chore(deps): update module go:github.com/gohugoio/hugo to v0.160.1

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
go:github.com/gohugoio/hugo	v0.157.0 → v0.160.1

---

Release Notes

gohugoio/hugo (go:github.com/gohugoio/hugo)

v0.160.1

Compare Source

What's Changed

• Fix panic when passthrough elements are used in headings 8b00030 @​bep #​14677
• Fix panic on edit of legacy mapped template names that's also a valid path in the new setup c485516 @​bep #​14740
• Fix RenderShortcodes leaking context markers when indented 161d0d4 @​bep #​12457
• Strip nested page context markers from standalone RenderShortcodes 45e4596 @​bep #​14732
• Rename deprecated cascade._target to cascade.target in tests 58927aa @​bep
• Fix auto-creation of root sections in multilingual sites ce009e3 @​bep #​14681
• readme: Fix links 0755872 @​chicks-net

v0.160.0

Compare Source

Now you can inject CSS vars, e.g. from the configuration, into your stylesheets when building with css.Build. Also, now all the render hooks has a .Position method, now also more accurate and effective.

Bug fixes

• Fix some recently introduced Position issues 4e91e14 @​bep #​14710
• markup/goldmark: Fix double-escaping of ampersands in link URLs dc9b51d @​bep #​14715
• tpl: Fix stray quotes from partial decorator in script context 43aad71 @​bep #​14711

Improvements

• all: Replace NewIntegrationTestBuilder with Test/TestE/TestRunning 481baa0 @​bep
• tpl/css: Support @​import "hugo:vars" for CSS custom properties in css.Build 5d09b5e @​bep #​14699
• Improve and extend .Position handling in Goldmark render hooks 303e443 @​bep #​14663
• markup/goldmark: Clean up test 638262c @​bep

Dependency Updates

• build(deps): bump github.com/magefile/mage from 1.16.1 to 1.17.1 bf6e35a @​dependabot[bot]
• build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 0eda24e @​dependabot[bot]
• build(deps): bump golang.org/x/image from 0.37.0 to 0.38.0 beb57a6 @​dependabot[bot]

Documentation

• readme: Revise edition descriptions and installation instructions 9f1f1be @​jmooring

v0.159.2

Compare Source

Note that the security fix below is not a potential threat if you either:

• Trust your Markdown content files.
• Have custom render hook template for links and images.

EDIT IN: This release also adds release archives for non-extended-withdeploy builds.

What's Changed

• Fix potential content XSS by escaping dangerous URLs in Markdown links and images 479fe6c @​bep
• resources/page: Fix shared reader in Source.ValueAsOpenReadSeekCloser df520e3 @​jmooring #​14684

v0.159.1

Compare Source

The regression fixed in this release isn't new, but it's so subtle that we thought we'd release this sooner rather than later. For some time now, the minifier we use have stripped namespaced attributes in SVGs, which broke dynamic constructs using e.g. AlpineJS' x-bind: namespace (library used by Hugo's documentation site).

To fix this, the upstream library has hadded a keepNamespaces slice option. It was not possible to find a default that would make all happy, so we opted for an option that at least would make AlpineJS sites work out of the box:

 [minify.tdewolff.svg]
      keepNamespaces = ['', 'x-bind']

What's Changed

• minifiers: Keep x-bind and blank namespace in SVG minification 42289d7 @​bep #​14669

v0.159.0

Compare Source

This release greatly improves and simplifies management of Node.js/npm dependencies in a multi-module setup. See this page for more information.

Note

• Replace deprecated site.Data with hugo.Data in tests a8fca59 @​bep
• Replace deprecated excludeFiles and includeFiles with files in tests 182b104 @​bep
• Replace deprecated :filename with :contentbasename in the permalinks test eb11c3d @​bep

Bug fixes

• tpl/tplimpl: Fix Vimeo shortcode test eaf4c75 @​jmooring #​14649

Improvements

• create: Return error instead of panic when page not found 807cae1 @​mango766 #​14112
• commands: Preserve non-content files in convert output c4fb61d @​xndvaz #​4621
• npm: Use workspaces to simplify hugo mod npm pack d88a29e @​bep
• commands: Close cpu profile file when StartCPUProfile fails 9dd9c76 @​buley
• Remove the AI Watchdog workflow for now 3315a86 @​bep
• Remove 'bep' from PR user logins skip list 3824484 @​bep
• tpl/tplimpl: Comment out the Vimeo simple shortcode tests 7813c5c @​bep #​14649

Dependency Updates

• build(deps): bump github.com/olekukonko/tablewriter from 1.1.3 to 1.1.4 (#​14641) 3ff9b7f @​dependabot[bot]
• build(deps): bump github.com/yuin/goldmark from 1.7.16 to 1.7.17 be93ccd @​dependabot[bot]
• build(deps): bump github.com/magefile/mage from 1.15.0 to 1.16.1 2669bca @​dependabot[bot]
• build(deps): bump golang.org/x/image from 0.36.0 to 0.37.0 753d447 @​dependabot[bot]
• build(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.3 4f39d72 @​dependabot[bot]

Documentation

• docs: Update docs.yaml d2043cf @​bep
• commands: Update docs linke to Node.js docs 4f3c398 @​bep

v0.158.0

Compare Source

This release adds css.Build, native and very fast bundling/transformation/minifying of CSS resources. Also see the new strings.ReplacePairs, a very fast option if you need to do many string replacements.

Notes

• Upgrade to to Go 1.26.1 (#​14597) (note) 1f578f1 @​bep #​14595. This fixes a security issue in Go's template package used by Hugo: https://www.cve.org/CVERecord?id=CVE-2026-27142

Deprecations

The methods and config options are deprecated and will be removed in a future Hugo release.

Also see this article

Language configuration

• languageCode → Use locale instead.
• languages.<lang>.languageCode → Use languages.<lang>.locale instead.
• languages.<lang>.languageName → Use languages.<lang>.label instead.
• languages.<lang>.languageDirection → Use languages.<lang>.direction instead.

Language methods

• .Site.LanguageCode → Use .Site.Language.Locale instead.
• .Language.LanguageCode → Use .Language.Locale instead.
• .Language.LanguageName → Use .Language.Label instead.
• .Language.LanguageDirection → Use .Language.Direction instead.

Bug fixes

• tpl/css: Fix external source maps e431f90 @​bep #​14620
• hugolib: Fix server no watch 59e0446 @​jmooring #​14615
• resources: Fix context canceled on GetRemote with per-request timeout 842d8f1 @​bep #​14611
• tpl/tplimpl: Prefer early suffixes when media type matches 4eafd9e @​bep #​13877 #​14601
• all: Run go fix ./... e310822 @​bep
• internal/warpc: Fix SIGSEGV in Close() when dispatcher fails to start c9b88e4 @​bep #​14536
• Fix index out of range panic in fileEventsContentPaths f797f84 @​bep #​14573

Improvements

• resources: Re-publish on transformation cache hit 3c980c0 @​bep #​14629
• create/skeletons: Use css.Build in theme skeleton 404ac00 @​jmooring #​14626
• tpl/css: Add a test case for rebuilds on CSS options changes 06fcb72 @​bep
• hugolib: Allow regular pages to cascade to self 9b5f1d4 @​jmooring #​14627
• tpl/css: Allow the user to override single loader entries 623722b @​bep #​14623
• tpl/css: Make default loader resolution for CSS @​import and url() always behave the same a7cbcf1 @​bep #​14619
• internal/js: Add default mainFields for CSS builds 36cdb2c @​jmooring #​14614
• Add css.Build 3e3b849 @​bep #​14609 #​14613
• resources: Use full path for Exif etc. decoding error/warning messages c47ec23 @​bep #​12693
• Move to new locales library and upgrade CLDR from v36.1 to v48.1 4652ae4 @​bep
• tpl/strings: Add strings.ReplacePairs function 13a95b9 @​jmooring #​14594
• github: Remove pull_request_template.md 54c8048 @​bep
• testing: Make commands tests pass in Go 1.26.1 157bfdd @​bep
• refactor: Deprecate language configuration and template methods d4f2122 @​jmooring #​14269
• Replace Exif with Meta in tests 991d2f9 @​bep
• resources: Improve getImageOps error message e857777 @​jmooring #​14571
• resources/images: Add IsImageResourceWithMeta etc. tests for bmp and gif 44dc384 @​bep #​14568

Dependency Updates

• deps: Upgrade github.com/evanw/esbuild v0.27.3 => v0.27.4 0e46a97 @​bep
• build(deps): bump github.com/getkin/kin-openapi from 0.133.0 to 0.134.0 c27d9e8 @​dependabot[bot]
• build(deps): bump golang.org/x/tools from 0.42.0 to 0.43.0 098eac5 @​dependabot[bot]
• build(deps): bump gocloud.dev from 0.44.0 to 0.45.0 87f8de8 @​dependabot[bot]
• build(deps): bump golang.org/x/sync from 0.19.0 to 0.20.0 67ef6c6 @​dependabot[bot]
• build(deps): bump golang.org/x/net from 0.50.0 to 0.51.0 (#​14569) b29c2f7 @​dependabot[bot]
• build(deps): bump github.com/tdewolff/minify/v2 from 2.24.9 to 2.24.10 (#​14585) e91d191 @​dependabot[bot]
• build(deps): bump github.com/bep/imagemeta from 0.15.0 to 0.17.0 (#​14584) a8a54bd @​dependabot[bot]

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.