ci(deps): update dependency hugo to v0.145.0

[renovate]

Note: This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Update	Change
hugo	minor	0.124.1 → 0.145.0

---

Release Notes

gohugoio/hugo (hugo)

v0.145.0

Compare Source

The notable new feature is the new transform.PortableText function that makes it possible to use the Sanity CMS with Hugo.

Bug fixes

• all: Typo fixes 4094a1e @​coliff
• all: Run modernize -fix ./... 521911a @​bep
• readme: Fix relative links in Editions section ab9e545 @​martey
• Fix some related content issues with content adapters 381c0da @​bep #​13443
• Fix potential nilpointer in httpcache config 227e429 @​bep
• Fix --printPathWarnings when site calls templates.Defer c3d435a @​bep #​13420

Improvements

• Use the page path and not the backing filename as the last resort in the default sort c498d0f @​bep
• tpl: HTTPS the instagram Shortcode JS 2f4e666 @​coliff
• Add transform.PortableText 04f21b4 @​bep
• hugolib: Deprecate _build front matter key in favor of build d0ce942 @​jmooring

Dependency Updates

• deps: Upgrade github.com/rogpeppe/go-internal v1.13.1 => v1.14.1 6927e6f @​bep #​13449
• build(deps): bump github.com/yuin/goldmark-emoji from 1.0.4 to 1.0.5 b7ae24b @​dependabot[bot]
• build(deps): bump github.com/google/go-cmp from 0.6.0 to 0.7.0 1a4851f @​dependabot[bot]
• build(deps): bump github.com/tetratelabs/wazero from 1.8.2 to 1.9.0 d1f2330 @​dependabot[bot]

Documentation

• github: Build docker image with both extended and withdeploy tags e5eecbd @​margau

Build Setup

• snap: Update Node.js to 22.x 4fd7f32 @​jmooring

v0.144.2

Compare Source

What's Changed

• Fix --printPathWarnings when site calls templates.Defer c3d435a @​bep #​13420

v0.144.1

Compare Source

What's Changed

• markup/goldmark: Fix panic on empty Markdown header 494e88a @​bep #​13416

v0.144.0

Compare Source

Go 1.24 upgrade, several performance improvements, new :contentbasename and :slugorcontentbasename permalink tokens, enable KaTeX mhchem extension for transform.ToMath, full dependency refresh, new drop option for js.Build, new auth module option useful for private module repositories, autoID support for definition terms, new configurationTypes configuration option, and more. For more details, see this topic.

Note

• Fix auto generated header ids so they don't contain e.g. hyperlink destinations (note) 24cc255 @​bep #​13405 #​13410

Bug fixes

• markup/goldmark: Fix panic on stray attribute nodes 85c1727 @​bep
• Fix Position for passthrough hooks 641403f @​bep #​13406
• config: Fix server.redirects.fromRe being ignored unless server.redirects.from is also set c1f4228 @​p-weston
• Fix shortcode name in error message on self-closing shortcodes with no .Inner e865d59 @​bep #​13344

Improvements

• config/allconfig: Deprecate :filename and :slugorfilename tokens 5de3913 @​jmooring
• resources/page: Revise the new contentbasename permalinks tokens 7b7a0f3 @​bep #​11722
• resources/page: Add :contentbasename and :contentbasenameorslug permalink tokens cb7a433 @​hacdias #​11722
• Add autoID for definition terms 157d370 @​bep #​13403 #​11566
• internal/warpc: Enable KaTeX mhchem extension 503dcf6 @​jmooring
• modules: Add GOAUTH to module config 2c77719 @​bep #​13385
• Support menus as maps in content adapters fd38aee @​bep #​13384
• js/esbuild: Add drop option d25f7ec @​bep #​13362
• config: Remove unused code 34dcac5 @​jmooring
• commands: Use punctuation consistently in short description ee43860 @​jmooring
• Upgrade to Go 1.24 fd8b0fb @​bep #​13381
• Deprecate kind, lang, and path from front matter 9b5f786 @​bep #​12484
• commands: Move the CHMOD event filter up e6feb9e @​bep #​13373
• parser: Handle org-mode filetags as slice f02da7f @​theSuess
• Add ContentTypes to config c2fb221 @​bep #​12274
• commands: Validate style argument passed to gen chromastyles a352e69 @​jmooring #​13357
• Update CONTRIBUTING.md 1dd27be @​bep
• Move "print unused templates" after renderDeferred eb7a5aa @​bep #​13355
• Add some more server options/improvements 029d1e0 @​bep

Dependency Updates

• build(deps): bump github.com/spf13/cobra from 1.8.1 to 1.9.1 a2ca956 @​dependabot[bot]
• build(deps): bump github.com/sanity-io/litter from 1.5.7 to 1.5.8 367fe52 @​dependabot[bot]
• build(deps): bump github.com/sanity-io/litter from 1.5.5 to 1.5.7 9c2f8ec @​dependabot[bot]
• build(deps): bump github.com/gohugoio/hugo-goldmark-extensions/extras bd77944 @​dependabot[bot]
• build(deps): bump golang.org/x/tools from 0.29.0 to 0.30.0 2e835d0 @​dependabot[bot]
• build(deps): bump github.com/aws/aws-sdk-go-v2/service/cloudfront d89b9d8 @​dependabot[bot]
• build(deps): bump google.golang.org/api from 0.206.0 to 0.221.0 8721a35 @​dependabot[bot]
• build(deps): bump github.com/bep/imagemeta from 0.8.3 to 0.8.4 c054e18 @​dependabot[bot]
• build(deps): bump golang.org/x/image from 0.22.0 to 0.24.0 5e4ffa0 @​dependabot[bot]
• build(deps): bump golang.org/x/mod from 0.22.0 to 0.23.0 0cdcc2b @​dependabot[bot]
• build(deps): bump github.com/gohugoio/hashstructure from 0.3.0 to 0.5.0 a591c44 @​dependabot[bot]
• build(deps): bump github.com/bep/simplecobra from 0.4.0 to 0.5.0 2d86a05 @​dependabot[bot]
• build(deps): bump github.com/aws/aws-sdk-go-v2/service/cloudfront 22ee091 @​dependabot[bot]
• build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.32.4 to 1.36.1 b50ab04 @​dependabot[bot]
• build(deps): bump github.com/getkin/kin-openapi from 0.123.0 to 0.129.0 b772f0e @​dependabot[bot]
• build(deps): bump github.com/spf13/pflag from 1.0.5 to 1.0.6 d58c019 @​dependabot[bot]

Documentation

• Update README.md 5dd0ba0 @​jmooring
• helpers: Add Chroma styles to docs.yaml f0c1852 @​jmooring #​13360

v0.143.1

Compare Source

What's Changed

• Fix RSS with baseURL with sub dir when render hooks is enabled 760c13a @​bep #​13332
• mage: Simplify magefile 3bd73d2 @​alexandear
• common/hugo: Adjust deprecation timing and message 7104de8 @​jmooring #​13333
• Re-introduce the LRU-evicted identities in change set calculation 835579b @​bep

v0.143.0

Compare Source

This is mostly a bug fix release, ironing out some quirks with the partial server rebuilds etc., but notable is also the new responseHeaders option on resources.GetRemote that allows you to extract headers from the server’s response.

Bug fixes

• Fix some server/watch rebuild issues db28695 @​bep #​13316
• Fix "concurrent map iteration and map write" in pages from data 329b234 @​bep #​13254
• Fix TailwindCSS related server rebuild issue 6c68142 @​bep #​13316
• Fix some server rebuild issues for non-HTML custom output formats cd7dc7a @​bep #​13014
• Fix cascade with overlapping sections bb7b3d3 @​bep #​12465
• markup/goldmark: Fix typo in func comment f704d75 @​chalin

Improvements

• Don't re-render aliases on server rebuilds 778f0d9 @​bep
• tpl/tplimpl: Remove leading whitespaces produced by Youtube shortcode 13b208e @​alex-shpak
• resources: Remove debug statement 33b46d8 @​jmooring #​13320
• markup/goldmark: Trim space from blockquote render hook text e08d9af @​jmooring #​13302
• parser/pageparser: Don't allow parameters after closing tag in shortcodes c939c33 @​guilhas07
• tpl/tplimpl: Improve shortcode test coverage 873a5cd @​jmooring
• tpl/tplimpl: Deprecate gist shortcode f42a4b6 @​jmooring #​13211
• resources: Remove conditional used for debugging a563783 @​bep
• resources: Add responseHeaders option to resources.GetRemote 68586c8 @​bep #​12521
• tpl/tplimpl: Skip TestTemplateFuncsExamples on s390x 51bb2fe @​bep #​13204
• Make cascade front matter order deterministic 7f0f50b @​bep #​12594
• tpl/tplimpl: Deprecate comment shortcode 77a8e34 @​jmooring

v0.142.0

Compare Source

This is is mostly a bug fix release. It's a minor and not a patch release because of the image file cache issue fixes (see #​13273 #​13272). Fixing this required us to break the hashes for many of the generated images so we used this opportunity to simplify how we generate these hashes/image filenames.

Bug fixes

• Fix render hook's PlainText with typographer extension enabled 6aa72ac @​bep #​13286 #​13292
• Fix build with Go 1.24 4b0c194 @​flyn-org
• tpl/tplimpl: Fix context in shortcode error messages 8de4ffb @​jmooring #​13279
• resources: Fix 2 image file cache key issues 1f5a15a @​bep #​13273 #​13272

Improvements

• Also handle inline HTML comments 637995b @​bep
• Do not warn on potentially unsafe HTML comments when unsafe=false f1de5d2 @​bep #​13278
• tpl: Add loading attribute to qr shortcode 8897113 @​nfriedli

v0.141.0

Compare Source

This release adds try, a new general mechanism for handling errors within templates, a new images.Mask image filter, a new images.QR function, a new alignx option to control horizontal alignment in images.Text, and more.

Note

• Adjust error handling in ToMath vs try (note) dde9d9d @​bep #​13239
• resources: Replace error handling in GetRemote with try (note) 0918e08 @​bep #​13216
• For render hooks, only fallback to HTML (or the defaultOutputFormat) template 7699336 @​bep #​13242

Bug fixes

• common/paths: Fix docstring 8b52626 @​jdbaldry
• commands: Fix spelling in comment 60c24fc @​bep
• Fix branch resource overlapping bundle path c5a63a3 @​bep #​13228
• templates: Fix handling of multiple defers in the same template 61d3d20 @​bep #​13236
• Fix NPX issue with TailwindCSS v4 cfa0801 @​bep #​13221
• Fix server refresh on 404 template changes d913f46 @​bep #​13209

Improvements

• tpl/tplimpl: Simplify some test assertions 1fad383 @​bep
• tpl/tplimpl: Deprecate twitter shortcode in favor of x shortcode 1191467 @​jmooring #​13214
• commands: Set up the glboal logger early 4113707 @​bep #​13265
• commands: Add --printZero to the config command 5bb1564 @​bep
• tpl/collections: Use MapRange/SetIterKey/SetIterValue for Where, Sort and Merge de7137c @​bep
• tpl/collections: Add BenchmarkWhereMap 956f915 @​bep
• tpl/collections: Add BenchmarkSortMap a2a4166 @​bep
• tpl/collections: Add Merge benchmark 39f582f @​bep
• resources/images: Refactor golden image tests to locate them closer to the implementation 2501de7 @​bep
• resources/images: Add some mask tests 06cc867 @​bep #​13244
• resources/images: Add images.Mask 71fae99 @​trickkiste #​13244
• tpl/tplimpl: Use plain text for image render hook alt attribute 8af0474 @​jmooring
• resources/images: Add some golden tests for images.QR 892b491 @​bep
• tpl/images: Change signature of images.QR to images.QR TEXT OPTIONS b13d0a6 @​jmooring #​13230
• resources/images: Add some golden tests for images.Text d9594a9 @​bep
• images.Text: Add "alignx" option for horizontal alignment 4a5cc2d @​jlskuz #​10849
• images: Rework the golden tests 9cad8d3 @​bep
• create: Respect --noBuildLock in hugo new 2a7bb1c @​bep
• tpl/images: Format the QR hashes as hex 5f2adad @​bep
• tpl/images: Add images.QR function 4ea94c4 @​jmooring #​13205
• Add try 5d2cbee @​bep #​9737
• resources: Add FromOpts for more effective resource creation 723e3f4 @​bep
• markup/highlight: Remove noHl option 2db43f8 @​jmooring #​9885

Dependency Updates

• deps: Upgrade github.com/gohugoio/hashstructure from 0.1.0 to 0.3.0 a2edf04 @​bep
• build(deps): bump golang.org/x/tools from 0.28.0 to 0.29.0 f024a50 @​dependabot[bot]
• build(deps): bump golang.org/x/net from 0.33.0 to 0.34.0 80704bc @​dependabot[bot]
• build(deps): bump github.com/evanw/esbuild from 0.24.0 to 0.24.2 b7b49fb @​dependabot[bot]
• build(deps): bump github.com/alecthomas/chroma/v2 from 2.14.0 to 2.15.0 a837976 @​dependabot[bot]

Documentation

• docs: Regen CLI docs 88ecc3b @​bep
• docs: Regen CLI docs 4462861 @​bep

Build Setup

• snap: Always package latest stable version of Go 3682027 @​jmooring

v0.140.2

Compare Source

The timing of this release comes from the security fix in golang.org/x/net's html.Parse function. This is used in two places in Hugo:

1. Extracting table of contents from Asciidoctor rendered output.
2. Collecting HTML classes etc. when build stats is enabled

It's a little bit of a stretch to see how this could be exploited in Hugo, but we understand that many want a clean security report. See this issue for details.

What's Changed

• Print cli usage of hugo gen chromastyles alongside css 83cec78 @​diwasrimal
• build(deps): bump golang.org/x/net from 0.32.0 to 0.33.0 4e52be8 @​dependabot[bot]
• config/allconfig: Fix slice of language configs 7888ac5 @​jmooring #​13201
• config/allconfig: Throw error when output format is not defined eb1dbe0 @​jmooring #​13199
• Fix same resource file published more than once 77824d7 @​bep #​13164
• markup/highlight: Add wrapperClass option ec0caae @​bep
• Update README.md 845b888 @​bep

v0.140.1

Compare Source

Some bug fixes in the (most likely) last Hugo release of the year. Of some technical interest to some, I can mention that I, @​bep, have reworked hugoreleaser to use YAML (with anchors/aliases) instead of TOML for the release configuration. Have a look at the end result.

What's Changed

• Update gocloud and docs for S3-Compatible Endpoints e229f4b @​tebriel
• js/esbuild: Don't try to resolve packages in /assets marked as external 0202539 @​bep #​13183
• Fix union, complement, symdiff, and intersect for transient resources 4a5e940 @​bep #​13181
• release: Add withdeploy deb extended archives 48a7aee @​bep #​13166
• common/loggers: Write PrintTimerIfDelayed output to stdErr 6c583e3 @​jmooring #​13171
• build(deps): bump github.com/spf13/cast from 1.7.0 to 1.7.1 5d64b49 @​dependabot[bot]
• hugolib: Fix fallbacks for menu entry Name and Title b3f3294 @​jmooring #​13161

v0.140.0

Compare Source

The big new feature in this release is js.Batch – this enables JavaScript bundle groups (e.g. scripts per section) with global code splitting and flexible hooks/runners setup.

Bug fixes

• Fix panic on server rebuilds when using both base templates and template.Defer a5e5be2 @​bep #​12963
• js: Fix js.Batch for multihost setups 565c30e @​bep #​13151
• parser/pageparser: Fix Org Mode summary delimiter assignment 48dd6a9 @​jmooring #​13152
• Fix a rebuild on resource rename case 744b856 @​bep
• tpl/tplimpl: Fix title attribute in details shortcode a32c889 @​jmooring
• Fix Sass imports on the form index.{scss,sass} 5ab38de @​bep #​13123
• markup/goldmark: Fix blockquote render hook text parsing 3437340 @​jmooring #​12913 #​13119

Improvements

• js/esbuild: Add missing es2024 target 5c80cb0 @​bep
• js/esbuild: Add runners after scripts 7de5317 @​bep
• js/esbuild: Batch: Avoid nil Instances slice 4cbd4ef @​bep
• tpl/tplimpl: Update youtube shortcode 852d868 @​jmooring
• tpl/tplimpl: Update details shortcode 1e34e5b @​jmooring
• tpl/collections: Allow querify to accept a map argument 641d261 @​jmooring #​13131
• js/esbuild: Build groups in order of their ID a834bb9 @​bep
• tpl/tplimpl: Add details shortcode 4f130f6 @​racehd
• Write all logging (INFO, WARN, ERROR) to stderr 9dfa112 @​bep #​13074
• js/esbuild: Add platform option ec1933f @​bep #​13136
• Add config option disableDefaultLanguageRedirect 75ad9cd @​bep #​13133
• Add js.Batch e293e7c @​bep #​12626 #​7499 #​9978 #​12879 #​13113 #​13116
• Upgrade to Go 1.23.4 6be2530 @​bep #​13130
• Remove some old and unused shell scripts 989b299 @​bep

Dependency Updates

• build(deps): bump golang.org/x/crypto from 0.30.0 to 0.31.0 157d864 @​dependabot[bot]
• build(deps): bump golang.org/x/tools from 0.27.0 to 0.28.0 947e4e6 @​dependabot[bot]
• build(deps): bump github.com/hairyhenderson/go-codeowners 5f89786 @​dependabot[bot]
• build(deps): bump golang.org/x/net from 0.31.0 to 0.32.0 7b69218 @​dependabot[bot]

v0.139.5

Compare Source

This is a release created for technical reasons, see #​13147

It's the same as https://github.com/gohugoio/hugo/releases/tag/v0.139.4 -- go there for release archives.

v0.139.4

Compare Source

This release contains a security fix. See this Security Advisory for details. Note that this is only relevant if you don't trust your content (e.g. Markdown) files.

What's Changed

• tpl/tplimpl: Escape Markdown attributes in render hooks and shortcodes 54398f8 @​jmooring
• deps: Upgrade github.com/bep/godartsass/v2 v2.3.1 => v2.3.2 b8c15f2 @​bep
• common/maps: Simplify TestScratchSetInMap/DeleteInMap d0dc518 @​alexandear
• markup/tableofcontents: Cast Fragments.ToHTML args to int b529859 @​jmooring #​13107

v0.139.3

Compare Source

What's Changed

• Fix server edits of resources included in shortcode/hooks c1dc35d @​bep #​13093
• commands: Fix flaw in the livereload logic dea158c @​bep
• build(deps): bump github.com/bep/godartsass/v2 from 2.3.0 to 2.3.1 7e130e3 @​dependabot[bot]
• build(deps): bump github.com/tetratelabs/wazero from 1.8.1 to 1.8.2 88b7868 @​dependabot[bot]
• Fix some typos fc3d1cb @​thirdkeyword

v0.139.2

Compare Source

Note that this is the second patch release today. See v0.139.1. We had to do this release to get the Hugo Docs build running.

What's Changed

• modules: Skip empty lines in modules.txt 0ab8189 @​bep #​13084

v0.139.1

Compare Source

What's Changed

• Revert "build(deps): bump github.com/tdewolff/minify/v2 from 2.20.37 to 2.21.1" aa3dd19 @​bep #​13082
• minifiers: Add failing test for upstream bug 5a50eee @​bep #​13082
• dartsass: Fix nilpointer on Close when Dart Sass isn't installed 8d017a6 @​bep #​13076

v0.139.0

Compare Source

This release is mostly about removing code that has been deprecated for a long time. This has been shown as an ERROR in the build log and failed the build for at least the last 6 minor Hugo versions, in most cases much longer.

But this is also a full dependency refresh, and there are also some new stuff. For one, we added a -O flag to hugo server to open up the site in your browser after start. This is now my (@​bep) shortcut to start the server:

function h() {
  hugo server  -F -O -N -D
}

Note

• dartsass: Remove support for v1 of the protocol/binary (note) 1fd845e @​bep
• Remove deprecations <= v0.122.0 (note) ad43d13 @​bep

Bug fixes

• dartsass: Fix error message 8d92042 @​bep #​13065
• Fix extra newline/paragraphs issue with .RenderShortcodes d4de780 @​bep #​13051
• markup/goldmark: Fix typo in error message e79ee0d @​deining

Improvements

• Make sure term is always set e917401 @​bep #​13063
• dartsass: Add silenceDeprecations option 3b6eaf9 @​bep #​13045
• Run go mod tidy 5e3133a @​bep
• commands: Add -O flag to server to open browser ac6962d @​bep #​13040
• Preserve input type. 23d21b0 @​KN4CK3R
• server: Strip ANSI escape codes from browser error log ce9cf88 @​bep #​13037
• parser/metadecoders: Add benchmark 8aba6dc @​bep
• Add site.Store and hugo.Store and Shortcode.Store a7df536 @​bep #​13021
• markup/goldmark: Improve the raw HTML omitted warning 2b97a2a @​jmooring #​13023

Dependency Updates

• build(deps): bump github.com/aws/aws-sdk-go-v2/service/cloudfront eb29814 @​dependabot[bot]
• build(deps): bump google.golang.org/api from 0.191.0 to 0.206.0 61e2ce2 @​dependabot[bot]
• build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.30.3 to 1.32.4 2d503f8 @​dependabot[bot]
• build(deps): bump github.com/fsnotify/fsnotify from 1.7.0 to 1.8.0 3a6b2e6 @​dependabot[bot]
• deps: Upgrade github.com/bep/imagemeta v0.8.1 => v0.8.3 6bde8ab @​bep
• build(deps): bump golang.org/x/tools from 0.26.0 to 0.27.0 2c54c32 @​dependabot[bot]
• build(deps): bump github.com/tdewolff/minify/v2 from 2.20.37 to 2.21.1 7a2f04e @​dependabot[bot]
• build(deps): bump github.com/fatih/color from 1.17.0 to 1.18.0 7921777 @​dependabot[bot]
• build(deps): bump golang.org/x/image from 0.21.0 to 0.22.0 33e964d @​dependabot[bot]
• deps: Upgrade github.com/yuin/goldmark v1.7.4 => v1.7.8 588c901 @​bep #​12958
• build(deps): bump golang.org/x/sync from 0.8.0 to 0.9.0 46e1705 @​dependabot[bot]
• build(deps): bump github.com/hairyhenderson/go-codeowners cb6580d @​dependabot[bot]

Documentation

• docs: Regen CLI docs 66dd6ec @​bep
• docs: Regenerate CLI docs 58a3c91 @​bep

Build Setup

• release: Add missing withdeploy archive for arm64 Linux f7fc6cc @​bep #​13029

v0.138.0

Compare Source

What's Changed

• Fix concurrent map read and map write in short page lookups 95e2d5b @​bep #​13019
• Alias Page.Scratch to Page.Store (note) 2c3efc8 @​bep #​13016

v0.137.1

Compare Source

What's Changed

• common/hugo: Add withdeploy to the version string printed in hugo version ca4fc58 @​bep
• markup: Goldmark log "Raw HTML omitted" warning also for inline HTML 4faaaf9 @​bep #​13013
• build: Add missing withdeploy archive for Windows 94b46c3 @​bep #​13009
• commands: Print the "deploy not available" error message even if flags provided 2b0b3b8 @​bep #​13012
• tpl/tplimpl: Create an embedded comment shortcode 801035b @​jmooring #​13010

v0.137.0

Compare Source

Note that we have no longer build the deploy feature in the standard and extended archives. If you need that, download archives with withdeploy in the filename. See instalation for details. You can read #​12994 for more on the motivation behind this, but for one, it shaves off about 40% of the binary size.

Bug fixes

• Fix stale pages on rebuilds in GetPage with short refs 30d9aea @​bep #​13004
• Fix some RenderShortcodes error cases 1f23b49 @​bep #​12854 #​12998
• dynacache: Fix potential deadlocks on panics in GetOrCreate e10915f @​bep

Improvements

• Do not watch directories with no mounted files in it fcdc454 @​bep #​12912 #​13007
• markup/goldmark: Only log Raw HTML omitted WARN on block entering 6cf23bf [@​bep

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.