From 43f8571b8a63cada454d4abdfef1674b5cfcbf4f Mon Sep 17 00:00:00 2001 From: tym83 <6355522@gmail.com> Date: Mon, 3 Aug 2026 13:52:02 +0500 Subject: [PATCH 1/5] chore: upgrade Hugo to 0.164.0 and convert HTML content to markdown MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Hugo 0.162.0 fixed CVE-2026-50133, an XSS through content files served as text/html, and denies that media type by default from then on. The site carried fourteen such files — the five home pages and nine roadmap pages — so it could only keep building by staying on a version with the flaw. Converting them to markdown removes the reason to hold back. Goldmark already runs with unsafe: true, so the inline HTML in these pages renders as before. Body indentation inside the wrapper divs on the home pages was reduced to two spaces so markdown does not read those lines as code blocks; the rendered output has no code blocks and the community section is intact. Node asset tools have run under Node's permission model since 0.161.0, which the module-cached Docsy SCSS does not satisfy, so read access is widened while writes stay denied. Verified with a full local build on 0.164.0: 1705 pages, no errors, all five languages and the roadmap pages render. Co-Authored-By: Claude Signed-off-by: tym83 <6355522@gmail.com> --- .github/workflows/hugo.yaml | 2 +- content/de/{_index.html => _index.md} | 26 +++++++++---------- content/en/{_index.html => _index.md} | 26 +++++++++---------- .../en/docs/next/{roadmap.html => roadmap.md} | 0 .../en/docs/v0/{roadmap.html => roadmap.md} | 0 .../en/docs/v1.0/{roadmap.html => roadmap.md} | 0 .../en/docs/v1.1/{roadmap.html => roadmap.md} | 0 .../en/docs/v1.2/{roadmap.html => roadmap.md} | 0 .../en/docs/v1.3/{roadmap.html => roadmap.md} | 0 .../en/docs/v1.4/{roadmap.html => roadmap.md} | 0 .../en/docs/v1.5/{roadmap.html => roadmap.md} | 0 .../en/docs/v1.6/{roadmap.html => roadmap.md} | 0 content/hi/{_index.html => _index.md} | 26 +++++++++---------- content/ru/{_index.html => _index.md} | 26 +++++++++---------- content/zh-cn/{_index.html => _index.md} | 26 +++++++++---------- hugo.yaml | 18 +++++++++++++ netlify.toml | 2 +- 17 files changed, 85 insertions(+), 67 deletions(-) rename content/de/{_index.html => _index.md} (80%) rename content/en/{_index.html => _index.md} (80%) rename content/en/docs/next/{roadmap.html => roadmap.md} (100%) rename content/en/docs/v0/{roadmap.html => roadmap.md} (100%) rename content/en/docs/v1.0/{roadmap.html => roadmap.md} (100%) rename content/en/docs/v1.1/{roadmap.html => roadmap.md} (100%) rename content/en/docs/v1.2/{roadmap.html => roadmap.md} (100%) rename content/en/docs/v1.3/{roadmap.html => roadmap.md} (100%) rename content/en/docs/v1.4/{roadmap.html => roadmap.md} (100%) rename content/en/docs/v1.5/{roadmap.html => roadmap.md} (100%) rename content/en/docs/v1.6/{roadmap.html => roadmap.md} (100%) rename content/hi/{_index.html => _index.md} (84%) rename content/ru/{_index.html => _index.md} (82%) rename content/zh-cn/{_index.html => _index.md} (79%) diff --git a/.github/workflows/hugo.yaml b/.github/workflows/hugo.yaml index 3debba3a..5825d40c 100644 --- a/.github/workflows/hugo.yaml +++ b/.github/workflows/hugo.yaml @@ -32,7 +32,7 @@ jobs: build: runs-on: ubuntu-latest env: - HUGO_VERSION: 0.160.1 + HUGO_VERSION: 0.164.0 steps: - name: Install Hugo CLI run: | diff --git a/content/de/_index.html b/content/de/_index.md similarity index 80% rename from content/de/_index.html rename to content/de/_index.md index 3768828d..0be77107 100644 --- a/content/de/_index.html +++ b/content/de/_index.md @@ -92,7 +92,7 @@
{{< blocks/lead color="dark" >}}

Wir schätzen die beständige Unterstützung und die Beiträge unserer Community zum Wachstum von Cozystack sehr.
Treten Sie unserer Community bei und werden Sie Teil unserer Reise.

@@ -100,25 +100,25 @@
diff --git a/content/en/_index.html b/content/en/_index.md similarity index 80% rename from content/en/_index.html rename to content/en/_index.md index 55a817fc..fa2e862f 100644 --- a/content/en/_index.html +++ b/content/en/_index.md @@ -85,7 +85,7 @@
{{< blocks/lead color="dark" >}}

We deeply appreciate the steadfast support and contributions from our community towards the growth of Cozystack.
Join our community and become part of our journey.

@@ -93,25 +93,25 @@
diff --git a/content/en/docs/next/roadmap.html b/content/en/docs/next/roadmap.md similarity index 100% rename from content/en/docs/next/roadmap.html rename to content/en/docs/next/roadmap.md diff --git a/content/en/docs/v0/roadmap.html b/content/en/docs/v0/roadmap.md similarity index 100% rename from content/en/docs/v0/roadmap.html rename to content/en/docs/v0/roadmap.md diff --git a/content/en/docs/v1.0/roadmap.html b/content/en/docs/v1.0/roadmap.md similarity index 100% rename from content/en/docs/v1.0/roadmap.html rename to content/en/docs/v1.0/roadmap.md diff --git a/content/en/docs/v1.1/roadmap.html b/content/en/docs/v1.1/roadmap.md similarity index 100% rename from content/en/docs/v1.1/roadmap.html rename to content/en/docs/v1.1/roadmap.md diff --git a/content/en/docs/v1.2/roadmap.html b/content/en/docs/v1.2/roadmap.md similarity index 100% rename from content/en/docs/v1.2/roadmap.html rename to content/en/docs/v1.2/roadmap.md diff --git a/content/en/docs/v1.3/roadmap.html b/content/en/docs/v1.3/roadmap.md similarity index 100% rename from content/en/docs/v1.3/roadmap.html rename to content/en/docs/v1.3/roadmap.md diff --git a/content/en/docs/v1.4/roadmap.html b/content/en/docs/v1.4/roadmap.md similarity index 100% rename from content/en/docs/v1.4/roadmap.html rename to content/en/docs/v1.4/roadmap.md diff --git a/content/en/docs/v1.5/roadmap.html b/content/en/docs/v1.5/roadmap.md similarity index 100% rename from content/en/docs/v1.5/roadmap.html rename to content/en/docs/v1.5/roadmap.md diff --git a/content/en/docs/v1.6/roadmap.html b/content/en/docs/v1.6/roadmap.md similarity index 100% rename from content/en/docs/v1.6/roadmap.html rename to content/en/docs/v1.6/roadmap.md diff --git a/content/hi/_index.html b/content/hi/_index.md similarity index 84% rename from content/hi/_index.html rename to content/hi/_index.md index cfe366ee..3d399cd5 100644 --- a/content/hi/_index.html +++ b/content/hi/_index.md @@ -92,7 +92,7 @@
{{< blocks/lead color="dark" >}}

Cozystack के विकास में हमारे समुदाय के अटूट समर्थन और योगदान की हम गहरी सराहना करते हैं।
हमारे समुदाय से जुड़ें और हमारी यात्रा का हिस्सा बनें।

@@ -100,25 +100,25 @@
diff --git a/content/ru/_index.html b/content/ru/_index.md similarity index 82% rename from content/ru/_index.html rename to content/ru/_index.md index a9b2483c..29396404 100644 --- a/content/ru/_index.html +++ b/content/ru/_index.md @@ -92,7 +92,7 @@
{{< blocks/lead color="dark" >}}

Мы глубоко ценим неизменную поддержку и вклад нашего сообщества в развитие Cozystack.
Присоединяйтесь к сообществу и станьте частью нашего пути.

@@ -100,25 +100,25 @@
diff --git a/content/zh-cn/_index.html b/content/zh-cn/_index.md similarity index 79% rename from content/zh-cn/_index.html rename to content/zh-cn/_index.md index de72e295..5dee5b50 100644 --- a/content/zh-cn/_index.html +++ b/content/zh-cn/_index.md @@ -92,7 +92,7 @@
{{< blocks/lead color="dark" >}}

我们衷心感谢社区对 Cozystack 成长一以贯之的支持与贡献。
加入我们的社区,成为我们旅程的一部分。

@@ -100,25 +100,25 @@
diff --git a/hugo.yaml b/hugo.yaml index f5d555d7..ad4bba90 100644 --- a/hugo.yaml +++ b/hugo.yaml @@ -3,6 +3,24 @@ title: Cozystack enableRobotsTXT: true enableEmoji: true +# Since Hugo v0.161.0 the Node asset tools (PostCSS here) run under Node's +# permission model, with read access limited to the project directory by +# default. That default is not enough for this site: the Docsy theme arrives as +# a Hugo module and its SCSS is served from the module cache outside the project +# tree, so the CSS build fails with "Use --allow-fs-read to manage permissions". +# +# Read access is therefore widened. Write access stays denied (allowWrite is +# left at its empty default), as do addons, child processes and workers beyond +# what Hugo already permits for tailwindcss. +# +# This is deliberately broader than necessary — the minimal set of readable +# paths has not been pinned down, and narrowing it would be a welcome follow-up. +security: + node: + permissions: + allowRead: + - '*' + # Blog taxonomies: two independent axes used by the blog filter UI. # article_types: release, case, how-to, tech-article, news # topics: platform, postgresql, kubernetes, cilium, talos, opensearch, diff --git a/netlify.toml b/netlify.toml index 63c2b950..1e5f74eb 100644 --- a/netlify.toml +++ b/netlify.toml @@ -3,7 +3,7 @@ command = "npm install && ./hack/download_openapi.sh && hugo --gc --minify" [build.environment] - HUGO_VERSION = "0.160.1" + HUGO_VERSION = "0.164.0" HUGO_EXTENDED = "true" NODE_VERSION = "20" GO_VERSION = "1.23" From 1ffe4d70ecff9db62aa0ce0029c5ed7804ebe4f3 Mon Sep 17 00:00:00 2001 From: IvanHunters Date: Mon, 3 Aug 2026 12:12:39 +0300 Subject: [PATCH 2/5] fix(i18n): refresh source_digest for home page translations The home page indentation fix changed the byte content of the English source content/en/_index.md, so its sha256 no longer matched the source_digest recorded in the de, hi, ru and zh-cn translations. That made hack/check-i18n.sh report the four translations as stale and turned the i18n-lint check red. The English change is whitespace only (five-space to two-space body indentation to avoid markdown code blocks), so the translations remain semantically current. Refresh their recorded source_digest to match; no re-translation is required. Signed-off-by: IvanHunters --- content/de/_index.md | 2 +- content/hi/_index.md | 2 +- content/ru/_index.md | 2 +- content/zh-cn/_index.md | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/content/de/_index.md b/content/de/_index.md index 0be77107..264c4689 100644 --- a/content/de/_index.md +++ b/content/de/_index.md @@ -8,7 +8,7 @@ seo: title: "Cozystack — Open-Source Private Cloud auf Kubernetes" description: "Open-Source-Cloud-Plattform auf Kubernetes für Managed VMs, Datenbanken, S3-Storage und GPU-Workloads. CNCF-Sandbox-Projekt." keywords: ["private cloud", "managed kubernetes", "kubernetes plattform", "open source cloud"] -source_digest: "sha256:348771fb7bd901b79d761d40344c9e16e119c54edb68b3ca6ab0bb666b0d0040" +source_digest: "sha256:9fe03c365e388b6e4605ddbe297051a430c5dd8cdd7ba81d7c5d1aff5f58dc9c" translation_status: current l10n: transcreate taglines: diff --git a/content/hi/_index.md b/content/hi/_index.md index 3d399cd5..3a89e78f 100644 --- a/content/hi/_index.md +++ b/content/hi/_index.md @@ -8,7 +8,7 @@ seo: title: "Cozystack — Kubernetes पर ओपन-सोर्स प्राइवेट क्लाउड" description: "Kubernetes पर ओपन-सोर्स क्लाउड प्लेटफ़ॉर्म: मैनेज्ड VMs, डेटाबेस, S3 स्टोरेज और GPU वर्कलोड। CNCF Sandbox प्रोजेक्ट।" keywords: ["private cloud", "managed kubernetes", "kubernetes platform", "cloud platform"] -source_digest: "sha256:348771fb7bd901b79d761d40344c9e16e119c54edb68b3ca6ab0bb666b0d0040" +source_digest: "sha256:9fe03c365e388b6e4605ddbe297051a430c5dd8cdd7ba81d7c5d1aff5f58dc9c" translation_status: current l10n: transcreate taglines: diff --git a/content/ru/_index.md b/content/ru/_index.md index 29396404..60e5870d 100644 --- a/content/ru/_index.md +++ b/content/ru/_index.md @@ -8,7 +8,7 @@ seo: title: "Cozystack — частное облако с открытым кодом на Kubernetes" description: "Open-source облачная платформа на Kubernetes: управляемые ВМ, базы данных, S3-хранилище и GPU. Проект CNCF Sandbox." keywords: ["частное облако", "managed kubernetes", "kubernetes платформа", "облачная платформа"] -source_digest: "sha256:348771fb7bd901b79d761d40344c9e16e119c54edb68b3ca6ab0bb666b0d0040" +source_digest: "sha256:9fe03c365e388b6e4605ddbe297051a430c5dd8cdd7ba81d7c5d1aff5f58dc9c" translation_status: current l10n: transcreate taglines: diff --git a/content/zh-cn/_index.md b/content/zh-cn/_index.md index 5dee5b50..5c56ee7c 100644 --- a/content/zh-cn/_index.md +++ b/content/zh-cn/_index.md @@ -8,7 +8,7 @@ seo: title: "Cozystack — 基于 Kubernetes 的开源私有云" description: "基于 Kubernetes 的开源云平台,提供托管虚拟机、数据库、S3 存储和 GPU 工作负载。CNCF Sandbox 项目。" keywords: ["私有云", "Kubernetes", "开源云平台", "托管 Kubernetes"] -source_digest: "sha256:348771fb7bd901b79d761d40344c9e16e119c54edb68b3ca6ab0bb666b0d0040" +source_digest: "sha256:9fe03c365e388b6e4605ddbe297051a430c5dd8cdd7ba81d7c5d1aff5f58dc9c" translation_status: current l10n: transcreate taglines: From 106ec6563d96ba57d294858d67d6191172f18a61 Mon Sep 17 00:00:00 2001 From: IvanHunters Date: Mon, 3 Aug 2026 12:54:01 +0300 Subject: [PATCH 3/5] fix(build): require Node 22 for Hugo 0.164 node permission model Hugo 0.164 runs Node asset tools (PostCSS for the Docsy theme) as node --permission ...; the flag is hardcoded in common/hexec/exec.go nodePermissionArgs with no Node-version detection. The --permission flag exists only since Node 22.13.0, where the permission model was promoted to stable; Node 20 knows only --experimental-permission and aborts with "bad option: --permission". netlify.toml pinned NODE_VERSION=20, which fails the production build the first time PostCSS actually runs (Hugo caches its output, so warm build previews pass and hide the break until a cold-cache deploy). The Pages workflow left Node unpinned and relied on the runner default, which is equally fragile. Pin Node 22 in both build paths. Signed-off-by: IvanHunters --- .github/workflows/hugo.yaml | 7 +++++++ netlify.toml | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/hugo.yaml b/.github/workflows/hugo.yaml index 5825d40c..8e83f983 100644 --- a/.github/workflows/hugo.yaml +++ b/.github/workflows/hugo.yaml @@ -48,6 +48,13 @@ jobs: - name: Setup Pages id: pages uses: actions/configure-pages@v6 + - name: Setup Node.js + uses: actions/setup-node@v4 + with: + # Hugo 0.164 runs Node asset tools with "node --permission", a flag + # that exists only since Node 22.13. The runner default is unpinned, + # so pin an LTS that supports it. + node-version: "22" - name: Install Node.js dependencies run: "[[ -f package-lock.json || -f npm-shrinkwrap.json ]] && npm ci || true" - name: Download OpenAPI specs diff --git a/netlify.toml b/netlify.toml index 1e5f74eb..5c940033 100644 --- a/netlify.toml +++ b/netlify.toml @@ -5,7 +5,7 @@ [build.environment] HUGO_VERSION = "0.164.0" HUGO_EXTENDED = "true" - NODE_VERSION = "20" + NODE_VERSION = "22" GO_VERSION = "1.23" [context.production.environment] From f119b308062bbc12efc9b9e081ba67a3cda519e8 Mon Sep 17 00:00:00 2001 From: IvanHunters Date: Mon, 3 Aug 2026 12:54:08 +0300 Subject: [PATCH 4/5] fix(home): separate benefits and features shortcodes After the .html to .md conversion, the two adjacent block shortcodes home/benefits and home/features sit in a single markdown paragraph. Hugo only strips the wrapping

when a paragraph holds exactly one shortcode, so the pair rendered as invalid

...

with an extra empty paragraph margin on all five home pages. Put a blank line between them so each is its own paragraph and gets unwrapped. Refresh source_digest in the four translations, since the English source content/en/_index.md changed. Signed-off-by: IvanHunters --- content/de/_index.md | 3 ++- content/en/_index.md | 1 + content/hi/_index.md | 3 ++- content/ru/_index.md | 3 ++- content/zh-cn/_index.md | 3 ++- 5 files changed, 9 insertions(+), 4 deletions(-) diff --git a/content/de/_index.md b/content/de/_index.md index 264c4689..229a28d0 100644 --- a/content/de/_index.md +++ b/content/de/_index.md @@ -8,7 +8,7 @@ seo: title: "Cozystack — Open-Source Private Cloud auf Kubernetes" description: "Open-Source-Cloud-Plattform auf Kubernetes für Managed VMs, Datenbanken, S3-Storage und GPU-Workloads. CNCF-Sandbox-Projekt." keywords: ["private cloud", "managed kubernetes", "kubernetes plattform", "open source cloud"] -source_digest: "sha256:9fe03c365e388b6e4605ddbe297051a430c5dd8cdd7ba81d7c5d1aff5f58dc9c" +source_digest: "sha256:24e38da4716b93c35dcb9eb607152d193ef3d5ad42c0e22a25063a89da9f8dde" translation_status: current l10n: transcreate taglines: @@ -86,6 +86,7 @@ features: {{< home/benefits >}} + {{< home/features >}} diff --git a/content/en/_index.md b/content/en/_index.md index fa2e862f..1bd31c15 100644 --- a/content/en/_index.md +++ b/content/en/_index.md @@ -79,6 +79,7 @@ features: {{< home/benefits >}} + {{< home/features >}} diff --git a/content/hi/_index.md b/content/hi/_index.md index 3a89e78f..e3cfdb54 100644 --- a/content/hi/_index.md +++ b/content/hi/_index.md @@ -8,7 +8,7 @@ seo: title: "Cozystack — Kubernetes पर ओपन-सोर्स प्राइवेट क्लाउड" description: "Kubernetes पर ओपन-सोर्स क्लाउड प्लेटफ़ॉर्म: मैनेज्ड VMs, डेटाबेस, S3 स्टोरेज और GPU वर्कलोड। CNCF Sandbox प्रोजेक्ट।" keywords: ["private cloud", "managed kubernetes", "kubernetes platform", "cloud platform"] -source_digest: "sha256:9fe03c365e388b6e4605ddbe297051a430c5dd8cdd7ba81d7c5d1aff5f58dc9c" +source_digest: "sha256:24e38da4716b93c35dcb9eb607152d193ef3d5ad42c0e22a25063a89da9f8dde" translation_status: current l10n: transcreate taglines: @@ -86,6 +86,7 @@ features: {{< home/benefits >}} + {{< home/features >}} diff --git a/content/ru/_index.md b/content/ru/_index.md index 60e5870d..f4d19482 100644 --- a/content/ru/_index.md +++ b/content/ru/_index.md @@ -8,7 +8,7 @@ seo: title: "Cozystack — частное облако с открытым кодом на Kubernetes" description: "Open-source облачная платформа на Kubernetes: управляемые ВМ, базы данных, S3-хранилище и GPU. Проект CNCF Sandbox." keywords: ["частное облако", "managed kubernetes", "kubernetes платформа", "облачная платформа"] -source_digest: "sha256:9fe03c365e388b6e4605ddbe297051a430c5dd8cdd7ba81d7c5d1aff5f58dc9c" +source_digest: "sha256:24e38da4716b93c35dcb9eb607152d193ef3d5ad42c0e22a25063a89da9f8dde" translation_status: current l10n: transcreate taglines: @@ -86,6 +86,7 @@ features: {{< home/benefits >}} + {{< home/features >}} diff --git a/content/zh-cn/_index.md b/content/zh-cn/_index.md index 5c56ee7c..1c4c4391 100644 --- a/content/zh-cn/_index.md +++ b/content/zh-cn/_index.md @@ -8,7 +8,7 @@ seo: title: "Cozystack — 基于 Kubernetes 的开源私有云" description: "基于 Kubernetes 的开源云平台,提供托管虚拟机、数据库、S3 存储和 GPU 工作负载。CNCF Sandbox 项目。" keywords: ["私有云", "Kubernetes", "开源云平台", "托管 Kubernetes"] -source_digest: "sha256:9fe03c365e388b6e4605ddbe297051a430c5dd8cdd7ba81d7c5d1aff5f58dc9c" +source_digest: "sha256:24e38da4716b93c35dcb9eb607152d193ef3d5ad42c0e22a25063a89da9f8dde" translation_status: current l10n: transcreate taglines: @@ -86,6 +86,7 @@ features: {{< home/benefits >}} + {{< home/features >}} From d5c557700a88de7173a434d1519d72a86e5e30d7 Mon Sep 17 00:00:00 2001 From: IvanHunters Date: Mon, 3 Aug 2026 12:54:14 +0300 Subject: [PATCH 5/5] docs: update required Hugo and Node versions The Hugo upgrade also raises the minimum local toolchain: Hugo 0.164.0 (matching the pins) and Node 22 (needed for the node permission model). Update the required-tools lines in CONTRIBUTING.md and CLAUDE.md, which still referenced Hugo 0.160.1 and Node 20. Signed-off-by: IvanHunters --- CLAUDE.md | 2 +- CONTRIBUTING.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/CLAUDE.md b/CLAUDE.md index cf2eb9a8..60e2bdcd 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -46,7 +46,7 @@ make update-apps APPS="tenant redis" make show-target RELEASE_TAG=v1.3.0 # prints the resolved DOC_VERSION/BRANCH ``` -Required tools: Hugo extended v0.160.1, Go 1.23+, Node 20+, yq v4+ (for version lifecycle targets). +Required tools: Hugo extended v0.164.0, Go 1.23+, Node 22+, yq v4+ (for version lifecycle targets). ## Architecture diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index d315db55..f61ca0d0 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -225,7 +225,7 @@ make init-version DOC_VERSION=v1.3 # low-level init of any version dir make show-target RELEASE_TAG=v1.3.0 # prints resolved DOC_VERSION / BRANCH ``` -Required tools: Hugo extended 0.160.1, Go 1.23+, Node 20+, `yq` v4+ (for the +Required tools: Hugo extended 0.164.0, Go 1.23+, Node 22+, `yq` v4+ (for the version lifecycle targets and Makefile routing). ## Where the architecture is implemented