Skip to content

chore(deps): update dependency aqua:gohugoio/hugo to v0.161.1#68

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/aqua-gohugoio-hugo-0.x
Open

chore(deps): update dependency aqua:gohugoio/hugo to v0.161.1#68
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/aqua-gohugoio-hugo-0.x

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Apr 21, 2026 •
edited
Loading

This PR contains the following updates:

Package Update Change
aqua:gohugoio/hugo minor 0.159.1 → 0.161.1

Release Notes

gohugoio/hugo (aqua:gohugoio/hugo)

v0.161.1

Compare Source

What's Changed

v0.161.0

Compare Source

This release contains two security hardening fixes:

  • We now run the Node tools PostCSS, Babel and TailwindCSS, by default, with the --permission flag with the permissions defined in security.node.permissions. This means that you need Node >= 22 installed and that css.TailwindCSS now requires that the Tailwind CSS CLI must be installed as a Node.js package. The standalone executable is no longer supported
  • We have made the defaults in security.http.urls more restrictive.

But there are some notable new features, as well:

Nested vars support in css.Build and css.Sass

A practical example in css.Build would be to have something like this in hugo.toml:

[params.style]
    primary    = "#​000000"
    background = "#ffffff"
    [params.style.dark]
        primary    = "#ffffff"
        background = "#​000000"

And in the stylesheet:

@​import "hugo:vars";
@​import "hugo:vars/dark" (prefers-color-scheme: dark);

:root {
  color-scheme: light dark;
}

Slice-based permalinks config

The permalinks configuration is now much more flexible (the old setup still works). It uses the same target matchers as in the cascade config, meaning you can now do:

permalinks:
  - target:
      kind: page
      path: "/books/**"
    pattern: /books/:year/:slug/
  - target:
      kind: section
      path: "/{books,books/**}"
    pattern: /libros/:sections[1:]
  - target:
      kind: page
    pattern: /other/:slug/

The above example isn't great, but it at least shows the gist of it.

A more flexible scheme for identifiers in filenames

What we had before was e.g. content/mypost.en.md which told Hugo that the content files was in English. With the new setup you could also name the file content/mypost._language_en_.md. This alone doesn't sound very useful, but this allows you to use more prefixes:

Prefix Description Relevant for
language_ Language Content and layout files.
role_ Role Content and layout files.
version_ Version Content and layout files.
outputformat_ Output format Layout files.
mediatype_ Media type Layout files.
kind_ Page kind Layout files.
layout_ Layout Layout files.

All Changes

v0.160.1

Compare Source

What's Changed

v0.160.0

Compare Source

Now you can inject CSS vars, e.g. from the configuration, into your stylesheets when building with css.Build. Also, now all the render hooks has a .Position method, now also more accurate and effective.

Bug fixes

Improvements

Dependency Updates

Documentation

v0.159.2

Compare Source

Note that the security fix below is not a potential threat if you either:

EDIT IN: This release also adds release archives for non-extended-withdeploy builds.

What's Changed

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At 12:00 AM through 04:59 AM and 10:00 PM through 11:59 PM, Monday through Friday (* 0-4,22-23 * * 1-5)
    • Only on Sunday and Saturday (* * * * 0,6)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 21, 2026 •
edited
Loading

Renovate PR Review Results

⚖️ Safety Assessment: ✅ Safe

🔍 Release Content Analysis

Version Jump Overview: 0.159.1 → 0.161.1 (3 minor versions, spanning v0.159.2, v0.160.0, v0.160.1, v0.161.0, v0.161.1)

Security Fixes

  • v0.159.2: Fixed XSS vulnerability (CVE-2026-35166) in Markdown link/image rendering by escaping dangerous URLs. Not applicable to this codebase as it doesn't use custom render hooks for links/images
  • v0.161.0: Hardened Node.js tool execution with --permission flag for PostCSS/Babel/TailwindCSS (requires Node ≥ 22). Not applicable - this codebase doesn't use these tools
  • v0.161.0: Restricted security.http.urls defaults (credentials in URLs blocked by default)
  • v0.161.1: Added AllowChildProcess to security.node.permissions
  • v0.161.1: Further restricted HTTP URLs with userinfo (credentials) by default

Breaking Changes

  • v0.161.0: TailwindCSS standalone executable no longer supported; must use Node.js package. Not applicable - this codebase doesn't use TailwindCSS
  • v0.161.0: Node.js ≥ 22 required for CSS tools. Not applicable - no CSS tools in use

New Features

  • v0.160.0: CSS variable injection via @import "hugo:vars" in css.Build - allows passing configuration values to stylesheets
  • v0.160.0: Nested CSS vars support with @import "hugo:vars/dark" syntax
  • v0.160.0: Enhanced .Position method in all render hooks (more accurate location tracking)
  • v0.161.0: Flexible filename identifiers (_language_, _role_, _version_, _outputformat_, _mediatype_, _kind_, _layout_ prefixes)
  • v0.161.0: Slice-based permalinks configuration with PageMatcher targets
  • v0.161.1: Honor Retry-After header in resources.GetRemote retries

Bug Fixes

  • v0.159.2: Fixed shared reader bug in Source.ValueAsOpenReadSeekCloser
  • v0.160.0: Fixed double-escaping of ampersands in link URLs
  • v0.160.0: Fixed stray quotes from partial decorators in script context
  • v0.160.1: Fixed panic with passthrough elements in headings
  • v0.160.1: Fixed panic on legacy mapped template names edit
  • v0.160.1: Fixed RenderShortcodes leaking context markers when indented
  • v0.160.1: Fixed auto-creation of root sections in multilingual sites

🎯 Impact Scope Investigation

Codebase Analysis

✅ No Breaking Changes Impact

  1. Node.js Tools: Not used

    • No TailwindCSS, PostCSS, or Babel configuration found
    • No package.json, tailwind.config.*, postcss.config.*, or .babelrc files
    • The security hardening requiring Node ≥ 22 does not affect this project

  2. Template Functions: Compatible

    • Uses urls.Parse in layouts/_default/single.html:61 for parsing reference URLs - no breaking changes to this function
    • No usage of deprecated functions detected

  3. Configuration: Simple and compatible

    • Uses basic Hugo config in hugo.yaml with PaperMod theme
    • No permalinks configuration (slice-based config is optional enhancement)
    • No security.* configuration (defaults are acceptable)

  4. Content Structure: Standard format

    • All content uses standard content/posts/<yyyy>/<mm>/<dd>/<slug>.md format
    • No files using new filename identifier formats (_language_, _role_, etc.)
    • Content contains only Japanese posts with frontmatter (date, title, description, tags, references)

  5. Custom Templates: Minimal and compatible

    • Only two custom layout files: layouts/_default/single.html and layouts/_default/list.html
    • Both use standard Hugo functions with no deprecated syntax
    • No custom render hooks (uses Hugo defaults, so XSS fix applies automatically)

  6. Theme: Git submodule

    • Uses PaperMod theme as git submodule at commit 10d3dcc
    • No direct modifications that would conflict with Hugo updates

  7. Resource Fetching: No remote resources

    • No usage of resources.GetRemote (Retry-After improvement not applicable)

Dependencies Impact

  • Hugo version managed by mise (aqua provider) - straightforward version bump
  • No other Hugo-related dependencies affected

💡 Recommended Actions

Immediate Actions

  1. Merge this PR - The update is safe and backward compatible for this codebase
  2. No code changes required - All existing templates and content work as-is

Optional Enhancements (Future Consideration)

  1. CSS Variable Injection - Could leverage new @import "hugo:vars" feature if dynamic theming is desired
  2. Filename Identifiers - New _language_, _role_, _version_ prefixes available if multi-version content needed
  3. Permalinks Configuration - Slice-based config with PageMatcher offers more flexibility if URL structure changes needed

Benefits of Updating

  • Security: XSS vulnerability (CVE-2026-35166) patched automatically
  • Stability: Multiple bug fixes for edge cases
  • Performance: Improved resource fetching with Retry-After header support
  • Future-proofing: Access to new features when needed

🔗 Reference Links

Release Notes:

Security Information:

Feature Documentation:

Technical Analysis:

Generated by koki-develop/claude-renovate-review

@renovate renovate Bot force-pushed the renovate/aqua-gohugoio-hugo-0.x branch 2 times, most recently from 9290f24 to 5530fc6 Compare April 24, 2026 01:29
@renovate renovate Bot force-pushed the renovate/aqua-gohugoio-hugo-0.x branch 2 times, most recently from dfa819a to 72cfd14 Compare May 5, 2026 13:57
@renovate renovate Bot changed the title chore(deps): update dependency aqua:gohugoio/hugo to v0.160.1 chore(deps): update dependency aqua:gohugoio/hugo to v0.161.0 May 5, 2026
@renovate renovate Bot force-pushed the renovate/aqua-gohugoio-hugo-0.x branch from 72cfd14 to 9bb93fc Compare May 6, 2026 17:56
@renovate renovate Bot changed the title chore(deps): update dependency aqua:gohugoio/hugo to v0.161.0 chore(deps): update dependency aqua:gohugoio/hugo to v0.161.1 May 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants