Skip to content

chore(deps): update dependency aqua:gohugoio/hugo to v0.161.1#68

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/aqua-gohugoio-hugo-0.x
Open

chore(deps): update dependency aqua:gohugoio/hugo to v0.161.1#68
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/aqua-gohugoio-hugo-0.x

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Apr 21, 2026 •
edited
Loading

This PR contains the following updates:

Package Update Change Pending
aqua:gohugoio/hugo minor 0.159.1 → 0.161.1 0.162.1 (+1)

Release Notes

gohugoio/hugo (aqua:gohugoio/hugo)

v0.161.1

Compare Source

What's Changed

v0.161.0

Compare Source

This release contains two security hardening fixes:

  • We now run the Node tools PostCSS, Babel and TailwindCSS, by default, with the --permission flag with the permissions defined in security.node.permissions. This means that you need Node >= 22 installed and that css.TailwindCSS now requires that the Tailwind CSS CLI must be installed as a Node.js package. The standalone executable is no longer supported
  • We have made the defaults in security.http.urls more restrictive.

But there are some notable new features, as well:

Nested vars support in css.Build and css.Sass

A practical example in css.Build would be to have something like this in hugo.toml:

[params.style]
    primary    = "#​000000"
    background = "#ffffff"
    [params.style.dark]
        primary    = "#ffffff"
        background = "#​000000"

And in the stylesheet:

@​import "hugo:vars";
@​import "hugo:vars/dark" (prefers-color-scheme: dark);

:root {
  color-scheme: light dark;
}

Slice-based permalinks config

The permalinks configuration is now much more flexible (the old setup still works). It uses the same target matchers as in the cascade config, meaning you can now do:

permalinks:
  - target:
      kind: page
      path: "/books/**"
    pattern: /books/:year/:slug/
  - target:
      kind: section
      path: "/{books,books/**}"
    pattern: /libros/:sections[1:]
  - target:
      kind: page
    pattern: /other/:slug/

The above example isn't great, but it at least shows the gist of it.

A more flexible scheme for identifiers in filenames

What we had before was e.g. content/mypost.en.md which told Hugo that the content files was in English. With the new setup you could also name the file content/mypost._language_en_.md. This alone doesn't sound very useful, but this allows you to use more prefixes:

Prefix Description Relevant for
language_ Language Content and layout files.
role_ Role Content and layout files.
version_ Version Content and layout files.
outputformat_ Output format Layout files.
mediatype_ Media type Layout files.
kind_ Page kind Layout files.
layout_ Layout Layout files.

All Changes

v0.160.1

Compare Source

What's Changed

v0.160.0

Compare Source

Now you can inject CSS vars, e.g. from the configuration, into your stylesheets when building with css.Build. Also, now all the render hooks has a .Position method, now also more accurate and effective.

Bug fixes

Improvements

Dependency Updates

Documentation

v0.159.2

Compare Source

Note that the security fix below is not a potential threat if you either:

EDIT IN: This release also adds release archives for non-extended-withdeploy builds.

What's Changed

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
    • Only on Sunday and Saturday (* * * * 0,6)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 21, 2026 •
edited
Loading

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

🔍 Release Content Analysis

Version Jump: v0.159.1 → v0.161.1 (includes v0.160.0, v0.160.1, v0.161.0, v0.161.1)

Security-Related Changes

v0.161.0 - Security Hardening:

  • Node.js Permissions System: Hugo now runs Node tools (PostCSS, Babel, TailwindCSS) with the --permission flag by default, requiring Node.js >= 22. The Tailwind CSS standalone executable is no longer supported - only the npm package version works.
  • HTTP URL Security: More restrictive defaults in security.http.urls. Now denies URLs with userinfo (credentials in URLs like http://user:pass@example.com) by default, while still allowing OAuth token formats.
  • CVE-2026-27820 Protection: Added URL escaping for dangerous content in Markdown links and images to prevent XSS attacks.

v0.159.2 - XSS Fix:

  • Escapes dangerous URLs in Markdown links and images to prevent potential XSS exploits (only a threat if content files are untrusted).

v0.161.1 - Minor Improvements:

  • Honors Retry-After header in resources.GetRemote retries
  • Moved to a newer parser library (parson.c)
  • Added AllowChildProcess to security.node.permissions
  • Restricted default http.urls "@" deny to userinfo only

New Features

v0.161.0:

  • Nested CSS vars support: css.Build and css.Sass now support nested Hugo variables (e.g., @import "hugo:vars/dark" for dark mode variables)
  • Slice-based permalinks config: New flexible permalinks configuration using target matchers (similar to cascade config)
  • Flexible filename identifiers: New prefix system for filenames (language_en_, role_X_, version_X_, outputformat_, mediatype_, kind_, layout_) replacing the old .en.md format

v0.160.0:

  • CSS vars injection support via css.Build's vars parameter

Bug Fixes

v0.161.0:

  • Fixed translation lookup for language variants (hugo:7982)
  • Fixed non-deterministic conflict detection in hugo new content (hugo:14769)
  • Fixed environment isolation for configuration settings (hugo:14763)
  • Fixed filename dimension identifiers to replace mount config (hugo:14756)
  • Do not render aliases if the page is not rendered (hugo:14807)

v0.160.1:

  • Fixed panic when passthrough elements are used in headings (hugo:14677)
  • Fixed panic on edit of legacy mapped template names (hugo:14740)
  • Fixed RenderShortcodes leaking context markers when indented (hugo:12457)
  • Fixed auto-creation of root sections in multilingual sites (hugo:14681)

v0.160.0:

  • Fixed double-escaping of ampersands in link URLs (hugo:14715)
  • Fixed stray quotes from partial decorator in script context (hugo:14711)

🎯 Impact Scope Investigation

Usage Location Analysis

No impact areas identified:

  1. ✅ No Node.js tooling: Codebase doesn't use TailwindCSS, PostCSS, or Babel. Only plain CSS files in assets/css/extended/.
  2. ✅ No resources.GetRemote: No remote resource fetching in templates.
  3. ✅ No custom render hooks: No link/image render hooks that would override default XSS protection.
  4. ✅ No permalinks customization: Default permalink structure used (hugo.yaml has no permalink configuration).
  5. ✅ No security config override: No custom security settings in hugo.yaml.
  6. ✅ Simple Hugo configuration: Uses only basic Hugo features (baseURL, locale, menu, params, theme).

Codebase Characteristics

  • Content files: All content is in Markdown format with standard frontmatter (date, title, description, tags, references)
  • Theme: Uses PaperMod theme (git submodule) with minimal custom overrides (2 layout files: single.html, list.html)
  • CSS: Only plain CSS files, no preprocessors
  • Templates: Uses Hugo's template functions like urls.Parse, .GetTerms, standard partials
  • Hugo features used: Basic features (content management, taxonomies, custom layouts, simple CSS)

Dependency Analysis

  • Hugo: Managed via aqua (mise.toml)
  • Build process: Uses hugo build --gc --minify in GitHub Actions
  • No Node.js dependencies: No package.json, no npm scripts
  • Theme dependency: PaperMod (external, pinned via git submodule)

💡 Recommended Actions

This upgrade is safe to merge immediately. No manual intervention required.

Why It's Safe

  1. Security improvements are non-breaking: The XSS fix and HTTP URL hardening only affect edge cases not present in this codebase.
  2. Node.js security changes don't apply: The project doesn't use any Node.js-based CSS processors, so the permission system changes are irrelevant.
  3. New features are opt-in: All new features (nested CSS vars, slice-based permalinks, filename identifiers) are optional enhancements that don't affect existing functionality.
  4. Bug fixes improve stability: All bug fixes address edge cases and improve reliability without changing core behavior.
  5. Backward compatibility maintained: Hugo maintains excellent backward compatibility - this is a minor version bump with no breaking changes for typical use cases.

Post-Merge Verification

After merging, verify the deployment succeeds by checking:

  1. GitHub Actions build workflow completes successfully
  2. Site deploys to GitHub Pages without errors
  3. Content renders correctly on the live site

No code changes or configuration updates are required for this upgrade.

🔗 Reference Links

Generated by koki-develop/claude-renovate-review

@renovate renovate Bot force-pushed the renovate/aqua-gohugoio-hugo-0.x branch 2 times, most recently from 9290f24 to 5530fc6 Compare April 24, 2026 01:29
@renovate renovate Bot force-pushed the renovate/aqua-gohugoio-hugo-0.x branch 2 times, most recently from dfa819a to 72cfd14 Compare May 5, 2026 13:57
@renovate renovate Bot changed the title chore(deps): update dependency aqua:gohugoio/hugo to v0.160.1 chore(deps): update dependency aqua:gohugoio/hugo to v0.161.0 May 5, 2026
@renovate renovate Bot force-pushed the renovate/aqua-gohugoio-hugo-0.x branch from 72cfd14 to 9bb93fc Compare May 6, 2026 17:56
@renovate renovate Bot changed the title chore(deps): update dependency aqua:gohugoio/hugo to v0.161.0 chore(deps): update dependency aqua:gohugoio/hugo to v0.161.1 May 6, 2026
@renovate renovate Bot force-pushed the renovate/aqua-gohugoio-hugo-0.x branch from 9bb93fc to 6fc7ba5 Compare May 14, 2026 16:54
@renovate renovate Bot force-pushed the renovate/aqua-gohugoio-hugo-0.x branch 2 times, most recently from 9fed292 to cb97d7b Compare May 28, 2026 18:21
@renovate renovate Bot force-pushed the renovate/aqua-gohugoio-hugo-0.x branch from cb97d7b to b4f0784 Compare May 29, 2026 11:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants