib (#14787) 
Bumps [github.com/bep/mclib](https://github.com/bep/mclib) from 1.20400.20402 to 1.20401.20400.
- [Release notes](https://github.com/bep/mclib/releases)
- [Commits](https://github.com/bep/mclib/compare/v1.20400.20402...v1.20401.20400)

---
updated-dependencies:
- dependency-name: github.com/bep/mclib
  dependency-version: 1.20401.20400
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-22 15:51:00 +02:00
Bjørn Erik Pedersen a54c398b93 Harden Node tool execution with --permission flag 
Add security.node.permissions config to run Node tools (PostCSS, Babel,
TailwindCSS) under Node's permission model, restricting file system access
to the working directory by default.

The binary resolution is simplified to node_modules/.bin → PATH (npx removed).
For both locations, the actual JS entry point is resolved via symlinks (macOS/Linux)
or by parsing npm wrapper scripts (Windows .cmd), then executed as
"node --permission --allow-fs-read=<path> --allow-fs-write=<path> <script>".

Users can opt out by removing "node" from security.exec.allow.

Closes #7287
 2026-04-22 15:47:34 +02:00
Bjørn Erik Pedersen f5fce935e7 tpl/collections: Honor the Eqer interface in where comparisons 
The where function previously fell through to a no-op when comparing
two values whose kinds were not handled by the primitive type switches
(e.g. two Page interface values). This made `where pages "Parent" $page`
return an empty list, while the equivalent `range pages` + `if eq` worked.

Use compare.Eqer for equality operators when either side implements it,
matching the behavior of the eq/ne template funcs.

Fixes #14777

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-20 19:45:06 +02:00
dependabot[bot] 52123ae23f build(deps): bump google.golang.org/api from 0.267.0 to 0.276.0 
Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.267.0 to 0.276.0.
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](https://github.com/googleapis/google-api-go-client/compare/v0.267.0...v0.276.0)

---
updated-dependencies:
- dependency-name: google.golang.org/api
  dependency-version: 0.276.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-20 19:12:24 +02:00
dependabot[bot] 38b8afdc90 build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.41.5 to 1.41.6 
Bumps [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) from 1.41.5 to 1.41.6.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/v1.41.5...v1.41.6)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2
  dependency-version: 1.41.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-20 19:12:13 +02:00
Bjørn Erik Pedersen 4169c1f70f modules: Ignore non-require blocks in go.mod rewrite 
The Go 1.24 tool directive uses single-token entries inside a
tool ( ... ) block. The previous splitter treated any tab-indented
line as a require entry, causing an index out of range panic when
running hugo mod tidy on a module with a tool block.

Track the require block state explicitly so other blocks (tool,
replace, exclude, retract) are left untouched.

Fixes #14783
 2026-04-20 19:11:41 +02:00
Bjørn Erik Pedersen 7574e35b40 Replace the concurrent map with an identical upstream version 2026-04-20 18:33:59 +02:00
dependabot[bot] 927666005c build(deps): bump github.com/getkin/kin-openapi from 0.134.0 to 0.135.0 (#14781) 
Bumps [github.com/getkin/kin-openapi](https://github.com/getkin/kin-openapi) from 0.134.0 to 0.135.0.
- [Release notes](https://github.com/getkin/kin-openapi/releases)
- [Commits](https://github.com/getkin/kin-openapi/compare/v0.134.0...v0.135.0)

---
updated-dependencies:
- dependency-name: github.com/getkin/kin-openapi
  dependency-version: 0.135.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-20 17:45:53 +02:00
dependabot[bot] 790f4084a1 build(deps): bump github.com/bep/goportabletext from 0.1.0 to 0.2.0 (#14779) 
Bumps [github.com/bep/goportabletext](https://github.com/bep/goportabletext) from 0.1.0 to 0.2.0.
- [Release notes](https://github.com/bep/goportabletext/releases)
- [Commits](https://github.com/bep/goportabletext/compare/v0.1.0...v0.2.0)

---
updated-dependencies:
- dependency-name: github.com/bep/goportabletext
  dependency-version: 0.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-20 17:45:36 +02:00
dependabot[bot] de6955bab3 build(deps): bump golang.org/x/image from 0.38.0 to 0.39.0 (#14780) 
Bumps [golang.org/x/image](https://github.com/golang/image) from 0.38.0 to 0.39.0.
- [Commits](https://github.com/golang/image/compare/v0.38.0...v0.39.0)

---
updated-dependencies:
- dependency-name: golang.org/x/image
  dependency-version: 0.39.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-20 15:19:28 +02:00
Bjørn Erik Pedersen a77bd527fd deps: Upgrade github.com/bep/imagemeta v0.17.0 => v0.17.1 (#14775) 
Close #14758
 2026-04-20 10:35:22 +02:00
Bjørn Erik Pedersen 017a7cd63a Add slice-based permalinks config with PageMatcher target 
Closes #14744
Clses #4641

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-19 19:45:45 +02:00
Bjørn Erik Pedersen e3413d927f commands: Add missing import 2026-04-19 15:35:46 +02:00
Bjørn Erik Pedersen b01cc14703 Revert "common/hugo: Deprecate extended and extended_withdeploy editions" 
This reverts commit a17bdbc5fa.

Close #14771
 2026-04-19 11:15:49 +02:00
Bjørn Erik Pedersen 8ee19ff9a3 Adjust the SECURITY.md slightly 2026-04-18 23:05:27 +02:00
Joe Mooring 6436deb3e1 create: Fix non-deterministic conflict detection in hugo new content 
The contentInclusionFilter used strings.Contains to match filenames
against the target path. Because strings.Contains is a substring check,
a directory entry like "content/about" matches "content/about.md",
causing unrelated files to be pulled into the mini-build. Whether the
conflict was then detected depended on whether the filesystem walker
delivered a directory entry or a full file path.

Also adds an upfront check for the directory-conflict case, since
a corrected filter alone would allow about.md to be created alongside
an existing about/ directory.

Closes #12602
Closes #12786
Closes #14112
Closes #14769

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-18 15:06:28 +02:00
dependabot[bot] 547ab29ced build(deps): bump golang.org/x/tools from 0.43.0 to 0.44.0 
Bumps [golang.org/x/tools](https://github.com/golang/tools) from 0.43.0 to 0.44.0.
- [Release notes](https://github.com/golang/tools/releases)
- [Commits](https://github.com/golang/tools/compare/v0.43.0...v0.44.0)

---
updated-dependencies:
- dependency-name: golang.org/x/tools
  dependency-version: 0.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-18 15:03:47 +02:00
Joe Mooring 0d58e4286f resources/page: Add passing test for Issue #14325 2026-04-18 15:02:47 +02:00
Bjørn Erik Pedersen bbb42b5a6a agents: Add a note about having the issue ID in test names 2026-04-17 21:59:11 +02:00
Joe Mooring 1eea9fba0b commands: Fix environment isolation for configuration settings 
Closes #14763

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-17 09:40:23 +02:00
dependabot[bot] 9a5c7e0d24 build(deps): bump github.com/evanw/esbuild from 0.27.4 to 0.28.0 
Bumps [github.com/evanw/esbuild](https://github.com/evanw/esbuild) from 0.27.4 to 0.28.0.
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](https://github.com/evanw/esbuild/compare/v0.27.4...v0.28.0)

---
updated-dependencies:
- dependency-name: github.com/evanw/esbuild
  dependency-version: 0.28.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-16 19:56:49 +02:00
dependabot[bot] 6613b08eb6 build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.41.1 to 1.41.5 
Bumps [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) from 1.41.1 to 1.41.5.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/v1.41.1...v1.41.5)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2
  dependency-version: 1.41.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-16 19:55:55 +02:00
dependabot[bot] 582c26ef42 build(deps): bump github.com/pelletier/go-toml/v2 from 2.2.4 to 2.3.0 
Bumps [github.com/pelletier/go-toml/v2](https://github.com/pelletier/go-toml) from 2.2.4 to 2.3.0.
- [Release notes](https://github.com/pelletier/go-toml/releases)
- [Commits](https://github.com/pelletier/go-toml/compare/v2.2.4...v2.3.0)

---
updated-dependencies:
- dependency-name: github.com/pelletier/go-toml/v2
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-16 19:55:18 +02:00
dependabot[bot] a4f2a8a579 build(deps): bump github.com/tdewolff/minify/v2 from 2.24.11 to 2.24.12 
Bumps [github.com/tdewolff/minify/v2](https://github.com/tdewolff/minify) from 2.24.11 to 2.24.12.
- [Release notes](https://github.com/tdewolff/minify/releases)
- [Commits](https://github.com/tdewolff/minify/compare/v2.24.11...v2.24.12)

---
updated-dependencies:
- dependency-name: github.com/tdewolff/minify/v2
  dependency-version: 2.24.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-16 13:57:04 +02:00
Bjørn Erik Pedersen 8d6145f3c3 Fix filename dimension identifiers (_role_X_, _version_X_) to replace mount config 
Filename identifiers for roles and versions were parsed but never applied
to the SitesMatrix. Now they replace the mount's configuration for that
dimension, matching how language identifiers already worked.

Fixes #14756

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-15 20:34:34 +02:00
Bjørn Erik Pedersen ce2a156a4e Add a more flexible filename identifier scheme that also allows setting roles and versions (#14754) 
Fixes #14750
 2026-04-15 16:44:19 +02:00
Bjørn Erik Pedersen 9747724222 Fix it so we never auto-fallback to page resources in other roles/versions 
This is some logic that's left behind from when we had only one dimension (language) where the common case would be to have one resource set (e.g. an image) and many content translation.

After this commit:

* For sites matrix defined in the content filename (e.g. data.en.js) or in its mount definition, we may use that as a fallback for e.g. German languages if we don't find a better match.
* For content adapters, this is not relevant: Here you must be explicit about this.
* We never auto-fallback on resources from a role/version to another.
* When a page bundle spans multiple roles (e.g. via roles = "*"), we clone its resources to all roles so each gets role-specific paths.

Fixes #14749
Fixes #14752
 2026-04-14 16:33:38 +02:00
Joe Mooring a17bdbc5fa common/hugo: Deprecate extended and extended_withdeploy editions 
Closes #14696
 2026-04-13 23:18:23 +02:00
Bjørn Erik Pedersen 8f94d65cac parser/pageparser: Add a parser fuzz test 
Ran it for 40 minutes on my MacBook Pro, and it found no issues.
 2026-04-09 12:25:19 +02:00
hugoreleaser d6bc8165e6 releaser: Bump versions for release of 0.160.1 
[ci skip]
v0.160.1 		2026-04-08 14:02:42 +00:00
Bjørn Erik Pedersen 8b00030b34 Fix panic when passthrough elements are used in headings 
Fixes #14677

Co-Authored-By: xingzihai <1315258019@qq.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-08 15:03:05 +02:00
Bjørn Erik Pedersen c48551677c Fix panic on edit of legacy mapped template names that's also a valid path in the new setup 
This mapping was added in Hugo `v0.146.0`.

Fixes #14740
 2026-04-08 13:19:45 +02:00
Bjørn Erik Pedersen 161d0d4757 Fix RenderShortcodes leaking context markers when indented 
Strip leading whitespace from Hugo context marker lines before
Goldmark parsing to prevent them from being treated as indented
code blocks.

Fixes #12457

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-07 22:05:42 +02:00
Bjørn Erik Pedersen 45e4596630 Strip nested page context markers from standalone RenderShortcodes 
Fixes #14732

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-07 19:27:40 +02:00