Now you can inject CSS vars, e.g. from the configuration, into your stylesheets when building with css.Build. Also, now all the render hooks has a .Position method, now also more accurate and effective.

Bug fixes

• Fix some recently introduced Position issues 4e91e14 @bep #14710
• markup/goldmark: Fix double-escaping of ampersands in link URLs dc9b51d @bep #14715
• tpl: Fix stray quotes from partial decorator in script context 43aad71 @bep #14711

Improvements

• all: Replace NewIntegrationTestBuilder with Test/TestE/TestRunning 481baa0 @bep
• tpl/css: Support @import "hugo:vars" for CSS custom properties in css.Build 5d09b5e @bep #14699
• Improve and extend .Position handling in Goldmark render hooks 303e443 @bep #14663
• markup/goldmark: Clean up test 638262c @bep

Dependency Updates

• build(deps): bump github.com/magefile/mage from 1.16.1 to 1.17.1 bf6e35a @dependabot[bot]
• build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 0eda24e @dependabot[bot]
• build(deps): bump golang.org/x/image from 0.37.0 to 0.38.0 beb57a6 @dependabot[bot]

Documentation

• readme: Revise edition descriptions and installation instructions 9f1f1be @jmooring

Note that the security fix below is not a potential threat if you either:

• Trust your Markdown content files.
• Have custom render hook template for links and images.

EDIT IN: This release also adds release archives for non-extended-withdeploy builds.

What's Changed

• Fix potential content XSS by escaping dangerous URLs in Markdown links and images 479fe6c @bep
• resources/page: Fix shared reader in Source.ValueAsOpenReadSeekCloser df520e3 @jmooring #14684

The regression fixed in this release isn't new, but it's so subtle that we thought we'd release this sooner rather than later. For some time now, the minifier we use have stripped namespaced attributes in SVGs, which broke dynamic constructs using e.g. AlpineJS' x-bind: namespace (library used by Hugo's documentation site).

To fix this, the upstream library has hadded a keepNamespaces slice option. It was not possible to find a default that would make all happy, so we opted for an option that at least would make AlpineJS sites work out of the box:

 [minify.tdewolff.svg]
      keepNamespaces = ['', 'x-bind']

What's Changed

• minifiers: Keep x-bind and blank namespace in SVG minification 42289d7 @bep #14669

This release greatly improves and simplifies management of Node.js/npm dependencies in a multi-module setup. See this page for more information.

Note

• Replace deprecated site.Data with hugo.Data in tests a8fca59 @bep
• Replace deprecated excludeFiles and includeFiles with files in tests 182b104 @bep
• Replace deprecated :filename with :contentbasename in the permalinks test eb11c3d @bep

Bug fixes

• tpl/tplimpl: Fix Vimeo shortcode test eaf4c75 @jmooring #14649

Improvements

• create: Return error instead of panic when page not found 807cae1 @mango766 #14112
• commands: Preserve non-content files in convert output c4fb61d @xndvaz #4621
• npm: Use workspaces to simplify hugo mod npm pack d88a29e @bep
• commands: Close cpu profile file when StartCPUProfile fails 9dd9c76 @buley
• Remove the AI Watchdog workflow for now 3315a86 @bep
• Remove 'bep' from PR user logins skip list 3824484 @bep
• tpl/tplimpl: Comment out the Vimeo simple shortcode tests 7813c5c @bep #14649

Dependency Updates

• build(deps): bump github.com/olekukonko/tablewriter from 1.1.3 to 1.1.4 (#14641) 3ff9b7f @dependabot[bot]
• build(deps): bump github.com/yuin/goldmark from 1.7.16 to 1.7.17 be93ccd @dependabot[bot]
• build(deps): bump github.com/magefile/mage from 1.15.0 to 1.16.1 2669bca @dependabot[bot]
• build(deps): bump golang.org/x/image from 0.36.0 to 0.37.0 753d447 @dependabot[bot]
• build(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.3 4f39d72 @dependabot[bot]

Documentation

• docs: Update docs.yaml d2043cf @bep
• commands: Update docs linke to Node.js docs 4f3c398 @bep

This release adds css.Build, native and very fast bundling/transformation/minifying of CSS resources. Also see the new strings.ReplacePairs, a very fast option if you need to do many string replacements.

Notes

• Upgrade to to Go 1.26.1 (#14597) (note) 1f578f1 @bep #14595. This fixes a security issue in Go's template package used by Hugo: https://www.cve.org/CVERecord?id=CVE-2026-27142

Deprecations

The methods and config options are deprecated and will be removed in a future Hugo release.

Also see this article

Language configuration

• languageCode → Use locale instead.
• languages.<lang>.languageCode → Use languages.<lang>.locale instead.
• languages.<lang>.languageName → Use languages.<lang>.label instead.
• languages.<lang>.languageDirection → Use languages.<lang>.direction instead.

Language methods

• .Site.LanguageCode → Use .Site.Language.Locale instead.
• .Language.LanguageCode → Use .Language.Locale instead.
• .Language.LanguageName → Use .Language.Label instead.
• .Language.LanguageDirection → Use .Language.Direction instead.

Bug fixes

• tpl/css: Fix external source maps e431f90 @bep #14620
• hugolib: Fix server no watch 59e0446 @jmooring #14615
• resources: Fix context canceled on GetRemote with per-request timeout 842d8f1 @bep #14611
• tpl/tplimpl: Prefer early suffixes when media type matches 4eafd9e @bep #13877 #14601
• all: Run go fix ./... e310822 @bep
• internal/warpc: Fix SIGSEGV in Close() when dispatcher fails to start c9b88e4 @bep #14536
• Fix index out of range panic in fileEventsContentPaths f797f84 @bep #14573

Improvements

• resources: Re-publish on transformation cache hit 3c980c0 @bep #14629
• create/skeletons: Use css.Build in theme skeleton 404ac00 @jmooring #14626
• tpl/css: Add a test case for rebuilds on CSS options changes 06fcb72 @bep
• hugolib: Allow regular pages to cascade to self 9b5f1d4 @jmooring #14627
• tpl/css: Allow the user to override single loader entries 623722b @bep #14623
• tpl/css: Make default loader resolution for CSS @import and url() always behave the same a7cbcf1 @bep #14619
• internal/js: Add default mainFields for CSS builds 36cdb2c @jmooring #14614
• Add css.Build 3e3b849 @bep #14609 #14613
• resources: Use full path for Exif etc. decoding error/warning messages c47ec23 @bep #12693
• Move to new locales library and upgrade CLDR from v36.1 to v48.1 4652ae4 @bep
• tpl/strings: Add strings.ReplacePairs function 13a95b9 @jmooring #14594
• github: Remove pull_request_template.md 54c8048 @bep
• testing: Make commands tests pass in Go 1.26.1 157bfdd @bep
• refactor: Deprecate language configuration and template methods d4f2122 @jmooring #14269
• Replace Exif with Meta in tests 991d2f9 @bep
• resources: Improve getImageOps error message e857777 @jmooring #14571
• resources/images: Add IsImageResourceWithMeta etc. tests for bmp and gif 44dc384 @bep #14568

Dependency Updates

• deps: Upgrade github.com/evanw/esbuild v0.27.3 => v0.27.4 0e46a97 @bep
• build(deps): bump github.com/getkin/kin-openapi from 0.133.0 to 0.134.0 c27d9e8 @dependabot[bot]
• build(deps): bump golang.org/x/tools from 0.42.0 to 0.43.0 098eac5 @dependabot[bot]
• build(deps): bump gocloud.dev from 0.44.0 to 0.45.0 87f8de8 @dependabot[bot]
• build(deps): bump golang.org/x/sync from 0.19.0 to 0.20.0 67ef6c6 @dependabot[bot]
• build(deps): bump golang.org/x/net from 0.50.0 to 0.51.0 (#14569) b29c2f7 @dependabot[bot]
• build(deps): bump github.com/tdewolff/minify/v2 from 2.24.9 to 2.24.10 (#14585) e91d191 @dependabot[bot]
• build(deps): bump github.com/bep/imagemeta from 0.15.0 to 0.17.0 (#14584) a8a54bd @dependabot[bot]

The notable new feature is GitInfo support for Hugo Modules. See this repo for a runnable demo where multiple versions of the same content is mounted into different versions.

Bug fixes

• Fix menu pageRef resolution in multidimensional setups 3dff7c8 @bep #14566
• docs: Regen and fix the imaging docshelper output 8e28668 @bep #14562
• hugolib: Fix automatic section pages not replaced by sites.complements a18bec1 @bep #14540

Improvements

• Handle GitInfo for modules where Origin is not set when running go list d98cd4a @bep #14564
• commands: Update link to highlighting style examples 6805997 @jmooring #14556
• Add AVIF, HEIF and HEIC partial support (only metadata for now) 49bfb10 @bep #14549
• resources/images: Adjust WebP processing defaults b7203bb @jmooring
• Add Page.GitInfo support for content from Git modules dfece5b @bep #14431 #5533
• Add per-request timeout option to resources.GetRemote 2d691c7 @vanbroup
• Update AI Watchdog action version in workflow b96d58a @bep
• config: Skip taxonomy entries with empty keys or values 65b4287 @bep #14550
• Add guideline for brevity in code and comments cc338a9 @bep
• modules: Include JSON error info from go mod download in error messages 3850881 @bep #14543

Dependency Updates

• build(deps): bump github.com/tdewolff/minify/v2 from 2.24.8 to 2.24.9 9869e71 @dependabot[bot]
• build(deps): bump github.com/bep/imagemeta from 0.14.0 to 0.15.0 8f47fe8 @dependabot[bot]

This release brings significant speedups of collections.Where and collections.Sort – but this is mostly a "spring cleaning" release, to make the API cleaner and simpler to understand/document.

Deprecated

• Site.AllPages is Deprecated
• Site.BuildDrafts is Deprecated
• Site.Languages is Deprecated
• Site.Data is deprecated, use hugo.Data
• Page.Sites and Site.Sites is Deprecated, use hugo.Sites

See this topic for more info.

Removed

These have all been deprecated at least since v0.136.0 and any usage have been logged as an error for a long time:

Template functions

• data.GetCSV / getCSV (use resources.GetRemote)
• data.GetJSON / getJSON (use resources.GetRemote)
• crypto.FNV32a (use hash.FNV32a)
• resources.Babel (use js.Babel)
• resources.PostCSS (use css.PostCSS)
• resources.ToCSS (use css.Sass)

Page methods:

• .Page.NextPage (use .Page.Next)
• .Page.PrevPage (use .Page.Prev)

Paginator:

• .Paginator.PageSize (use .Paginator.PagerSize)

Site methods:

• .Site.LastChange (use .Site.Lastmod)
• .Site.Author (use .Site.Params.Author)
• .Site.Authors (use .Site.Params.Authors)
• .Site.Social (use .Site.Params.Social)
• .Site.IsMultiLingual (use hugo.IsMultilingual)
• .Sites.First (use .Sites.Default)

Site config:

• paginate (use pagination.pagerSize)
• paginatePath (use pagination.path)

File caches:

• getjson cache
• getcsv cache

Notes

• Remove items deprecated <= v0.136.0 (note) af5051e @bep
• hugolib: Move site.Data to hugo.Data, deprecate Site.AllPages/BuildDrafts/Languages 86aa625 @bep #14521
• hugolib: Add Page.Sites to Site.Sites deprecation notice 4148ede @jmooring #14532
• resources/page: Deprecate cascade._target in favor of cascade.target 828ee72 @jmooring #14341
• tpl/tplimpl: Throw error when calling gist shortcode 4384f9b @jmooring #14491
• tpl/tplimpl: Throw error when calling twitter/twitter_simple shortcodes 55d136d @jmooring #14488

Bug fixes

• tpl/internal: Replace deprecated parser.ParseDir and doc.New 4a641d1 @bep #14513
• commands: Fix --panicOnWarning flag having no effect with module version warnings 3f9d0ad @bep #14524
• paths: Fix handling of _ as a path name 32027e5 @khayyamsaleem #14344
• docs: Fix lineNos default value in docs.yaml 498431d @jmooring
• hugolib: Fix term title when taxonomy name contains spaces 773664b @bep #13422

Improvements

• hugolib: Simplify sites collection bba2aed @bep
• hugolib: Adjust hugo.Sites.Default 29b8e17 @bep #14531
• Move common/hugo/HugoInfo to resources/page 3c82340 @bep
• hugolib: Add hugo.Sites and .Site.IsDefault(), modify .Site.Sites ab62320 @jmooring #14479 #14481
• output: Remove unused method 8d19f5a @bep #14522
• Update AI assistance guidelines in CONTRIBUTING.md 7729473 @bep
• tpl/collections: Speed up where and sort performance 47e39af @bep
• commands: Skip chmod for files without owner-write permission 7850e7c @jmooring #14507
• tpl/collections: Add some more benchmarks for where and sort 2e5132d @bep
• all: Change site to project where appropriate 19ab3f5 @jmooring #14504
• markup/highlight: Allow lineNos to be true, false, "inline", or "table" 3158a51 @jmooring #13481
• Upgrade to Go 1.26 b358a65 @bep
• tpl: Move from md5 to xxhash for some in memory keys 8ae5e1a @bep
• testscripts/commands: Update 'future' date to far future e277659 @toddy15 #14486

Dependency Updates

• build(deps): bump google.golang.org/api from 0.255.0 to 0.267.0 d8ec0ee @dependabot[bot]
• build(deps): bump github.com/bep/textandbinarywriter 21be4af @dependabot[bot]
• build(deps): bump github.com/bep/simplecobra from 0.6.1 to 0.7.0 e549016 @dependabot[bot]
• build(deps): bump github.com/bep/tmc from 0.5.1 to 0.6.0 a392906 @dependabot[bot]
• build(deps): bump github.com/gohugoio/hugo-goldmark-extensions/extras 86786c9 @dependabot[bot]
• build(deps): bump github.com/gohugoio/hugo-goldmark-extensions/passthrough 7a7308a @dependabot[bot]
• build(deps): bump golang.org/x/tools from 0.41.0 to 0.42.0 2d1d731 @dependabot[bot]
• build(deps): bump github.com/bep/helpers from 0.6.0 to 0.7.0 b26fbf8 @dependabot[bot]
• build(deps): bump golang.org/x/image from 0.35.0 to 0.36.0 7358309 @dependabot[bot]

Build Setup

• snap: Stop building for ppc64el and s390x e6f01bb @jmooring #14519
• Reapply "release: Support alpha, beta, and RC releases" de0c9f3 @jmooring #14466

Documentation

• docs: Regenerate docs.yaml 8b7b6af @bep
• docker: Add full tar and openssh-client to support GitHub Actions 7137714 @jmooring #14502

What's Changed

• hugolib: Don't render default site redirect for non-primary isHTML output formats 6ac7d08 @bep #14482
• server: Fix stuck server global error logging 24eb84f @bep #14469
• build(deps): bump github.com/evanw/esbuild from 0.27.2 to 0.27.3 95a3678 @dependabot[bot]
• server: Fix panic when the server browser error handler tried to use a config in a state of flux 9045797 @bep #14470

Note that the bug fix below is for the two new dimensions introduced in v0.153.0 (version and role), multiple languages worked fine. Also, changes to the first version and role also worked, which had me head-scratching for a while. Oh, well, enjoy.

• Fix template change detection for multi-version sites 0f1c7d1 @bep #14461
• resources/image: Add some image decode/encode debug logging 6bd2bde @bep #14337 #14460

What's Changed

• Fix image DecodeConfig regression of WebP images from file cache b5d43cd @bep #14453
• resources/images: Fix WebP useSharpYuv being ignored b1e1eed @jmooring #14449
• tpl/tplimpl: Remove failing Twitter tests f522a72 @jmooring