fix(deps): update module github.com/gohugoio/hugo to v0.161.1

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/gohugoio/hugo	v0.146.4 → v0.161.1

---

Release Notes

gohugoio/hugo (github.com/gohugoio/hugo)

v0.161.1

Compare Source

What's Changed

• resources: Honor Retry-After header in resources.GetRemote retries c4eba92 @​bep #​14828
• warpc: Move to parson.c in https://github.com/kgabis/parson 8b40a96 @​bep #​14823
• config/security: Add AllowChildProcess to security.node.permissions d65af84 @​bep #​14824
• config/security: Restrict default http.urls "@​" deny to userinfo 454450a @​bep #​14825

v0.161.0

Compare Source

This release contains two security hardening fixes:

• We now run the Node tools PostCSS, Babel and TailwindCSS, by default, with the --permission flag with the permissions defined in security.node.permissions. This means that you need Node >= 22 installed and that css.TailwindCSS now requires that the Tailwind CSS CLI must be installed as a Node.js package. The standalone executable is no longer supported
• We have made the defaults in security.http.urls more restrictive.

But there are some notable new features, as well:

Nested vars support in css.Build and css.Sass

A practical example in css.Build would be to have something like this in hugo.toml:

[params.style]
    primary    = "#​000000"
    background = "#ffffff"
    [params.style.dark]
        primary    = "#ffffff"
        background = "#​000000"

And in the stylesheet:

@​import "hugo:vars";
@​import "hugo:vars/dark" (prefers-color-scheme: dark);

:root {
  color-scheme: light dark;
}

Slice-based permalinks config

The permalinks configuration is now much more flexible (the old setup still works). It uses the same target matchers as in the cascade config, meaning you can now do:

permalinks:
  - target:
      kind: page
      path: "/books/**"
    pattern: /books/:year/:slug/
  - target:
      kind: section
      path: "/{books,books/**}"
    pattern: /libros/:sections[1:]
  - target:
      kind: page
    pattern: /other/:slug/

The above example isn't great, but it at least shows the gist of it.

A more flexible scheme for identifiers in filenames

What we had before was e.g. content/mypost.en.md which told Hugo that the content files was in English. With the new setup you could also name the file content/mypost._language_en_.md. This alone doesn't sound very useful, but this allows you to use more prefixes:

Prefix	Description	Relevant for
language_	Language	Content and layout files.
role_	Role	Content and layout files.
version_	Version	Content and layout files.
outputformat_	Output format	Layout files.
mediatype_	Media type	Layout files.
kind_	Page kind	Layout files.
layout_	Layout	Layout files.

All Changes

• langs/i18n: Fix translation lookup when using language variants 72b85d5 @​jmooring #​7982
• create: Fix non-deterministic conflict detection in hugo new content 6436deb @​jmooring #​12602 #​12786 #​14112 #​14769
• commands: Fix environment isolation for configuration settings 1eea9fb @​jmooring #​14763
• Fix filename dimension identifiers (role_X, version_X) to replace mount config 8d6145f @​bep #​14756
• Fix it so we never auto-fallback to page resources in other roles/versions 9747724 @​bep #​14749 #​14752
• css: Support nested hugo:vars/ imports 7622dd8 @​bep #​14705
• github: Update GitHub actions versions 0814059 @​bep #​14810
• hugolib: Do not render aliases if the page is not rendered 8920d56 @​jmooring #​14807
• langs/i18n: Improve default content language fallback 633cc77 @​jmooring #​14243
• helpers: Remove unused code 4c40c6d @​bep
• common/constants: Remove unused consts d2594db @​bep
• common/paths: Remove unused code ab2de51 @​bep
• tests: Update Ruby setup action to v1.305.0 75f6183 @​jmooring
• langs: Use Language.Locale as primary localization key 1b7495b @​jmooring #​9109
• config/security: Add "! " negation to Whitelist, harden default http.urls 79f030b @​bep #​14792
• Harden Node tool execution with --permission flag a54c398 @​bep #​7287
• tpl/collections: Honor the Eqer interface in where comparisons f5fce93 @​bep #​14777
• modules: Ignore non-require blocks in go.mod rewrite 4169c1f @​bep #​14783
• Replace the concurrent map with an identical upstream version 7574e35 @​bep
• Add slice-based permalinks config with PageMatcher target 017a7cd @​bep #​14744
• commands: Add missing import e3413d9 @​bep
• Revert "common/hugo: Deprecate extended and extended_withdeploy editions" b01cc14 @​bep #​14771
• Adjust the SECURITY.md slightly 8ee19ff @​bep
• resources/page: Add passing test for Issue #​14325 0d58e42 @​jmooring
• Add a more flexible filename identifier scheme that also allows setting roles and versions (#​14754) ce2a156 @​bep #​14750
• common/hugo: Deprecate extended and extended_withdeploy editions a17bdbc @​jmooring #​14696
• parser/pageparser: Add a parser fuzz test 8f94d65 @​bep
• Replace deprecated .Site.Sites/.Page.Sites with hugo.Sites intests 90d8bf3 @​bep
• agents: Add a note about having the issue ID in test names bbb42b5 @​bep
• build(deps): bump github.com/getkin/kin-openapi from 0.135.0 to 0.137.0 d4ae662 @​dependabot[bot]
• build(deps): bump github.com/mattn/go-isatty from 0.0.21 to 0.0.22 9ede5fb @​dependabot[bot]
• build(deps): bump github.com/tdewolff/minify/v2 from 2.24.12 to 2.24.13 833a878 @​dependabot[bot]
• build(deps): bump github.com/magefile/mage from 1.17.1 to 1.17.2 4c03129 @​dependabot[bot]
• deps: Upgrade github.com/bep/imagemeta v0.17.1 => v0.17.2 080970b @​bep
• build(deps): bump github.com/aws/aws-sdk-go-v2/service/cloudfront (#​14789) 896bc89 @​dependabot[bot]
• build(deps): bump github.com/mattn/go-isatty from 0.0.20 to 0.0.21 (#​14788) 100dde5 @​dependabot[bot]
• build(deps): bump github.com/bep/mclib (#​14787) bdebb79 @​dependabot[bot]
• build(deps): bump google.golang.org/api from 0.267.0 to 0.276.0 52123ae @​dependabot[bot]
• build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.41.5 to 1.41.6 38b8afd @​dependabot[bot]
• build(deps): bump github.com/getkin/kin-openapi from 0.134.0 to 0.135.0 (#​14781) 9276660 @​dependabot[bot]
• build(deps): bump github.com/bep/goportabletext from 0.1.0 to 0.2.0 (#​14779) 790f408 @​dependabot[bot]
• build(deps): bump golang.org/x/image from 0.38.0 to 0.39.0 (#​14780) de6955b @​dependabot[bot]
• deps: Upgrade github.com/bep/imagemeta v0.17.0 => v0.17.1 (#​14775) a77bd52 @​bep #​14758
• build(deps): bump golang.org/x/tools from 0.43.0 to 0.44.0 547ab29 @​dependabot[bot]
• build(deps): bump github.com/evanw/esbuild from 0.27.4 to 0.28.0 9a5c7e0 @​dependabot[bot]
• build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.41.1 to 1.41.5 6613b08 @​dependabot[bot]
• build(deps): bump github.com/pelletier/go-toml/v2 from 2.2.4 to 2.3.0 582c26e @​dependabot[bot]
• build(deps): bump github.com/tdewolff/minify/v2 from 2.24.11 to 2.24.12 a4f2a8a @​dependabot[bot]

v0.160.1

Compare Source

What's Changed

• Fix panic when passthrough elements are used in headings 8b00030 @​bep #​14677
• Fix panic on edit of legacy mapped template names that's also a valid path in the new setup c485516 @​bep #​14740
• Fix RenderShortcodes leaking context markers when indented 161d0d4 @​bep #​12457
• Strip nested page context markers from standalone RenderShortcodes 45e4596 @​bep #​14732
• Rename deprecated cascade._target to cascade.target in tests 58927aa @​bep
• Fix auto-creation of root sections in multilingual sites ce009e3 @​bep #​14681
• readme: Fix links 0755872 @​chicks-net

v0.160.0

Compare Source

Now you can inject CSS vars, e.g. from the configuration, into your stylesheets when building with css.Build. Also, now all the render hooks has a .Position method, now also more accurate and effective.

Bug fixes

• Fix some recently introduced Position issues 4e91e14 @​bep #​14710
• markup/goldmark: Fix double-escaping of ampersands in link URLs dc9b51d @​bep #​14715
• tpl: Fix stray quotes from partial decorator in script context 43aad71 @​bep #​14711

Improvements

• all: Replace NewIntegrationTestBuilder with Test/TestE/TestRunning 481baa0 @​bep
• tpl/css: Support @​import "hugo:vars" for CSS custom properties in css.Build 5d09b5e @​bep #​14699
• Improve and extend .Position handling in Goldmark render hooks 303e443 @​bep #​14663
• markup/goldmark: Clean up test 638262c @​bep

Dependency Updates

• build(deps): bump github.com/magefile/mage from 1.16.1 to 1.17.1 bf6e35a @​dependabot[bot]
• build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 0eda24e @​dependabot[bot]
• build(deps): bump golang.org/x/image from 0.37.0 to 0.38.0 beb57a6 @​dependabot[bot]

Documentation

• readme: Revise edition descriptions and installation instructions 9f1f1be @​jmooring

v0.159.2

Compare Source

Note that the security fix below is not a potential threat if you either:

• Trust your Markdown content files.
• Have custom render hook template for links and images.

EDIT IN: This release also adds release archives for non-extended-withdeploy builds.

What's Changed

• Fix potential content XSS by escaping dangerous URLs in Markdown links and images 479fe6c @​bep
• resources/page: Fix shared reader in Source.ValueAsOpenReadSeekCloser df520e3 @​jmooring #​14684

v0.159.1

Compare Source

The regression fixed in this release isn't new, but it's so subtle that we thought we'd release this sooner rather than later. For some time now, the minifier we use have stripped namespaced attributes in SVGs, which broke dynamic constructs using e.g. AlpineJS' x-bind: namespace (library used by Hugo's documentation site).

To fix this, the upstream library has hadded a keepNamespaces slice option. It was not possible to find a default that would make all happy, so we opted for an option that at least would make AlpineJS sites work out of the box:

 [minify.tdewolff.svg]
      keepNamespaces = ['', 'x-bind']

What's Changed

• minifiers: Keep x-bind and blank namespace in SVG minification 42289d7 @​bep #​14669

v0.159.0

Compare Source

This release greatly improves and simplifies management of Node.js/npm dependencies in a multi-module setup. See this page for more information.

Note

• Replace deprecated site.Data with hugo.Data in tests a8fca59 @​bep
• Replace deprecated excludeFiles and includeFiles with files in tests 182b104 @​bep
• Replace deprecated :filename with :contentbasename in the permalinks test eb11c3d @​bep

Bug fixes

• tpl/tplimpl: Fix Vimeo shortcode test eaf4c75 @​jmooring #​14649

Improvements

• create: Return error instead of panic when page not found 807cae1 @​mango766 #​14112
• commands: Preserve non-content files in convert output c4fb61d @​xndvaz #​4621
• npm: Use workspaces to simplify hugo mod npm pack d88a29e @​bep
• commands: Close cpu profile file when StartCPUProfile fails 9dd9c76 @​buley
• Remove the AI Watchdog workflow for now 3315a86 @​bep
• Remove 'bep' from PR user logins skip list 3824484 @​bep
• tpl/tplimpl: Comment out the Vimeo simple shortcode tests 7813c5c @​bep #​14649

Dependency Updates

• build(deps): bump github.com/olekukonko/tablewriter from 1.1.3 to 1.1.4 (#​14641) 3ff9b7f @​dependabot[bot]
• build(deps): bump github.com/yuin/goldmark from 1.7.16 to 1.7.17 be93ccd @​dependabot[bot]
• build(deps): bump github.com/magefile/mage from 1.15.0 to 1.16.1 2669bca @​dependabot[bot]
• build(deps): bump golang.org/x/image from 0.36.0 to 0.37.0 753d447 @​dependabot[bot]
• build(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.3 4f39d72 @​dependabot[bot]

Documentation

• docs: Update docs.yaml d2043cf @​bep
• commands: Update docs linke to Node.js docs 4f3c398 @​bep

v0.158.0

Compare Source

This release adds css.Build, native and very fast bundling/transformation/minifying of CSS resources. Also see the new strings.ReplacePairs, a very fast option if you need to do many string replacements.

Notes

• Upgrade to to Go 1.26.1 (#​14597) (note) 1f578f1 @​bep #​14595. This fixes a security issue in Go's template package used by Hugo: https://www.cve.org/CVERecord?id=CVE-2026-27142

Deprecations

The methods and config options are deprecated and will be removed in a future Hugo release.

Also see this article

Language configuration

• languageCode → Use locale instead.
• languages.<lang>.languageCode → Use languages.<lang>.locale instead.
• languages.<lang>.languageName → Use languages.<lang>.label instead.
• languages.<lang>.languageDirection → Use languages.<lang>.direction instead.

Language methods

• .Site.LanguageCode → Use .Site.Language.Locale instead.
• .Language.LanguageCode → Use .Language.Locale instead.
• .Language.LanguageName → Use .Language.Label instead.
• .Language.LanguageDirection → Use .Language.Direction instead.

Bug fixes

• tpl/css: Fix external source maps e431f90 @​bep #​14620
• hugolib: Fix server no watch 59e0446 @​jmooring #​14615
• resources: Fix context canceled on GetRemote with per-request timeout 842d8f1 @​bep #​14611
• tpl/tplimpl: Prefer early suffixes when media type matches 4eafd9e @​bep #​13877 #​14601
• all: Run go fix ./... e310822 @​bep
• internal/warpc: Fix SIGSEGV in Close() when dispatcher fails to start c9b88e4 @​bep #​14536
• Fix index out of range panic in fileEventsContentPaths f797f84 @​bep #​14573

Improvements

• resources: Re-publish on transformation cache hit 3c980c0 @​bep #​14629
• create/skeletons: Use css.Build in theme skeleton 404ac00 @​jmooring #​14626
• tpl/css: Add a test case for rebuilds on CSS options changes 06fcb72 @​bep
• hugolib: Allow regular pages to cascade to self 9b5f1d4 @​jmooring #​14627
• tpl/css: Allow the user to override single loader entries 623722b @​bep #​14623
• tpl/css: Make default loader resolution for CSS @​import and url() always behave the same a7cbcf1 @​bep #​14619
• internal/js: Add default mainFields for CSS builds 36cdb2c @​jmooring #​14614
• Add css.Build 3e3b849 @​bep #​14609 #​14613
• resources: Use full path for Exif etc. decoding error/warning messages c47ec23 @​bep #​12693
• Move to new locales library and upgrade CLDR from v36.1 to v48.1 4652ae4 @​bep
• tpl/strings: Add strings.ReplacePairs function 13a95b9 @​jmooring #​14594
• github: Remove pull_request_template.md 54c8048 @​bep
• testing: Make commands tests pass in Go 1.26.1 157bfdd @​bep
• refactor: Deprecate language configuration and template methods d4f2122 @​jmooring #​14269
• Replace Exif with Meta in tests 991d2f9 @​bep
• resources: Improve getImageOps error message e857777 @​jmooring #​14571
• resources/images: Add IsImageResourceWithMeta etc. tests for bmp and gif 44dc384 @​bep #​14568

Dependency Updates

• deps: Upgrade github.com/evanw/esbuild v0.27.3 => v0.27.4 0e46a97 @​bep
• build(deps): bump github.com/getkin/kin-openapi from 0.133.0 to 0.134.0 c27d9e8 @​dependabot[bot]
• build(deps): bump golang.org/x/tools from 0.42.0 to 0.43.0 098eac5 @​dependabot[bot]
• build(deps): bump gocloud.dev from 0.44.0 to 0.45.0 87f8de8 @​dependabot[bot]
• build(deps): bump golang.org/x/sync from 0.19.0 to 0.20.0 67ef6c6 @​dependabot[bot]
• build(deps): bump golang.org/x/net from 0.50.0 to 0.51.0 (#​14569) b29c2f7 @​dependabot[bot]
• build(deps): bump github.com/tdewolff/minify/v2 from 2.24.9 to 2.24.10 (#​14585) e91d191 @​dependabot[bot]
• build(deps): bump github.com/bep/imagemeta from 0.15.0 to 0.17.0 (#​14584) a8a54bd @​dependabot[bot]

v0.157.0

Compare Source

The notable new feature is GitInfo support for Hugo Modules. See this repo for a runnable demo where multiple versions of the same content is mounted into different versions.

Bug fixes

• Fix menu pageRef resolution in multidimensional setups 3dff7c8 @​bep #​14566
• docs: Regen and fix the imaging docshelper output 8e28668 @​bep #​14562
• hugolib: Fix automatic section pages not replaced by sites.complements a18bec1 @​bep #​14540

Improvements

• Handle GitInfo for modules where Origin is not set when running go list d98cd4a @​bep #​14564
• commands: Update link to highlighting style examples 6805997 @​jmooring #​14556
• Add AVIF, HEIF and HEIC partial support (only metadata for now) 49bfb10 @​bep #​14549
• resources/images: Adjust WebP processing defaults b7203bb @​jmooring
• Add Page.GitInfo support for content from Git modules dfece5b @​bep #​14431 #​5533
• Add per-request timeout option to resources.GetRemote 2d691c7 @​vanbroup
• Update AI Watchdog action version in workflow b96d58a @​bep
• config: Skip taxonomy entries with empty keys or values 65b4287 @​bep #​14550
• Add guideline for brevity in code and comments cc338a9 @​bep
• modules: Include JSON error info from go mod download in error messages 3850881 @​bep #​14543

Dependency Updates

• build(deps): bump github.com/tdewolff/minify/v2 from 2.24.8 to 2.24.9 9869e71 @​dependabot[bot]
• build(deps): bump github.com/bep/imagemeta from 0.14.0 to 0.15.0 8f47fe8 @​dependabot[bot]

v0.156.0

Compare Source

This release brings significant speedups of collections.Where and collections.Sort – but this is mostly a "spring cleaning" release, to make the API cleaner and simpler to understand/document.

Deprecated

• Site.AllPages is Deprecated
• Site.BuildDrafts is Deprecated
• Site.Languages is Deprecated
• Site.Data is deprecated, use hugo.Data
• Page.Sites and Site.Sites is Deprecated, use hugo.Sites

See this topic for more info.

Removed

These have all been deprecated at least since v0.136.0 and any usage have been logged as an error for a long time:

Template functions

• data.GetCSV / getCSV (use resources.GetRemote)
• data.GetJSON / getJSON (use resources.GetRemote)
• crypto.FNV32a (use hash.FNV32a)
• resources.Babel (use js.Babel)
• resources.PostCSS (use css.PostCSS)
• resources.ToCSS (use css.Sass)

Page methods:

• .Page.NextPage (use .Page.Next)
• .Page.PrevPage (use .Page.Prev)

Paginator:

• .Paginator.PageSize (use .Paginator.PagerSize)

Site methods:

• .Site.LastChange (use .Site.Lastmod)
• .Site.Author (use .Site.Params.Author)
• .Site.Authors (use .Site.Params.Authors)
• .Site.Social (use .Site.Params.Social)
• .Site.IsMultiLingual (use hugo.IsMultilingual)
• .Sites.First (use .Sites.Default)

Site config:

• paginate (use pagination.pagerSize)
• paginatePath (use pagination.path)

File caches:

• getjson cache
• getcsv cache

Notes

• Remove items deprecated <= v0.136.0 (note) af5051e @​bep
• hugolib: Move site.Data to hugo.Data, deprecate Site.AllPages/BuildDrafts/Languages 86aa625 @​bep #​14521
• hugolib: Add Page.Sites to Site.Sites deprecation notice 4148ede @​jmooring #​14532
• resources/page: Deprecate cascade._target in favor of cascade.target 828ee72 @​jmooring #​14341
• tpl/tplimpl: Throw error when calling gist shortcode 4384f9b @​jmooring #​14491
• tpl/tplimpl: Throw error when calling twitter/twitter_simple shortcodes 55d136d @​jmooring #​14488

Bug fixes

• tpl/internal: Replace deprecated parser.ParseDir and doc.New 4a641d1 @​bep #​14513
• commands: Fix --panicOnWarning flag having no effect with module version warnings 3f9d0ad @​bep #​14524
• paths: Fix handling of _ as a path name 32027e5 @​khayyamsaleem #​14344
• docs: Fix lineNos default value in docs.yaml 498431d @​jmooring
• hugolib: Fix term title when taxonomy name contains spaces 773664b @​bep #​13422

Improvements

• hugolib: Simplify sites collection bba2aed @​bep
• hugolib: Adjust hugo.Sites.Default 29b8e17 @​bep #​14531
• Move common/hugo/HugoInfo to resources/page 3c82340 @​bep
• hugolib: Add hugo.Sites and .Site.IsDefault(), modify .Site.Sites ab62320 @​jmooring #​14479 #​14481
• output: Remove unused method 8d19f5a @​bep #​14522
• Update AI assistance guidelines in CONTRIBUTING.md 7729473 @​bep
• tpl/collections: Speed up where and sort performance 47e39af @​bep
• commands: Skip chmod for files without owner-write permission 7850e7c @​jmooring #​14507
• tpl/collections: Add some more benchmarks for where and sort 2e5132d @​bep
• all: Change site to project where appropriate 19ab3f5 @​jmooring #​14504
• markup/highlight: Allow lineNos to be true, false, "inline", or "table" 3158a51 @​jmooring #​13481
• Upgrade to Go 1.26 b358a65 @​bep
• tpl: Move from md5 to xxhash for some in memory keys 8ae5e1a @​bep
• testscripts/commands: Update 'future' date to far future e277659 @​toddy15 #​14486

Dependency Updates

• build(deps): bump google.golang.org/api from 0.255.0 to 0.267.0 d8ec0ee @​dependabot[bot]
• build(deps): bump github.com/bep/textandbinarywriter 21be4af @​dependabot[bot]
• build(deps): bump github.com/bep/simplecobra from 0.6.1 to 0.7.0 e549016 @​dependabot[bot]
• build(deps): bump github.com/bep/tmc from 0.5.1 to 0.6.0 a392906 @​dependabot[bot]
• build(deps): bump github.com/gohugoio/hugo-goldmark-extensions/extras 86786c9 @​dependabot[bot]
• build(deps): bump github.com/gohugoio/hugo-goldmark-extensions/passthrough 7a7308a @​dependabot[bot]
• build(deps): bump golang.org/x/tools from 0.41.0 to 0.42.0 2d1d731 @​dependabot[bot]
• build(deps): bump github.com/bep/helpers from 0.6.0 to 0.7.0 b26fbf8 @​dependabot[bot]
• build(deps): bump golang.org/x/image from 0.35.0 to 0.36.0 7358309 @​dependabot[bot]

Build Setup

• snap: Stop building for ppc64el and s390x e6f01bb @​jmooring #​14519
• Reapply "release: Support alpha, beta, and RC releases" de0c9f3 @​jmooring #​14466

Documentation

• docs: Regenerate docs.yaml 8b7b6af @​bep
• docker: Add full tar and openssh-client to support GitHub Actions 7137714 @​jmooring #​14502

v0.155.3

Compare Source

What's Changed

• hugolib: Don't render default site redirect for non-primary isHTML output formats 6ac7d08 @​bep #​14482
• server: Fix stuck server global error logging 24eb84f @​bep #​14469
• build(deps): bump github.com/evanw/esbuild from 0.27.2 to 0.27.3 95a3678 @​dependabot[bot]
• server: Fix panic when the server browser error handler tried to use a config in a state of flux 9045797 @​bep #​14470

v0.155.2

Compare Source

Note that the bug fix below is for the two new dimensions introduced in v0.153.0 (version and role), multiple languages worked fine. Also, changes to the first version and role also worked, which had me head-scratching for a while. Oh, well, enjoy.

• Fix template change detection for multi-version sites 0f1c7d1 @​bep #​14461
• resources/image: Add some image decode/encode debug logging 6bd2bde @​bep #​14337 #​14460

v0.155.1

Compare Source

What's Changed

• Fix image DecodeConfig regression of WebP images from file cache b5d43cd @​bep #​14453
• resources/images: Fix WebP useSharpYuv being ignored b1e1eed @​jmooring #​14449
• tpl/tplimpl: Remove failing Twitter tests f522a72 @​jmooring

v0.155.0

Compare Source

Some notable new things in this release are:

• Improvements to how versions are handled: We now support version (and also for the other dimension) range queries (e.g. >= v1.0.0), and we now cache Go module version queries, which makes mounting multiple versions of the same GitHub repo with different version much more practical and enjoyable, se this site and config for an annotated example.
• We finally have XMP and IPTC image metadata support, in addition to EXIF, see #​13146
• Page aliases now works in multidimensional sites (e.g. multiple languages), and it is now much easier to create e.g. Netlify _redirects files that works in such setups.
• There are several performance related WebP improvements in this release.
• Also, image processing in general (e.g. resize operations) should be considerably more effective.

Breaking change

Prior to v0.155.0, alias paths beginning with a slash (/) were treated as server-relative. In v0.155.0 and later, they are now site-relative. This change only affects multilingual single-host projects that used alias paths beginning with a slash (/) to cross language boundaries. See details.

Note

• Make Page.Aliases more useful in multidimensional setups (note) ee91c70 @​bep #​14402

Bug fixes

• Fix data race when clearing cache in cachebusters 8a979d5 @​wjiec
• resources/images: Fix comment for Quality field in ImageConfig fd49df8 @​bep
• Fix panic reported in discourse c7b35c8 @​bep #​14441
• Fix recently introduced partial rendering bug 8dfcece @​bep #​14433
• tpl: Fix partial decorator panic when partial returns falsy f472dd4 @​simonheimlicher #​14419
• resources: Fix race condition in test helper 48566b6 @​simonheimlicher
• Fix casc

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ Artifact update notice

File name: deps/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 9 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.23.0 -> 1.24.0
github.com/gohugoio/hashstructure	v0.5.0 -> v0.6.0
github.com/niklasfasching/go-org	v1.7.0 -> v1.9.1
github.com/spf13/afero	v1.14.0 -> v1.15.0
github.com/spf13/cast	v1.7.1 -> v1.10.0
github.com/tdewolff/parse/v2	v2.7.18 -> v2.8.5-0.20251020133559-0efcf90bef1a
golang.org/x/net	v0.39.0 -> v0.46.0
golang.org/x/sys	v0.32.0 -> v0.37.0
golang.org/x/text	v0.24.0 -> v0.30.0
google.golang.org/protobuf	v1.36.5 -> v1.36.9

[renovate]

ℹ️ Artifact update notice

File name: deps/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 11 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.23.0 -> 1.25.0
github.com/mattn/go-colorable	v0.1.13 -> v0.1.14
github.com/mattn/go-isatty	v0.0.20 -> v0.0.22
github.com/niklasfasching/go-org	v1.7.0 -> v1.9.1
github.com/pelletier/go-toml/v2	v2.2.4 -> v2.3.0
github.com/spf13/afero	v1.14.0 -> v1.15.0
github.com/spf13/cast	v1.7.1 -> v1.10.0
github.com/tdewolff/parse/v2	v2.7.18 -> v2.8.12
golang.org/x/net	v0.39.0 -> v0.53.0
golang.org/x/sys	v0.32.0 -> v0.43.0
golang.org/x/text	v0.24.0 -> v0.36.0
google.golang.org/protobuf	v1.36.5 -> v1.36.11