From 3fb402cd82c72b8739ab72da8c8a8d5bfadfba43 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 22 Jun 2026 18:28:02 +0000
Subject: [PATCH] chore: bump github.com/gohugoio/hugo from 0.163.0 to 0.163.3
 (#26579)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [github.com/gohugoio/hugo](https://github.com/gohugoio/hugo) from
0.163.0 to 0.163.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/gohugoio/hugo/releases">github.com/gohugoio/hugo's
releases</a>.</em></p>
<blockquote>
<h2>v0.163.3</h2>
<h2>What's Changed</h2>
<ul>
<li>markup/highlight: Escape lang in default code block rendering
ce1a7e0b <a href="https://github.com/bep"><code>@​bep</code></a> thanks
to <a href="https://github.com/k0ngj1"><code>@​k0ngj1</code></a> for
reporting this issue.</li>
<li>parser/pageparser: Preserve non-ASCII whitespace after e.g. summary
divider 70a9068a <a
href="https://github.com/bep"><code>@​bep</code></a></li>
<li>resources: Support babel/postcss config variants 9d66d513 <a
href="https://github.com/jmooring"><code>@​jmooring</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/15039">#15039</a>
<a
href="https://redirect.github.com/gohugoio/hugo/issues/15040">#15040</a>
<a
href="https://redirect.github.com/gohugoio/hugo/issues/15043">#15043</a></li>
<li>hugolib: Fix page/section name collision regression f0133466 <a
href="https://github.com/jmooring"><code>@​jmooring</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/15046">#15046</a></li>
</ul>
<h2>v0.163.2</h2>
<h2>What's Changed</h2>
<ul>
<li>Continue resolving on ERR_ACCESS_DENIED in Node's resolver 134674f0
<a href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/15041">#15041</a></li>
<li>markup: Standardize behavior when external converters are missing
147f605f <a
href="https://github.com/jmooring"><code>@​jmooring</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14222">#14222</a></li>
</ul>
<h2>v0.163.1</h2>
<p>The majority of the fixes in this release are security related
(including the upstream fix in 93c8c7d3 (golang.org/x/image)). Thanks to
<a href="https://github.com/vnth4nhnt"><code>@​vnth4nhnt</code></a> for
finding the issues fixed in a00b5c72 and cf9c8f93 (I will do the CVE
work on this later). There has been a uptick in security reports lately,
which doesn't mean that Hugo has gotten less secure, this is mostly the
work of the new and powerful AI tools using Hugo's restrictive <a
href="https://gohugo.io/about/security/">security model</a> as their
baseline. Just take a look at Go's recent <a
href="https://github.com/golang/go/issues?q=is%3Aissue%20label%3ASecurity">security
issue list</a> to see a demonstration of this.</p>
<h2>What's Changed</h2>
<ul>
<li>build(deps): bump golang.org/x/image from 0.41.0 to 0.42.0 93c8c7d3
<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]</li>
<li>Fix multi --renderSegments merge behavior 95e5e9f4 <a
href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/15024">#15024</a></li>
<li>security: Normalize integer IPv4 host encodings in http.urls check
a00b5c72 <a href="https://github.com/bep"><code>@​bep</code></a></li>
<li>Drop symlinks in os.ReadDir, os.ReadFile, os.Stat and os.FileExists
cf9c8f93 <a href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/15019">#15019</a></li>
<li>commands: Fix convert command 2602796c <a
href="https://github.com/jmooring"><code>@​jmooring</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/15012">#15012</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/gohugoio/hugo/commit/4d22555aebf458d5d150500c9ac4bee5b24cf0d3"><code>4d22555</code></a>
releaser: Bump versions for release of 0.163.3</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/ce1a7e0bce3713af40496ded3c2c0ceeed49231d"><code>ce1a7e0</code></a>
markup/highlight: Escape lang in default code block rendering</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/e8988c31412249897a2e6805b61c37ed5c82a10c"><code>e8988c3</code></a>
Merge commit 'c86d9f4aa8a58931f52df6516f10b67c807505fb'</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/c86d9f4aa8a58931f52df6516f10b67c807505fb"><code>c86d9f4</code></a>
Squashed 'docs/' changes from 1f8ddb8a52..e17426e2b6</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/70a9068aa67c67a9eb2ab5fe062faf5a99e6b650"><code>70a9068</code></a>
parser/pageparser: Preserve non-ASCII whitespace after e.g. summary
divider</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/9d66d513cee02e77c96c78059d5c3ae6b1c5dde9"><code>9d66d51</code></a>
resources: Support babel/postcss config variants</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/f01334666790f328e222f67c278396ee77003021"><code>f013346</code></a>
hugolib: Fix page/section name collision regression</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/96e06e1ab8484327dcbb521b8445a52d0c022cf3"><code>96e06e1</code></a>
releaser: Prepare repository for 0.164.0-DEV</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/19a5cec0b9618163bb519487382e861d29edf383"><code>19a5cec</code></a>
releaser: Bump versions for release of 0.163.2</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/134674f00df2c2c0db24f0674de2263298d33eb7"><code>134674f</code></a>
Continue resolving on ERR_ACCESS_DENIED in Node's resolver</li>
<li>Additional commits viewable in <a
href="https://github.com/gohugoio/hugo/compare/v0.163.0...v0.163.3">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/gohugoio/hugo&package-manager=go_modules&previous-version=0.163.0&new-version=0.163.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/coder/coder/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 go.mod | 2 +-
 go.sum | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/go.mod b/go.mod
index 174500ea5f..0e4a58893b 100644
--- a/go.mod
+++ b/go.mod
@@ -176,7 +176,7 @@ require (
 	github.com/go-logr/logr v1.4.3
 	github.com/go-playground/validator/v10 v10.30.0
 	github.com/gofrs/flock v0.13.0
-	github.com/gohugoio/hugo v0.163.0
+	github.com/gohugoio/hugo v0.163.3
 	github.com/golang-jwt/jwt/v4 v4.5.2
 	github.com/golang-migrate/migrate/v4 v4.19.0
 	github.com/gomarkdown/markdown v0.0.0-20260411013819-759bbc3e3207
diff --git a/go.sum b/go.sum
index c3f0b0ae99..aae59a6603 100644
--- a/go.sum
+++ b/go.sum
@@ -235,8 +235,8 @@ github.com/bep/lazycache v0.8.1 h1:ko6ASLjkPxyV5DMWoNNZ8B2M0weyjqXX8IZkjBoBtvg=
 github.com/bep/lazycache v0.8.1/go.mod h1:pbEiFsZoq7cLXvrTll0AHOPEurB1aGGxx4jKjOtlx9w=
 github.com/bep/logg v0.4.0 h1:luAo5mO4ZkhA5M1iDVDqDqnBBnlHjmtZF6VAyTp+nCQ=
 github.com/bep/logg v0.4.0/go.mod h1:Ccp9yP3wbR1mm++Kpxet91hAZBEQgmWgFgnXX3GkIV0=
-github.com/bep/overlayfs v0.10.0 h1:wS3eQ6bRsLX+4AAmwGjvoFSAQoeheamxofFiJ2SthSE=
-github.com/bep/overlayfs v0.10.0/go.mod h1:ouu4nu6fFJaL0sPzNICzxYsBeWwrjiTdFZdK4lI3tro=
+github.com/bep/overlayfs v0.11.0 h1:aymHDGC0CHpvn0XvTfgpK6skCp16oMi+tdUF32l6pPs=
+github.com/bep/overlayfs v0.11.0/go.mod h1:L+ggdoKm+Y7Xb4a1osd+/LOPG4qsY62snqRqJH5Mspc=
 github.com/bep/textandbinarywriter v0.1.0 h1:KXmXsRN2Uhwhm1G3e/snM8+5SPQBJrCEpIosdIBR3po=
 github.com/bep/textandbinarywriter v0.1.0/go.mod h1:dAcHveajlWWU7PXhp6Dn4PIAYDg2H13Huif9xMS2w8w=
 github.com/bep/tmc v0.6.0 h1:5zWy4L+3gS+Kk8czzLC4g7ETaC3wkX9ZtTRdAdL8V4s=
@@ -616,8 +616,8 @@ github.com/gohugoio/hashstructure v0.6.0 h1:7wMB/2CfXoThFYhdWRGv3u3rUM761Cq29CxU
 github.com/gohugoio/hashstructure v0.6.0/go.mod h1:lapVLk9XidheHG1IQ4ZSbyYrXcaILU1ZEP/+vno5rBQ=
 github.com/gohugoio/httpcache v0.8.0 h1:hNdsmGSELztetYCsPVgjA960zSa4dfEqqF/SficorCU=
 github.com/gohugoio/httpcache v0.8.0/go.mod h1:fMlPrdY/vVJhAriLZnrF5QpN3BNAcoBClgAyQd+lGFI=
-github.com/gohugoio/hugo v0.163.0 h1:AO/K+CxBe10sBxDODvpjUNIY1x2n3SceugFF7l7TSZM=
-github.com/gohugoio/hugo v0.163.0/go.mod h1:jamkaakWQKHc8uNrUCU6Gu5H9fbYrKb3B/Cg7CmH4XA=
+github.com/gohugoio/hugo v0.163.3 h1:fkiOvLv8hYZt96OhJE9RDWw4IkQVASCIIndBmAiLHgM=
+github.com/gohugoio/hugo v0.163.3/go.mod h1:3FPGFgeqGYDTPRe1NJ10L1giY5ViUGeNlkVBDmVk46w=
 github.com/gohugoio/hugo-goldmark-extensions/extras v0.7.0 h1:I/n6v7VImJ3aISLnn73JAHXyjcQsMVvbguQPTk9Ehus=
 github.com/gohugoio/hugo-goldmark-extensions/extras v0.7.0/go.mod h1:9LJNfKWFmhEJ7HW0in5znezMwH+FYMBIhNZ3VWtRcRs=
 github.com/gohugoio/hugo-goldmark-extensions/passthrough v0.5.0 h1:p13Q0DBCrBRpJGtbtlgkYNCs4TnIlZJh8vHgnAiofrI=