Repository navigation
deps: bump HUGO to 0.169.0 - #3817
Merged
Merged
Conversation
Made with ❤️️ by updatecli
Made with ❤️️ by updatecli
updateclibot
Bot
added
the
dependencies
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
deps: Bump HUGO version in Netlify configuration
deps: update hugo used by Netlify to 0.169.0
1 file(s) updated with "HUGO_VERSION = \"0.169.0\"": * netlify.toml
v0.169.0
The main motivation behind this release is to get out a build with [Go 1.27.3](https://github.com/golang/go/issues?q=milestone%3AGo1.27.3+label%3ACherryPickApproved), which blocks trust in a small set of intermediate certificates due to specific security concerns around their operation. See the [eMudhra incident](https://go.dev/blog/emudhra-incident) for more information. This affects Hugo features that fetch remote resources over HTTPS, e.g. `resources.GetRemote`. This release also contains some security hardening of the template functions and menu entries that can render content as HTML (see below), a deprecation of looking up reserved front matter fields via `.Params` (also below), a faster and more robust `plainify`, and a set of bug fixes. ## Security notes Templates are trusted in Hugo, but content (including front matter) is not necessarily. This release tightens a few places where values from content could end up rendered as unescaped HTML: * `pre` and `post` values in menu entries defined in **front matter** are now HTML escaped, unless `text/html` is allowed in [`security.allowContent`](https://gohugo.io/configuration/security/), which already marks HTML in `/content` as trusted. A warning (`warning-menu-pre-post-html-escaped`) is logged when a value containing HTML markup is escaped. Menu entries defined in the project configuration are not affected. f63482bf * `emojify` and `plainify` now return a `string` unless the input is `template.HTML`, in which case the result is also `template.HTML`. Previously both always returned `template.HTML`, so e.g. `{{ .Title | emojify }}` would mark a potentially unsafe title as safe HTML. If you relied on the old behavior with trusted input, pipe the result through `safeHTML`. Thanks to @Reload3d for reporting this. #15452 ## Deprecations Reserved front matter fields such as `title`, `date` and `summary` are currently also stored in `.Params`. Lookups such as `.Params.title` (and `ByParam "title"`, `where .Pages "Params.title" ...` etc.) are now redirected to the corresponding `Page` method and logged as deprecated, unless the field was set in the `params` section of front matter. The content of `.Params` is unchanged for now. 53e1fef9 | Deprecated | Use instead | | --- | --- | | `.Params.date` | `.Date` | | `.Params.description` | `.Description` | | `.Params.draft` | `.Draft` | | `.Params.expirydate` | `.ExpiryDate` | | `.Params.keywords` | `.Keywords` | | `.Params.lastmod` | `.Lastmod` | | `.Params.layout` | `.Layout` | | `.Params.linktitle` | `.LinkTitle` | | `.Params.publishdate` | `.PublishDate` | | `.Params.slug` | `.Slug` | | `.Params.summary` | `.RawSummary` (new) | | `.Params.title` | `.Title` | | `.Params.translationkey` | `.TranslationKey` | | `.Params.type` | `.Type` | | `.Params.weight` | `.Weight` | ## Bug fixes * hugolib: Fix template change detection when saving via temp file and rename 46e51f30 @bep #15484 * markup/goldmark: Fix auto heading ID when link text starts with a bracket c22158c1 @chanellebingham #15472 * urls: Fix JoinPath panic with empty slice ce5d232b @Ferdinand-MZ #15473 * js: Fix js.Build with browser-disabled extensionless requires 2efee511 @bep #15481 * Fix Site.Key used in e.g. partialCached b86e0caa @bep #15466 * ci: Fix Windows running out of disk space and simplify test runs 77230eba @bep * hugolib: Fix build hang after too many page render errors 85fb23f1 @bep #15449 * tpl/cast: Fix nil pointer panic in hugo gen docshelper 8df31809 @jmooring #15444 ## Improvements * Redirect .Params.title etc. to .Title etc. and deprecate it 53e1fef9 @bep * ci: Revert to plain go install honnef.co/go/tools/cmd/staticcheck@latest 3e67572c @bep * navigation: Escape pre/post in front matter menu entries f63482bf @bep * Upgrade to Go 1.27.3 7343fc9c @bep * resources: Make processed image key stable across builds ff4eab75 @bep #15467 * tpl: Make StripHTML (plainify) more robust and faster 7ec3a366 @bep #15462 * tpl/transform: Make emojify and plainify preserve template.HTML input type 895f5837 @bep #15452 * Make emojify return a string 87bf5858 @bep #15452 * Skip staticcheck in check.sh unless --full is set 9d502917 @bep #15453 * Delete CLAUDE.md 683a877f @bep ## Dependency Updates * build(deps): bump github.com/getkin/kin-openapi from 0.151.0 to 0.152.0 6e494d01 @dependabot[bot] * build(deps): bump github.com/tdewolff/minify/v2 from 2.24.19 to 2.24.22 8c1fdcac @dependabot[bot] * build(deps): bump github.com/tdewolff/parse/v2 from 2.8.16 to 2.8.18 ed22b85c @dependabot[bot] * build(deps): bump github.com/getkin/kin-openapi from 0.149.0 to 0.151.0 4102d1af @dependabot[bot] * build(deps): bump golang.org/x/tools from 0.51.0 to 0.52.0 ac5af664 @dependabot[bot]deps: Bump HUGO version from GitHub Action
deps: update hugo used by Github Action to 0.169.0
1 file(s) updated with "hugo-version: 0.169.0": * .github/workflows/build.yaml
v0.169.0
The main motivation behind this release is to get out a build with [Go 1.27.3](https://github.com/golang/go/issues?q=milestone%3AGo1.27.3+label%3ACherryPickApproved), which blocks trust in a small set of intermediate certificates due to specific security concerns around their operation. See the [eMudhra incident](https://go.dev/blog/emudhra-incident) for more information. This affects Hugo features that fetch remote resources over HTTPS, e.g. `resources.GetRemote`. This release also contains some security hardening of the template functions and menu entries that can render content as HTML (see below), a deprecation of looking up reserved front matter fields via `.Params` (also below), a faster and more robust `plainify`, and a set of bug fixes. ## Security notes Templates are trusted in Hugo, but content (including front matter) is not necessarily. This release tightens a few places where values from content could end up rendered as unescaped HTML: * `pre` and `post` values in menu entries defined in **front matter** are now HTML escaped, unless `text/html` is allowed in [`security.allowContent`](https://gohugo.io/configuration/security/), which already marks HTML in `/content` as trusted. A warning (`warning-menu-pre-post-html-escaped`) is logged when a value containing HTML markup is escaped. Menu entries defined in the project configuration are not affected. f63482bf * `emojify` and `plainify` now return a `string` unless the input is `template.HTML`, in which case the result is also `template.HTML`. Previously both always returned `template.HTML`, so e.g. `{{ .Title | emojify }}` would mark a potentially unsafe title as safe HTML. If you relied on the old behavior with trusted input, pipe the result through `safeHTML`. Thanks to @Reload3d for reporting this. #15452 ## Deprecations Reserved front matter fields such as `title`, `date` and `summary` are currently also stored in `.Params`. Lookups such as `.Params.title` (and `ByParam "title"`, `where .Pages "Params.title" ...` etc.) are now redirected to the corresponding `Page` method and logged as deprecated, unless the field was set in the `params` section of front matter. The content of `.Params` is unchanged for now. 53e1fef9 | Deprecated | Use instead | | --- | --- | | `.Params.date` | `.Date` | | `.Params.description` | `.Description` | | `.Params.draft` | `.Draft` | | `.Params.expirydate` | `.ExpiryDate` | | `.Params.keywords` | `.Keywords` | | `.Params.lastmod` | `.Lastmod` | | `.Params.layout` | `.Layout` | | `.Params.linktitle` | `.LinkTitle` | | `.Params.publishdate` | `.PublishDate` | | `.Params.slug` | `.Slug` | | `.Params.summary` | `.RawSummary` (new) | | `.Params.title` | `.Title` | | `.Params.translationkey` | `.TranslationKey` | | `.Params.type` | `.Type` | | `.Params.weight` | `.Weight` | ## Bug fixes * hugolib: Fix template change detection when saving via temp file and rename 46e51f30 @bep #15484 * markup/goldmark: Fix auto heading ID when link text starts with a bracket c22158c1 @chanellebingham #15472 * urls: Fix JoinPath panic with empty slice ce5d232b @Ferdinand-MZ #15473 * js: Fix js.Build with browser-disabled extensionless requires 2efee511 @bep #15481 * Fix Site.Key used in e.g. partialCached b86e0caa @bep #15466 * ci: Fix Windows running out of disk space and simplify test runs 77230eba @bep * hugolib: Fix build hang after too many page render errors 85fb23f1 @bep #15449 * tpl/cast: Fix nil pointer panic in hugo gen docshelper 8df31809 @jmooring #15444 ## Improvements * Redirect .Params.title etc. to .Title etc. and deprecate it 53e1fef9 @bep * ci: Revert to plain go install honnef.co/go/tools/cmd/staticcheck@latest 3e67572c @bep * navigation: Escape pre/post in front matter menu entries f63482bf @bep * Upgrade to Go 1.27.3 7343fc9c @bep * resources: Make processed image key stable across builds ff4eab75 @bep #15467 * tpl: Make StripHTML (plainify) more robust and faster 7ec3a366 @bep #15462 * tpl/transform: Make emojify and plainify preserve template.HTML input type 895f5837 @bep #15452 * Make emojify return a string 87bf5858 @bep #15452 * Skip staticcheck in check.sh unless --full is set 9d502917 @bep #15453 * Delete CLAUDE.md 683a877f @bep ## Dependency Updates * build(deps): bump github.com/getkin/kin-openapi from 0.151.0 to 0.152.0 6e494d01 @dependabot[bot] * build(deps): bump github.com/tdewolff/minify/v2 from 2.24.19 to 2.24.22 8c1fdcac @dependabot[bot] * build(deps): bump github.com/tdewolff/parse/v2 from 2.8.16 to 2.8.18 ed22b85c @dependabot[bot] * build(deps): bump github.com/getkin/kin-openapi from 0.149.0 to 0.151.0 4102d1af @dependabot[bot] * build(deps): bump golang.org/x/tools from 0.51.0 to 0.52.0 ac5af664 @dependabot[bot]Created automatically by Updatecli
Options:
Most of Updatecli configuration is done via its manifest(s).
Feel free to report any issues at github.com/updatecli/updatecli.
If you find this tool useful, do not hesitate to star our GitHub repository as a sign of appreciation, and/or to tell us directly on our chat!