blogs/hugo
1
0
Fork 0
mirror of https://github.com/gohugoio/hugo.git synced 2026-08-24 15:28:54 +00:00
Code Issues Packages Projects Releases Wiki Activity
9,700 Commits 242 Branches 381 Tags
ff22c62a32628fcf51f82de2f72a749e1cdf4fc3
Commit Graph

9700 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Joe Mooring ff22c62a32 commands: Improve description of command flags 
Closes #14817
 2026-04-30 21:38:44 +02:00
hugoreleaser 7fd65e16e4 releaser: Prepare repository for 0.162.0-DEV 
[ci skip]
 2026-04-29 14:17:46 +00:00
hugoreleaser ea8f66a7ce releaser: Bump versions for release of 0.161.1 
[ci skip]
v0.161.1 		2026-04-29 13:56:01 +00:00
Bjørn Erik Pedersen c4eba92863 resources: Honor Retry-After header in resources.GetRemote retries 
When the server returns a temporary HTTP error (e.g. 429 or 503)
together with a Retry-After header, use that value as the next sleep
duration instead of the default exponential backoff. The Retry-After
value is also surfaced in the retry-timeout error message.

Fixes #14828
 2026-04-29 15:44:16 +02:00
Bjørn Erik Pedersen 8b40a96b6e warpc: Move to parson.c in https://github.com/kgabis/parson 
And be specific about which commit we use.

Hugo treat this as an upstream dependency, so we would appreciate that any bugs will be reported and fixed upstream.

See #14823
 2026-04-29 13:51:42 +02:00
Bjørn Erik Pedersen d65af84d15 config/security: Add AllowChildProcess to security.node.permissions 
Some Linux setups trigger detect-libc's spawnSync('getconf') fallback
when process.report does not expose glibcVersionRuntime, breaking
tailwindcss under the Node permission model. Add AllowChildProcess
mirroring AllowAddons/AllowWorker, default to ["tailwindcss"], and
emit --allow-child-process accordingly.

Fixes #14824
 2026-04-29 13:50:37 +02:00
Bjørn Erik Pedersen 454450a647 config/security: Restrict default http.urls "@" deny to userinfo 
The previous "! @" deny rule rejected any URL containing "@",
including legitimate version-pinned imports such as
https://cdn.jsdelivr.net/npm/mermaid@latest/dist/mermaid.esm.min.mjs.
Tighten it to "! (?i)^https?://[^/?#]*@" so only "@" inside the
authority section (i.e. real userinfo) is blocked.

Fixes #14825

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-29 13:50:37 +02:00
hugoreleaser 2bfcc6b994 releaser: Prepare repository for 0.162.0-DEV 
[ci skip]
 2026-04-28 12:08:01 +00:00
hugoreleaser 98d396c16a releaser: Bump versions for release of 0.161.0 
[ci skip]
v0.161.0 		2026-04-28 11:46:32 +00:00
dependabot[bot] d4ae662d59 build(deps): bump github.com/getkin/kin-openapi from 0.135.0 to 0.137.0 
Bumps [github.com/getkin/kin-openapi](https://github.com/getkin/kin-openapi) from 0.135.0 to 0.137.0.
- [Release notes](https://github.com/getkin/kin-openapi/releases)
- [Commits](https://github.com/getkin/kin-openapi/compare/v0.135.0...v0.137.0)

---
updated-dependencies:
- dependency-name: github.com/getkin/kin-openapi
  dependency-version: 0.137.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-28 13:40:06 +02:00
dependabot[bot] 9ede5fb9e0 build(deps): bump github.com/mattn/go-isatty from 0.0.21 to 0.0.22 
Bumps [github.com/mattn/go-isatty](https://github.com/mattn/go-isatty) from 0.0.21 to 0.0.22.
- [Commits](https://github.com/mattn/go-isatty/compare/v0.0.21...v0.0.22)

---
updated-dependencies:
- dependency-name: github.com/mattn/go-isatty
  dependency-version: 0.0.22
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-27 20:10:08 +02:00
dependabot[bot] 833a878eef build(deps): bump github.com/tdewolff/minify/v2 from 2.24.12 to 2.24.13 
Bumps [github.com/tdewolff/minify/v2](https://github.com/tdewolff/minify) from 2.24.12 to 2.24.13.
- [Release notes](https://github.com/tdewolff/minify/releases)
- [Commits](https://github.com/tdewolff/minify/compare/v2.24.12...v2.24.13)

---
updated-dependencies:
- dependency-name: github.com/tdewolff/minify/v2
  dependency-version: 2.24.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-27 20:08:49 +02:00
Bjørn Erik Pedersen 7622dd86ce css: Support nested hugo:vars/<name> imports 
Allow CSS variables to be grouped under sub-paths and imported via
@import "hugo:vars/mobile" (or @use for Dart Sass), so callers can pass
nested dicts like:

    {{ dict "primary-color" "blue" "mobile" (dict "primary-color" "red") }}

Top-level "hugo:vars" now skips nested map entries instead of emitting
garbage for them.

Fixes #14705

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-27 19:42:50 +02:00
Bjørn Erik Pedersen 0814059bb6 github: Update GitHub actions versions 
By running:

```
ghat swot --stable 7 -d .github
```

Closes #14810
 2026-04-27 19:15:56 +02:00
Joe Mooring 8920d56e95 hugolib: Do not render aliases if the page is not rendered 
Closes #14807
 2026-04-25 18:41:27 +02:00
Joe Mooring 633cc772e0 langs/i18n: Improve default content language fallback 
The fallback order for translations is now:

1. Current language's locale (e.g., pt-BR → pt-br.toml)
2. Current language's key (e.g., pt → pt.toml)
3. Default language's locale (e.g., es-AR → es-ar.toml) ← new
4. Default language's key (e.g., es → es.toml)

Closes #14243

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-25 10:43:37 +02:00
Bjørn Erik Pedersen 90d8bf34ae Replace deprecated .Site.Sites/.Page.Sites with hugo.Sites intests 2026-04-24 19:02:46 +02:00
Bjørn Erik Pedersen 4c40c6d5ca helpers: Remove unused code 2026-04-23 20:05:09 +02:00
Bjørn Erik Pedersen d2594db670 common/constants: Remove unused consts 2026-04-23 20:05:09 +02:00
Bjørn Erik Pedersen ab2de51e07 common/paths: Remove unused code 
Identified with:

```
punused "common/paths/**.go"
 ````
 2026-04-23 20:05:09 +02:00
Joe Mooring 72b85d5f9c langs/i18n: Fix translation lookup when using language variants 
Closes #7982

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-23 18:47:12 +02:00
Joe Mooring 75f61832c2 tests: Update Ruby setup action to v1.305.0 2026-04-23 18:46:49 +02:00
dependabot[bot] 4c03129fcf build(deps): bump github.com/magefile/mage from 1.17.1 to 1.17.2 
Bumps [github.com/magefile/mage](https://github.com/magefile/mage) from 1.17.1 to 1.17.2.
- [Release notes](https://github.com/magefile/mage/releases)
- [Commits](https://github.com/magefile/mage/compare/v1.17.1...v1.17.2)

---
updated-dependencies:
- dependency-name: github.com/magefile/mage
  dependency-version: 1.17.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-23 15:02:42 +02:00
Bjørn Erik Pedersen 080970bc6b deps: Upgrade github.com/bep/imagemeta v0.17.1 => v0.17.2 2026-04-23 15:02:28 +02:00
Joe Mooring 1b7495bc49 langs: Use Language.Locale as primary localization key 
Localization now uses Language.Locale as the golocales lookup key,
falling back to Language.Lang, then defaultContentLanguage, then "en".

Closes #9109
 2026-04-22 22:41:51 +02:00
Bjørn Erik Pedersen 79f030be5b config/security: Add "! " negation to Whitelist, harden default http.urls 
Whitelist now treats any pattern prefixed with "! " (the same negation
prefix used by hglob/predicate) as a deny rule. Deny matches take
precedence over allow, and a whitelist made up exclusively of deny
rules implicitly allows everything it does not deny.

The default security.http.urls now reads:

    urls = ['(?i)^https?://[a-z]', '! (?i)localhost', '! @']

i.e. allow URLs whose host starts with a letter (the common
"https://example.com" shape), deny anything that looks like localhost,
and deny URLs with userinfo to foil "http://user@127.0.0.1/" bypasses.
Public IP literals are collateral blocks; users who need them (or their
own private hosts) override security.http.urls as before, mixing allow
and deny rules with the same "! " prefix, e.g.

    [security.http]
    urls = ['.*', '! ^https?://evil\.example\.com']

Fixes #14792
 2026-04-22 20:15:19 +02:00
dependabot[bot] 896bc89ab8 build(deps): bump github.com/aws/aws-sdk-go-v2/service/cloudfront (#14789) 
Bumps [github.com/aws/aws-sdk-go-v2/service/cloudfront](https://github.com/aws/aws-sdk-go-v2) from 1.59.0 to 1.61.1.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/service/s3/v1.59.0...service/s3/v1.61.1)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/service/cloudfront
  dependency-version: 1.61.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-22 15:51:30 +02:00
dependabot[bot] 100dde53ad build(deps): bump github.com/mattn/go-isatty from 0.0.20 to 0.0.21 (#14788) 
Bumps [github.com/mattn/go-isatty](https://github.com/mattn/go-isatty) from 0.0.20 to 0.0.21.
- [Commits](https://github.com/mattn/go-isatty/compare/v0.0.20...v0.0.21)

---
updated-dependencies:
- dependency-name: github.com/mattn/go-isatty
  dependency-version: 0.0.21
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-22 15:51:14 +02:00
dependabot[bot] bdebb79705 build(deps): bump github.com/bep/mclib (#14787) 
Bumps [github.com/bep/mclib](https://github.com/bep/mclib) from 1.20400.20402 to 1.20401.20400.
- [Release notes](https://github.com/bep/mclib/releases)
- [Commits](https://github.com/bep/mclib/compare/v1.20400.20402...v1.20401.20400)

---
updated-dependencies:
- dependency-name: github.com/bep/mclib
  dependency-version: 1.20401.20400
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-22 15:51:00 +02:00
Bjørn Erik Pedersen a54c398b93 Harden Node tool execution with --permission flag 
Add security.node.permissions config to run Node tools (PostCSS, Babel,
TailwindCSS) under Node's permission model, restricting file system access
to the working directory by default.

The binary resolution is simplified to node_modules/.bin → PATH (npx removed).
For both locations, the actual JS entry point is resolved via symlinks (macOS/Linux)
or by parsing npm wrapper scripts (Windows .cmd), then executed as
"node --permission --allow-fs-read=<path> --allow-fs-write=<path> <script>".

Users can opt out by removing "node" from security.exec.allow.

Closes #7287
 2026-04-22 15:47:34 +02:00
Bjørn Erik Pedersen f5fce935e7 tpl/collections: Honor the Eqer interface in where comparisons 
The where function previously fell through to a no-op when comparing
two values whose kinds were not handled by the primitive type switches
(e.g. two Page interface values). This made `where pages "Parent" $page`
return an empty list, while the equivalent `range pages` + `if eq` worked.

Use compare.Eqer for equality operators when either side implements it,
matching the behavior of the eq/ne template funcs.

Fixes #14777

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-04-20 19:45:06 +02:00
dependabot[bot] 52123ae23f build(deps): bump google.golang.org/api from 0.267.0 to 0.276.0 
Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.267.0 to 0.276.0.
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](https://github.com/googleapis/google-api-go-client/compare/v0.267.0...v0.276.0)

---
updated-dependencies:
- dependency-name: google.golang.org/api
  dependency-version: 0.276.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-20 19:12:24 +02:00
dependabot[bot] 38b8afdc90 build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.41.5 to 1.41.6 
Bumps [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) from 1.41.5 to 1.41.6.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/v1.41.5...v1.41.6)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2
  dependency-version: 1.41.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-20 19:12:13 +02:00
Bjørn Erik Pedersen 4169c1f70f modules: Ignore non-require blocks in go.mod rewrite 
The Go 1.24 tool directive uses single-token entries inside a
tool ( ... ) block. The previous splitter treated any tab-indented
line as a require entry, causing an index out of range panic when
running hugo mod tidy on a module with a tool block.

Track the require block state explicitly so other blocks (tool,
replace, exclude, retract) are left untouched.

Fixes #14783
 2026-04-20 19:11:41 +02:00
Bjørn Erik Pedersen 7574e35b40 Replace the concurrent map with an identical upstream version 2026-04-20 18:33:59 +02:00
dependabot[bot] 927666005c build(deps): bump github.com/getkin/kin-openapi from 0.134.0 to 0.135.0 (#14781) 
Bumps [github.com/getkin/kin-openapi](https://github.com/getkin/kin-openapi) from 0.134.0 to 0.135.0.
- [Release notes](https://github.com/getkin/kin-openapi/releases)
- [Commits](https://github.com/getkin/kin-openapi/compare/v0.134.0...v0.135.0)

---
updated-dependencies:
- dependency-name: github.com/getkin/kin-openapi
  dependency-version: 0.135.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-20 17:45:53 +02:00
dependabot[bot] 790f4084a1 build(deps): bump github.com/bep/goportabletext from 0.1.0 to 0.2.0 (#14779) 
Bumps [github.com/bep/goportabletext](https://github.com/bep/goportabletext) from 0.1.0 to 0.2.0.
- [Release notes](https://github.com/bep/goportabletext/releases)
- [Commits](https://github.com/bep/goportabletext/compare/v0.1.0...v0.2.0)

---
updated-dependencies:
- dependency-name: github.com/bep/goportabletext
  dependency-version: 0.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-20 17:45:36 +02:00
dependabot[bot] de6955bab3 build(deps): bump golang.org/x/image from 0.38.0 to 0.39.0 (#14780) 
Bumps [golang.org/x/image](https://github.com/golang/image) from 0.38.0 to 0.39.0.
- [Commits](https://github.com/golang/image/compare/v0.38.0...v0.39.0)

---
updated-dependencies:
- dependency-name: golang.org/x/image
  dependency-version: 0.39.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-04-20 15:19:28 +02:00
Bjørn Erik Pedersen a77bd527fd deps: Upgrade github.com/bep/imagemeta v0.17.0 => v0.17.1 (#14775) 
Close #14758
 2026-04-20 10:35:22 +02:00
Bjørn Erik Pedersen 017a7cd63a Add slice-based permalinks config with PageMatcher target 
Closes #14744
Clses #4641

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-04-19 19:45:45 +02:00
Bjørn Erik Pedersen e3413d927f commands: Add missing import 2026-04-19 15:35:46 +02:00
Bjørn Erik Pedersen b01cc14703 Revert "common/hugo: Deprecate extended and extended_withdeploy editions" 
This reverts commit a17bdbc5fa.

Close #14771
 2026-04-19 11:15:49 +02:00
Bjørn Erik Pedersen 8ee19ff9a3 Adjust the SECURITY.md slightly 2026-04-18 23:05:27 +02:00
Joe Mooring 6436deb3e1 create: Fix non-deterministic conflict detection in hugo new content 
The contentInclusionFilter used strings.Contains to match filenames
against the target path. Because strings.Contains is a substring check,
a directory entry like "content/about" matches "content/about.md",
causing unrelated files to be pulled into the mini-build. Whether the
conflict was then detected depended on whether the filesystem walker
delivered a directory entry or a full file path.

Also adds an upfront check for the directory-conflict case, since
a corrected filter alone would allow about.md to be created alongside
an existing about/ directory.

Closes #12602
Closes #12786
Closes #14112
Closes #14769

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-18 15:06:28 +02:00
dependabot[bot] 547ab29ced build(deps): bump golang.org/x/tools from 0.43.0 to 0.44.0 
Bumps [golang.org/x/tools](https://github.com/golang/tools) from 0.43.0 to 0.44.0.
- [Release notes](https://github.com/golang/tools/releases)
- [Commits](https://github.com/golang/tools/compare/v0.43.0...v0.44.0)

---
updated-dependencies:
- dependency-name: golang.org/x/tools
  dependency-version: 0.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-18 15:03:47 +02:00
Joe Mooring 0d58e4286f resources/page: Add passing test for Issue #14325 2026-04-18 15:02:47 +02:00
Bjørn Erik Pedersen bbb42b5a6a agents: Add a note about having the issue ID in test names 2026-04-17 21:59:11 +02:00
Joe Mooring 1eea9fba0b commands: Fix environment isolation for configuration settings 
Closes #14763

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-04-17 09:40:23 +02:00
dependabot[bot] 9a5c7e0d24 build(deps): bump github.com/evanw/esbuild from 0.27.4 to 0.28.0 
Bumps [github.com/evanw/esbuild](https://github.com/evanw/esbuild) from 0.27.4 to 0.28.0.
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](https://github.com/evanw/esbuild/compare/v0.27.4...v0.28.0)

---
updated-dependencies:
- dependency-name: github.com/evanw/esbuild
  dependency-version: 0.28.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-16 19:56:49 +02:00
dependabot[bot] 6613b08eb6 build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.41.1 to 1.41.5 
Bumps [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) from 1.41.1 to 1.41.5.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/v1.41.1...v1.41.5)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2
  dependency-version: 1.41.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-16 19:55:55 +02:00