Skip to content

chore(deps): update hugo to v0.170.0 - #506

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/hugo
Open

chore(deps): update hugo to v0.170.0#506
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/hugo

Conversation

@renovate

@renovate renovate Bot commented Nov 13, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change
ghcr.io/gohugoio/hugo minor v0.169.0 → v0.170.0
hugo uses-with minor 0.169.0 → 0.170.0

Release Notes

gohugoio/hugo (ghcr.io/gohugoio/hugo)

v0.170.0

Compare Source

The big change in this release is that the extended edition of Hugo is gone. LibSass has been deprecated for a long time, and it was the main reason we needed a CGO-enabled extended build. There is now only one Hugo binary, and apart from LibSass it has all the features the extended build had.

Notes

  • Setting transpiler to libsass in css.Sass now returns an error. Dart Sass is now the default and the only transpiler, so you need to install it if you use Sass.
  • We no longer publish hugo_extended_* archives. To avoid breaking existing CI setups, we publish aliases for the most downloaded extended archives (e.g. hugo_extended_<version>_linux-amd64.tar.gz, hugo_extended_<version>_Linux-64bit.tar.gz, the linux-amd64.deb, linux-arm64.tar.gz and windows-amd64.zip), but you should update your scripts to use the standard archives. The extended_withdeploy builds are also removed. See Installation.
  • hugo.IsExtended now always returns false, and the module config setting hugoVersion.extended is deprecated and has no effect.
  • Command-line flags (e.g. --buildDrafts) now override OS environment variables (e.g. HUGO_BUILDDRAFTS). This also fixes HUGO_ENVIRONMENT=qa hugo build -e staging loading the staging config but reporting qa in hugo.Environment.
  • strings.Truncate has been rewritten on top of a proper HTML scanner. It now handles comments, void elements, quoted attributes with > and raw text elements such as script correctly, and it's faster and allocates less. On a curious note, the old version was implemented by Mathias Biilmann, the Netlify CEO.
  • time.Time values now keep their named time zone, and eq, ne, in and uniq compare time.Time values by instant.
  • resources.Match and friends now preserve the directory casing in the matched paths, so e.g. resources.Match "gallery/Travel/Iceland/*" now works on case-sensitive file systems.
  • Syncing of static files is much faster for big unchanged files, as we now skip the content check for files with the same size and modification time.
  • Several fixes and hardening of the WASM based image codecs (AVIF crash at encoderSpeed 6 and lower, recovering from broken WASM instances in the server).

Security

Hugo
  • Passthrough content is now HTML escaped when no passthrough render hook is set, unless markup.goldmark.renderer.unsafe is enabled. Before this, e.g. \(<img src=x onerror=alert(1)>\) in a content file emitted raw HTML.
  • The wrapperClass option, settable from the highlight shortcode and transform.Highlight, is now escaped.
  • Vendored module paths are now restricted to the _vendor directory (symlinks pointing outside are rejected).

Thanks to @​R0X4R for finding and reporting the last two issues.

Go

This release is built with Go 1.27.4, which includes 12 security fixes. The one most relevant for Hugo is a crash in the net/http HTTP/1 server (used by hugo server) caused by a race in MaxBytesReader. The other 11 are in the cmd/go toolchain (cgo flag and linker injection at build time) and mainly matter if you build Hugo from source with untrusted dependencies.

Dependencies
  • golang.org/x/net v0.62.0 fixes two issues in the html package: quadratic complexity when coalescing text nodes, and a namespace issue when rendering raw text. Hugo uses this package when collecting HTML elements for hugo_stats.json and in the AsciiDoc integration.
  • github.com/go-jose/go-jose/v4 v4.1.6 (indirect dependency) contains a number of security fixes, among them GHSA-mgcc-cww5-fp2q (RSA modulus size limit when parsing JWKs) and a stack depth limit in the JSON decoder.

Changes

Dependency Updates

Documentation

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
chore(deps): update hugo to v0.170.0
19ccede 
| datasource      | package               | from     | to       |
| --------------- | --------------------- | -------- | -------- |
| docker          | ghcr.io/gohugoio/hugo | v0.169.0 | v0.170.0 |
| github-releases | gohugoio/hugo         | v0.169.0 | v0.170.0 |


Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@renovate
renovate Bot requested a review from a team as a code owner November 13, 2026 22:05
@renovate
renovate Bot enabled auto-merge (rebase) November 13, 2026 22:06

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

automated no-issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants