From 476b1b5390889d46011e7a0658cd457dc48c1c3e Mon Sep 17 00:00:00 2001
From: Josh Aas <jaas@kflag.net>
Date: Fri, 4 Sep 2026 09:49:32 -0400
Subject: [PATCH] Add tailwindcss to the default allow list

---
 config/_default/hugo.toml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/config/_default/hugo.toml b/config/_default/hugo.toml
index 887d74c87..af5d67145 100644
--- a/config/_default/hugo.toml
+++ b/config/_default/hugo.toml
@@ -15,6 +15,13 @@ enableRobotsTXT = true
 [security]
 allowContent = ['.*']
 
+# Hugo 0.165.0 removed tailwindcss from the default security.exec.allow list
+# (https://github.com/gohugoio/hugo/issues/15178), so css.TailwindCSS fails
+# with "access denied" on newer Hugo versions. Setting `allow` replaces Hugo's
+# defaults rather than extending them, so they are repeated here.
+[security.exec]
+allow = ['^(dart-)?sass(-embedded)?$', '^go$', '^git$', '^node$', '^postcss$', '^tailwindcss$']
+
 # Note that this currently has no effect in Hugo.
 timezone = "America/Los_Angeles"