From 43f8571b8a63cada454d4abdfef1674b5cfcbf4f Mon Sep 17 00:00:00 2001
From: tym83 <6355522@gmail.com>
Date: Mon, 3 Aug 2026 13:52:02 +0500
Subject: [PATCH 1/5] chore: upgrade Hugo to 0.164.0 and convert HTML content
to markdown
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Hugo 0.162.0 fixed CVE-2026-50133, an XSS through content files served as
text/html, and denies that media type by default from then on. The site
carried fourteen such files — the five home pages and nine roadmap pages —
so it could only keep building by staying on a version with the flaw.
Converting them to markdown removes the reason to hold back. Goldmark
already runs with unsafe: true, so the inline HTML in these pages renders
as before. Body indentation inside the wrapper divs on the home pages was
reduced to two spaces so markdown does not read those lines as code blocks;
the rendered output has no code blocks and the community section is intact.
Node asset tools have run under Node's permission model since 0.161.0, which
the module-cached Docsy SCSS does not satisfy, so read access is widened
while writes stay denied.
Verified with a full local build on 0.164.0: 1705 pages, no errors, all five
languages and the roadmap pages render.
Co-Authored-By: Claude
Signed-off-by: tym83 <6355522@gmail.com>
---
.github/workflows/hugo.yaml | 2 +-
content/de/{_index.html => _index.md} | 26 +++++++++----------
content/en/{_index.html => _index.md} | 26 +++++++++----------
.../en/docs/next/{roadmap.html => roadmap.md} | 0
.../en/docs/v0/{roadmap.html => roadmap.md} | 0
.../en/docs/v1.0/{roadmap.html => roadmap.md} | 0
.../en/docs/v1.1/{roadmap.html => roadmap.md} | 0
.../en/docs/v1.2/{roadmap.html => roadmap.md} | 0
.../en/docs/v1.3/{roadmap.html => roadmap.md} | 0
.../en/docs/v1.4/{roadmap.html => roadmap.md} | 0
.../en/docs/v1.5/{roadmap.html => roadmap.md} | 0
.../en/docs/v1.6/{roadmap.html => roadmap.md} | 0
content/hi/{_index.html => _index.md} | 26 +++++++++----------
content/ru/{_index.html => _index.md} | 26 +++++++++----------
content/zh-cn/{_index.html => _index.md} | 26 +++++++++----------
hugo.yaml | 18 +++++++++++++
netlify.toml | 2 +-
17 files changed, 85 insertions(+), 67 deletions(-)
rename content/de/{_index.html => _index.md} (80%)
rename content/en/{_index.html => _index.md} (80%)
rename content/en/docs/next/{roadmap.html => roadmap.md} (100%)
rename content/en/docs/v0/{roadmap.html => roadmap.md} (100%)
rename content/en/docs/v1.0/{roadmap.html => roadmap.md} (100%)
rename content/en/docs/v1.1/{roadmap.html => roadmap.md} (100%)
rename content/en/docs/v1.2/{roadmap.html => roadmap.md} (100%)
rename content/en/docs/v1.3/{roadmap.html => roadmap.md} (100%)
rename content/en/docs/v1.4/{roadmap.html => roadmap.md} (100%)
rename content/en/docs/v1.5/{roadmap.html => roadmap.md} (100%)
rename content/en/docs/v1.6/{roadmap.html => roadmap.md} (100%)
rename content/hi/{_index.html => _index.md} (84%)
rename content/ru/{_index.html => _index.md} (82%)
rename content/zh-cn/{_index.html => _index.md} (79%)
diff --git a/.github/workflows/hugo.yaml b/.github/workflows/hugo.yaml
index 3debba3a..5825d40c 100644
--- a/.github/workflows/hugo.yaml
+++ b/.github/workflows/hugo.yaml
@@ -32,7 +32,7 @@ jobs:
build:
runs-on: ubuntu-latest
env:
- HUGO_VERSION: 0.160.1
+ HUGO_VERSION: 0.164.0
steps:
- name: Install Hugo CLI
run: |
diff --git a/content/de/_index.html b/content/de/_index.md
similarity index 80%
rename from content/de/_index.html
rename to content/de/_index.md
index 3768828d..0be77107 100644
--- a/content/de/_index.html
+++ b/content/de/_index.md
@@ -92,7 +92,7 @@
diff --git a/content/en/_index.html b/content/en/_index.md
similarity index 80%
rename from content/en/_index.html
rename to content/en/_index.md
index 55a817fc..fa2e862f 100644
--- a/content/en/_index.html
+++ b/content/en/_index.md
@@ -85,7 +85,7 @@
diff --git a/content/en/docs/next/roadmap.html b/content/en/docs/next/roadmap.md
similarity index 100%
rename from content/en/docs/next/roadmap.html
rename to content/en/docs/next/roadmap.md
diff --git a/content/en/docs/v0/roadmap.html b/content/en/docs/v0/roadmap.md
similarity index 100%
rename from content/en/docs/v0/roadmap.html
rename to content/en/docs/v0/roadmap.md
diff --git a/content/en/docs/v1.0/roadmap.html b/content/en/docs/v1.0/roadmap.md
similarity index 100%
rename from content/en/docs/v1.0/roadmap.html
rename to content/en/docs/v1.0/roadmap.md
diff --git a/content/en/docs/v1.1/roadmap.html b/content/en/docs/v1.1/roadmap.md
similarity index 100%
rename from content/en/docs/v1.1/roadmap.html
rename to content/en/docs/v1.1/roadmap.md
diff --git a/content/en/docs/v1.2/roadmap.html b/content/en/docs/v1.2/roadmap.md
similarity index 100%
rename from content/en/docs/v1.2/roadmap.html
rename to content/en/docs/v1.2/roadmap.md
diff --git a/content/en/docs/v1.3/roadmap.html b/content/en/docs/v1.3/roadmap.md
similarity index 100%
rename from content/en/docs/v1.3/roadmap.html
rename to content/en/docs/v1.3/roadmap.md
diff --git a/content/en/docs/v1.4/roadmap.html b/content/en/docs/v1.4/roadmap.md
similarity index 100%
rename from content/en/docs/v1.4/roadmap.html
rename to content/en/docs/v1.4/roadmap.md
diff --git a/content/en/docs/v1.5/roadmap.html b/content/en/docs/v1.5/roadmap.md
similarity index 100%
rename from content/en/docs/v1.5/roadmap.html
rename to content/en/docs/v1.5/roadmap.md
diff --git a/content/en/docs/v1.6/roadmap.html b/content/en/docs/v1.6/roadmap.md
similarity index 100%
rename from content/en/docs/v1.6/roadmap.html
rename to content/en/docs/v1.6/roadmap.md
diff --git a/content/hi/_index.html b/content/hi/_index.md
similarity index 84%
rename from content/hi/_index.html
rename to content/hi/_index.md
index cfe366ee..3d399cd5 100644
--- a/content/hi/_index.html
+++ b/content/hi/_index.md
@@ -92,7 +92,7 @@
diff --git a/content/ru/_index.html b/content/ru/_index.md
similarity index 82%
rename from content/ru/_index.html
rename to content/ru/_index.md
index a9b2483c..29396404 100644
--- a/content/ru/_index.html
+++ b/content/ru/_index.md
@@ -92,7 +92,7 @@
diff --git a/content/zh-cn/_index.html b/content/zh-cn/_index.md
similarity index 79%
rename from content/zh-cn/_index.html
rename to content/zh-cn/_index.md
index de72e295..5dee5b50 100644
--- a/content/zh-cn/_index.html
+++ b/content/zh-cn/_index.md
@@ -92,7 +92,7 @@
diff --git a/hugo.yaml b/hugo.yaml
index f5d555d7..ad4bba90 100644
--- a/hugo.yaml
+++ b/hugo.yaml
@@ -3,6 +3,24 @@ title: Cozystack
enableRobotsTXT: true
enableEmoji: true
+# Since Hugo v0.161.0 the Node asset tools (PostCSS here) run under Node's
+# permission model, with read access limited to the project directory by
+# default. That default is not enough for this site: the Docsy theme arrives as
+# a Hugo module and its SCSS is served from the module cache outside the project
+# tree, so the CSS build fails with "Use --allow-fs-read to manage permissions".
+#
+# Read access is therefore widened. Write access stays denied (allowWrite is
+# left at its empty default), as do addons, child processes and workers beyond
+# what Hugo already permits for tailwindcss.
+#
+# This is deliberately broader than necessary — the minimal set of readable
+# paths has not been pinned down, and narrowing it would be a welcome follow-up.
+security:
+ node:
+ permissions:
+ allowRead:
+ - '*'
+
# Blog taxonomies: two independent axes used by the blog filter UI.
# article_types: release, case, how-to, tech-article, news
# topics: platform, postgresql, kubernetes, cilium, talos, opensearch,
diff --git a/netlify.toml b/netlify.toml
index 63c2b950..1e5f74eb 100644
--- a/netlify.toml
+++ b/netlify.toml
@@ -3,7 +3,7 @@
command = "npm install && ./hack/download_openapi.sh && hugo --gc --minify"
[build.environment]
- HUGO_VERSION = "0.160.1"
+ HUGO_VERSION = "0.164.0"
HUGO_EXTENDED = "true"
NODE_VERSION = "20"
GO_VERSION = "1.23"
From 1ffe4d70ecff9db62aa0ce0029c5ed7804ebe4f3 Mon Sep 17 00:00:00 2001
From: IvanHunters
Date: Mon, 3 Aug 2026 12:12:39 +0300
Subject: [PATCH 2/5] fix(i18n): refresh source_digest for home page
translations
The home page indentation fix changed the byte content of the English
source content/en/_index.md, so its sha256 no longer matched the
source_digest recorded in the de, hi, ru and zh-cn translations. That
made hack/check-i18n.sh report the four translations as stale and turned
the i18n-lint check red.
The English change is whitespace only (five-space to two-space body
indentation to avoid markdown code blocks), so the translations remain
semantically current. Refresh their recorded source_digest to match;
no re-translation is required.
Signed-off-by: IvanHunters
---
content/de/_index.md | 2 +-
content/hi/_index.md | 2 +-
content/ru/_index.md | 2 +-
content/zh-cn/_index.md | 2 +-
4 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/content/de/_index.md b/content/de/_index.md
index 0be77107..264c4689 100644
--- a/content/de/_index.md
+++ b/content/de/_index.md
@@ -8,7 +8,7 @@ seo:
title: "Cozystack — Open-Source Private Cloud auf Kubernetes"
description: "Open-Source-Cloud-Plattform auf Kubernetes für Managed VMs, Datenbanken, S3-Storage und GPU-Workloads. CNCF-Sandbox-Projekt."
keywords: ["private cloud", "managed kubernetes", "kubernetes plattform", "open source cloud"]
-source_digest: "sha256:348771fb7bd901b79d761d40344c9e16e119c54edb68b3ca6ab0bb666b0d0040"
+source_digest: "sha256:9fe03c365e388b6e4605ddbe297051a430c5dd8cdd7ba81d7c5d1aff5f58dc9c"
translation_status: current
l10n: transcreate
taglines:
diff --git a/content/hi/_index.md b/content/hi/_index.md
index 3d399cd5..3a89e78f 100644
--- a/content/hi/_index.md
+++ b/content/hi/_index.md
@@ -8,7 +8,7 @@ seo:
title: "Cozystack — Kubernetes पर ओपन-सोर्स प्राइवेट क्लाउड"
description: "Kubernetes पर ओपन-सोर्स क्लाउड प्लेटफ़ॉर्म: मैनेज्ड VMs, डेटाबेस, S3 स्टोरेज और GPU वर्कलोड। CNCF Sandbox प्रोजेक्ट।"
keywords: ["private cloud", "managed kubernetes", "kubernetes platform", "cloud platform"]
-source_digest: "sha256:348771fb7bd901b79d761d40344c9e16e119c54edb68b3ca6ab0bb666b0d0040"
+source_digest: "sha256:9fe03c365e388b6e4605ddbe297051a430c5dd8cdd7ba81d7c5d1aff5f58dc9c"
translation_status: current
l10n: transcreate
taglines:
diff --git a/content/ru/_index.md b/content/ru/_index.md
index 29396404..60e5870d 100644
--- a/content/ru/_index.md
+++ b/content/ru/_index.md
@@ -8,7 +8,7 @@ seo:
title: "Cozystack — частное облако с открытым кодом на Kubernetes"
description: "Open-source облачная платформа на Kubernetes: управляемые ВМ, базы данных, S3-хранилище и GPU. Проект CNCF Sandbox."
keywords: ["частное облако", "managed kubernetes", "kubernetes платформа", "облачная платформа"]
-source_digest: "sha256:348771fb7bd901b79d761d40344c9e16e119c54edb68b3ca6ab0bb666b0d0040"
+source_digest: "sha256:9fe03c365e388b6e4605ddbe297051a430c5dd8cdd7ba81d7c5d1aff5f58dc9c"
translation_status: current
l10n: transcreate
taglines:
diff --git a/content/zh-cn/_index.md b/content/zh-cn/_index.md
index 5dee5b50..5c56ee7c 100644
--- a/content/zh-cn/_index.md
+++ b/content/zh-cn/_index.md
@@ -8,7 +8,7 @@ seo:
title: "Cozystack — 基于 Kubernetes 的开源私有云"
description: "基于 Kubernetes 的开源云平台,提供托管虚拟机、数据库、S3 存储和 GPU 工作负载。CNCF Sandbox 项目。"
keywords: ["私有云", "Kubernetes", "开源云平台", "托管 Kubernetes"]
-source_digest: "sha256:348771fb7bd901b79d761d40344c9e16e119c54edb68b3ca6ab0bb666b0d0040"
+source_digest: "sha256:9fe03c365e388b6e4605ddbe297051a430c5dd8cdd7ba81d7c5d1aff5f58dc9c"
translation_status: current
l10n: transcreate
taglines:
From 106ec6563d96ba57d294858d67d6191172f18a61 Mon Sep 17 00:00:00 2001
From: IvanHunters
Date: Mon, 3 Aug 2026 12:54:01 +0300
Subject: [PATCH 3/5] fix(build): require Node 22 for Hugo 0.164 node
permission model
Hugo 0.164 runs Node asset tools (PostCSS for the Docsy theme) as
node --permission ...; the flag is hardcoded in common/hexec/exec.go
nodePermissionArgs with no Node-version detection. The --permission
flag exists only since Node 22.13.0, where the permission model was
promoted to stable; Node 20 knows only --experimental-permission and
aborts with "bad option: --permission".
netlify.toml pinned NODE_VERSION=20, which fails the production build
the first time PostCSS actually runs (Hugo caches its output, so warm
build previews pass and hide the break until a cold-cache deploy).
The Pages workflow left Node unpinned and relied on the runner default,
which is equally fragile.
Pin Node 22 in both build paths.
Signed-off-by: IvanHunters
---
.github/workflows/hugo.yaml | 7 +++++++
netlify.toml | 2 +-
2 files changed, 8 insertions(+), 1 deletion(-)
diff --git a/.github/workflows/hugo.yaml b/.github/workflows/hugo.yaml
index 5825d40c..8e83f983 100644
--- a/.github/workflows/hugo.yaml
+++ b/.github/workflows/hugo.yaml
@@ -48,6 +48,13 @@ jobs:
- name: Setup Pages
id: pages
uses: actions/configure-pages@v6
+ - name: Setup Node.js
+ uses: actions/setup-node@v4
+ with:
+ # Hugo 0.164 runs Node asset tools with "node --permission", a flag
+ # that exists only since Node 22.13. The runner default is unpinned,
+ # so pin an LTS that supports it.
+ node-version: "22"
- name: Install Node.js dependencies
run: "[[ -f package-lock.json || -f npm-shrinkwrap.json ]] && npm ci || true"
- name: Download OpenAPI specs
diff --git a/netlify.toml b/netlify.toml
index 1e5f74eb..5c940033 100644
--- a/netlify.toml
+++ b/netlify.toml
@@ -5,7 +5,7 @@
[build.environment]
HUGO_VERSION = "0.164.0"
HUGO_EXTENDED = "true"
- NODE_VERSION = "20"
+ NODE_VERSION = "22"
GO_VERSION = "1.23"
[context.production.environment]
From f119b308062bbc12efc9b9e081ba67a3cda519e8 Mon Sep 17 00:00:00 2001
From: IvanHunters
Date: Mon, 3 Aug 2026 12:54:08 +0300
Subject: [PATCH 4/5] fix(home): separate benefits and features shortcodes
After the .html to .md conversion, the two adjacent block shortcodes
home/benefits and home/features sit in a single markdown paragraph.
Hugo only strips the wrapping when a paragraph holds exactly one
shortcode, so the pair rendered as invalid
...
with an
extra empty paragraph margin on all five home pages. Put a blank line
between them so each is its own paragraph and gets unwrapped.
Refresh source_digest in the four translations, since the English source
content/en/_index.md changed.
Signed-off-by: IvanHunters
---
content/de/_index.md | 3 ++-
content/en/_index.md | 1 +
content/hi/_index.md | 3 ++-
content/ru/_index.md | 3 ++-
content/zh-cn/_index.md | 3 ++-
5 files changed, 9 insertions(+), 4 deletions(-)
diff --git a/content/de/_index.md b/content/de/_index.md
index 264c4689..229a28d0 100644
--- a/content/de/_index.md
+++ b/content/de/_index.md
@@ -8,7 +8,7 @@ seo:
title: "Cozystack — Open-Source Private Cloud auf Kubernetes"
description: "Open-Source-Cloud-Plattform auf Kubernetes für Managed VMs, Datenbanken, S3-Storage und GPU-Workloads. CNCF-Sandbox-Projekt."
keywords: ["private cloud", "managed kubernetes", "kubernetes plattform", "open source cloud"]
-source_digest: "sha256:9fe03c365e388b6e4605ddbe297051a430c5dd8cdd7ba81d7c5d1aff5f58dc9c"
+source_digest: "sha256:24e38da4716b93c35dcb9eb607152d193ef3d5ad42c0e22a25063a89da9f8dde"
translation_status: current
l10n: transcreate
taglines:
@@ -86,6 +86,7 @@ features:
{{< home/benefits >}}
+
{{< home/features >}}
diff --git a/content/en/_index.md b/content/en/_index.md
index fa2e862f..1bd31c15 100644
--- a/content/en/_index.md
+++ b/content/en/_index.md
@@ -79,6 +79,7 @@ features:
{{< home/benefits >}}
+
{{< home/features >}}
diff --git a/content/hi/_index.md b/content/hi/_index.md
index 3a89e78f..e3cfdb54 100644
--- a/content/hi/_index.md
+++ b/content/hi/_index.md
@@ -8,7 +8,7 @@ seo:
title: "Cozystack — Kubernetes पर ओपन-सोर्स प्राइवेट क्लाउड"
description: "Kubernetes पर ओपन-सोर्स क्लाउड प्लेटफ़ॉर्म: मैनेज्ड VMs, डेटाबेस, S3 स्टोरेज और GPU वर्कलोड। CNCF Sandbox प्रोजेक्ट।"
keywords: ["private cloud", "managed kubernetes", "kubernetes platform", "cloud platform"]
-source_digest: "sha256:9fe03c365e388b6e4605ddbe297051a430c5dd8cdd7ba81d7c5d1aff5f58dc9c"
+source_digest: "sha256:24e38da4716b93c35dcb9eb607152d193ef3d5ad42c0e22a25063a89da9f8dde"
translation_status: current
l10n: transcreate
taglines:
@@ -86,6 +86,7 @@ features:
{{< home/benefits >}}
+
{{< home/features >}}
diff --git a/content/ru/_index.md b/content/ru/_index.md
index 60e5870d..f4d19482 100644
--- a/content/ru/_index.md
+++ b/content/ru/_index.md
@@ -8,7 +8,7 @@ seo:
title: "Cozystack — частное облако с открытым кодом на Kubernetes"
description: "Open-source облачная платформа на Kubernetes: управляемые ВМ, базы данных, S3-хранилище и GPU. Проект CNCF Sandbox."
keywords: ["частное облако", "managed kubernetes", "kubernetes платформа", "облачная платформа"]
-source_digest: "sha256:9fe03c365e388b6e4605ddbe297051a430c5dd8cdd7ba81d7c5d1aff5f58dc9c"
+source_digest: "sha256:24e38da4716b93c35dcb9eb607152d193ef3d5ad42c0e22a25063a89da9f8dde"
translation_status: current
l10n: transcreate
taglines:
@@ -86,6 +86,7 @@ features:
{{< home/benefits >}}
+
{{< home/features >}}
diff --git a/content/zh-cn/_index.md b/content/zh-cn/_index.md
index 5c56ee7c..1c4c4391 100644
--- a/content/zh-cn/_index.md
+++ b/content/zh-cn/_index.md
@@ -8,7 +8,7 @@ seo:
title: "Cozystack — 基于 Kubernetes 的开源私有云"
description: "基于 Kubernetes 的开源云平台,提供托管虚拟机、数据库、S3 存储和 GPU 工作负载。CNCF Sandbox 项目。"
keywords: ["私有云", "Kubernetes", "开源云平台", "托管 Kubernetes"]
-source_digest: "sha256:9fe03c365e388b6e4605ddbe297051a430c5dd8cdd7ba81d7c5d1aff5f58dc9c"
+source_digest: "sha256:24e38da4716b93c35dcb9eb607152d193ef3d5ad42c0e22a25063a89da9f8dde"
translation_status: current
l10n: transcreate
taglines:
@@ -86,6 +86,7 @@ features:
{{< home/benefits >}}
+
{{< home/features >}}
From d5c557700a88de7173a434d1519d72a86e5e30d7 Mon Sep 17 00:00:00 2001
From: IvanHunters
Date: Mon, 3 Aug 2026 12:54:14 +0300
Subject: [PATCH 5/5] docs: update required Hugo and Node versions
The Hugo upgrade also raises the minimum local toolchain: Hugo 0.164.0
(matching the pins) and Node 22 (needed for the node permission model).
Update the required-tools lines in CONTRIBUTING.md and CLAUDE.md, which
still referenced Hugo 0.160.1 and Node 20.
Signed-off-by: IvanHunters
---
CLAUDE.md | 2 +-
CONTRIBUTING.md | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/CLAUDE.md b/CLAUDE.md
index cf2eb9a8..60e2bdcd 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -46,7 +46,7 @@ make update-apps APPS="tenant redis"
make show-target RELEASE_TAG=v1.3.0 # prints the resolved DOC_VERSION/BRANCH
```
-Required tools: Hugo extended v0.160.1, Go 1.23+, Node 20+, yq v4+ (for version lifecycle targets).
+Required tools: Hugo extended v0.164.0, Go 1.23+, Node 22+, yq v4+ (for version lifecycle targets).
## Architecture
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index d315db55..f61ca0d0 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -225,7 +225,7 @@ make init-version DOC_VERSION=v1.3 # low-level init of any version dir
make show-target RELEASE_TAG=v1.3.0 # prints resolved DOC_VERSION / BRANCH
```
-Required tools: Hugo extended 0.160.1, Go 1.23+, Node 20+, `yq` v4+ (for the
+Required tools: Hugo extended 0.164.0, Go 1.23+, Node 22+, `yq` v4+ (for the
version lifecycle targets and Makefile routing).
## Where the architecture is implemented