mxmehl/mehl.mx
1
0
Fork 0
Code Issues 3 Pull Requests 1 Actions Releases Wiki Activity

chore(deps): update dependency hugo-extended to v0.162.1 #19

Merged
mxmehl merged 1 commits from renovate/hugo-extended-0.x into main 2026-06-08 11:56:21 +02:00
Conversation 0 Commits 1 Files Changed 2
+16 -16
renovate-bot commented 2026-05-30 04:16:30 +02:00
Collaborator
Copy Link
Copy Source

This PR contains the following updates:

Package Update Change
hugo-extended minor 0.161.1 → 0.162.1

Release Notes

gohugoio/hugo (hugo-extended)

v0.162.1

Compare Source

What's Changed

v0.162.0

Compare Source

The notable new feature in this release is support for AVIF images (both encoder and decoder). There's a demo site set up that demonstrates the difference between HDR AVIF and SDR JPEG images. Note that that demo is only really interesting if viewed on an HDR capable screen (e.g. Apple Retina).

Security fixes

There are some notable security fixes in this release.

Security fixes in Go

This release upgrades from Go 1.26.1 to 126.3, which brings a set of security fixes. Some relevant for Hugo are:

  • XSS in html/template (CVE-2026-39826 & CVE-2026-39823): Two separate vulnerabilities where escaper bypasses in html/template could lead to Cross-Site Scripting (XSS).
  • html/template: Fixes an issue where JS template literal contexts were incorrectly tracked across template branches, which could lead to improper content escaping.
Security fixes and hardening in Hugo

The following changes either fix a concrete issue or reduce the default attack surface of hugo builds.

  • Disallow text/html content files by default (e41a064). A new security.allowContent policy gates which content media types may be used for pages under /content. text/html is denied by default; sites that rely on hand-authored or adapter-emitted HTML content can opt back in with security.allowContent = ['.*'].
  • Re-check security.http.urls on every redirect hop in resources.GetRemote (86fbb0f).
  • Reject symlinked entries in resources.Get (f8b5fa0).

We will update this section later with links to CVEs where applicable.

All changes

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [hugo-extended](https://github.com/gohugoio/hugo) | minor | `0.161.1` → `0.162.1` | --- ### Release Notes <details> <summary>gohugoio/hugo (hugo-extended)</summary> ### [`v0.162.1`](https://github.com/gohugoio/hugo/releases/tag/v0.162.1) [Compare Source](https://github.com/gohugoio/hugo/compare/v0.162.0...v0.162.1) #### What's Changed - modules/npm: Fix false stale warning after npm pack [`59f35cd`](https://github.com/gohugoio/hugo/commit/59f35cd9) [@&#8203;jmooring](https://github.com/jmooring) [#&#8203;14959](https://github.com/gohugoio/hugo/issues/14959) - Revert "tpl/collections: Make dict return nil when no values are provided" [`c270975`](https://github.com/gohugoio/hugo/commit/c2709750) [@&#8203;bep](https://github.com/bep) [#&#8203;14958](https://github.com/gohugoio/hugo/issues/14958) - tpl/time: Fix locale-specific month abbreviations [`ea8b48a`](https://github.com/gohugoio/hugo/commit/ea8b48af) [@&#8203;jmooring](https://github.com/jmooring) [#&#8203;14948](https://github.com/gohugoio/hugo/issues/14948) ### [`v0.162.0`](https://github.com/gohugoio/hugo/releases/tag/v0.162.0) [Compare Source](https://github.com/gohugoio/hugo/compare/v0.161.1...v0.162.0) The notable new feature in this release is support for [AVIF images](https://gohugo.io/configuration/imaging/#avif-images) (both encoder and decoder). There's a [demo site](https://github.com/bep/hdrsdr.com) set up that demonstrates the difference between HDR AVIF and SDR JPEG images. Note that that demo is only really interesting if viewed on an HDR capable screen (e.g. Apple Retina). #### Security fixes There are some notable security fixes in this release. ##### Security fixes in Go This release upgrades from Go 1.26.1 to 126.3, which brings a set of security fixes. Some relevant for Hugo are: - XSS in html/template (CVE-2026-39826 & CVE-2026-39823): Two separate vulnerabilities where escaper bypasses in html/template could lead to Cross-Site Scripting (XSS). - html/template: Fixes an issue where JS template literal contexts were incorrectly tracked across template branches, which could lead to improper content escaping. ##### Security fixes and hardening in Hugo The following changes either fix a concrete issue or reduce the default attack surface of `hugo` builds. - **Disallow `text/html` content files by default** ([e41a064](https://github.com/gohugoio/hugo/commit/e41a06447d)). A new `security.allowContent` policy gates which content media types may be used for pages under `/content`. `text/html` is denied by default; sites that rely on hand-authored or adapter-emitted HTML content can opt back in with `security.allowContent = ['.*']`. - **Re-check `security.http.urls` on every redirect hop in `resources.GetRemote`** ([86fbb0f](https://github.com/gohugoio/hugo/commit/86fbb0f7a8)). - **Reject symlinked entries in `resources.Get`** ([f8b5fa0](https://github.com/gohugoio/hugo/commit/f8b5fa09a6)). **We will update this section later with links to CVEs where applicable.** #### All changes - hugolib: Fix Page.GitInfo for modules with go.mod in a repo subdirectory [`df54219`](https://github.com/gohugoio/hugo/commit/df542191) [@&#8203;bep](https://github.com/bep) [#&#8203;14942](https://github.com/gohugoio/hugo/issues/14942) - Fix typo in CONTRIBUTING.md [`4bc7cae`](https://github.com/gohugoio/hugo/commit/4bc7caea) [@&#8203;bep](https://github.com/bep) - resources: Fix the :counter placeholder [`5d51b82`](https://github.com/gohugoio/hugo/commit/5d51b82a) [@&#8203;jmooring](https://github.com/jmooring) [#&#8203;14921](https://github.com/gohugoio/hugo/issues/14921) - commands: Fix import from Jekyll [`81d7762`](https://github.com/gohugoio/hugo/commit/81d77620) [@&#8203;jmooring](https://github.com/jmooring) [#&#8203;14795](https://github.com/gohugoio/hugo/issues/14795) [#&#8203;14906](https://github.com/gohugoio/hugo/issues/14906) - Fix prevention of direct symlink reads in resources.Get [`f8b5fa0`](https://github.com/gohugoio/hugo/commit/f8b5fa09) [@&#8203;bep](https://github.com/bep) - commands: Fix github-dark chromastyles [`88d838a`](https://github.com/gohugoio/hugo/commit/88d838a9) [@&#8203;xndvaz](https://github.com/xndvaz) [#&#8203;14831](https://github.com/gohugoio/hugo/issues/14831) - Disallow HTML content by default [`e41a064`](https://github.com/gohugoio/hugo/commit/e41a0644) [@&#8203;bep](https://github.com/bep) - Add image processing support for AVIF [`90d9f81`](https://github.com/gohugoio/hugo/commit/90d9f812) [@&#8203;bep](https://github.com/bep) [#&#8203;7837](https://github.com/gohugoio/hugo/issues/7837) - config: Preserve intentionally empty maps [`80e6084`](https://github.com/gohugoio/hugo/commit/80e60847) [@&#8203;jmooring](https://github.com/jmooring) [#&#8203;14944](https://github.com/gohugoio/hugo/issues/14944) - hugolib: Merge existing hugo\_stats.json when renderSegments is set [`aeb9a5c`](https://github.com/gohugoio/hugo/commit/aeb9a5cc) [@&#8203;bep](https://github.com/bep) [#&#8203;14939](https://github.com/gohugoio/hugo/issues/14939) - all: Replace RWMutex struct caches with ConcurrentMap [`c4bbc28`](https://github.com/gohugoio/hugo/commit/c4bbc280) [@&#8203;bep](https://github.com/bep) - tpl/tplimpl: Consolidate and improve embedded template integration tests [`d8c7021`](https://github.com/gohugoio/hugo/commit/d8c70218) [@&#8203;jmooring](https://github.com/jmooring) [#&#8203;14932](https://github.com/gohugoio/hugo/issues/14932) - parser: Drop empty sub maps from hugo config output [`ee4f1ac`](https://github.com/gohugoio/hugo/commit/ee4f1acd) [@&#8203;bep](https://github.com/bep) [#&#8203;14855](https://github.com/gohugoio/hugo/issues/14855) - markup/highlight: Allow overriding type and code via options [`b613365`](https://github.com/gohugoio/hugo/commit/b6133657) [@&#8203;bep](https://github.com/bep) [#&#8203;11872](https://github.com/gohugoio/hugo/issues/11872) - Update AI assistance disclosure requirements [`d2c821b`](https://github.com/gohugoio/hugo/commit/d2c821b5) [@&#8203;bep](https://github.com/bep) - hugolib: Use AllTranslated in IsTranslated [`4ed7600`](https://github.com/gohugoio/hugo/commit/4ed7600f) [@&#8203;bep](https://github.com/bep) - tpl: Simplify sitemap template [`cbe4339`](https://github.com/gohugoio/hugo/commit/cbe4339a) [@&#8203;bep](https://github.com/bep) [#&#8203;14912](https://github.com/gohugoio/hugo/issues/14912) - tpl: Use AllTranslations in sitemap template [`6475d30`](https://github.com/gohugoio/hugo/commit/6475d308) [@&#8203;bep](https://github.com/bep) [#&#8203;14912](https://github.com/gohugoio/hugo/issues/14912) [#&#8203;14917](https://github.com/gohugoio/hugo/issues/14917) - tpl/collections: Make dict return nil when no values are provided [`67aede4`](https://github.com/gohugoio/hugo/commit/67aede43) [@&#8203;bep](https://github.com/bep) - Sync Go template package to 1.26.3 [`87f194b`](https://github.com/gohugoio/hugo/commit/87f194b2) [@&#8203;bep](https://github.com/bep) [#&#8203;14897](https://github.com/gohugoio/hugo/issues/14897) - Upgrade to Go 1.26.3 [`d81e3c2`](https://github.com/gohugoio/hugo/commit/d81e3c29) [@&#8203;bep](https://github.com/bep) [#&#8203;14897](https://github.com/gohugoio/hugo/issues/14897) - ci: Check embedded template formatting with gotmplfmt [`7c65a4d`](https://github.com/gohugoio/hugo/commit/7c65a4db) [@&#8203;bep](https://github.com/bep) - tpl: Run gotmplfmt -w . [`d31a927`](https://github.com/gohugoio/hugo/commit/d31a9275) [@&#8203;bep](https://github.com/bep) - markup/goldmark/codeblocks: Always split Chroma options into .Options [`c36608c`](https://github.com/gohugoio/hugo/commit/c36608c5) [@&#8203;jmooring](https://github.com/jmooring) [#&#8203;14909](https://github.com/gohugoio/hugo/issues/14909) - hugolib: Allow empty params front matter [`2f361a8`](https://github.com/gohugoio/hugo/commit/2f361a8e) [@&#8203;xndvaz](https://github.com/xndvaz) [#&#8203;14886](https://github.com/gohugoio/hugo/issues/14886) - common/hmaps: Merge slice-valued module config into site config [`5559263`](https://github.com/gohugoio/hugo/commit/55592633) [@&#8203;jmooring](https://github.com/jmooring) [#&#8203;13869](https://github.com/gohugoio/hugo/issues/13869) - tpl: Use GetMatch for both local and global image resources [`656fc04`](https://github.com/gohugoio/hugo/commit/656fc040) [@&#8203;bep](https://github.com/bep) [#&#8203;14062](https://github.com/gohugoio/hugo/issues/14062) - Revert "markup/tableofcontents: Skip empty TOC levels" [`a20cb5b`](https://github.com/gohugoio/hugo/commit/a20cb5b1) [@&#8203;bep](https://github.com/bep) [#&#8203;14898](https://github.com/gohugoio/hugo/issues/14898) - tpl/templates: Reject Defer inside partialCached [`4d775cb`](https://github.com/gohugoio/hugo/commit/4d775cbe) [@&#8203;bep](https://github.com/bep) [#&#8203;13492](https://github.com/gohugoio/hugo/issues/13492) - common/hexec: Make NODE\_PATH a fallback for ESM bare imports [`ae7bf74`](https://github.com/gohugoio/hugo/commit/ae7bf74b) [@&#8203;bep](https://github.com/bep) [#&#8203;13987](https://github.com/gohugoio/hugo/issues/13987) - config: Allow repeating the root key in /config files [`ba5d812`](https://github.com/gohugoio/hugo/commit/ba5d8126) [@&#8203;bep](https://github.com/bep) [#&#8203;12899](https://github.com/gohugoio/hugo/issues/12899) [#&#8203;14882](https://github.com/gohugoio/hugo/issues/14882) - Revise test naming guidelines in AGENTS.md [`be4a0df`](https://github.com/gohugoio/hugo/commit/be4a0df3) [@&#8203;bep](https://github.com/bep) - Update AGENTS.md [`e4cf565`](https://github.com/gohugoio/hugo/commit/e4cf565c) [@&#8203;bep](https://github.com/bep) - js: Return error for missing batch imports [`9e64953`](https://github.com/gohugoio/hugo/commit/9e649533) [@&#8203;xndvaz](https://github.com/xndvaz) [#&#8203;13737](https://github.com/gohugoio/hugo/issues/13737) - resources/images: Keep smart crop target size [`f0cfc28`](https://github.com/gohugoio/hugo/commit/f0cfc28c) [@&#8203;xndvaz](https://github.com/xndvaz) [#&#8203;13688](https://github.com/gohugoio/hugo/issues/13688) - testing: Use synctest where relevant [`16e854a`](https://github.com/gohugoio/hugo/commit/16e854a4) [@&#8203;bep](https://github.com/bep) - security: Validate redirects against security.http.urls [`86fbb0f`](https://github.com/gohugoio/hugo/commit/86fbb0f7) [@&#8203;bep](https://github.com/bep) [#&#8203;14871](https://github.com/gohugoio/hugo/issues/14871) - markup/tableofcontents: Skip empty TOC levels [`7d4af7a`](https://github.com/gohugoio/hugo/commit/7d4af7a1) [@&#8203;xndvaz](https://github.com/xndvaz) [#&#8203;7128](https://github.com/gohugoio/hugo/issues/7128) - Fall back to hugo.buildDate in hugo.BuildDate() in non-vcs builds [`28147cb`](https://github.com/gohugoio/hugo/commit/28147cb0) [@&#8203;bep](https://github.com/bep) [#&#8203;14862](https://github.com/gohugoio/hugo/issues/14862) - css: Make css.Build's file-loader URLs absolute to web context root [`e51e761`](https://github.com/gohugoio/hugo/commit/e51e761d) [@&#8203;bep](https://github.com/bep) [#&#8203;14849](https://github.com/gohugoio/hugo/issues/14849) - hugolib: Don't warn about lang/kind/path coming from cascade.params [`7011239`](https://github.com/gohugoio/hugo/commit/70112392) [@&#8203;bep](https://github.com/bep) [#&#8203;14848](https://github.com/gohugoio/hugo/issues/14848) - markup/goldmark: Unwrap inner HTML for plain code blocks [`694906f`](https://github.com/gohugoio/hugo/commit/694906f6) [@&#8203;cyphercodes](https://github.com/cyphercodes) [#&#8203;14820](https://github.com/gohugoio/hugo/issues/14820) - tpl/tplimpl: Extend page image lookup to include global resources [`d27b9c0`](https://github.com/gohugoio/hugo/commit/d27b9c06) [@&#8203;ogulcanaydogan](https://github.com/ogulcanaydogan) [#&#8203;14062](https://github.com/gohugoio/hugo/issues/14062) - security: Allow hostnames starting with digits in default http.urls [`62cef36`](https://github.com/gohugoio/hugo/commit/62cef367) [@&#8203;bep](https://github.com/bep) [#&#8203;14837](https://github.com/gohugoio/hugo/issues/14837) - commands: Improve description of command flags [`ff22c62`](https://github.com/gohugoio/hugo/commit/ff22c62a) [@&#8203;jmooring](https://github.com/jmooring) [#&#8203;14817](https://github.com/gohugoio/hugo/issues/14817) - build(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 [`4f444c8`](https://github.com/gohugoio/hugo/commit/4f444c81) [@&#8203;dependabot](https://github.com/dependabot)\[bot] - build(deps): bump golang.org/x/image from 0.40.0 to 0.41.0 [`fe6c726`](https://github.com/gohugoio/hugo/commit/fe6c7265) [@&#8203;dependabot](https://github.com/dependabot)\[bot] - build(deps): bump github.com/getkin/kin-openapi from 0.137.0 to 0.138.0 [`6a2a038`](https://github.com/gohugoio/hugo/commit/6a2a0380) [@&#8203;dependabot](https://github.com/dependabot)\[bot] - build(deps): bump github.com/JohannesKaufmann/html-to-markdown/v2 [`cf1de59`](https://github.com/gohugoio/hugo/commit/cf1de598) [@&#8203;dependabot](https://github.com/dependabot)\[bot] - build(deps): bump golang.org/x/image from 0.39.0 to 0.40.0 [`97f990c`](https://github.com/gohugoio/hugo/commit/97f990cc) [@&#8203;dependabot](https://github.com/dependabot)\[bot] - build(deps): bump golang.org/x/tools from 0.44.0 to 0.45.0 [`b99634e`](https://github.com/gohugoio/hugo/commit/b99634e2) [@&#8203;dependabot](https://github.com/dependabot)\[bot] - build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 [`fdd977e`](https://github.com/gohugoio/hugo/commit/fdd977e9) [@&#8203;dependabot](https://github.com/dependabot)\[bot] - build(deps): bump github.com/pelletier/go-toml/v2 from 2.3.0 to 2.3.1 [`123018d`](https://github.com/gohugoio/hugo/commit/123018de) [@&#8203;dependabot](https://github.com/dependabot)\[bot] - deps: Upgrade to Chroma v2.24.1 [`b88fa8c`](https://github.com/gohugoio/hugo/commit/b88fa8cc) [@&#8203;bep](https://github.com/bep) [#&#8203;14839](https://github.com/gohugoio/hugo/issues/14839) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yMDIuMSIsInVwZGF0ZWRJblZlciI6IjQzLjIwNS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->
renovate-bot changed title from chore(deps): update dependency hugo-extended to v0.162.0 to chore(deps): update dependency hugo-extended to v0.162.1 2026-06-01 03:16:33 +02:00
renovate-bot added 1 commit 2026-06-01 03:16:33 +02:00
chore(deps): update dependency hugo-extended to v0.162.1
renovate/stability-days Updates have met minimum release age requirement
Details
Website build and deploy / build (pull_request) Successful in 1m8s
Details
6762d6338b
renovate-bot force-pushed renovate/hugo-extended-0.x from c1391be176 to 6762d6338b 2026-06-01 03:16:33 +02:00 Compare
mxmehl merged commit 41cf63b419 into main 2026-06-08 11:56:21 +02:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Assignees
Clear assignees
renovate-bot mxmehl
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mxmehl/mehl.mx#19
Delete Branch "renovate/hugo-extended-0.x"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?