Sourced from github.com/gohugoio/hugo's releases.
v0.159.2
Note that the security fix below is not a potential threat if you either:
- Trust your Markdown content files.
- Have custom render hook template for links and images.
EDIT IN: This release also adds release archives for non-extended-withdeploy builds.
What's Changed
- Fix potential content XSS by escaping dangerous URLs in Markdown links and images 479fe6c6
@bep- resources/page: Fix shared reader in Source.ValueAsOpenReadSeekCloser df520e31
@jmooring#14684v0.159.1
The regression fixed in this release isn't new, but it's so subtle that we thought we'd release this sooner rather than later. For some time now, the minifier we use have stripped namespaced attributes in SVGs, which broke dynamic constructs using e.g. AlpineJS' x-bind: namespace (library used by Hugo's documentation site).
To fix this, the upstream library has hadded a
keepNamespacesslice option. It was not possible to find a default that would make all happy, so we opted for an option that at least would make AlpineJS sites work out of the box:[minify.tdewolff.svg] keepNamespaces = ['', 'x-bind']What's Changed
v0.159.0
This release greatly improves and simplifies management of Node.js/npm dependencies in a multi-module setup. See this page for more information.
Note
- Replace deprecated site.Data with hugo.Data in tests a8fca598
@bep- Replace deprecated excludeFiles and includeFiles with files in tests 182b1045
@bep- Replace deprecated :filename with :contentbasename in the permalinks test eb11c3d0
@bepBug fixes
- tpl/tplimpl: Fix Vimeo shortcode test eaf4c751
@jmooring#14649Improvements
- create: Return error instead of panic when page not found 807cae1d
@mango766#14112- commands: Preserve non-content files in convert output c4fb61d9
@xndvaz#4621- npm: Use workspaces to simplify
hugo mod npm packd88a29e0@bep
... (truncated)
5f4646a
releaser: Bump versions for release of 0.159.2479fe6c
Fix potential content XSS by escaping dangerous URLs in links and
images81a5cdc
releaser: Add standard withdeploy release assetsdf520e3
resources/page: Fix shared reader in
Source.ValueAsOpenReadSeekCloserb55d452
testing: Simplify line ending handling in testsea7eac6
readme: Update Go version to 1.25.0458ebdd
releaser: Prepare repository for 0.160.0-DEV86c7d3a
releaser: Bump versions for release of 0.159.142289d7
minifiers: Keep x-bind and blank namespace in SVG minification0c013c2
Adjust depreceated syntax in tests