chore(deps): update dependency gohugoio/hugo to v0.125.4 #144

Open
renovator wants to merge 1 commits from renovate/gohugoio-hugo-0.x into main
Member

This PR contains the following updates:

Package Update Change
gohugoio/hugo minor v0.124.1 -> v0.125.4

Release Notes

gohugoio/hugo (gohugoio/hugo)

v0.125.4

Compare Source

What Changed

v0.125.3

Compare Source

This release fixes a security issue reported by @​ejona86 (see #​12411) that could allow XSS injection from Markdown content files if one of the internal link or image render hook templates added in Hugo 0.123.0 are enabled. You typically control and trust the content files, but according to Hugo's security model, we state that "template and configuration authors (you) are trusted, but the data you send in is not."

v0.125.2

Compare Source

What's Changed

v0.125.1

Compare Source

What's Changed

v0.125.0

Compare Source

Some of the notable new features in this release:

  • strings.Diff template func.
  • .PageInner in render hooks to get the inner page when using .RenderShortcode in a shortcode, typically used to resolve links and page resources relative to an included Page.
  • Add Luminance to $image.Color, allowing for sorting by relative luminance. e197c7b @​bep #​10450

This release is built with Go 1.22.2 (#​12351) which comes with a fix for security issue CVE-2023-45288. We don't see how that could be exploited in Hugo, but we do appreciate that people want a clean security report.

Bug fixes

Improvements

Dependency Updates

Documentation


Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [gohugoio/hugo](https://github.com/gohugoio/hugo) | minor | `v0.124.1` -> `v0.125.4` | --- ### Release Notes <details> <summary>gohugoio/hugo (gohugoio/hugo)</summary> ### [`v0.125.4`](https://github.com/gohugoio/hugo/releases/tag/v0.125.4) [Compare Source](https://github.com/gohugoio/hugo/compare/v0.125.3...v0.125.4) #### What Changed - Fix rebuilds when running hugo -w [`7203a95`](https://github.com/gohugoio/hugo/commit/7203a95a6) [@&#8203;bep](https://github.com/bep) [#&#8203;12296](https://github.com/gohugoio/hugo/issues/12296) - tpl/tplimpl: Fix double-escaping in opengraph template [`fb51b69`](https://github.com/gohugoio/hugo/commit/fb51b698b) [@&#8203;jmooring](https://github.com/jmooring) [#&#8203;12418](https://github.com/gohugoio/hugo/issues/12418) - commands: Clarify that create or install a theme are two options [`fe84cc2`](https://github.com/gohugoio/hugo/commit/fe84cc218) [@&#8203;Habbie](https://github.com/Habbie) - config: Setups with only one active language can never be multihost [`babcb33`](https://github.com/gohugoio/hugo/commit/babcb339a) [@&#8203;bep](https://github.com/bep) [#&#8203;12288](https://github.com/gohugoio/hugo/issues/12288) - Use Apache License without modification [`6b86797`](https://github.com/gohugoio/hugo/commit/6b867972e) [@&#8203;bep](https://github.com/bep) [#&#8203;12415](https://github.com/gohugoio/hugo/issues/12415) - build(deps): bump github.com/tdewolff/minify/v2 from 2.20.19 to 2.20.20 [`fb08439`](https://github.com/gohugoio/hugo/commit/fb084390c) [@&#8203;dependabot](https://github.com/dependabot)\[bot] ### [`v0.125.3`](https://github.com/gohugoio/hugo/releases/tag/v0.125.3) [Compare Source](https://github.com/gohugoio/hugo/compare/v0.125.2...v0.125.3) This release fixes a security issue reported by [@&#8203;ejona86](https://github.com/ejona86) (see [#&#8203;12411](https://github.com/gohugoio/hugo/issues/12411)) that could allow [XSS injection](https://owasp.org/www-community/attacks/xss/) from Markdown content files if one of the internal [link or image](https://gohugo.io/getting-started/configuration-markup/#renderhooksimageenabledefault) render hook templates added in Hugo 0.123.0 are enabled. You typically control and trust the content files, but according to Hugo's [security model](https://gohugo.io/about/security/), we state that "template and configuration authors (you) are trusted, but the data you send in is not." - markup/goldmark: Fix data race in the hugocontext wrapper [`509ab08`](https://github.com/gohugoio/hugo/commit/509ab08c1) [@&#8203;bep](https://github.com/bep) - tpl: Escape .Title in built-in image and link render hooks [`15a4b9b`](https://github.com/gohugoio/hugo/commit/15a4b9b33) [@&#8203;bep](https://github.com/bep) - tpl/tplimpl: Improve embedded templates [`10a8448`](https://github.com/gohugoio/hugo/commit/10a8448ee) [@&#8203;jmooring](https://github.com/jmooring) [#&#8203;12396](https://github.com/gohugoio/hugo/issues/12396) - SECURITY.md: Update link to security model [`722c486`](https://github.com/gohugoio/hugo/commit/722c486a3) [@&#8203;ejona86](https://github.com/ejona86) - modules: Fix potential infinite loop in module collection [`f40f50e`](https://github.com/gohugoio/hugo/commit/f40f50ead) [@&#8203;bep](https://github.com/bep) [#&#8203;12407](https://github.com/gohugoio/hugo/issues/12407) ### [`v0.125.2`](https://github.com/gohugoio/hugo/releases/tag/v0.125.2) [Compare Source](https://github.com/gohugoio/hugo/compare/v0.125.1...v0.125.2) #### What's Changed - Only add root sections to the section pages menu [`06d2489`](https://github.com/gohugoio/hugo/commit/06d248910) [@&#8203;bep](https://github.com/bep) [#&#8203;12399](https://github.com/gohugoio/hugo/issues/12399) - Fix partial rebuilds for SCSS fetched with GetMatch and similar Fixes [#&#8203;12395](https://github.com/gohugoio/hugo/issues/12395) [`004b694`](https://github.com/gohugoio/hugo/commit/004b69439) [@&#8203;bep](https://github.com/bep) - commands: Add gen chromastyles --lineNumbersTableStyle flag [`da6112f`](https://github.com/gohugoio/hugo/commit/da6112fc6) [@&#8203;jmooring](https://github.com/jmooring) [#&#8203;12393](https://github.com/gohugoio/hugo/issues/12393) - resources/images: Fix TestColorLuminance on s390x [`faf9fed`](https://github.com/gohugoio/hugo/commit/faf9fedc3) [@&#8203;bep](https://github.com/bep) - commands: Provide examples for chromastyles flags [`11aa893`](https://github.com/gohugoio/hugo/commit/11aa89319) [@&#8203;jmooring](https://github.com/jmooring) [#&#8203;12387](https://github.com/gohugoio/hugo/issues/12387) ### [`v0.125.1`](https://github.com/gohugoio/hugo/releases/tag/v0.125.1) [Compare Source](https://github.com/gohugoio/hugo/compare/v0.125.0...v0.125.1) #### What's Changed - tpl: Use erroridf for remote YouTube errors [`0c188fd`](https://github.com/gohugoio/hugo/commit/0c188fda2) [@&#8203;bep](https://github.com/bep) [#&#8203;12383](https://github.com/gohugoio/hugo/issues/12383) - build: Fix \`GLIBC\_2.29' not found issue [`bbc6888`](https://github.com/gohugoio/hugo/commit/bbc6888d0) [@&#8203;bep](https://github.com/bep) [#&#8203;12381](https://github.com/gohugoio/hugo/issues/12381) ### [`v0.125.0`](https://github.com/gohugoio/hugo/releases/tag/v0.125.0) [Compare Source](https://github.com/gohugoio/hugo/compare/v0.124.1...v0.125.0) Some of the notable new features in this release: - [strings.Diff](https://gohugo.io/functions/strings/diff/) template func. - [.PageInner](https://gohugo.io/render-hooks/images/#pageinner) in render hooks to get the inner page when using `.RenderShortcode` in a shortcode, typically used to resolve links and page resources relative to an included `Page`. - Add [`Luminance`](https://gohugo.io/methods/resource/colors/) to `$image.Color`, allowing for sorting by relative luminance. [`e197c7b`](https://github.com/gohugoio/hugo/commit/e197c7b29) [@&#8203;bep](https://github.com/bep) [#&#8203;10450](https://github.com/gohugoio/hugo/issues/10450) This release is built with Go 1.22.2 ([#&#8203;12351](https://github.com/gohugoio/hugo/issues/12351)) which comes with a fix for security issue CVE-2023-45288. We don't see how that could be exploited in Hugo, but we do appreciate that people want a clean security report. #### Bug fixes - Fix server rebuilds when adding a content file on Linux [`fa60a2f`](https://github.com/gohugoio/hugo/commit/fa60a2fbc) [@&#8203;bep](https://github.com/bep) [#&#8203;12362](https://github.com/gohugoio/hugo/issues/12362) - helpers: Fix TrimShortHTML when used with AsciiDoc content [`6049ba9`](https://github.com/gohugoio/hugo/commit/6049ba99f) [@&#8203;jmooring](https://github.com/jmooring) [#&#8203;12369](https://github.com/gohugoio/hugo/issues/12369) - github: Fix CI build [`9323376`](https://github.com/gohugoio/hugo/commit/9323376df) [@&#8203;bep](https://github.com/bep) - all: Fix duplicate words in comments [`bf0b140`](https://github.com/gohugoio/hugo/commit/bf0b14036) [@&#8203;grimreaper](https://github.com/grimreaper) - all: Typo fixes [`17765a7`](https://github.com/gohugoio/hugo/commit/17765a745) [@&#8203;coliff](https://github.com/coliff) - hugolib: Fix regression for blank summaries [`2664052`](https://github.com/gohugoio/hugo/commit/26640525a) [@&#8203;curegit](https://github.com/curegit) - Fix sectionPagesMenu for pages in root level [`488b21d`](https://github.com/gohugoio/hugo/commit/488b21d15) [@&#8203;bep](https://github.com/bep) [#&#8203;12306](https://github.com/gohugoio/hugo/issues/12306) - Fix resource bundling for overlapping page.md vs page.txt [`983b8d5`](https://github.com/gohugoio/hugo/commit/983b8d537) [@&#8203;bep](https://github.com/bep) [#&#8203;12320](https://github.com/gohugoio/hugo/issues/12320) - Fix panic with debug.Dump with Page when running the server [`38e05bd`](https://github.com/gohugoio/hugo/commit/38e05bd3c) [@&#8203;bep](https://github.com/bep) [#&#8203;12309](https://github.com/gohugoio/hugo/issues/12309) - resources/page: Fix GoDoc comment [`27414d4`](https://github.com/gohugoio/hugo/commit/27414d43a) [@&#8203;availhang](https://github.com/availhang) #### Improvements - Add Luminance to Color [`e197c7b`](https://github.com/gohugoio/hugo/commit/e197c7b29) [@&#8203;bep](https://github.com/bep) [#&#8203;10450](https://github.com/gohugoio/hugo/issues/10450) - Pass .RenderShortcodes' Page to render hooks as .PageInner [`df11327`](https://github.com/gohugoio/hugo/commit/df11327ba) [@&#8203;bep](https://github.com/bep) [#&#8203;12356](https://github.com/gohugoio/hugo/issues/12356) - github: Add a "free space" step on Ubuntu [`8e50ccf`](https://github.com/gohugoio/hugo/commit/8e50ccfae) [@&#8203;bep](https://github.com/bep) - helpers: Add BenchmarkTrimShortHTML [`bfc3122`](https://github.com/gohugoio/hugo/commit/bfc3122f8) [@&#8203;bep](https://github.com/bep) - github: Update actions [`00ae8e8`](https://github.com/gohugoio/hugo/commit/00ae8e8c7) [@&#8203;bep](https://github.com/bep) - github: Format GitHub actions files [`e423e56`](https://github.com/gohugoio/hugo/commit/e423e5627) [@&#8203;bep](https://github.com/bep) - hugolib: Display server address after each rebuild [`09eb822`](https://github.com/gohugoio/hugo/commit/09eb82282) [@&#8203;jmooring](https://github.com/jmooring) [#&#8203;12359](https://github.com/gohugoio/hugo/issues/12359) - resources/page: Add taxonomies Page method [`a6e8439`](https://github.com/gohugoio/hugo/commit/a6e843917) [@&#8203;jmooring](https://github.com/jmooring) [#&#8203;12316](https://github.com/gohugoio/hugo/issues/12316) - commands: Adjust completions [`38f68cd`](https://github.com/gohugoio/hugo/commit/38f68cd16) [@&#8203;bep](https://github.com/bep) - completion: Improve existing argument completions, add many more [`a67650b`](https://github.com/gohugoio/hugo/commit/a67650b6f) [@&#8203;scop](https://github.com/scop) - Upgrade to Go 1.22.2 [`2a060b3`](https://github.com/gohugoio/hugo/commit/2a060b37a) [@&#8203;bep](https://github.com/bep) [#&#8203;12351](https://github.com/gohugoio/hugo/issues/12351) - babel: Run go fmt [`92de862`](https://github.com/gohugoio/hugo/commit/92de8625c) [@&#8203;bep](https://github.com/bep) - babel: Close file before removing [`7907935`](https://github.com/gohugoio/hugo/commit/7907935a4) [@&#8203;testwill](https://github.com/testwill) - bump golang.org/x/mod from 0.16.0 to 0.17.0 [`02d5ec1`](https://github.com/gohugoio/hugo/commit/02d5ec14f) [@&#8203;dependabot](https://github.com/dependabot)\[bot] - resources/page: Escape hash sign in permalinks [`4500b0e`](https://github.com/gohugoio/hugo/commit/4500b0e42) [@&#8203;sorenisanerd](https://github.com/sorenisanerd) [#&#8203;4926](https://github.com/gohugoio/hugo/issues/4926) [#&#8203;8232](https://github.com/gohugoio/hugo/issues/8232) [#&#8203;12342](https://github.com/gohugoio/hugo/issues/12342) - tpl/strings: Improve type checking [`7bf1abf`](https://github.com/gohugoio/hugo/commit/7bf1abfc5) [@&#8203;jmooring](https://github.com/jmooring) - tpl/tplimpl: Improve youtube shortcode [`8a0ea12`](https://github.com/gohugoio/hugo/commit/8a0ea12d8) [@&#8203;jmooring](https://github.com/jmooring) [#&#8203;3694](https://github.com/gohugoio/hugo/issues/3694) [#&#8203;9213](https://github.com/gohugoio/hugo/issues/9213) [#&#8203;10520](https://github.com/gohugoio/hugo/issues/10520) [#&#8203;10575](https://github.com/gohugoio/hugo/issues/10575) [#&#8203;10576](https://github.com/gohugoio/hugo/issues/10576) - errors: Return error from cast.ToStringE() consistently [`6f07e59`](https://github.com/gohugoio/hugo/commit/6f07e5976) [@&#8203;seiyab](https://github.com/seiyab) - tpl/tplimpl: Improve embedded opengraph template [`2da4ec5`](https://github.com/gohugoio/hugo/commit/2da4ec573) [@&#8203;jmooring](https://github.com/jmooring) [#&#8203;8296](https://github.com/gohugoio/hugo/issues/8296) [#&#8203;8698](https://github.com/gohugoio/hugo/issues/8698) [#&#8203;8991](https://github.com/gohugoio/hugo/issues/8991) [#&#8203;9818](https://github.com/gohugoio/hugo/issues/9818) [#&#8203;9866](https://github.com/gohugoio/hugo/issues/9866) [#&#8203;10647](https://github.com/gohugoio/hugo/issues/10647) - tpl/strings: Create strings.Diff template function [`6624979`](https://github.com/gohugoio/hugo/commit/6624979e1) [@&#8203;jmooring](https://github.com/jmooring) [#&#8203;12330](https://github.com/gohugoio/hugo/issues/12330) - tpl/tplimpl: Optionally exclude content from sitemap [`6738a3e`](https://github.com/gohugoio/hugo/commit/6738a3e79) [@&#8203;jmooring](https://github.com/jmooring) [#&#8203;653](https://github.com/gohugoio/hugo/issues/653) [#&#8203;12282](https://github.com/gohugoio/hugo/issues/12282) - tpl/tplimpl: Remove trailing slash from void elements [`2f7df4b`](https://github.com/gohugoio/hugo/commit/2f7df4b92) [@&#8203;jmooring](https://github.com/jmooring) [#&#8203;11867](https://github.com/gohugoio/hugo/issues/11867) - tpl/tplimpl: Update RSS template [`f0a26cf`](https://github.com/gohugoio/hugo/commit/f0a26cf58) [@&#8203;jmooring](https://github.com/jmooring) [#&#8203;3918](https://github.com/gohugoio/hugo/issues/3918) [#&#8203;11692](https://github.com/gohugoio/hugo/issues/11692) - tpl/tplimpl: Update schema template [`74ce5dc`](https://github.com/gohugoio/hugo/commit/74ce5dc84) [@&#8203;jmooring](https://github.com/jmooring) [#&#8203;7570](https://github.com/gohugoio/hugo/issues/7570) - resources: Use different cache key when copying resources [`54a8f0c`](https://github.com/gohugoio/hugo/commit/54a8f0ce2) [@&#8203;jmooring](https://github.com/jmooring) [#&#8203;10412](https://github.com/gohugoio/hugo/issues/10412) [#&#8203;12310](https://github.com/gohugoio/hugo/issues/12310) - tpl/tplimpl: Update Google Analytics template and config [`ebfca61`](https://github.com/gohugoio/hugo/commit/ebfca61ac) [@&#8203;jmooring](https://github.com/jmooring) [#&#8203;11802](https://github.com/gohugoio/hugo/issues/11802) [#&#8203;10093](https://github.com/gohugoio/hugo/issues/10093) - hugolib: Conditionally suppress .Site.Author deprecation notice [`e191774`](https://github.com/gohugoio/hugo/commit/e1917740a) [@&#8203;jmooring](https://github.com/jmooring) [#&#8203;12297](https://github.com/gohugoio/hugo/issues/12297) #### Dependency Updates - build(deps): bump github.com/pelletier/go-toml/v2 from 2.2.0 to 2.2.1 [`fe63de3`](https://github.com/gohugoio/hugo/commit/fe63de3a8) [@&#8203;dependabot](https://github.com/dependabot)\[bot] - build(deps): bump google.golang.org/protobuf from 1.31.0 to 1.33.0 [`a18e2bc`](https://github.com/gohugoio/hugo/commit/a18e2bcb9) [@&#8203;dependabot](https://github.com/dependabot)\[bot] - build(deps): bump golang.org/x/tools from 0.19.0 to 0.20.0 [`97df6be`](https://github.com/gohugoio/hugo/commit/97df6be59) [@&#8203;dependabot](https://github.com/dependabot)\[bot] - build(deps): bump golang.org/x/net from 0.23.0 to 0.24.0 [`e9b8bec`](https://github.com/gohugoio/hugo/commit/e9b8bec43) [@&#8203;dependabot](https://github.com/dependabot)\[bot] - build(deps): bump github.com/getkin/kin-openapi from 0.123.0 to 0.124.0 [`888cc1e`](https://github.com/gohugoio/hugo/commit/888cc1e61) [@&#8203;dependabot](https://github.com/dependabot)\[bot] - build(deps): bump github.com/pelletier/go-toml/v2 from 2.1.1 to 2.2.0 [`060cce0`](https://github.com/gohugoio/hugo/commit/060cce0a9) [@&#8203;dependabot](https://github.com/dependabot)\[bot] - build(deps): bump github.com/yuin/goldmark from 1.7.0 to 1.7.1 [`5608ba1`](https://github.com/gohugoio/hugo/commit/5608ba1f7) [@&#8203;dependabot](https://github.com/dependabot)\[bot] - build(deps): bump github.com/aws/aws-sdk-go-v2/service/cloudfront [`2fedca6`](https://github.com/gohugoio/hugo/commit/2fedca6c8) [@&#8203;dependabot](https://github.com/dependabot)\[bot] - build(deps): bump golang.org/x/net from 0.22.0 to 0.23.0 [`07873b7`](https://github.com/gohugoio/hugo/commit/07873b74b) [@&#8203;dependabot](https://github.com/dependabot)\[bot] #### Documentation - docs: Regen docshelper [`df9f2fb`](https://github.com/gohugoio/hugo/commit/df9f2fb61) [@&#8203;bep](https://github.com/bep) - hugolib: Add an asciidoc rebuild test case [`74e9129`](https://github.com/gohugoio/hugo/commit/74e912956) [@&#8203;bep](https://github.com/bep) [#&#8203;12375](https://github.com/gohugoio/hugo/issues/12375) - markup/asciidocext: Add Level to Heading struct [`c837f36`](https://github.com/gohugoio/hugo/commit/c837f36ab) [@&#8203;jmooring](https://github.com/jmooring) [#&#8203;12291](https://github.com/gohugoio/hugo/issues/12291) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4zMDAuMCIsInVwZGF0ZWRJblZlciI6IjM3LjMyMS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
renovator added 1 commit 2024-04-16 17:32:01 +02:00
ci/woodpecker/pr/build-package Pipeline was successful Details
ci/woodpecker/pr/build-container Pipeline was successful Details
ci/woodpecker/pr/docs Pipeline was successful Details
ab9d557506
chore(deps): update dependency gohugoio/hugo to v0.125.0
renovator force-pushed renovate/gohugoio-hugo-0.x from ab9d557506 to 77774b4c5a 2024-04-18 11:02:19 +02:00 Compare
renovator changed title from chore(deps): update dependency gohugoio/hugo to v0.125.0 to chore(deps): update dependency gohugoio/hugo to v0.125.1 2024-04-18 11:02:20 +02:00
renovator force-pushed renovate/gohugoio-hugo-0.x from 77774b4c5a to e16b4685a9 2024-04-20 18:02:01 +02:00 Compare
renovator changed title from chore(deps): update dependency gohugoio/hugo to v0.125.1 to chore(deps): update dependency gohugoio/hugo to v0.125.2 2024-04-20 18:02:02 +02:00
renovator changed title from chore(deps): update dependency gohugoio/hugo to v0.125.2 to chore(deps): update dependency gohugoio/hugo to v0.125.3 2024-04-22 20:01:36 +02:00
renovator force-pushed renovate/gohugoio-hugo-0.x from e16b4685a9 to 212df64d38 2024-04-22 20:01:36 +02:00 Compare
renovator force-pushed renovate/gohugoio-hugo-0.x from 212df64d38 to e9276308cf 2024-04-25 16:01:49 +02:00 Compare
renovator changed title from chore(deps): update dependency gohugoio/hugo to v0.125.3 to chore(deps): update dependency gohugoio/hugo to v0.125.4 2024-04-25 16:01:50 +02:00
All checks were successful
ci/woodpecker/pr/build-package Pipeline was successful
ci/woodpecker/pr/build-container Pipeline was successful
ci/woodpecker/pr/docs Pipeline was successful
This pull request can be merged automatically.
You are not authorized to merge this pull request.
You can also view command line instructions.

Step 1:

From your project repository, check out a new branch and test the changes.
git checkout -b renovate/gohugoio-hugo-0.x main
git pull origin renovate/gohugoio-hugo-0.x

Step 2:

Merge the changes and update on Gitea.
git checkout main
git merge --no-ff renovate/gohugoio-hugo-0.x
git push origin main
Sign in to join this conversation.
No reviewers
No Label
No Milestone
No Assignees
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: container/hugo#144
No description provided.