hugo

The big change in this release is that the _extended_ edition of Hugo is gone. LibSass has been deprecated for a long time, and it was the only remaining reason we needed a CGO-enabled extended build. There is now only one Hugo binary, and apart from LibSass it has all the features the extended build had.

Notes

• Setting transpiler to libsass in css.Sass now returns an error. Dart Sass is now the default and the only transpiler, so you need to install it if you use Sass.
• We no longer publish hugo_extended_* archives. To avoid breaking existing CI setups, we publish aliases for the most downloaded extended archives (e.g. hugo_extended__linux-amd64.tar.gz, hugo_extended__Linux-64bit.tar.gz, the linux-amd64.deb, linux-arm64.tar.gz and windows-amd64.zip), but you should update your scripts to use the standard archives. The extended_withdeploy builds are also removed. See Installation.
• hugo.IsExtended now always returns false, and the module config setting hugoVersion.extended is deprecated and has no effect.
• Command-line flags (e.g. --buildDrafts) now override OS environment variables (e.g. HUGO_BUILDDRAFTS). This also fixes HUGO_ENVIRONMENT=qa hugo build -e staging loading the staging config but reporting qa in hugo.Environment.
• strings.Truncate has been rewritten on top of a proper HTML scanner. It now handles comments, void elements, quoted attributes with > and raw text elements such as script correctly, and it's faster and allocates less. On a curious note, the old version was implemented by Mathias Biilmann, the Netlify CEO.
• time.Time values now keep their named time zone, and eq, ne, in and uniq compare time.Time values by instant.
• resources.Match and friends now preserve the directory casing in the matched paths, so e.g. resources.Match "gallery/Travel/Iceland/*" now works on case-sensitive file systems.
• Syncing of static files is much faster for big unchanged files, as we now skip the content check for files with the same size and modification time.
• Several fixes and hardening of the WASM based image codecs (AVIF crash at encoderSpeed 6 and lower, recovering from broken WASM instances in the server).

Security

Hugo

• Passthrough content is now HTML escaped when no passthrough render hook is set, unless markup.goldmark.renderer.unsafe is enabled. Before this, e.g. \(\) in a content file emitted raw HTML.
• The wrapperClass option, settable from the highlight shortcode and transform.Highlight, is now escaped.
• Vendored module paths are now restricted to the _vendor directory (symlinks pointing outside are rejected).

Thanks to @R0X4R for finding and reporting the last two issues.

Go

This release is built with Go 1.27.4, which includes 12 security fixes. The one most relevant for Hugo is a crash in the net/http HTTP/1 server (used by hugo server) caused by a race in MaxBytesReader. The other 11 are in the cmd/go toolchain (cgo flag and linker injection at build time) and mainly matter if you build Hugo from source with untrusted dependencies.

Dependencies

• golang.org/x/net v0.62.0 fixes two issues in the html package: quadratic complexity when coalescing text nodes, and a namespace issue when rendering raw text. Hugo uses this package when collecting HTML elements for hugo_stats.json and in the AsciiDoc integration.
• github.com/go-jose/go-jose/v4 v4.1.6 (indirect dependency) contains a number of security fixes, among them GHSA-mgcc-cww5-fp2q (RSA modulus size limit when parsing JWKs) and a stack depth limit in the JSON decoder.

Changes

• Remove libsass and the extended build tag c2f9cb82 @bep #15405
• Remove the extended build from the release 0b66ebd4 @bep #15502
• Fix typo in AGENTS.md 588241bf @pei711
• tpl/collections: Fix sort when some items lack the sort key a8a8e978 @bep #15523
• warpc, commands: Fix Close of image dispatchers, recover in fast render 3c2f52d4 @bep #15522
• warpc: Fix AVIF encode crashing at encoderSpeed 6 and lower 47425654 @bep #15522
• Fix misc layout lookup issues f3875ec3 @bep #15538 #15540
• tpl/collections: Fix merge of maps with concrete element types b76fde2f @bep #15499
• tpl/tplimpl: Fix shortcode layout lookup in non-default output formats 87e6e14c @jmooring #15536
• langs/i18n: Fix project translations losing to module translations fa5a3d48 @jmooring #15518
• Adjust Exif test to fix now failing deprecation tests 471d0fb3 @bep
• markup/goldmark: Escape passthrough content when no render hook is set e2f66a23 @raghu45345
• tpl: Compare time.Time values by instant in eq, ne, in and uniq 3519196b @jmooring #15577
• Skip content check for static files with the same size and modification time afb2d9ac @bep #15572
• commands: Rebuild assets also mounted as static b755c9d5 @xndvaz #15567
• hugolib: Keep npm installs in their test directory 2056ed69 @xndvaz #15568
• Upgrade to Go 1.27.4 bca2cec8 @bep
• common/htime: Preserve location of time.Time values 59224216 @jmooring #8895 #15565
• markup/highlight: Escape wrapperClass bdde5aa5 @bep
• modules: Restrict vendor module paths to the _vendor directory d41a8a19 @bep
• hugofs: Preserve directory casing in resource matches 5b44cfce @xndvaz #7686 #10112
• config: Make command-line flags override OS environment variables d5ba1aaa @bep #15549 #15550
• tpl/resources: Accept []any of resources in Concat e6a470cb @jmooring #15546
• warpc: Keep function names in WASM binaries, set WebP stack size 1a014e53 @bep #15522
• warpc, commands: Recover from broken WASM instances in the server 5086d5fc @bep #15522
• resources: Resolve remote media type from Hugo's media types 3a1985b1 @AnaTejeda1 #11601
• langs/i18n: Add failing test for project translation precedence 2b0e1e1e @jmooring #15518
• ci: Upgrade setup-ruby and Ruby 185a609e @jmooring
• tpl/strings: Rewrite truncate using the hhtml scanner 6b0c89c3 @bep #15505 #15509

Dependency Updates

• build(deps): bump golang.org/x/image from 0.47.0 to 0.48.0 29bcc86d @dependabot[bot]
• build(deps): bump golang.org/x/text from 0.43.0 to 0.44.0 4f8354eb @dependabot[bot]
• build(deps): bump github.com/spf13/pflag from 1.0.10 to 1.1.0 6aebad49 @dependabot[bot]
• build(deps): bump github.com/getkin/kin-openapi from 0.152.0 to 0.153.0 88468544 @dependabot[bot]
• build(deps): bump github.com/bits-and-blooms/bitset 0586add2 @dependabot[bot]
• build(deps): bump github.com/tdewolff/minify/v2 from 2.24.24 to 2.24.25 45dfa4e8 @dependabot[bot]
• build(deps): bump github.com/yuin/goldmark from 1.8.6 to 1.8.7 d2010fcc @dependabot[bot]