Add security.node.permissions config to run Node tools (PostCSS, Babel,
TailwindCSS) under Node's permission model, restricting file system access
to the working directory by default.
The binary resolution is simplified to node_modules/.bin → PATH (npx removed).
For both locations, the actual JS entry point is resolved via symlinks (macOS/Linux)
or by parsing npm wrapper scripts (Windows .cmd), then executed as
"node --permission --allow-fs-read=<path> --allow-fs-write=<path> <script>".
Users can opt out by removing "node" from security.exec.allow.
Closes#7287
* Main reason is that it slows down my own `gh` workflow (I also frequently accidentally select that template).
* We also don't have a large volume of PRs from new contributors, so the template isn't as necessary.
This adds a new file cache named 'modulequeries' with a 24h maxAge
that caches JSON responses from 'go mod download -json' when querying
module versions with constraints (e.g., version = "<v3.0.0").
On subsequent builds, if the cached JSON exists and the module
directory it references is non-empty, the cached result is used
directly, skipping the costly VCS interaction entirely.
Fixes#14417
Fixes an issue where improper attribute derivation from the page's
relative permalink caused failures with `outdir`, `imagesoutdir`, and
`imagesdir` when `markup.asciidocext.workingFolderCurrent` is enabled.
The updated logic now correctly handles:
- Multi-byte characters
- Multilingual multi-host sites
- Site builds from a subdirectory
- Pages using ugly URLs
Supports diagram caching as implemented in v3.1.0 of the asciidoctor-diagram
extension:
- Enables caching by default
- Sets default cache location to the compiled value of caches.misc.dir
Reduces duration of integration tests by:
- Generating GoAT diagrams instead of Ditaa diagrams
- Taking advantage of asciidoctor-diagram caching
Closes#9202Closes#10183Closes#10473Closes#14160
In 2c80dee358 we enabled rendering of
PlantUML diagrams within integration tests. This commit removes PlantUML
support from the tests in favor of rendering Ditaa diagrams, which take
less time to generate.
Build tags setup changed to:
* !nodeploy => withdeploy
* nodeploy => !withdeploy
Also move the deploy feature out into its own release archives.
See #12994 for the primary motivation for this change. But this also greatly reduces the number of dependencies in Hugo when you don't need this feature and cuts the binary size greatly.
Fixes#12994
The previous build workflow used emulation to build the Docker image,
which results in a somewhat complicated push-by-digest and merge
workflow to create a multi-platform image.
This commit changes the Docker build to use cross-compilation instead,
resulting in a faster and more straightforward build.
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
That work flow was added to make sure Hugo kept on working for people using the old Dart Sass Protocol binary. We still do, but testing it on every PR build is too much now that all/most people should have upgraded.
Bjørn Erik Pedersen