Repository navigation
chore(deps): update hugo to v0.169.0 - #503
Merged
Merged
Conversation
| datasource | package | from | to | | --------------- | --------------------- | -------- | -------- | | docker | ghcr.io/gohugoio/hugo | v0.168.0 | v0.169.0 | | github-releases | gohugoio/hugo | v0.168.0 | v0.169.0 | Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v0.168.0→v0.169.00.168.0→0.169.0Release Notes
gohugoio/hugo (ghcr.io/gohugoio/hugo)
v0.169.0Compare Source
The main motivation behind this release is to get out a build with Go 1.27.3, which blocks trust in a small set of intermediate certificates due to specific security concerns around their operation. See the eMudhra incident for more information. This affects Hugo features that fetch remote resources over HTTPS, e.g.
resources.GetRemote.This release also contains some security hardening of the template functions and menu entries that can render content as HTML (see below), a deprecation of looking up reserved front matter fields via
.Params(also below), a faster and more robustplainify, and a set of bug fixes.Security notes
Templates are trusted in Hugo, but content (including front matter) is not necessarily. This release tightens a few places where values from content could end up rendered as unescaped HTML:
preandpostvalues in menu entries defined in front matter are now HTML escaped, unlesstext/htmlis allowed insecurity.allowContent, which already marks HTML in/contentas trusted. A warning (warning-menu-pre-post-html-escaped) is logged when a value containing HTML markup is escaped. Menu entries defined in the project configuration are not affected.f63482bemojifyandplainifynow return astringunless the input istemplate.HTML, in which case the result is alsotemplate.HTML. Previously both always returnedtemplate.HTML, so e.g.{{ .Title | emojify }}would mark a potentially unsafe title as safe HTML. If you relied on the old behavior with trusted input, pipe the result throughsafeHTML. Thanks to @Reload3d for reporting this. #15452Deprecations
Reserved front matter fields such as
title,dateandsummaryare currently also stored in.Params. Lookups such as.Params.title(andByParam "title",where .Pages "Params.title" ...etc.) are now redirected to the correspondingPagemethod and logged as deprecated, unless the field was set in theparamssection of front matter. The content of.Paramsis unchanged for now.53e1fef.Params.date.Date.Params.description.Description.Params.draft.Draft.Params.expirydate.ExpiryDate.Params.keywords.Keywords.Params.lastmod.Lastmod.Params.layout.Layout.Params.linktitle.LinkTitle.Params.publishdate.PublishDate.Params.slug.Slug.Params.summary.RawSummary(new).Params.title.Title.Params.translationkey.TranslationKey.Params.type.Type.Params.weight.WeightBug fixes
46e51f3@bep #15484c22158c@chanellebingham #15472ce5d232@Ferdinand-MZ #154732efee51@bep #15481b86e0ca@bep #1546677230eb@bep85fb23f@bep #154498df3180@jmooring #15444Improvements
53e1fef@bep3e67572@bepf63482b@bep7343fc9@bepff4eab7@bep #154677ec3a36@bep #15462895f583@bep #1545287bf585@bep #154529d50291@bep #15453683a877@bepDependency Updates
6e494d0@dependabot[bot]8c1fdca@dependabot[bot]ed22b85@dependabot[bot]4102d1a@dependabot[bot]ac5af66@dependabot[bot]Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.