github.com/gohugoio/hugo
v0.165.0
#8 most downloaded on Go modules
gohugoio/hugo
What this package is like to depend on
Last release 3 days ago
20 Aug 2026
Ships on a steady schedule
a new release about every 9 days
Rarely documented
notes for 10 of 334 stable releases
Nothing withdrawn
no release was ever pulled
12 years old
6897 releases · first in 2015
529 releases in the last 12 months
see the full history below
Release timeline
6897 releases · Aug 2023 to Aug 2026Releases
latest 60 of 6897-
v0.165.1-0.20260820195640-7b5199fdeff720 Aug 2026 pre-releaseNothing published for this version
-
v0.165.1-0.20260819180006-87260e4a602c19 Aug 2026 pre-releaseNothing published for this version
-
v0.165.1-0.20260819142111-8405b802cf6419 Aug 2026 pre-releaseNothing published for this version
-
v0.165.1-0.20260819111355-a05736cb9f6b19 Aug 2026 pre-releaseNothing published for this version
-
v0.165.1-0.20260815184257-49dceb19f54615 Aug 2026 pre-releaseNothing published for this version
-
v0.165.1-0.20260812144736-0805c734a41b12 Aug 2026 pre-releaseNothing published for this version
-
v0.165.012 Aug 2026Release notes
Open source →The two main new things is the new
css.ChromaStylestemplate func and the newimportContextoption demonstrated below.The
importContextis relevant forcss.Build,js.Build,css.Sass, andcss.PostCSS. and it allows you to make resources (e.g. built fromresources.FromString) resolvable in e.g. CSS@importstatements.Note
Bug fixes
- Fix resource transformation chaining after content access f772998 @bep #15189
- Fix server static file detection for deleted files/directories in the static syncer 2ffaf1f @bep
- Fix server errors when deleting static files or directories a808f6e @bep #15174
- Fix panic on server atomic save edits on MacOS 6bf1524 @bep #15130
- markup/asciidocext: Fix TOC parsing for asciidoctor-html5s f961093 @jmooring #15121
- snap: Fix snap home environment 984358f @jmooring #15114
Improvements
- resources: Resume chained resource transformations 995a215 @bep #15189 #15189
- resources/jsconfig: Drop source root mapping for the current source root f88f0a9 @bep #15169
- circleci: Upgrade to Go 1.26.5 52c9bd7 @bep
- Add Data.Artifacts to css.Build and js.Build 44da086 @bep #15173
- css: Add classDark and classLight options to css.ChromaStyles and gen chromastyles 33d1f2c @bep #15167
- markup/highlight: Re-emit token colors dropped by Chroma's minifier 64da6d7 @bep #15161
- Add importContext option to css.Build, js.Build, css.Sass and css.TailwindCSS 70db201 @bep #15103
- Remove some old deprecations 8a468df @bep
- Add css.ChromaStyles 615e45d @bep #15112
- check.sh: Handle staticcheck not installed/in PATH a243a61 @Soundcreates
- warpc: Improve AVIF error message on memory allocation failure 7d90277 @bep
- cache/filecache: Don't prune used cache entries with mixed-case dir names 861ede6 @bep #15101
- Drop symlinks in parent directories f228c87 @bep
- Delete .gemini 7df45f6 @bep
- common/hugo: Include non-go dependencies in go env output 89b8c32 @jmooring #15116
Dependency Updates
- build(deps): bump github.com/bep/imagemeta from 0.17.3 to 1.0.0 0bb337b @dependabot[bot]
- build(deps): bump github.com/evanw/esbuild from 0.28.1 to 0.28.2 03dc917 @dependabot[bot]
- build(deps): bump github.com/tdewolff/minify/v2 from 2.24.14 to 2.24.16 c829b73 @dependabot[bot]
- build(deps): bump github.com/getkin/kin-openapi from 0.145.0 to 0.146.0 94f3908 @dependabot[bot]
- build(deps): bump github.com/rogpeppe/go-internal from 1.15.0 to 1.16.0 75fcc75 @dependabot[bot]
- build(deps): bump github.com/mattn/go-isatty from 0.0.22 to 0.0.24 b5fa03d @dependabot[bot]
- build(deps): bump github.com/yuin/goldmark from 1.8.4 to 1.8.5 9da472d @dependabot[bot]
- build(deps): bump golang.org/x/tools from 0.47.0 to 0.48.0 635532a @dependabot[bot]
- build(deps): bump github.com/kyokomi/emoji/v2 from 2.2.13 to 2.2.14 9c71f60 @dependabot[bot]
- build(deps): bump github.com/getkin/kin-openapi from 0.144.0 to 0.145.0 420527f @dependabot[bot]
- build(deps): bump golang.org/x/image from 0.43.0 to 0.44.0 7fe786e @dependabot[bot]
- build(deps): bump github.com/bep/imagemeta from 0.17.2 to 0.17.3 03b244f @dependabot[bot]
- build(deps): bump github.com/tdewolff/minify/v2 from 2.24.13 to 2.24.14 9611813 @dependabot[bot]
- build(deps): bump github.com/yuin/goldmark from 1.8.2 to 1.8.4 e35b7f0 @dependabot[bot]
- build(deps): bump golang.org/x/net from 0.56.0 to 0.57.0 0796fa7 @dependabot[bot]
- build(deps): bump golang.org/x/text from 0.38.0 to 0.40.0 1b701b7 @dependabot[bot]
- build(deps): bump github.com/getkin/kin-openapi from 0.140.0 to 0.144.0 a32d70b @dependabot[bot]
- build(deps): bump google.golang.org/grpc from 1.80.0 to 1.82.1 948cfb9 @dependabot[bot]
- build(deps): bump golang.org/x/mod from 0.37.0 to 0.38.0 8930802 @dependabot[bot]
Documentation
-
v0.164.1-0.20260812114911-0bb337b22ab712 Aug 2026 pre-releaseNothing published for this version
-
v0.164.1-0.20260812093840-c829b736cc5712 Aug 2026 pre-releaseNothing published for this version
-
v0.164.1-0.20260811171224-995a2159e5a111 Aug 2026 pre-releaseNothing published for this version
-
v0.164.1-0.20260810210830-dd3f2731e06110 Aug 2026 pre-releaseNothing published for this version
-
v0.164.1-0.20260809193857-52c9bd7908b409 Aug 2026 pre-releaseNothing published for this version
-
v0.164.1-0.20260808175142-44da086082a108 Aug 2026 pre-releaseNothing published for this version
-
v0.164.1-0.20260807093151-94f3908ec6a107 Aug 2026 pre-releaseNothing published for this version
-
v0.164.1-0.20260805140448-33d1f2c853ec05 Aug 2026 pre-releaseNothing published for this version
-
v0.164.1-0.20260803192006-70db201ed4f703 Aug 2026 pre-releaseNothing published for this version
-
v0.164.1-0.20260729184847-8a468df065a729 Jul 2026 pre-releaseNothing published for this version
-
v0.164.1-0.20260729095208-635532a20f9829 Jul 2026 pre-releaseNothing published for this version
-
v0.164.1-0.20260728103102-a243a6154cc228 Jul 2026 pre-releaseNothing published for this version
-
v0.164.1-0.20260727154456-7fe786e3b07327 Jul 2026 pre-releaseNothing published for this version
-
v0.164.1-0.20260726150318-0796fa7aced426 Jul 2026 pre-releaseNothing published for this version
-
v0.164.1-0.20260726094027-861ede6d103126 Jul 2026 pre-releaseNothing published for this version
-
v0.164.1-0.20260725161706-f228c87d417a25 Jul 2026 pre-releaseNothing published for this version
-
v0.164.1-0.20260722173219-f961093ea9f122 Jul 2026 pre-releaseNothing published for this version
-
v0.164.1-0.20260713085838-89b8c322008f13 Jul 2026 pre-releaseNothing published for this version
-
v0.164.1-0.20260706174751-a198116669fd06 Jul 2026 pre-releaseNothing published for this version
-
v0.164.006 Jul 2026Release notes
Open source →Notable new features in this release are:
- The Chroma highlighter styles now introduces dark/light pairs. See also the new flags on the hugo gen chromastyles command.
- New template funcs encoding.HexEncode, encoding.HexDecode, and crypto.Hash.
- New markup.rst.syntaxHighlight option.
- We added Pandoc citation support.
- We now spport sub paths in layouts passed to Page.Render.
- This release also fixes a performance regression introduced in Hugo v0.128.0. This should mostly be prominent in bigger sites. See this discussion for some background.
Notes
Changes
- all: Rewrite deprecated constructs in tests 5a5f4a5 @bep
- tpl/tplimpl: Support sub paths in layouts passed to .Render d83ce27 @bep #15056
- Add markup.rst.syntaxHighlight option c6acc24 @bep #5349
- tpl/resources: Deprecate resources.PostProcess in favour of templates.Defer 29ed932 @bep #15086
- tpl/collections: Include key in IsSet unsupported-type warning 671897a @bejaratommy #11794
- create: Keep new content placeholders buildable 499794d @sjh9714 #15078
- hugio: Speedup hasBytesWriter 65c8217 @bep
- tpl/crypto: Add crypto.Hash dfb35dc @bep #15072
- Add encoding.HexDecode/Encode a5ec542 @bep #15068 #15060
- tpl/tplimpl: Make template name lookup case-insensitive e46d37a @jmooring #15057
- hugolib: Return error from .Render when template not found fe06735 @jmooring #15052
- markup/pandoc: Add citation support 128fb17 @jmooring #15062
Dependency Updates
- build(deps): bump github.com/JohannesKaufmann/html-to-markdown/v2 921db7b @dependabot[bot]
- build(deps): bump golang.org/x/tools from 0.45.0 to 0.47.0 786ce71 @dependabot[bot]
- build(deps): bump golang.org/x/image from 0.42.0 to 0.43.0 5ad2846 @dependabot[bot]
- build(deps): bump golang.org/x/net from 0.55.0 to 0.56.0 36ad9f5 @dependabot[bot]
- build(deps): bump github.com/pelletier/go-toml/v2 from 2.4.2 to 2.4.3 7c0a0bc @dependabot[bot]
- build(deps): bump github.com/getkin/kin-openapi from 0.139.0 to 0.140.0 a879ebf @dependabot[bot]
- build(deps): bump golang.org/x/mod from 0.36.0 to 0.37.0 332d5ec @dependabot[bot]
- build(deps): bump github.com/pelletier/go-toml/v2 from 2.3.1 to 2.4.2 212cc11 @dependabot[bot]
- deps: Upgrade github.com/evanw/esbuild v0.28.0 => v0.28.1 884439b @bep #15033
- deps: Add Chroma dark/light mode support 790a8aa @bep #15017
-
v0.163.4-0.20260706163930-ce2470e7012b06 Jul 2026 pre-releaseNothing published for this version
-
v0.163.4-0.20260704161003-7b4ddd1863ce04 Jul 2026 pre-releaseNothing published for this version
-
v0.163.4-0.20260628193951-a5ec5423931228 Jun 2026 pre-releaseNothing published for this version
-
v0.163.4-0.20260627162120-790a8aa4741227 Jun 2026 pre-releaseNothing published for this version
-
v0.163.4-0.20260625100952-fe067352140425 Jun 2026 pre-releaseNothing published for this version
-
v0.163.4-0.20260618163926-d15baf53a91318 Jun 2026 pre-releaseNothing published for this version
-
v0.163.318 Jun 2026Release notes
Open source →What's Changed
- markup/highlight: Escape lang in default code block rendering ce1a7e0 @bep thanks to @k0ngj1 for reporting this issue.
- parser/pageparser: Preserve non-ASCII whitespace after e.g. summary divider 70a9068 @bep
- resources: Support babel/postcss config variants 9d66d51 @jmooring #15039 #15040 #15043
- hugolib: Fix page/section name collision regression f013346 @jmooring #15046
-
v0.163.3-0.20260615151737-96e06e1ab84815 Jun 2026 pre-releaseNothing published for this version
-
v0.163.215 Jun 2026 -
v0.163.2-0.20260615145500-19a5cec0b96115 Jun 2026 pre-releaseNothing published for this version
-
v0.163.2-0.20260613181947-147f605f7d1613 Jun 2026 pre-releaseNothing published for this version
-
v0.163.2-0.20260611155544-1f35beb9181011 Jun 2026 pre-releaseNothing published for this version
-
v0.163.111 Jun 2026Release notes
Open source →The majority of the fixes in this release are security related (including the upstream fix in 93c8c7d (golang.org/x/image)). Thanks to @vnth4nhnt for finding the issues fixed in a00b5c7 and cf9c8f9 (I will do the CVE work on this later). There has been a uptick in security reports lately, which doesn't mean that Hugo has gotten less secure, this is mostly the work of the new and powerful AI tools using Hugo's restrictive security model as their baseline. Just take a look at Go's recent security issue list to see a demonstration of this.
What's Changed
- build(deps): bump golang.org/x/image from 0.41.0 to 0.42.0 93c8c7d @dependabot[bot]
- Fix multi --renderSegments merge behavior 95e5e9f @bep #15024
- security: Normalize integer IPv4 host encodings in http.urls check a00b5c7 @bep
- Drop symlinks in os.ReadDir, os.ReadFile, os.Stat and os.FileExists cf9c8f9 @bep #15019
- commands: Fix convert command 2602796 @jmooring #15012
-
v0.163.1-0.20260610165336-a00b5c72ac5710 Jun 2026 pre-releaseNothing published for this version
-
v0.163.1-0.20260609123407-11f09f59fc8e09 Jun 2026 pre-releaseNothing published for this version
-
v0.163.1-0.20260608143612-72495f9fba6908 Jun 2026 pre-releaseNothing published for this version
-
v0.163.008 Jun 2026Release notes
Open source →The main topic in this release is improvements to the AVIF image handling that we introduced in
v0.162.0. See the docs for details, but:- We have turned down the default
qualityfor AVIF to 60. Turns out, JPEG/WebP with quality 75 is comparable to AVIF with quality 60. You can now also set quality per image format in your project config (and also per image processed if needed). - We have added a
hintto the AVIF with the same values as forWEBP. Forlossycompression, the photo/picture hints (and the default) encodes with YUV420 chroma subsampling instead of YUV444, keeping 444 for text/icon/drawing. This greatly reduces the memory needed to encode these images.
Improvements
- resources/jsconfig: Remove deprecated baseUrl setting ff2903a @bep #14991 #14996
- all: Adjust tests for deprecated link and image render hook settings ca68936 @jmooring
- all: Run go fix ./... 781fabf @bep
- pagesfromdata: Use relative path for content adapter template metrics 1d018ef @anupamojha-eng #14999
- ci: Re-add macos-latest to the test matrix 121bc6c @bep
- images: Deprecate Imaging.Compression and move it down to webp and avif configs cf18b82 @bep #14998
- Only support the latest Go version 98ad9b3 @bep #14997
- page: Add IsBranch and deprecate IsNode b89e7fe @bep #11574
- images: Force cache invalidation for AVIF target e8fefc8 @bep #14990
- images: Add a per-format AVIF hint setting a043d3e @bep #14992
- images: Make AVIF chroma subsampling content-aware via the hint 341f575 @bep #14987
- Cap AVIF lossy quality at 99 248241b @bep #14981
- config: Deprecate the glogal imaging quality setting 4e47d95 @bep #14979
- images: Make 60 the default quality for AVIF 03b4b54 @bep #14979
- livereload: Disconnect from websocket server on pageswap 79be053 @bep #14983
- tpl/tplimpl/embedded: Prevent leading newline in sitemap template 0f44046 @bep #14977
- images: Recover from memory alloc errors in WASM image processors 4e17421 @bep #14985
- images: Add quality setting per image format b01ecd4 @bep #14957
- misc: Remove duplicate words in comments 45c00b7 @jmooring #14936 #14950 #14965
- Add some PNG to AVIF golden test cases 28d882a @bep
Dependency Updates
- build(deps): bump github.com/bits-and-blooms/bitset 0d29fc8 @dependabot[bot]
- build(deps): bump github.com/tetratelabs/wazero bb57404 @dependabot[bot]
- build(deps): bump github.com/rogpeppe/go-internal from 1.14.1 to 1.15.0 7d1b1fb @dependabot[bot]
- build(deps): bump github.com/getkin/kin-openapi from 0.138.0 to 0.139.0 77a1147 @dependabot[bot]
- We have turned down the default
-
v0.162.2-0.20260607192040-781fabf4e40607 Jun 2026 pre-releaseNothing published for this version
-
v0.162.2-0.20260604165456-341f575d2db604 Jun 2026 pre-releaseNothing published for this version
-
v0.162.2-0.20260601184355-b01ecd4cd43701 Jun 2026 pre-releaseNothing published for this version
-
v0.162.2-0.20260529155414-45c00b7c162b29 May 2026 pre-releaseNothing published for this version
-
v0.162.2-0.20260529092827-28d882ab704e29 May 2026 pre-releaseNothing published for this version
-
v0.162.2-0.20260528180330-b0fd7ee2e17528 May 2026 pre-releaseNothing published for this version
-
v0.162.128 May 2026 -
v0.162.026 May 2026Release notes
Open source →The notable new feature in this release is support for AVIF images (both encoder and decoder). There's a demo site set up that demonstrates the difference between HDR AVIF and SDR JPEG images. Note that that demo is only really interesting if viewed on an HDR capable screen (e.g. Apple Retina).
Security fixes
There are some notable security fixes in this release.
Security fixes in Go
This release upgrades from Go 1.26.1 to 126.3, which brings a set of security fixes. Some relevant for Hugo are:
- XSS in html/template (CVE-2026-39826 & CVE-2026-39823): Two separate vulnerabilities where escaper bypasses in html/template could lead to Cross-Site Scripting (XSS).
- html/template: Fixes an issue where JS template literal contexts were incorrectly tracked across template branches, which could lead to improper content escaping.
Security fixes and hardening in Hugo
The following changes either fix a concrete issue or reduce the default attack surface of
hugobuilds.- Disallow
text/htmlcontent files by default (e41a064). A newsecurity.allowContentpolicy gates which content media types may be used for pages under/content.text/htmlis denied by default; sites that rely on hand-authored or adapter-emitted HTML content can opt back in withsecurity.allowContent = ['.*']. - Re-check
security.http.urlson every redirect hop inresources.GetRemote(86fbb0f). - Reject symlinked entries in
resources.Get(f8b5fa0).
We will update this section later with links to CVEs where applicable.
All changes
- hugolib: Fix Page.GitInfo for modules with go.mod in a repo subdirectory df54219 @bep #14942
- Fix typo in CONTRIBUTING.md 4bc7cae @bep
- resources: Fix the :counter placeholder 5d51b82 @jmooring #14921
- commands: Fix import from Jekyll 81d7762 @jmooring #14795 #14906
- Fix prevention of direct symlink reads in resources.Get f8b5fa0 @bep
- commands: Fix github-dark chromastyles 88d838a @xndvaz #14831
- Disallow HTML content by default e41a064 @bep
- Add image processing support for AVIF 90d9f81 @bep #7837
- config: Preserve intentionally empty maps 80e6084 @jmooring #14944
- hugolib: Merge existing hugo_stats.json when renderSegments is set aeb9a5c @bep #14939
- all: Replace RWMutex struct caches with ConcurrentMap c4bbc28 @bep
- tpl/tplimpl: Consolidate and improve embedded template integration tests d8c7021 @jmooring #14932
- parser: Drop empty sub maps from hugo config output ee4f1ac @bep #14855
- markup/highlight: Allow overriding type and code via options b613365 @bep #11872
- Update AI assistance disclosure requirements d2c821b @bep
- hugolib: Use AllTranslated in IsTranslated 4ed7600 @bep
- tpl: Simplify sitemap template cbe4339 @bep #14912
- tpl: Use AllTranslations in sitemap template 6475d30 @bep #14912 #14917
- tpl/collections: Make dict return nil when no values are provided 67aede4 @bep
- Sync Go template package to 1.26.3 87f194b @bep #14897
- Upgrade to Go 1.26.3 d81e3c2 @bep #14897
- ci: Check embedded template formatting with gotmplfmt 7c65a4d @bep
- tpl: Run gotmplfmt -w . d31a927 @bep
- markup/goldmark/codeblocks: Always split Chroma options into .Options c36608c @jmooring #14909
- hugolib: Allow empty params front matter 2f361a8 @xndvaz #14886
- common/hmaps: Merge slice-valued module config into site config 5559263 @jmooring #13869
- tpl: Use GetMatch for both local and global image resources 656fc04 @bep #14062
- Revert "markup/tableofcontents: Skip empty TOC levels" a20cb5b @bep #14898
- tpl/templates: Reject Defer inside partialCached 4d775cb @bep #13492
- common/hexec: Make NODE_PATH a fallback for ESM bare imports ae7bf74 @bep #13987
- config: Allow repeating the root key in /config files ba5d812 @bep #12899 #14882
- Revise test naming guidelines in AGENTS.md be4a0df @bep
- Update AGENTS.md e4cf565 @bep
- js: Return error for missing batch imports 9e64953 @xndvaz #13737
- resources/images: Keep smart crop target size f0cfc28 @xndvaz #13688
- testing: Use synctest where relevant 16e854a @bep
- security: Validate redirects against security.http.urls 86fbb0f @bep #14871
- markup/tableofcontents: Skip empty TOC levels 7d4af7a @xndvaz #7128
- Fall back to hugo.buildDate in hugo.BuildDate() in non-vcs builds 28147cb @bep #14862
- css: Make css.Build's file-loader URLs absolute to web context root e51e761 @bep #14849
- hugolib: Don't warn about lang/kind/path coming from cascade.params 7011239 @bep #14848
- markup/goldmark: Unwrap inner HTML for plain code blocks 694906f @cyphercodes #14820
- tpl/tplimpl: Extend page image lookup to include global resources d27b9c0 @ogulcanaydogan #14062
- security: Allow hostnames starting with digits in default http.urls 62cef36 @bep #14837
- commands: Improve description of command flags ff22c62 @jmooring #14817
- build(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 4f444c8 @dependabot[bot]
- build(deps): bump golang.org/x/image from 0.40.0 to 0.41.0 fe6c726 @dependabot[bot]
- build(deps): bump github.com/getkin/kin-openapi from 0.137.0 to 0.138.0 6a2a038 @dependabot[bot]
- build(deps): bump github.com/JohannesKaufmann/html-to-markdown/v2 cf1de59 @dependabot[bot]
- build(deps): bump golang.org/x/image from 0.39.0 to 0.40.0 97f990c @dependabot[bot]
- build(deps): bump golang.org/x/tools from 0.44.0 to 0.45.0 b99634e @dependabot[bot]
- build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 fdd977e @dependabot[bot]
- build(deps): bump github.com/pelletier/go-toml/v2 from 2.3.0 to 2.3.1 123018d @dependabot[bot]
- deps: Upgrade to Chroma v2.24.1 b88fa8c @bep #14839
-
v0.161.2-0.20260525222822-df5421918a9825 May 2026 pre-releaseNothing published for this version
-
v0.161.2-0.20260525150052-aeb9a5cc02fa25 May 2026 pre-releaseNothing published for this version
-
v0.161.2-0.20260524132947-c4bbc2805c7024 May 2026 pre-releaseNothing published for this version
-
v0.161.2-0.20260523104700-4bc7caea140823 May 2026 pre-releaseNothing published for this version
-
v0.161.2-0.20260522121150-4ed7600fd6d622 May 2026 pre-releaseNothing published for this version
-
v0.161.2-0.20260521193643-cbe4339a5ffc21 May 2026 pre-releaseNothing published for this version
-
v0.161.2-0.20260519145025-7c65a4dbc0ff19 May 2026 pre-releaseNothing published for this version
-
v0.161.2-0.20260519042435-1e4037cadef719 May 2026 pre-releaseNothing published for this version