gohugoio / hugo

Hugo depends on Go's os/exec for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system %PATH% on Windows. However, if a malicious file with the same name (exe or bat) was found in the current working directory at the time of running hugo, the malicious command would be invoked instead of the system one.

Windows users who ran hugo inside untrusted Hugo sites was affected.

The origin of this issue comes from Go, see golang/go#38736

We have fixed this in Hugo by using a patched version of exec.LookPath from https://github.com/cli/safeexec (thanks to @mislav for the implementation).

Thanks to @Ry0taK for the bug report.

Hugo 0.79.0 is a small, but useful release. You can now set custom .Params in your menu configuration, and you can now also override deeply nested snake_cased configuration variables with OS environment variables. Other than that we have refreshed all the core upstream dependencies. A special thanks to @alecthomas (some new Chroma lexers and fixes) and @evanw (ESBuild).

This release represents 33 contributions by 8 contributors to the main Hugo code base. @bep leads the Hugo development with a significant amount of contributions, but also a big shoutout @AdamKorcz, and @davidejones for their ongoing contributions. And a big thanks to @digitalcraftsman for his relentless work on keeping the themes site in pristine condition and to @davidsneighbour, @coliff and @kaushalmodi for all the great work on the documentation site.

Many have also been busy writing and fixing the documentation in hugoDocs,
which has received 13 contributions by 11 contributors. A special thanks to @Valac01, @bep, @mhansen, and @chanjarster for their work on the documentation site.

Hugo now has:

• 48392+ stars
• 437+ contributors
• 361+ themes

Enhancements

Templates

• Add more layout lookup tests 34061706 @moorereason #7964

Other

• bump gopkg.in/yaml.v2 from 2.3.0 to 2.4.0 17e0bbe8 @dependabot[bot]
• Allow setting the delimiter used for setting config via OS env, e.g. HUGO_ 7e223b3b @bep #7829
• Update to github.com/evanw/esbuild 0.8.11 to 0.8.14 8a6e7060 @bep #7986
• bump github.com/google/go-cmp from 0.5.2 to 0.5.3 6f7633df @dependabot[bot]
• Remove unneeded meta tag from blog example a546059a @coliff
• bump github.com/getkin/kin-openapi from 0.30.0 to 0.31.0 b5d906e3 @dependabot[bot]
• Regen docshelper fd70bdaf @bep
• Add menu params 8f5c9a74 @davidejones #7951
• Preserve url set in frontmatter without sanitizing e4fcb672 @satotake #6007
• Add file deleted by accident 18c13adc @bep #7972
• Regenerate docshelper" 20a35374 @bep #7972
• Regenerate docshelper caf16c20 @bep
• Update to Chroma v0.8.2 b298c06e @bep #7970
• bump github.com/evanw/esbuild from 0.8.8 to 0.8.11 55e290af @dependabot[bot]
• bump github.com/getkin/kin-openapi from 0.26.0 to 0.30.0 506a190a @dependabot[bot]
• bump github.com/evanw/esbuild from 0.8.6 to 0.8.8 fc81de64 @dependabot[bot]
• Let ESBuild handle all imports from node_modules 78f227b6 @bep #7948
• bump github.com/evanw/esbuild from 0.8.5 to 0.8.6 5e03f644 @dependabot[bot]
• bump github.com/evanw/esbuild from 0.8.4 to 0.8.5 a92ef20f @dependabot[bot]
• bump github.com/getkin/kin-openapi from 0.22.1 to 0.26.0 0d54a844 @dependabot[bot]
• Update GH docs to say "main" as default branch 943f3c93 @maco
• Updated year in header 4f20bf29 @AdamKorcz
• Added first fuzzer 4c613d5d @AdamKorcz
• bump github.com/frankban/quicktest from 1.11.1 to 1.11.2 82a182e5 @dependabot[bot]
• bump golang.org/x/text from 0.3.3 to 0.3.4 dfc662b2 @dependabot[bot]
• bump github.com/evanw/esbuild from 0.8.3 to 0.8.4 2f0917cc @dependabot[bot]
• Disable NPM test on Travis on Windows 3437174c @bep
• Install nodejs on Windows f66302ca @bep
• Remove external source map option 944150ba @bep #7932

Fixes

Other

• Fix memory usage in writeStats d162bbd7 @bep #7945
• Fix server rebuild issue with partials referenced from render hooks e442cf30 @bep #7990
• Misc fixes bf2837a3 @bep #7924#7923

This is a bug-fix release with a couple of important fixes.

• js: Let ESBuild handle all imports from node_modules 78f227b6 @bep #7948
• build(deps): bump github.com/evanw/esbuild from 0.8.5 to 0.8.6 5e03f644 @dependabot[bot]
• build(deps): bump github.com/evanw/esbuild from 0.8.4 to 0.8.5 a92ef20f @dependabot[bot]
• build(deps): bump github.com/getkin/kin-openapi from 0.22.1 to 0.26.0 0d54a844 @dependabot[bot]
• Update GH docs to say "main" as default branch 943f3c93 @maco
• Updated year in header 4f20bf29 @AdamKorcz
• Added first fuzzer 4c613d5d @AdamKorcz
• build(deps): bump github.com/frankban/quicktest from 1.11.1 to 1.11.2 82a182e5 @dependabot[bot]
• build(deps): bump golang.org/x/text from 0.3.3 to 0.3.4 dfc662b2 @dependabot[bot]
• build(deps): bump github.com/evanw/esbuild from 0.8.3 to 0.8.4 2f0917cc @dependabot[bot]

This is a bug-fix release with a couple of important fixes.

• Disable NPM test on Travis on Windows 3437174c @bep
• travis: Install nodejs on Windows f66302ca @bep
• js: Remove external source map option 944150ba @bep #7932
• js: Misc fixes bf2837a3 @bep #7924#7923

This release finally brings full Hugo Modules support to js.Build, curtsy of the new plugin API in the really, really fast ESBuild by @evanw.

Some notes on the improvements in this release:

• Now js.Build fully supports the virtual union file system in Hugo Modules. Any import inside your JavaScript components will resolve starting from the top component mount inside /assets with a fallback to the traditional "JS way" (node_modules etc.)
• You can now pass configuration data from the templates to your scripts via a new params option.
• Hugo now writes a jsconfig.js file inside /assets (you can turn it off) with import mappings to help editors such as VS Code with intellisense/navigation, which is especially useful when there is no common root and the source lives inside some temporary directory.
• We have also improved the build errors you get from js.Build. In server mode you will get a preview of the failing lines and in the console you will get a link to the location.

Read more about this in the documentation, but a short usage example would look like:

In the template:

{{ $js := resources.Get "js/main.js" | js.Build (dict "params" (dict "api" "https://example.org/api" ) }}

And then in a JavaScript component:

import * as params from '@params';

// Wil resolve to one of `hello.{js,ts,tsx,jsx}` inside `assets/my/module`.
import { hello } from 'my/module/hello';

var api = params.api;

hello();

Changes

• Add avoidTDZ option 3b2fe3cd @bep #7865
• Make js.Build fully support modules 85e4dd73 @bep #7816#7777#7916
• Generate tsconfig files 3089fc0b @richtera #7777

Hugo 0.77.0 is a small, but useful release. Some notable updates are:

• time.AsTime accepts an optional location as second parameter, allowing timezone aware printing of dates.
• You can now build with mage install -tags nodeploy if you don't need the hugo deploy feature.
• Remote getJSON errors can now be ignored by adding ignoreErrors = ["error-remote-getjson"] to your site config.

There are also several useful Hugo Modules enhancements:

• We have added Replacements to the Module Configuration. This should enable a much simpler developer workflow, simpler to set up preview sites for your remote theme etc, as you now can do env HUGO_MODULE_REPLACEMENTS="github.com/bep/myprettytheme -> ../.." hugo and similar.
• The module Path for local modules can now be absolute for imports defined in the project.

This release represents 38 contributions by 11 contributors to the main Hugo code base.@bep leads the Hugo development with a significant amount of contributions, but also a big shoutout to @moorereason, and @anthonyfok for their ongoing contributions.
And a big thanks to @digitalcraftsman for his relentless work on keeping the themes site in pristine condition and to @davidsneighbour, @coliff and @kaushalmodi for all the great work on the documentation site.

Many have also been busy writing and fixing the documentation in hugoDocs,
which has received 3 contributions by 3 contributors.

Hugo now has:

• 47530+ stars
• 438+ contributors
• 361+ themes

Enhancements

Templates

• Refactor time.AsTime location implementation 807db97a @moorereason
• Update Hugo time to support optional [LOCATION] parameter 26eeb291 @virgofx
• Improve layout path construction acfa1538 @moorereason
• Test all lookup permutations in TestLayout 78b26d53 @moorereason
• Reformat TestLayout table 28179bd5 @moorereason

Other

• Allow absolute paths for project imports beabc8d9 @bep #7910
• Regen docs helper 332b65e4 @bep
• Add module.replacements 173187e2 @bep #7904#7908
• Do not call CDN service invalidation when executing a dry run deployment 56a34350 @zemanel #7884
• Pass editor arguments from newContentEditor correctly d48a98c4 @bhavin192
• Bump github.com/spf13/cobra from 0.0.7 to 1.1.1 3261678f @anthonyfok
• Allow optional "nodeploy" tag to exclude deploy command from bin f465c5c3 @emhagman #7826
• Allow cascade _target to work with non toml fm 3400aff2 @gwatts #7874
• Allow getJSON errors to be ignored fdfa4a5f @bep #7866
• bump github.com/evanw/esbuild from 0.7.15 to 0.7.18 8cbe2bbf @dependabot[bot]
• Revert "Add benchmark for building docs site" b886fa46 @bep
• Avoid making unnecessary allocation 14bce18a @moorereason
• Add benchmark for building docs site 837e084b @moorereason
• Always show page number when 5 pages or less 08e4f9ff @moorereason #7523
• bump github.com/frankban/quicktest from 1.11.0 to 1.11.1 f033d9f0 @dependabot[bot]
• bump github.com/evanw/esbuild from 0.7.14 to 0.7.15 59fe2794 @dependabot[bot]
• Merge branch 'release-0.76.5' 62119022 @bep
• Render aliases even if render=link 79a022a1 @bep #7832
• Render aliases even if render=link ead5799f @bep #7832
• bump github.com/spf13/afero from 1.4.0 to 1.4.1 d57be113 @dependabot[bot]
• bump github.com/evanw/esbuild from 0.7.9 to 0.7.14 d0705966 @dependabot[bot]
• Update to Go 1.15 and Alpine 3.12 f5ea359d @ducksecops
• Install postcss v8 explicitly as it is now a peer dependency e9a7ebaf @anthonyfok
• Merge branch 'release-0.76.3' 49972d07 @bep
• Add merge helper c98132e3 @bep
• Add workaround for known language, but missing plural rule error 33e9d79b @bep #7798
• Update to github.com/tdewolff/minify v2.9.4" 6dd60fca @bep #7792

Fixes

Templates

• Fix reflection bug in merge 6d95dc9d @moorereason #7899

Other

• Fix setting HUGO_MODULE_PROXY etc. via env vars 8a1c637c @bep #7903
• Fix for language code case issue with pt-br etc. 50682043 @bep #7804
• Fix for bare TOML keys fc6abc39 @bep
• Fix i18n .Count regression f9e798e8 @bep #7787
• Fix typo in 0.76.0 release note ee56efff @digitalcraftsman

This is a bug-fix release with one important fix.

• Render aliases even if render=link 79a022a1 @bep #7832

This is a bug-fix release with a couple of important fixes.

• snap: Install postcss v8 explicitly as it is now a peer dependency e9a7ebaf @anthonyfok
• lang/i18n: Fix for language code case issue with pt-br etc. 50682043 @bep #7804
• Merge branch 'release-0.76.3' 49972d07 @bep
• Add merge helper c98132e3 @bep

This is a bug-fix release with a couple of important fixes.

• langs/i18n: Add workaround for known language, but missing plural rule error 33e9d79b @bep #7798
• langs/i18n: Fix for bare TOML keys fc6abc39 @bep