chore(deps): update dependency gohugoio/hugo to v0.159.2

[renovate]

This PR contains the following updates:

Package	Update	Change
gohugoio/hugo	minor	0.157.0 → 0.159.2

---

Release Notes

gohugoio/hugo (gohugoio/hugo)

v0.159.2

Compare Source

Note that the security fix below is not a potential threat if you either:

• Trust your Markdown content files.
• Have custom render hook template for links and images.

EDIT IN: This release also adds release archives for non-extended-withdeploy builds.

What's Changed

• Fix potential content XSS by escaping dangerous URLs in Markdown links and images 479fe6c @​bep
• resources/page: Fix shared reader in Source.ValueAsOpenReadSeekCloser df520e3 @​jmooring #​14684

v0.159.1

Compare Source

The regression fixed in this release isn't new, but it's so subtle that we thought we'd release this sooner rather than later. For some time now, the minifier we use have stripped namespaced attributes in SVGs, which broke dynamic constructs using e.g. AlpineJS' x-bind: namespace (library used by Hugo's documentation site).

To fix this, the upstream library has hadded a keepNamespaces slice option. It was not possible to find a default that would make all happy, so we opted for an option that at least would make AlpineJS sites work out of the box:

 [minify.tdewolff.svg]
      keepNamespaces = ['', 'x-bind']

What's Changed

• minifiers: Keep x-bind and blank namespace in SVG minification 42289d7 @​bep #​14669

v0.159.0

Compare Source

This release greatly improves and simplifies management of Node.js/npm dependencies in a multi-module setup. See this page for more information.

Note

• Replace deprecated site.Data with hugo.Data in tests a8fca59 @​bep
• Replace deprecated excludeFiles and includeFiles with files in tests 182b104 @​bep
• Replace deprecated :filename with :contentbasename in the permalinks test eb11c3d @​bep

Bug fixes

• tpl/tplimpl: Fix Vimeo shortcode test eaf4c75 @​jmooring #​14649

Improvements

• create: Return error instead of panic when page not found 807cae1 @​mango766 #​14112
• commands: Preserve non-content files in convert output c4fb61d @​xndvaz #​4621
• npm: Use workspaces to simplify hugo mod npm pack d88a29e @​bep
• commands: Close cpu profile file when StartCPUProfile fails 9dd9c76 @​buley
• Remove the AI Watchdog workflow for now 3315a86 @​bep
• Remove 'bep' from PR user logins skip list 3824484 @​bep
• tpl/tplimpl: Comment out the Vimeo simple shortcode tests 7813c5c @​bep #​14649

Dependency Updates

• build(deps): bump github.com/olekukonko/tablewriter from 1.1.3 to 1.1.4 (#​14641) 3ff9b7f @​dependabot[bot]
• build(deps): bump github.com/yuin/goldmark from 1.7.16 to 1.7.17 be93ccd @​dependabot[bot]
• build(deps): bump github.com/magefile/mage from 1.15.0 to 1.16.1 2669bca @​dependabot[bot]
• build(deps): bump golang.org/x/image from 0.36.0 to 0.37.0 753d447 @​dependabot[bot]
• build(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.3 4f39d72 @​dependabot[bot]

Documentation

• docs: Update docs.yaml d2043cf @​bep
• commands: Update docs linke to Node.js docs 4f3c398 @​bep

v0.158.0

Compare Source

This release adds css.Build, native and very fast bundling/transformation/minifying of CSS resources. Also see the new strings.ReplacePairs, a very fast option if you need to do many string replacements.

Notes

• Upgrade to to Go 1.26.1 (#​14597) (note) 1f578f1 @​bep #​14595. This fixes a security issue in Go's template package used by Hugo: https://www.cve.org/CVERecord?id=CVE-2026-27142

Deprecations

The methods and config options are deprecated and will be removed in a future Hugo release.

Also see this article

Language configuration

• languageCode → Use locale instead.
• languages.<lang>.languageCode → Use languages.<lang>.locale instead.
• languages.<lang>.languageName → Use languages.<lang>.label instead.
• languages.<lang>.languageDirection → Use languages.<lang>.direction instead.

Language methods

• .Site.LanguageCode → Use .Site.Language.Locale instead.
• .Language.LanguageCode → Use .Language.Locale instead.
• .Language.LanguageName → Use .Language.Label instead.
• .Language.LanguageDirection → Use .Language.Direction instead.

Bug fixes

• tpl/css: Fix external source maps e431f90 @​bep #​14620
• hugolib: Fix server no watch 59e0446 @​jmooring #​14615
• resources: Fix context canceled on GetRemote with per-request timeout 842d8f1 @​bep #​14611
• tpl/tplimpl: Prefer early suffixes when media type matches 4eafd9e @​bep #​13877 #​14601
• all: Run go fix ./... e310822 @​bep
• internal/warpc: Fix SIGSEGV in Close() when dispatcher fails to start c9b88e4 @​bep #​14536
• Fix index out of range panic in fileEventsContentPaths f797f84 @​bep #​14573

Improvements

• resources: Re-publish on transformation cache hit 3c980c0 @​bep #​14629
• create/skeletons: Use css.Build in theme skeleton 404ac00 @​jmooring #​14626
• tpl/css: Add a test case for rebuilds on CSS options changes 06fcb72 @​bep
• hugolib: Allow regular pages to cascade to self 9b5f1d4 @​jmooring #​14627
• tpl/css: Allow the user to override single loader entries 623722b @​bep #​14623
• tpl/css: Make default loader resolution for CSS @​import and url() always behave the same a7cbcf1 @​bep #​14619
• internal/js: Add default mainFields for CSS builds 36cdb2c @​jmooring #​14614
• Add css.Build 3e3b849 @​bep #​14609 #​14613
• resources: Use full path for Exif etc. decoding error/warning messages c47ec23 @​bep #​12693
• Move to new locales library and upgrade CLDR from v36.1 to v48.1 4652ae4 @​bep
• tpl/strings: Add strings.ReplacePairs function 13a95b9 @​jmooring #​14594
• github: Remove pull_request_template.md 54c8048 @​bep
• testing: Make commands tests pass in Go 1.26.1 157bfdd @​bep
• refactor: Deprecate language configuration and template methods d4f2122 @​jmooring #​14269
• Replace Exif with Meta in tests 991d2f9 @​bep
• resources: Improve getImageOps error message e857777 @​jmooring #​14571
• resources/images: Add IsImageResourceWithMeta etc. tests for bmp and gif 44dc384 @​bep #​14568

Dependency Updates

• deps: Upgrade github.com/evanw/esbuild v0.27.3 => v0.27.4 0e46a97 @​bep
• build(deps): bump github.com/getkin/kin-openapi from 0.133.0 to 0.134.0 c27d9e8 @​dependabot[bot]
• build(deps): bump golang.org/x/tools from 0.42.0 to 0.43.0 098eac5 @​dependabot[bot]
• build(deps): bump gocloud.dev from 0.44.0 to 0.45.0 87f8de8 @​dependabot[bot]
• build(deps): bump golang.org/x/sync from 0.19.0 to 0.20.0 67ef6c6 @​dependabot[bot]
• build(deps): bump golang.org/x/net from 0.50.0 to 0.51.0 (#​14569) b29c2f7 @​dependabot[bot]
• build(deps): bump github.com/tdewolff/minify/v2 from 2.24.9 to 2.24.10 (#​14585) e91d191 @​dependabot[bot]
• build(deps): bump github.com/bep/imagemeta from 0.15.0 to 0.17.0 (#​14584) a8a54bd @​dependabot[bot]

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (0.159.2). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.