opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

chore: bump github.com/gohugoio/hugo from 0.160.0 to 0.161.1 (#24957)

Browse Source 
Bumps [github.com/gohugoio/hugo](https://github.com/gohugoio/hugo) from
0.160.0 to 0.161.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/gohugoio/hugo/releases">github.com/gohugoio/hugo's
releases</a>.</em></p>
<blockquote>
<h2>v0.161.1</h2>
<h2>What's Changed</h2>
<ul>
<li>resources: Honor Retry-After header in resources.GetRemote retries
c4eba928 <a href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14828">#14828</a></li>
<li>warpc: Move to parson.c in <a
href="https://github.com/kgabis/parson">https://github.com/kgabis/parson</a>
8b40a96b <a href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14823">#14823</a></li>
<li>config/security: Add AllowChildProcess to security.node.permissions
d65af84d <a href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14824">#14824</a></li>
<li>config/security: Restrict default http.urls &quot;@&quot; deny to
userinfo 454450a6 <a
href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14825">#14825</a></li>
</ul>
<h2>v0.161.0</h2>
<p>This release contains two security hardening fixes:</p>
<ul>
<li>We now run the Node tools PostCSS, Babel and TailwindCSS, by
default, with the <code>--permission</code> flag with the permissions
defined in <a
href="https://gohugo.io/configuration/security/">security.node.permissions</a>.
This means that you need Node &gt;= 22 installed and that
<code>css.TailwindCSS</code> now requires that the Tailwind CSS CLI must
be installed as a Node.js package. The <a
href="https://github.com/tailwindlabs/tailwindcss/releases/latest">standalone
executable</a> is no longer supported</li>
<li>We have made the defaults in <a
href="https://gohugo.io/configuration/security/#httpurls">security.http.urls</a>
more restrictive.</li>
</ul>
<p>But there are some notable new features, as well:</p>
<h2>Nested vars support in css.Build and css.Sass</h2>
<p>A practical example in <code>css.Build</code> would be to have
something like this in <code>hugo.toml</code>:</p>
<pre lang="toml"><code>[params.style]
primary =
&quot;[#000000](https://github.com/gohugoio/hugo/issues/000000)&quot;
    background = &quot;#ffffff&quot;
    [params.style.dark]
        primary    = &quot;#ffffff&quot;
background =
&quot;[#000000](https://github.com/gohugoio/hugo/issues/000000)&quot;
</code></pre>
<p>And in the stylesheet:</p>
<pre lang="css"><code>@import &quot;hugo:vars&quot;;
@import &quot;hugo:vars/dark&quot; (prefers-color-scheme: dark);
<p>:root {
color-scheme: light dark;
}
</code></pre></p>
<h2>Slice-based permalinks config</h2>
<p>The <code>permalinks</code> configuration is now much more flexible
(the old setup still works). It uses the same <a
href="https://gohugo.io/configuration/cascade/#target">target</a>
matchers as in the <code>cascade</code> config, meaning you can now
do:</p>
<pre lang="yaml"><code>permalinks:
  - target:
      kind: page
      path: &quot;/books/**&quot;
&lt;/tr&gt;&lt;/table&gt; 
</code></pre>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/gohugoio/hugo/commit/ea8f66a7ce988664dcc84c052fc96757042e2e4a"><code>ea8f66a</code></a>
releaser: Bump versions for release of 0.161.1</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/c4eba92863bbb988b23e63af40a22d6661b0ced6"><code>c4eba92</code></a>
resources: Honor Retry-After header in resources.GetRemote retries</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/8b40a96b6e992fbacd8626c24168889f50152808"><code>8b40a96</code></a>
warpc: Move to parson.c in <a
href="https://github.com/kgabis/parson">https://github.com/kgabis/parson</a></li>
<li><a
href="https://github.com/gohugoio/hugo/commit/d65af84d1572326057a9a55e26beb0cee784698a"><code>d65af84</code></a>
config/security: Add AllowChildProcess to security.node.permissions</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/454450a647111e5e0b41af595b310f3062c5630e"><code>454450a</code></a>
config/security: Restrict default http.urls &quot;@&quot; deny to
userinfo</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/2bfcc6b9941724cd1d0b490583e89413d7a66979"><code>2bfcc6b</code></a>
releaser: Prepare repository for 0.162.0-DEV</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/98d396c16a07b51df06e7673d817a3880da6218d"><code>98d396c</code></a>
releaser: Bump versions for release of 0.161.0</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/d4ae662d598db81d239a291bc26336be5fec6893"><code>d4ae662</code></a>
build(deps): bump github.com/getkin/kin-openapi from 0.135.0 to
0.137.0</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/9ede5fb9e0304d3eb193b3c1a9214c735f05db21"><code>9ede5fb</code></a>
build(deps): bump github.com/mattn/go-isatty from 0.0.21 to 0.0.22</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/833a878eef4fce2bbabb05dcbb8a7e31f93aadda"><code>833a878</code></a>
build(deps): bump github.com/tdewolff/minify/v2 from 2.24.12 to
2.24.13</li>
<li>Additional commits viewable in <a
href="https://github.com/gohugoio/hugo/compare/v0.160.0...v0.161.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/gohugoio/hugo&package-manager=go_modules&previous-version=0.160.0&new-version=0.161.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This commit is contained in:
dependabot[bot]
2026-05-05 11:19:15 +00:00
committed by GitHub
parent fc04f0d71e
commit a970ffdac8
2 changed files with 50 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files
go.mod
+10 -9
View File
@@ -159,7 +159,7 @@ require (
github.com/go-logr/logr v1.4.3
github.com/go-playground/validator/v10 v10.30.0
github.com/gofrs/flock v0.13.0
github.com/gohugoio/hugo v0.160.0
github.com/gohugoio/hugo v0.161.1
github.com/golang-jwt/jwt/v4 v4.5.2
github.com/golang-migrate/migrate/v4 v4.19.0
github.com/gomarkdown/markdown v0.0.0-20260411013819-759bbc3e3207
@@ -183,7 +183,7 @@ require (
github.com/kirsle/configdir v0.0.0-20170128060238-e45d2f54772f
github.com/klauspost/compress v1.18.5
github.com/lib/pq v1.10.9
github.com/mattn/go-isatty v0.0.20
github.com/mattn/go-isatty v0.0.22
github.com/mitchellh/go-wordwrap v1.0.1
github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c
github.com/mocktools/go-smtp-mock/v2 v2.5.0
@@ -237,7 +237,7 @@ require (
golang.org/x/text v0.36.0
golang.org/x/tools v0.44.0
golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da
google.golang.org/api v0.275.0
google.golang.org/api v0.276.0
google.golang.org/grpc v1.80.0
google.golang.org/protobuf v1.36.11
gopkg.in/DataDog/dd-trace-go.v1 v1.74.0
@@ -283,13 +283,13 @@ require (
github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
github.com/armon/go-radix v1.0.1-0.20221118154546-54df44f2176c // indirect
github.com/atotto/clipboard v0.1.4 // indirect
github.com/aws/aws-sdk-go-v2 v1.41.5
github.com/aws/aws-sdk-go-v2 v1.41.6
github.com/aws/aws-sdk-go-v2/config v1.32.12
github.com/aws/aws-sdk-go-v2/credentials v1.19.12
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20 // indirect
github.com/aws/aws-sdk-go-v2/feature/rds/auth v1.6.14
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 // indirect
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 // indirect
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.22 // indirect
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.22 // indirect
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 // indirect
@@ -407,7 +407,7 @@ require (
github.com/opencontainers/image-spec v1.1.1 // indirect
github.com/opencontainers/runc v1.2.8 // indirect
github.com/outcaste-io/ristretto v0.2.3 // indirect
github.com/pelletier/go-toml/v2 v2.2.4 // indirect
github.com/pelletier/go-toml/v2 v2.3.0 // indirect
github.com/philhofer/fwd v1.1.3-0.20240916144458-20a13a1f6b7c // indirect
github.com/pierrec/lz4/v4 v4.1.18 // indirect
github.com/pion/transport/v2 v2.2.10 // indirect
@@ -435,7 +435,7 @@ require (
github.com/tailscale/wireguard-go v0.0.0-20231121184858-cc193a0b3272
github.com/tchap/go-patricia/v2 v2.3.3 // indirect
github.com/tcnksm/go-httpstat v0.2.0 // indirect
github.com/tdewolff/parse/v2 v2.8.11 // indirect
github.com/tdewolff/parse/v2 v2.8.12 // indirect
github.com/tidwall/match v1.2.0 // indirect
github.com/tidwall/pretty v1.2.1
github.com/tinylib/msgp v1.2.5 // indirect
@@ -479,7 +479,7 @@ require (
google.golang.org/genproto/googleapis/api v0.0.0-20260319201613-d00831a3d3e7 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 // indirect
gopkg.in/ini.v1 v1.67.1 // indirect
howett.net/plist v1.0.0 // indirect
howett.net/plist v1.0.1 // indirect
kernel.org/pub/linux/libs/security/libcap/psx v1.2.77 // indirect
sigs.k8s.io/yaml v1.6.0 // indirect
)
@@ -623,6 +623,7 @@ require (
github.com/sergeymakinen/go-ico v1.0.0-beta.0 // indirect
github.com/spf13/cobra v1.10.2 // indirect
github.com/spiffe/go-spiffe/v2 v2.6.0 // indirect
github.com/tdewolff/test v1.0.12 // indirect
github.com/tmaxmax/go-sse v0.11.0 // indirect
github.com/ulikunitz/xz v0.5.15 // indirect
github.com/urfave/cli/v2 v2.27.5 // indirect