v0.140.2

The timing of this release comes from the security fix in golang.org/x/net's html.Parse function. This is used in two places in Hugo:

1. Extracting table of contents from Asciidoctor rendered output.
2. Collecting HTML classes etc. when build stats is enabled

It's a little bit of a stretch to see how this could be exploited in Hugo, but we understand that many want a clean security report. See this issue for details.

What's Changed

• Print cli usage of hugo gen chromastyles alongside css 83cec78 @diwasrimal
• build(deps): bump golang.org/x/net from 0.32.0 to 0.33.0 4e52be8 @dependabot[bot]
• config/allconfig: Fix slice of language configs 7888ac5 @jmooring #13201
• config/allconfig: Throw error when output format is not defined eb1dbe0 @jmooring #13199
• Fix same resource file published more than once 77824d7 @bep #13164
• markup/highlight: Add wrapperClass option ec0caae @bep
• Update README.md 845b888 @bep

v0.140.1

Some bug fixes in the (most likely) last Hugo release of the year. Of some technical interest to some, I can mention that I, @bep, have reworked hugoreleaser to use YAML (with anchors/aliases) instead of TOML for the release configuration. Have a look at the end result.

What's Changed

• Update gocloud and docs for S3-Compatible Endpoints e229f4b @tebriel
• js/esbuild: Don't try to resolve packages in /assets marked as external 0202539 @bep #13183
• Fix union, complement, symdiff, and intersect for transient resources 4a5e940 @bep #13181
• release: Add withdeploy deb extended archives 48a7aee @bep #13166
• common/loggers: Write PrintTimerIfDelayed output to stdErr 6c583e3 @jmooring #13171
• build(deps): bump github.com/spf13/cast from 1.7.0 to 1.7.1 5d64b49 @dependabot[bot]
• hugolib: Fix fallbacks for menu entry Name and Title b3f3294 @jmooring #13161

v0.140.0

The big new feature in this release is js.Batch – this enables JavaScript bundle groups (e.g. scripts per section) with global code splitting and flexible hooks/runners setup.

Bug fixes

• Fix panic on server rebuilds when using both base templates and template.Defer a5e5be2 @bep #12963
• js: Fix js.Batch for multihost setups 565c30e @bep #13151
• parser/pageparser: Fix Org Mode summary delimiter assignment 48dd6a9 @jmooring #13152
• Fix a rebuild on resource rename case 744b856 @bep
• tpl/tplimpl: Fix title attribute in details shortcode a32c889 @jmooring
• Fix Sass imports on the form index.{scss,sass} 5ab38de @bep #13123
• markup/goldmark: Fix blockquote render hook text parsing 3437340 @jmooring #12913 #13119

Improvements

• js/esbuild: Add missing es2024 target 5c80cb0 @bep
• js/esbuild: Add runners after scripts 7de5317 @bep
• js/esbuild: Batch: Avoid nil Instances slice 4cbd4ef @bep
• tpl/tplimpl: Update youtube shortcode 852d868 @jmooring
• tpl/tplimpl: Update details shortcode 1e34e5b @jmooring
• tpl/collections: Allow querify to accept a map argument 641d261 @jmooring #13131
• js/esbuild: Build groups in order of their ID a834bb9 @bep
• tpl/tplimpl: Add details shortcode 4f130f6 @racehd
• Write all logging (INFO, WARN, ERROR) to stderr 9dfa112 @bep #13074
• js/esbuild: Add platform option ec1933f @bep #13136
• Add config option disableDefaultLanguageRedirect 75ad9cd @bep #13133
• Add js.Batch e293e7c @bep #12626 #7499 #9978 #12879 #13113 #13116
• Upgrade to Go 1.23.4 6be2530 @bep #13130
• Remove some old and unused shell scripts 989b299 @bep

Dependency Updates

• build(deps): bump golang.org/x/crypto from 0.30.0 to 0.31.0 157d864 @dependabot[bot]
• build(deps): bump golang.org/x/tools from 0.27.0 to 0.28.0 947e4e6 @dependabot[bot]
• build(deps): bump github.com/hairyhenderson/go-codeowners 5f89786 @dependabot[bot]
• build(deps): bump golang.org/x/net from 0.31.0 to 0.32.0 7b69218 @dependabot[bot]

v0.139.5

This is a release created for technical reasons, see #13147

It's the same as https://github.com/gohugoio/hugo/releases/tag/v0.139.4 -- go there for release archives.

v0.139.4

This release contains a security fix. See this Security Advisory for details. Note that this is only relevant if you don't trust your content (e.g. Markdown) files.

What's Changed

• tpl/tplimpl: Escape Markdown attributes in render hooks and shortcodes 54398f8 @jmooring
• deps: Upgrade github.com/bep/godartsass/v2 v2.3.1 => v2.3.2 b8c15f2 @bep
• common/maps: Simplify TestScratchSetInMap/DeleteInMap d0dc518 @alexandear
• markup/tableofcontents: Cast Fragments.ToHTML args to int b529859 @jmooring #13107

v0.139.3

What's Changed

• Fix server edits of resources included in shortcode/hooks c1dc35d @bep #13093
• commands: Fix flaw in the livereload logic dea158c @bep
• build(deps): bump github.com/bep/godartsass/v2 from 2.3.0 to 2.3.1 7e130e3 @dependabot[bot]
• build(deps): bump github.com/tetratelabs/wazero from 1.8.1 to 1.8.2 88b7868 @dependabot[bot]
• Fix some typos fc3d1cb @thirdkeyword

v0.139.2

Note that this is the second patch release today. See v0.139.1. We had to do this release to get the Hugo Docs build running.

What's Changed

• modules: Skip empty lines in modules.txt 0ab8189 @bep #13084

v0.139.1

What's Changed

• Revert "build(deps): bump github.com/tdewolff/minify/v2 from 2.20.37 to 2.21.1" aa3dd19 @bep #13082
• minifiers: Add failing test for upstream bug 5a50eee @bep #13082
• dartsass: Fix nilpointer on Close when Dart Sass isn't installed 8d017a6 @bep #13076

v0.139.0

This release is mostly about removing code that has been deprecated for a long time. This has been shown as an ERROR in the build log and failed the build for at least the last 6 minor Hugo versions, in most cases much longer.

But this is also a full dependency refresh, and there are also some new stuff. For one, we added a -O flag to hugo server to open up the site in your browser after start. This is now my (@bep) shortcut to start the server:

function h() {
  hugo server  -F -O -N -D
}

Note

• dartsass: Remove support for v1 of the protocol/binary (note) 1fd845e @bep
• Remove deprecations <= v0.122.0 (note) ad43d13 @bep

Bug fixes

• dartsass: Fix error message 8d92042 @bep #13065
• Fix extra newline/paragraphs issue with .RenderShortcodes d4de780 @bep #13051
• markup/goldmark: Fix typo in error message e79ee0d @deining

Improvements

• Make sure term is always set e917401 @bep #13063
• dartsass: Add silenceDeprecations option 3b6eaf9 @bep #13045
• Run go mod tidy 5e3133a @bep
• commands: Add -O flag to server to open browser ac6962d @bep #13040
• Preserve input type. 23d21b0 @KN4CK3R
• server: Strip ANSI escape codes from browser error log ce9cf88 @bep #13037
• parser/metadecoders: Add benchmark 8aba6dc @bep
• Add site.Store and hugo.Store and Shortcode.Store a7df536 @bep #13021
• markup/goldmark: Improve the raw HTML omitted warning 2b97a2a @jmooring #13023

Dependency Updates

• build(deps): bump github.com/aws/aws-sdk-go-v2/service/cloudfront eb29814 @dependabot[bot]
• build(deps): bump google.golang.org/api from 0.191.0 to 0.206.0 61e2ce2 @dependabot[bot]
• build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.30.3 to 1.32.4 2d503f8 @dependabot[bot]
• build(deps): bump github.com/fsnotify/fsnotify from 1.7.0 to 1.8.0 3a6b2e6 @dependabot[bot]
• deps: Upgrade github.com/bep/imagemeta v0.8.1 => v0.8.3 6bde8ab @bep
• build(deps): bump golang.org/x/tools from 0.26.0 to 0.27.0 2c54c32 @dependabot[bot]
• build(deps): bump github.com/tdewolff/minify/v2 from 2.20.37 to 2.21.1 7a2f04e @dependabot[bot]
• build(deps): bump github.com/fatih/color from 1.17.0 to 1.18.0 7921777 @dependabot[bot]
• build(deps): bump golang.org/x/image from 0.21.0 to 0.22.0 33e964d @dependabot[bot]
• deps: Upgrade github.com/yuin/goldmark v1.7.4 => v1.7.8 588c901 @bep #12958
• build(deps): bump golang.org/x/sync from 0.8.0 to 0.9.0 46e1705 @dependabot[bot]
• build(deps): bump github.com/hairyhenderson/go-codeowners cb6580d @dependabot[bot]

Documentation

• docs: Regen CLI docs 66dd6ec @bep
• docs: Regenerate CLI docs 58a3c91 @bep

Build Setup

• release: Add missing withdeploy archive for arm64 Linux f7fc6cc @bep #13029

v0.138.0

What's Changed

• Fix concurrent map read and map write in short page lookups 95e2d5b @bep #13019
• Alias Page.Scratch to Page.Store (note) 2c3efc8 @bep #13016