Skip to content

chore(deps): update dependency aqua:gohugoio/hugo to v0.161.1#68

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/aqua-gohugoio-hugo-0.x
Open

chore(deps): update dependency aqua:gohugoio/hugo to v0.161.1#68
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/aqua-gohugoio-hugo-0.x

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Apr 21, 2026 •
edited
Loading

This PR contains the following updates:

Package Update Change Pending
aqua:gohugoio/hugo minor 0.159.1 → 0.161.1 0.162.0

Release Notes

gohugoio/hugo (aqua:gohugoio/hugo)

v0.161.1

Compare Source

What's Changed

v0.161.0

Compare Source

This release contains two security hardening fixes:

  • We now run the Node tools PostCSS, Babel and TailwindCSS, by default, with the --permission flag with the permissions defined in security.node.permissions. This means that you need Node >= 22 installed and that css.TailwindCSS now requires that the Tailwind CSS CLI must be installed as a Node.js package. The standalone executable is no longer supported
  • We have made the defaults in security.http.urls more restrictive.

But there are some notable new features, as well:

Nested vars support in css.Build and css.Sass

A practical example in css.Build would be to have something like this in hugo.toml:

[params.style]
    primary    = "#​000000"
    background = "#ffffff"
    [params.style.dark]
        primary    = "#ffffff"
        background = "#​000000"

And in the stylesheet:

@​import "hugo:vars";
@​import "hugo:vars/dark" (prefers-color-scheme: dark);

:root {
  color-scheme: light dark;
}

Slice-based permalinks config

The permalinks configuration is now much more flexible (the old setup still works). It uses the same target matchers as in the cascade config, meaning you can now do:

permalinks:
  - target:
      kind: page
      path: "/books/**"
    pattern: /books/:year/:slug/
  - target:
      kind: section
      path: "/{books,books/**}"
    pattern: /libros/:sections[1:]
  - target:
      kind: page
    pattern: /other/:slug/

The above example isn't great, but it at least shows the gist of it.

A more flexible scheme for identifiers in filenames

What we had before was e.g. content/mypost.en.md which told Hugo that the content files was in English. With the new setup you could also name the file content/mypost._language_en_.md. This alone doesn't sound very useful, but this allows you to use more prefixes:

Prefix Description Relevant for
language_ Language Content and layout files.
role_ Role Content and layout files.
version_ Version Content and layout files.
outputformat_ Output format Layout files.
mediatype_ Media type Layout files.
kind_ Page kind Layout files.
layout_ Layout Layout files.

All Changes

v0.160.1

Compare Source

What's Changed

v0.160.0

Compare Source

Now you can inject CSS vars, e.g. from the configuration, into your stylesheets when building with css.Build. Also, now all the render hooks has a .Position method, now also more accurate and effective.

Bug fixes

Improvements

Dependency Updates

Documentation

v0.159.2

Compare Source

Note that the security fix below is not a potential threat if you either:

EDIT IN: This release also adds release archives for non-extended-withdeploy builds.

What's Changed

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
    • Only on Sunday and Saturday (* * * * 0,6)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 21, 2026 •
edited
Loading

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

🔍 Release Content Analysis

Hugo 0.161.0 Security Hardening (Major Changes)

  • Node.js Permission Model: PostCSS, Babel, and TailwindCSS now run with --permission flag by default, enforcing strict filesystem access controls through security.node.permissions configuration
  • Node.js Version Requirement: Requires Node.js >= 22 for Node-based asset pipelines
  • TailwindCSS Breaking Change: Standalone executable no longer supported; must install TailwindCSS CLI as Node.js package
  • HTTP Security Restrictions: More restrictive defaults in security.http.urls (denies IP-based URLs, localhost, and URLs with authentication credentials)
  • Security Vulnerability Fix (CVE-2026-44301): Addressed path traversal vulnerability in versions ≥0.43.0 and <0.161.0 where Node-based asset pipelines could read/write arbitrary files outside project directory

New Features (0.161.0)

  • Nested vars support in css.Build and css.Sass (inject CSS vars from configuration via @import "hugo:vars")
  • Slice-based permalinks configuration with target matchers
  • Flexible filename identifier scheme supporting language_, role_, version_, outputformat_, mediatype_, kind_, and layout_ prefixes

Bug Fixes Across 0.160.x - 0.161.1

  • Fixed translation lookup when using language variants (#7982)
  • Fixed non-deterministic conflict detection in hugo new content (#12602)
  • Fixed panic when passthrough elements used in headings (#14677)
  • Fixed double-escaping of ampersands in link URLs (#14715)
  • Fixed RenderShortcodes leaking context markers when indented (#12457)
  • Fixed auto-creation of root sections in multilingual sites (#14681)
  • Resources now honor Retry-After header in resources.GetRemote retries (#14828)

🎯 Impact Scope Investigation

✅ No Impact on This Project

  1. No Node.js Asset Pipeline Usage

    • PaperMod theme uses vanilla CSS with zero Node.js build dependencies
    • No package.json, postcss.config.js, or tailwind.config.js found in project
    • Project uses Hugo's built-in asset bundling for CSS (assets/css/extended/references.css)
    • No usage of css.Build, css.Sass, css.PostCSS, PostCSS, Babel, or TailwindCSS detected

  2. No Remote Resource Fetching

    • No resources.GetRemote calls found in layouts or content
    • HTTP security restrictions won't affect this project

  3. Simple Configuration

    • Using basic Hugo configuration (hugo.yaml) with no permalinks, cascade, or advanced features
    • No deprecated .Site.Sites or .Page.Sites usage found
    • Custom layouts only override single.html and list.html for references section rendering

  4. CI Environment Compatibility

    • GitHub Actions workflow uses mise to manage Hugo version (automatically updates from mise.toml)
    • Current Node.js v18 in CI environment is below the Node >= 22 requirement, but this doesn't matter since the project doesn't use Node-based asset pipelines

Benefits for This Project

  • Security improvements are transparent (no action required)
  • Bug fixes improve reliability for multilingual support and content creation
  • New features available if needed in the future (nested CSS vars, flexible permalinks)

💡 Recommended Actions

✅ Safe to Merge Immediately

No migration steps required. The update from 0.159.1 to 0.161.1 is completely backward compatible for this project's use case.

Optional Future Considerations

  • If you plan to add PostCSS/TailwindCSS in the future, ensure Node.js >= 22 is installed in CI environment
  • If you need to use resources.GetRemote, be aware of the stricter HTTP URL restrictions (denies IP addresses, localhost, and URLs with credentials by default)
  • Consider leveraging the new nested hugo:vars feature if you want to inject theme variables from hugo.yaml into CSS

🔗 Reference Links

Official Release Notes

Security Information

Theme Reference

Generated by koki-develop/claude-renovate-review

@renovate renovate Bot force-pushed the renovate/aqua-gohugoio-hugo-0.x branch 2 times, most recently from 9290f24 to 5530fc6 Compare April 24, 2026 01:29
@renovate renovate Bot force-pushed the renovate/aqua-gohugoio-hugo-0.x branch 2 times, most recently from dfa819a to 72cfd14 Compare May 5, 2026 13:57
@renovate renovate Bot changed the title chore(deps): update dependency aqua:gohugoio/hugo to v0.160.1 chore(deps): update dependency aqua:gohugoio/hugo to v0.161.0 May 5, 2026
@renovate renovate Bot force-pushed the renovate/aqua-gohugoio-hugo-0.x branch from 72cfd14 to 9bb93fc Compare May 6, 2026 17:56
@renovate renovate Bot changed the title chore(deps): update dependency aqua:gohugoio/hugo to v0.161.0 chore(deps): update dependency aqua:gohugoio/hugo to v0.161.1 May 6, 2026
@renovate renovate Bot force-pushed the renovate/aqua-gohugoio-hugo-0.x branch from 9bb93fc to 6fc7ba5 Compare May 14, 2026 16:54
@renovate renovate Bot force-pushed the renovate/aqua-gohugoio-hugo-0.x branch from 6fc7ba5 to 9fed292 Compare May 22, 2026 18:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants