# Hugo changelog

> Static site generator in Go, with a large template and content pipeline.

- Vendor: Hugo
- Category: Developer Tools
- License: Apache-2.0
- Language: Go
- Official site: https://gohugo.io
- Tracked by: What's New (https://whatsnew.fyi/product/hugo)
- Harvested from: GitHub (gohugoio/hugo)
- Entries below: 13 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## Releases

### v0.167.0

- Date: 2026-09-28
- Version: v0.167.0
- Original notes: https://github.com/gohugoio/hugo/releases/tag/v0.167.0
- Permalink: https://whatsnew.fyi/product/hugo/releases/v0.167.0

- **added** — Support relative partial references using `./` or `../` prefixes that resolve relative to the calling partial's directory
- **added** — Add slug support for section, taxonomy and term pages with cascading to descendants
- **added** — Add `build.cleanDestinationDir` config with `keepFiles` and `keepDirs` Glob patterns
- **added** — Allow building Hugo without a config file
- **changed** — Numeric comparisons in `eq`, `where`, `in` and set functions now compare values exactly rather than via `float64`
- **changed** — Default `baseURL` is now `https://example.org/` instead of empty
- **changed** — Automatic summaries are expanded past `summaryLength` to avoid ending inside open container elements
- **changed** — User table render hooks are now preferred over the embedded one
- **changed** — Root `cleanDestinationDir` config key deprecated in favour of `build.cleanDestinationDir.enable`
- **fixed** — Fix Sass imports to be resolved by Hugo and checked against `security.allowRead` roots instead of following symlinks outside the project
- **fixed** — Fix ESBuild imports to be checked against allowed read paths before loading
- **fixed** — Fix symlinked directories in themes that could expose files outside the module
- **fixed** — Fix explicit heading IDs being written unescaped into table of contents href, preventing attribute breakout
- **fixed** — Fix smartcrop with rotation
- **fixed** — Fix stale page content when several files in the same directory change in one batch
- **fixed** — Fix union of slices with different numeric element types
- **fixed** — Fix build with Go 1.26 on Fedora 44 Beta

This release brings relative partial references, slug support for branch pages, and a handful of security hardening fixes.

**Relative partial references.** A partial name starting with `./` or `../` is now resolved relative to the directory of the calling partial. This makes it much easier to write self-contained, movable partial trees, e.g. `{{ partial "./item.html" . }}` from within `layouts/_partials/card/list.html`. Relative paths are only allowed from within partials, and paths resolving outside the partials directory is an error. See #15373 and the [documentation](https://gohugo.io/functions/partials/include/#relative-paths).

**Slugs for section, taxonomy and term pages.** The `slug` front matter now works for branch pages, not just regular pages, and it cascades to descendants. This is particularly useful in multilingual sites, where e.g. `content/help/_index.es.md` with `slug: ayuda` gives `/es/ayuda/`, `/es/ayuda/avanzado/` etc. See #14352.

**Other notable improvements** include the new `build.cleanDestinationDir` config with `keepFiles`/`keepDirs` Glob patterns (#14937, [docs](https://gohugo.io/configuration/build/#clean-destination-directory)), `hugo` now builds without a config file (#15393), exact numeric comparisons in `eq`, `where`, `in` and the set functions (#15322, #15358), and automatic summaries that no longer end inside an open list or blockquote (#14044).

##### Security

This release contains several hardening fixes. None of them are known to be exploited, but if you build sites with untrusted themes or modules, you should upgrade.

* Sass imports not found in Hugo's file systems were resolved by the Sass compiler itself, which follows symlinks and knows nothing about the project root. A theme could import a file outside the project and get its content into the published CSS. These imports are now resolved by Hugo and checked against the same `security.allowRead` roots as the Node.js tools and `js.Build`. 41040cc7 (thanks to @Hama1cco)
* Likewise, imports not found in `/assets` were resolved and read by ESBuild itself. The resolved path is now checked against the allowed read paths before ESBuild loads it. 2aa51f34 (thanks to @Hama1cco)
* A symlinked directory in a theme at the parent of a nested mount could expose files outside the module. 2fe9bab7
* Explicit heading IDs (e.g. `## Foo {id="..."}`) were written unescaped into the table of contents `href`, allowing attribute breakout. 671fbf2c

##### Note

* The default `baseURL` is now `https://example.org/` (it was empty). Hugo has always required a valid URL to work properly, so this mostly affects new and test sites, but if you relied on the empty default for relative URLs, set `baseURL` explicitly. bc686541 @bep #14625 #15384
* The root `cleanDestinationDir` config key is deprecated in favour of `build.cleanDestinationDir.enable`. The `--cleanDestinationDir` flag maps to the new key. Note that `.git` files in the publish dir are now kept by default. 90861931 @bep #14937
* `eq` now compares numeric values the same way as `lt`, `le` etc., so e.g. `eq 1 1.0` is now `true`. Also, `in`, `intersect`, `union`, `uniq`, `symdiff`, `complement` and `where`'s `in`/`not in` now compare numbers exactly rather than via `float64`, and no longer require the Go types to match. 4d628bbd 366377b6 @bep #15322 #15358
* A user table render hook is now preferred over the embedded one. 140d9362 @jmooring #15389
* Automatic summaries are expanded past `summaryLength` when needed so they don't end inside an open container element. This may change the summary for some pages. d692a243 @bep #14044

##### Bug fixes

* hugolib: Fix failing integration test fdbba5a6 @jmooring 
* Fix build with Go 1.26 on Fedora 44 Beta 2782bfd3 @flyn-org 
* Fix smartcrop with rotation (#15371) 5edd05bb @bep #11266 #15369 
* ci: Fix broken magefile 1d87ee5b @bep 
* tpl/collections: Fix union of slices with different numeric element types ffbcdba9 @hktitof #15323 
*

_[Truncated at 4000 characters — full notes: https://github.com/gohugoio/hugo/releases/tag/v0.167.0]_

### v0.166.0

- Date: 2026-09-09
- Version: v0.166.0
- Original notes: https://github.com/gohugoio/hugo/releases/tag/v0.166.0
- Permalink: https://whatsnew.fyi/product/hugo/releases/v0.166.0

- **added** — `.Render` template function now takes an optional context argument to pass data to content views
- **added** — New `resources.Publish` template function
- **added** — New `IndexOf` method on `Pages`
- **added** — Add `tokenize` option to `related` config for index values
- **changed** — `return` keyword in templates now works in any template and can be used anywhere, including inside `if` or `range` blocks
- **changed** — Index creation in `related` config is faster
- **changed** — Glob library upgraded to v1.0.0 with complete rewrite of matching engine; malformed patterns now fail with syntax error instead of being silently accepted
- **changed** — Page without explicit slug whose title contains `/` now gets a single URL segment instead of nested segments
- **changed** — Upgrade KaTeX to 0.18.4
- **security** — `text/org` content is now denied by default due to XSS vulnerabilities in export blocks and HTML snippets
- **security** — Remote fetches now validate resolved address at dial time and reject loopback, private, link-local, CGNAT and similar ranges
- **security** — Proxies from `HTTP_PROXY`/`HTTPS_PROXY` are now ignored unless `security.http.proxyFromEnvironment = true`
- **security** — Node.js tools now fail before invocation if a symlink inside the project resolves outside the allowed read/write roots
- **security** — Mount roots that are themselves symlinks are now dropped
- **fixed** — Fix replaceRE with zero-width assertions
- **fixed** — Fix float to int overflow guards
- **fixed** — Fix filters on transparent colors and paletted images
- **fixed** — Fix ReadingTime and FuzzyWordCount calculations
- **fixed** — Fix slice bounds panic when deleting multiple nodes at same path

This release is mostly about hardening and bug fixes, but there are some notable changes:

* [`.Render`](https://gohugo.io/methods/page/render/) now takes an optional context argument: `{{ .Render "view" $ctx }}`, mirroring the `partial` API. This makes it possible to pass e.g. a dict to a content view. See #15077.
* The [`return`](https://gohugo.io/functions/go-template/return/) keyword in templates has been reimplemented. It now works in any template (not just partials) and can be used anywhere, e.g. inside `if` or `range` blocks. See #15212.
* New [`resources.Publish`](https://gohugo.io/functions/resources/publish/) template function and [`IndexOf`](https://gohugo.io/methods/pages/indexof/) method on `Pages`.
* [`related`](https://gohugo.io/configuration/related-content/) config: new `tokenize` option for index values, and index creation is faster.
* Several [security](https://gohugo.io/configuration/security/) fixes; see the notes below.

##### Note

* tpl/transform: Bump fileCacheEntryVersion in transform.ToMath (note) 8d88b8b4 @bep #15267 
* resources/images: Bump formatVersionNumbers.PNG and fix version cache busting for images.Filter (note) d19e0a4b @bep #12536 #12543 #15266 
* warpc/js: Upgrade katex to 0.18.4 (note) ec52e638 @bep #15254 
* hexec: Fail on symlinks that escape the Node.js permission paths c05c012a @bep 
* config/security: Deny text/org content by default e6abb9c3 @bep 
* config/security: Add http.proxyFromEnvironment and document the resolved address check 6a2a955d @bep #15301 #15302 
* deps: Upgrade github.com/gobwas/glob v0.2.3 => v1.0.0 efd24562 @bep #15273 
* hugofs: Drop symlinked mount roots 938c8206 @bep 
* tpl: Improve the return keyword in templates 8405b802 @bep #15212 
* resources/page: Don't let a title's "/" split an auto-derived slug 39507d51 @ipince #4092 #3577 #5571 #4090 

###### Glob patterns

The glob library used for e.g. module mounts (`includeFiles`, `excludeFiles`), `cascade` targets, `segments`, `deployment` matchers and `noVendor` has been upgraded to v1.0.0. This is a complete rewrite of the matching engine that fixes a long list of correctness bugs, but it also means that some patterns may behave differently:

* Malformed patterns (e.g. an unclosed `{`, an empty `[]` class) now fail with a syntax error instead of being silently accepted.
* `**` matches any sequence of characters including separators, but it is not the `**/` "globstar" of shells: `**/x` requires the literal `/` and does not match `x`, and `a/**/b` does not match `a/b`. Use `{**/,}x` if you need both.
* `\` is the escape character, so a literal backslash must be written as `\\`.

If a pattern that used to match no longer does (or vice versa), it was most likely relying on a bug in the old engine.

###### Security

* `text/org` content is now denied by default, as Org mode's export blocks and `@@html:...@@` snippets pass raw HTML through unescaped, making it the same XSS sink as `text/html`. Sites with Org content can opt back in via `security.allowContent`.
* Remote fetches (`resources.GetRemote` etc.) now validate the resolved address at dial time and reject loopback, private, link-local, CGNAT and similar ranges. This only applies under the default `security.http.urls` allowlist; if you have customized it, you have opted into your own hosts and the check stands down. Proxies from `HTTP_PROXY`/`HTTPS_PROXY` hide the destination address from this check and are now ignored unless you set `security.http.proxyFromEnvironment = true`.
* Node.js tools (PostCSS, Tailwind CSS etc.) now fail before invocation if a symlink inside the project resolves outside the allowed read/write roots. If you have a legitimate link, add its target to `security.node.permissions.allowRead`.
* Mount roots that are themselves symlinks (e.g. `themes/mytheme/assets -> /somewhere/else`) are now dropped. This closes a gap in the `themes/` confinement; absolute mount `source` values are still allowed.

###

_[Truncated at 4000 characters — full notes: https://github.com/gohugoio/hugo/releases/tag/v0.166.0]_

### v0.165.0

- Date: 2026-08-12
- Version: v0.165.0
- Original notes: https://github.com/gohugoio/hugo/releases/tag/v0.165.0
- Permalink: https://whatsnew.fyi/product/hugo/releases/v0.165.0

- **added** — Add new css.ChromaStyles template function for generating Chroma syntax highlighting styles
- **added** — Add importContext option to css.Build, js.Build, css.Sass, and css.TailwindCSS to make resources resolvable in import statements
- **added** — Add Data.Artifacts to css.Build and js.Build
- **added** — Add classDark and classLight options to css.ChromaStyles
- **changed** — Resume chained resource transformations
- **changed** — Drop source root mapping for the current source root in resources/jsconfig
- **changed** — Re-emit token colors dropped by Chroma's minifier
- **changed** — Remove some old deprecations
- **fixed** — Fix resource transformation chaining after content access
- **fixed** — Fix server static file detection for deleted files and directories in the static syncer
- **fixed** — Fix server errors when deleting static files or directories
- **fixed** — Fix panic on server atomic save edits on MacOS
- **fixed** — Fix TOC parsing for asciidoctor-html5s in markup/asciidocext
- **fixed** — Fix snap home environment
- **fixed** — Don't prune used cache entries with mixed-case dir names in cache/filecache
- **removed** — Remove tailwindcss from the default security.exec.allow list
- **removed** — Drop symlinks in parent directories
- **removed** — Delete .gemini

The two main new things is the new `css.ChromaStyles` template func and the new `importContext` option demonstrated below.

```handlebars
{{ $light := css.ChromaStyles (dict "targetPath" "css/components/chroma-light.css" "style" "github" "mode" "light") }}
{{ $dark := css.ChromaStyles (dict "targetPath" "css/components/chroma-dark.css" "style" "github" "mode" "dark") }}
{{ $opts := dict "minify" true "importContext" (slice $light $dark) }}
{{ $css := resources.Get "css/main.css" | css.Build $opts }}
```

The `importContext` is relevant for `css.Build`, `js.Build`, `css.Sass`, and `css.PostCSS`. and it allows you to make resources (e.g. built from `resources.FromString`) resolvable in e.g. CSS `@import` statements.

##### Note

* Remove tailwindcss from the default security.exec.allow list (note) 8a55df7a @bep #15178 #15171 

##### Bug fixes

* Fix resource transformation chaining after content access f772998f @bep #15189 
* Fix server static file detection for deleted files/directories in the static syncer 2ffaf1fc @bep 
* Fix server errors when deleting static files or directories a808f6e4 @bep #15174 
* Fix panic on server atomic save edits on MacOS 6bf15241 @bep #15130 
* markup/asciidocext: Fix TOC parsing for asciidoctor-html5s f961093e @jmooring #15121 
* snap: Fix snap home environment 984358f0 @jmooring #15114 

##### Improvements

* resources: Resume chained resource transformations 995a2159 @bep #15189 #15189 
* resources/jsconfig: Drop source root mapping for the current source root f88f0a9f @bep #15169 
* circleci: Upgrade to Go 1.26.5 52c9bd79 @bep 
* Add Data.Artifacts to css.Build and js.Build 44da0860 @bep #15173 
* css: Add classDark and classLight options to css.ChromaStyles and gen chromastyles 33d1f2c8 @bep #15167 
* markup/highlight: Re-emit token colors dropped by Chroma's minifier 64da6d7c @bep #15161 
* Add importContext option to css.Build, js.Build, css.Sass and css.TailwindCSS 70db201e @bep #15103 
* Remove some old deprecations 8a468df0 @bep 
* Add css.ChromaStyles 615e45d6 @bep #15112 
* check.sh: Handle staticcheck not installed/in PATH a243a615 @Soundcreates 
* warpc: Improve AVIF error message on memory allocation failure 7d90277a @bep 
* cache/filecache: Don't prune used cache entries with mixed-case dir names 861ede6d @bep #15101 
* Drop symlinks in parent directories f228c87d @bep 
* Delete .gemini 7df45f61 @bep 
* common/hugo: Include non-go dependencies in go env output 89b8c322 @jmooring #15116 

##### Dependency Updates

* build(deps): bump github.com/bep/imagemeta from 0.17.3 to 1.0.0 0bb337b2 @dependabot[bot] 
* build(deps): bump github.com/evanw/esbuild from 0.28.1 to 0.28.2 03dc9170 @dependabot[bot] 
* build(deps): bump github.com/tdewolff/minify/v2 from 2.24.14 to 2.24.16 c829b736 @dependabot[bot] 
* build(deps): bump github.com/getkin/kin-openapi from 0.145.0 to 0.146.0 94f3908e @dependabot[bot] 
* build(deps): bump github.com/rogpeppe/go-internal from 1.15.0 to 1.16.0 75fcc752 @dependabot[bot] 
* build(deps): bump github.com/mattn/go-isatty from 0.0.22 to 0.0.24 b5fa03d3 @dependabot[bot] 
* build(deps): bump github.com/yuin/goldmark from 1.8.4 to 1.8.5 9da472dd @dependabot[bot] 
* build(deps): bump golang.org/x/tools from 0.47.0 to 0.48.0 635532a2 @dependabot[bot] 
* build(deps): bump github.com/kyokomi/emoji/v2 from 2.2.13 to 2.2.14 9c71f600 @dependabot[bot] 
* build(deps): bump github.com/getkin/kin-openapi from 0.144.0 to 0.145.0 420527fc @dependabot[bot] 
* build(deps): bump golang.org/x/image from 0.43.0 to 0.44.0 7fe786e3 @dependabot[bot] 
* build(deps): bump github.com/bep/imagemeta from 0.17.2 to 0.17.3 03b244fc @dependabot[bot] 
* build(deps): bump github.com/tdewolff/minify/v2 from 2.24.13 to 2.24.14 96118133 @dependabot[bot] 
* build(deps): bump github.com/yuin/goldmark from 1.8.2 to 1.8.4 e35b7f04 @dependabot[bot] 
* build(deps): bump golang.org/x/net from 0.56.0 to 0.57.0 0796fa7a @dependabot[bot] 
* build(deps

_[Truncated at 4000 characters — full notes: https://github.com/gohugoio/hugo/releases/tag/v0.165.0]_

### v0.164.0

- Date: 2026-07-06
- Version: v0.164.0
- Original notes: https://github.com/gohugoio/hugo/releases/tag/v0.164.0
- Permalink: https://whatsnew.fyi/product/hugo/releases/v0.164.0

- **added** — Chroma highlighter styles now introduce dark/light pairs
- **added** — New template functions encoding.HexEncode, encoding.HexDecode, and crypto.Hash
- **added** — New markup.rst.syntaxHighlight configuration option
- **added** — Pandoc citation support
- **added** — Support sub paths in layouts passed to Page.Render
- **deprecated** — Deprecate resources.PostProcess in favour of templates.Defer
- **fixed** — Performance regression introduced in Hugo v0.128.0
- **changed** — Include key in IsSet unsupported-type warning
- **changed** — Make template name lookup case-insensitive
- **changed** — Return error from .Render when template not found

Notable new features in this release are:

* The Chroma highlighter styles now introduces [dark/light pairs](https://gohugo.io/quick-reference/syntax-highlighting-styles/#modes). See also the new flags on the [hugo gen chromastyles](https://gohugo.io/commands/hugo_gen_chromastyles/) command.
* New template funcs [encoding.HexEncode](https://gohugo.io/functions/encoding/hexencode/), [encoding.HexDecode](https://gohugo.io/functions/encoding/hexdecode/), and [crypto.Hash](https://gohugo.io/functions/crypto/hash/).
* New [markup.rst.syntaxHighlight](https://gohugo.io/configuration/markup/#syntaxhighlight) option.
* We added Pandoc citation support.
* We now spport sub paths in layouts passed to [Page.Render](https://gohugo.io/methods/page/render/#article).
* This release also fixes a performance regression introduced in Hugo v0.128.0. This should mostly be prominent in bigger sites. See [this discussion](https://discourse.gohugo.io/t/hugo-building-slowly-from-release-0-128-0/57314/20) for some background.  

##### Notes

* tpl/resources: Deprecate resources.PostProcess in favour of templates.Defer 29ed9325 @bep #15086 

##### Changes

* all: Rewrite deprecated constructs in tests 5a5f4a54 @bep 
* tpl/tplimpl: Support sub paths in layouts passed to .Render d83ce27a @bep #15056 
* Add markup.rst.syntaxHighlight option c6acc246 @bep #5349 
* tpl/resources: Deprecate resources.PostProcess in favour of templates.Defer 29ed9325 @bep #15086 
* tpl/collections: Include key in IsSet unsupported-type warning 671897ae @bejaratommy #11794 
* create: Keep new content placeholders buildable 499794d1 @sjh9714 #15078 
* hugio: Speedup hasBytesWriter 65c82178 @bep 
* tpl/crypto: Add crypto.Hash dfb35dcd @bep #15072 
* Add encoding.HexDecode/Encode a5ec5423 @bep #15068 #15060 
* tpl/tplimpl: Make template name lookup case-insensitive e46d37a9 @jmooring #15057 
* hugolib: Return error from .Render when template not found fe067352 @jmooring #15052 
* markup/pandoc: Add citation support 128fb17c @jmooring #15062 

##### Dependency Updates

* build(deps): bump github.com/JohannesKaufmann/html-to-markdown/v2 921db7b5 @dependabot[bot] 
* build(deps): bump golang.org/x/tools from 0.45.0 to 0.47.0 786ce71e @dependabot[bot] 
* build(deps): bump golang.org/x/image from 0.42.0 to 0.43.0 5ad28461 @dependabot[bot] 
* build(deps): bump golang.org/x/net from 0.55.0 to 0.56.0 36ad9f58 @dependabot[bot] 
* build(deps): bump github.com/pelletier/go-toml/v2 from 2.4.2 to 2.4.3 7c0a0bc9 @dependabot[bot] 
* build(deps): bump github.com/getkin/kin-openapi from 0.139.0 to 0.140.0 a879ebfa @dependabot[bot] 
* build(deps): bump golang.org/x/mod from 0.36.0 to 0.37.0 332d5ec8 @dependabot[bot] 
* build(deps): bump github.com/pelletier/go-toml/v2 from 2.3.1 to 2.4.2 212cc11a @dependabot[bot] 
* deps: Upgrade github.com/evanw/esbuild v0.28.0 => v0.28.1 884439b9 @bep #15033 
* deps: Add Chroma dark/light mode support 790a8aa4 @bep #15017

### v0.163.3

- Date: 2026-06-18
- Version: v0.163.3
- Original notes: https://github.com/gohugoio/hugo/releases/tag/v0.163.3
- Permalink: https://whatsnew.fyi/product/hugo/releases/v0.163.3

- **fixed** — Escape lang in default code block rendering in markup/highlight
- **fixed** — Preserve non-ASCII whitespace after summary divider in parser/pageparser
- **added** — Support babel/postcss config variants in resources
- **fixed** — Fix page/section name collision regression in hugolib

##### What's Changed

* markup/highlight: Escape lang in default code block rendering ce1a7e0b @bep thanks to @k0ngj1 for reporting this issue.
* parser/pageparser: Preserve non-ASCII whitespace after e.g. summary divider 70a9068a @bep 
* resources: Support babel/postcss config variants 9d66d513 @jmooring #15039 #15040 #15043 
* hugolib: Fix page/section name collision regression f0133466 @jmooring #15046

### v0.163.2

- Date: 2026-06-15
- Version: v0.163.2
- Original notes: https://github.com/gohugoio/hugo/releases/tag/v0.163.2
- Permalink: https://whatsnew.fyi/product/hugo/releases/v0.163.2

- **fixed** — Continue resolving on ERR_ACCESS_DENIED in Node's resolver
- **changed** — Standardize behavior when external converters are missing in markup

##### What's Changed

* Continue resolving on ERR_ACCESS_DENIED in Node's resolver 134674f0 @bep #15041 
* markup: Standardize behavior when external converters are missing 147f605f @jmooring #14222

### v0.163.1

- Date: 2026-06-11
- Version: v0.163.1
- Original notes: https://github.com/gohugoio/hugo/releases/tag/v0.163.1
- Permalink: https://whatsnew.fyi/product/hugo/releases/v0.163.1

- **security** — Normalize integer IPv4 host encodings in http.urls check
- **security** — Drop symlinks in os.ReadDir, os.ReadFile, os.Stat and os.FileExists
- **changed** — Bump golang.org/x/image from 0.41.0 to 0.42.0
- **fixed** — Fix multi --renderSegments merge behavior
- **fixed** — Fix convert command

The majority of the fixes in this release are security related (including the upstream fix in 93c8c7d3 (golang.org/x/image)). Thanks to @vnth4nhnt for finding the issues fixed in a00b5c72 and cf9c8f93 (I will do the CVE work on this later). There has been a uptick in security reports lately, which doesn't mean that Hugo has gotten less secure, this is mostly the work of the new and powerful AI tools using Hugo's restrictive [security model](https://gohugo.io/about/security/) as their baseline. Just take a look at Go's recent [security issue list](https://github.com/golang/go/issues?q=is%3Aissue%20label%3ASecurity) to see a demonstration of this.

##### What's Changed

* build(deps): bump golang.org/x/image from 0.41.0 to 0.42.0 93c8c7d3 @dependabot[bot] 
* Fix multi --renderSegments merge behavior 95e5e9f4 @bep #15024 
* security: Normalize integer IPv4 host encodings in http.urls check a00b5c72 @bep 
* Drop symlinks in os.ReadDir, os.ReadFile, os.Stat and os.FileExists cf9c8f93 @bep #15019 
* commands: Fix convert command 2602796c @jmooring #15012

### v0.163.0

- Date: 2026-06-08
- Version: v0.163.0
- Original notes: https://github.com/gohugoio/hugo/releases/tag/v0.163.0
- Permalink: https://whatsnew.fyi/product/hugo/releases/v0.163.0

- **changed** — Set default AVIF quality to 60
- **added** — Add quality setting per image format in project config
- **added** — Add hint setting for AVIF with lossy compression using YUV420 chroma subsampling for photo/picture content and YUV444 for text/icon/drawing
- **deprecated** — Deprecate global imaging quality setting in favor of per-format configuration
- **deprecated** — Deprecate Imaging.Compression setting and move it to webp and avif specific configs
- **deprecated** — Deprecate baseUrl setting in jsconfig resources
- **deprecated** — Deprecate IsNode in favor of IsBranch
- **fixed** — Force cache invalidation for AVIF target
- **fixed** — Cap AVIF lossy quality at 99
- **fixed** — Recover from memory allocation errors in WASM image processors
- **fixed** — Disconnect from websocket server on page swap in livereload
- **fixed** — Prevent leading newline in sitemap template

The main topic in this release is improvements to the AVIF image handling that we introduced in `v0.162.0`. See [the docs]( https://gohugo.io/configuration/imaging/#avif) for details, but:

* We have turned down the default `quality` for AVIF to 60. Turns out, JPEG/WebP with quality 75 is comparable to AVIF with quality 60. You can now also set quality per image format in your project config (and also per image processed if needed).
* We have added a `hint` to the AVIF with the same values as for `WEBP`. For `lossy` compression, the photo/picture hints (and the default) encodes with YUV420 chroma subsampling instead of YUV444, keeping 444 for text/icon/drawing. This greatly reduces the memory needed to encode these images.

##### Improvements

* resources/jsconfig: Remove deprecated baseUrl setting ff2903a9 @bep #14991 #14996 
* all: Adjust tests for deprecated link and image render hook settings ca68936d @jmooring 
* all: Run go fix ./... 781fabf4 @bep 
* pagesfromdata: Use relative path for content adapter template metrics 1d018ef8 @anupamojha-eng #14999 
* ci: Re-add macos-latest to the test matrix 121bc6ce @bep 
* images: Deprecate Imaging.Compression and move it down to webp and avif configs cf18b827 @bep #14998 
* Only support the latest Go version 98ad9b3c @bep #14997 
* page: Add IsBranch and deprecate IsNode b89e7fe6 @bep #11574 
* images: Force cache invalidation for AVIF target e8fefc83 @bep #14990 
* images: Add a per-format AVIF hint setting a043d3ec @bep #14992 
* images: Make AVIF chroma subsampling content-aware via the hint 341f575d @bep #14987 
* Cap AVIF lossy quality at 99 248241b6 @bep #14981 
* config: Deprecate the glogal imaging quality setting 4e47d95d @bep #14979 
* images: Make 60 the default quality for AVIF 03b4b542 @bep #14979 
* livereload: Disconnect from websocket server on pageswap 79be0532 @bep #14983 
* tpl/tplimpl/embedded: Prevent leading newline in sitemap template 0f440460 @bep #14977 
* images: Recover from memory alloc errors in WASM image processors 4e17421e @bep #14985 
* images: Add quality setting per image format b01ecd4c @bep #14957 
* misc: Remove duplicate words in comments 45c00b7c @jmooring #14936 #14950 #14965 
* Add some PNG to AVIF golden test cases 28d882ab @bep 

##### Dependency Updates

* build(deps): bump github.com/bits-and-blooms/bitset 0d29fc81 @dependabot[bot] 
* build(deps): bump github.com/tetratelabs/wazero bb57404f @dependabot[bot] 
* build(deps): bump github.com/rogpeppe/go-internal from 1.14.1 to 1.15.0 7d1b1fb3 @dependabot[bot] 
* build(deps): bump github.com/getkin/kin-openapi from 0.138.0 to 0.139.0 77a11470 @dependabot[bot]

### v0.162.1

- Date: 2026-05-28
- Version: v0.162.1
- Original notes: https://github.com/gohugoio/hugo/releases/tag/v0.162.1
- Permalink: https://whatsnew.fyi/product/hugo/releases/v0.162.1

- **fixed** — Fix false stale warning after npm pack in modules/npm
- **fixed** — Revert dict to return non-nil value when no values are provided in tpl/collections
- **fixed** — Fix locale-specific month abbreviations in tpl/time

##### What's Changed

* modules/npm: Fix false stale warning after npm pack 59f35cd9 @jmooring #14959 
* Revert "tpl/collections: Make dict return nil when no values are provided" c2709750 @bep #14958 
* tpl/time: Fix locale-specific month abbreviations ea8b48af @jmooring #14948

### v0.162.0

- Date: 2026-05-26
- Version: v0.162.0
- Original notes: https://github.com/gohugoio/hugo/releases/tag/v0.162.0
- Permalink: https://whatsnew.fyi/product/hugo/releases/v0.162.0

- **added** — Support for AVIF images with both encoder and decoder for image processing
- **security** — Disallow text/html content files by default with new security.allowContent policy to gate which content media types may be used for pages
- **security** — Re-check security.http.urls on every redirect hop in resources.GetRemote
- **security** — Reject symlinked entries in resources.Get
- **security** — Upgrade from Go 1.26.1 to 1.26.3 which includes XSS fixes in html/template and JS template literal context tracking improvements
- **fixed** — Fix Page.GitInfo for modules with go.mod in a repo subdirectory
- **fixed** — Fix the :counter placeholder in resources
- **fixed** — Fix import from Jekyll command
- **fixed** — Fix github-dark chromastyles
- **fixed** — Fix prevention of direct symlink reads in resources.Get
- **changed** — Preserve intentionally empty maps in config
- **changed** — Merge existing hugo_stats.json when renderSegments is set
- **changed** — Replace RWMutex struct caches with ConcurrentMap
- **changed** — Drop empty sub maps from hugo config output
- **changed** — Allow overriding type and code via options in markup/highlight
- **changed** — Use AllTranslated in IsTranslated
- **changed** — Simplify sitemap template and use AllTranslations
- **changed** — Make dict return nil when no values are provided
- **fixed** — Allow empty params front matter
- **changed** — Use GetMatch for both local and global image resources in tpl

The notable new feature in this release is support for [AVIF images](https://gohugo.io/configuration/imaging/#avif-images) (both encoder and decoder). There's a [demo site](https://github.com/bep/hdrsdr.com) set up that demonstrates the difference between HDR AVIF and SDR JPEG images. Note that that demo is only really interesting if viewed on an HDR capable screen (e.g. Apple Retina).

##### Security fixes

There are some notable security fixes in this release.

###### Security fixes in Go

This release upgrades from Go 1.26.1 to 126.3, which brings a set of security fixes. Some relevant for Hugo are:

* XSS in html/template (CVE-2026-39826 & CVE-2026-39823): Two separate vulnerabilities where escaper bypasses in html/template could lead to Cross-Site Scripting (XSS).
* html/template: Fixes an issue where JS template literal contexts were incorrectly tracked across template branches, which could lead to improper content escaping.

###### Security fixes and hardening in Hugo

The following changes either fix a concrete issue or reduce the default attack surface of `hugo` builds.

- **Disallow `text/html` content files by default** ([e41a064](https://github.com/gohugoio/hugo/commit/e41a06447d)). A new `security.allowContent` policy gates which content media types may be used for pages under `/content`. `text/html` is denied by default; sites that rely on hand-authored or adapter-emitted HTML content can opt back in with `security.allowContent = ['.*']`.
- **Re-check `security.http.urls` on every redirect hop in `resources.GetRemote`** ([86fbb0f](https://github.com/gohugoio/hugo/commit/86fbb0f7a8)). 
- **Reject symlinked entries in `resources.Get`** ([f8b5fa0](https://github.com/gohugoio/hugo/commit/f8b5fa09a6)). 

**We will update this section later with links to CVEs where applicable.**

##### All changes

* hugolib: Fix Page.GitInfo for modules with go.mod in a repo subdirectory df542191 @bep #14942 
* Fix typo in CONTRIBUTING.md 4bc7caea @bep 
* resources: Fix the :counter placeholder 5d51b82a @jmooring #14921 
* commands: Fix import from Jekyll 81d77620 @jmooring #14795 #14906 
* Fix prevention of direct symlink reads in resources.Get f8b5fa09 @bep 
* commands: Fix github-dark chromastyles 88d838a9 @xndvaz #14831 
* Disallow HTML content by default e41a0644 @bep 
* Add image processing support for AVIF 90d9f812 @bep #7837 
* config: Preserve intentionally empty maps 80e60847 @jmooring #14944 
* hugolib: Merge existing hugo_stats.json when renderSegments is set aeb9a5cc @bep #14939 
* all: Replace RWMutex struct caches with ConcurrentMap c4bbc280 @bep 
* tpl/tplimpl: Consolidate and improve embedded template integration tests d8c70218 @jmooring #14932 
* parser: Drop empty sub maps from hugo config output ee4f1acd @bep #14855 
* markup/highlight: Allow overriding type and code via options b6133657 @bep #11872 
* Update AI assistance disclosure requirements d2c821b5 @bep 
* hugolib: Use AllTranslated in IsTranslated 4ed7600f @bep 
* tpl: Simplify sitemap template cbe4339a @bep #14912 
* tpl: Use AllTranslations in sitemap template 6475d308 @bep #14912 #14917 
* tpl/collections: Make dict return nil when no values are provided 67aede43 @bep 
* Sync Go template package to 1.26.3 87f194b2 @bep #14897 
* Upgrade to Go 1.26.3 d81e3c29 @bep #14897 
* ci: Check embedded template formatting with gotmplfmt 7c65a4db @bep 
* tpl: Run gotmplfmt -w . d31a9275 @bep 
* markup/goldmark/codeblocks: Always split Chroma options into .Options c36608c5 @jmooring #14909 
* hugolib: Allow empty params front matter 2f361a8e @xndvaz #14886 
* common/hmaps: Merge slice-valued module config into site config 55592633 @jmooring #13869 
* tpl: Use GetMatch for both local and global image resources 656fc040 @bep #14062 
* Revert "markup/tableofcontents: Skip empty TOC levels" a20cb5b1 @bep #14898 
* tpl/templates: Reject Defer inside partialCached 4d775cbe @bep #13492 
* common/hexec: Make NODE_PATH a f

_[Truncated at 4000 characters — full notes: https://github.com/gohugoio/hugo/releases/tag/v0.162.0]_

### v0.161.1

- Date: 2026-04-29
- Version: v0.161.1
- Original notes: https://github.com/gohugoio/hugo/releases/tag/v0.161.1
- Permalink: https://whatsnew.fyi/product/hugo/releases/v0.161.1

- **changed** — Honor Retry-After header in resources.GetRemote retries
- **changed** — Move warpc to parson.c in parson library
- **added** — Add AllowChildProcess to security.node.permissions
- **changed** — Restrict default http.urls "@" deny to userinfo

##### What's Changed

* resources: Honor Retry-After header in resources.GetRemote retries c4eba928 @bep #14828 
* warpc: Move to parson.c in https://github.com/kgabis/parson 8b40a96b @bep #14823 
* config/security: Add AllowChildProcess to security.node.permissions d65af84d @bep #14824 
* config/security: Restrict default http.urls "@" deny to userinfo 454450a6 @bep #14825

### v0.161.0

- Date: 2026-04-28
- Version: v0.161.0
- Original notes: https://github.com/gohugoio/hugo/releases/tag/v0.161.0
- Permalink: https://whatsnew.fyi/product/hugo/releases/v0.161.0

- **security** — Run Node tools PostCSS, Babel and TailwindCSS with the --permission flag using permissions defined in security.node.permissions, requiring Node >= 22 and TailwindCSS CLI as a Node.js package instead of standalone executable
- **security** — Make defaults in security.http.urls more restrictive and add negation support with '! ' prefix to Whitelist
- **added** — Support nested hugo:vars/<name> imports in css.Build and css.Sass with target matchers
- **added** — Add slice-based permalinks configuration using the same target matchers as cascade config
- **added** — Add flexible filename identifier scheme supporting language_, role_, version_, outputformat_, mediatype_, kind_, and layout_ prefixes
- **fixed** — Fix translation lookup when using language variants
- **fixed** — Fix non-deterministic conflict detection in hugo new content
- **fixed** — Fix environment isolation for configuration settings
- **fixed** — Fix filename dimension identifiers (_role_X_, _version_X_) to replace mount config
- **fixed** — Fix auto-fallback to page resources in other roles and versions
- **fixed** — Do not render aliases if the page is not rendered
- **changed** — Improve default content language fallback
- **changed** — Use Language.Locale as primary localization key
- **changed** — Honor the Eqer interface in where comparisons for collections
- **changed** — Ignore non-require blocks in go.mod rewrite
- **deprecated** — Deprecate extended and extended_withdeploy editions

This release contains two security hardening fixes:

* We now run the Node tools PostCSS, Babel and TailwindCSS, by default, with the `--permission` flag with the permissions defined in [security.node.permissions](https://gohugo.io/configuration/security/). This means that you need Node >= 22 installed and that `css.TailwindCSS` now requires that the Tailwind CSS CLI must be installed as a Node.js package. The [standalone executable](https://github.com/tailwindlabs/tailwindcss/releases/latest) is no longer supported
* We have made the defaults in [security.http.urls](https://gohugo.io/configuration/security/#httpurls) more restrictive.

But there are some notable new features, as well:

##### Nested vars support in css.Build and css.Sass

A practical example in `css.Build` would be to have something like this in `hugo.toml`:

```toml
[params.style]
    primary    = "#000000"
    background = "#ffffff"
    [params.style.dark]
        primary    = "#ffffff"
        background = "#000000"
```
And in the stylesheet:

```css
@import "hugo:vars";
@import "hugo:vars/dark" (prefers-color-scheme: dark);

:root {
  color-scheme: light dark;
}
```

##### Slice-based permalinks config

The `permalinks` configuration is now much more flexible (the old setup still works). It uses the same [target](https://gohugo.io/configuration/cascade/#target) matchers as in the `cascade` config, meaning you can now do:

```yaml
permalinks:
  - target:
      kind: page
      path: "/books/**"
    pattern: /books/:year/:slug/
  - target:
      kind: section
      path: "/{books,books/**}"
    pattern: /libros/:sections[1:]
  - target:
      kind: page
    pattern: /other/:slug/
```
The above example isn't great, but it at least shows the gist of it.

##### A more flexible scheme for identifiers in filenames

What we had before was e.g. `content/mypost.en.md` which told Hugo that the content files was in English. With the new setup you could also name the file `content/mypost._language_en_.md`. This alone doesn't sound very useful, but this allows you to use more prefixes:

| Prefix          | Description   | Relevant for              |
| --------------- | ------------- | ------------------------- |
| language_       | Language      | Content and layout files. |
| role_           | Role          | Content and layout files. |
| version_        | Version       | Content and layout files. |
| outputformat_   | Output format | Layout files.             |
| mediatype_      | Media type    | Layout files.             |
| kind_           | Page kind     | Layout files.             |
| layout_         | Layout        | Layout files.             |

##### All Changes

* langs/i18n: Fix translation lookup when using language variants 72b85d5f @jmooring #7982 
* create: Fix non-deterministic conflict detection in hugo new content 6436deb3 @jmooring #12602 #12786 #14112 #14769 
* commands: Fix environment isolation for configuration settings 1eea9fba @jmooring #14763 
* Fix filename dimension identifiers (_role_X_, _version_X_) to replace mount config 8d6145f3 @bep #14756 
* Fix it so we never auto-fallback to page resources in other roles/versions 97477242 @bep #14749 #14752 
* css: Support nested hugo:vars/<name> imports 7622dd86 @bep #14705 
* github: Update GitHub actions versions 0814059b @bep #14810 
* hugolib: Do not render aliases if the page is not rendered 8920d56e @jmooring #14807 
* langs/i18n: Improve default content language fallback 633cc772 @jmooring #14243 
* helpers: Remove unused code 4c40c6d5 @bep 
* common/constants: Remove unused consts d2594db6 @bep 
*  common/paths: Remove unused code ab2de51e @bep 
* tests: Update Ruby setup action to v1.305.0 75f61832 @jmooring 
* langs: Use Language.Locale as primary localization key 1b7495bc @jmooring #9109 
* config/security: Add "! " negation to Whitelist, harden default http.urls 79f030be @bep #14792 
* Harden Node tool execut

_[Truncated at 4000 characters — full notes: https://github.com/gohugoio/hugo/releases/tag/v0.161.0]_

### v0.160.1

- Date: 2026-04-08
- Version: v0.160.1
- Original notes: https://github.com/gohugoio/hugo/releases/tag/v0.160.1
- Permalink: https://whatsnew.fyi/product/hugo/releases/v0.160.1

- **fixed** — Fix panic when passthrough elements are used in headings
- **fixed** — Fix panic on edit of legacy mapped template names that's also a valid path in the new setup
- **fixed** — Fix RenderShortcodes leaking context markers when indented
- **fixed** — Strip nested page context markers from standalone RenderShortcodes
- **fixed** — Fix auto-creation of root sections in multilingual sites

##### What's Changed

* Fix panic when passthrough elements are used in headings 8b00030b @bep #14677 
* Fix panic on edit of legacy mapped template names that's also a valid path in the new setup c4855167 @bep #14740 
* Fix RenderShortcodes leaking context markers when indented 161d0d47 @bep #12457 
* Strip nested page context markers from standalone RenderShortcodes 45e45966 @bep #14732 
* Rename deprecated cascade._target to cascade.target in tests 58927aa1 @bep 
* Fix auto-creation of root sections in multilingual sites ce009e3a @bep #14681 
* readme: Fix links 07558724 @chicks-net