NewYour coding agent can read the release notes before it upgrades.Set up the MCP server →
Go modules · #6 by repository stars
Last release 4 days ago
01 Oct 2026
Ships on a steady schedule
a new release about every 8 days
Rarely documented
notes for 12 of the last 60 stable releases
Nothing withdrawn
no release was ever pulled
12 years old
6971 releases · first in 2015
Nothing published for this version
Nothing published for this version
Nothing published for this version
One column per quarter.
Nothing published for this version
tpl/resources: Deprecate resources.PostProcess in favour of templates.Defer 29ed932 @bep #15086
Notable new features in this release are:
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
markup/highlight: Escape lang in default code block rendering ce1a7e0 @bep thanks to @k0ngj1 for reporting this issue.
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
The majority of the fixes in this release are security related (including the upstream fix in 93c8c7d (golang.org/x/image)). Thanks to @vnth4nhnt for
The majority of the fixes in this release are security related (including the upstream fix in 93c8c7d (golang.org/x/image)). Thanks to @vnth4nhnt for finding the issues fixed in a00b5c7 and cf9c8f9 (I will do the CVE work on this later). There has been a uptick in security reports lately, which doesn't mean that Hugo has gotten less secure, this is mostly the work of the new and powerful AI tools using Hugo's restrictive security model as their baseline. Just take a look at Go's recent security issue list to see a demonstration of this.
Nothing published for this version
Nothing published for this version
Nothing published for this version
resources/jsconfig: Remove deprecated baseUrl setting ff2903a @bep #14991 #14996
The main topic in this release is improvements to the AVIF image handling that we introduced in v0.162.0. See the docs for details, but:
quality for AVIF to 60. Turns out, JPEG/WebP with quality 75 is comparable to AVIF with quality 60. You can now also set quality per image format in your project config (and also per image processed if needed).hint to the AVIF with the same values as for WEBP. For lossy compression, the photo/picture hints (and the default) encodes with YUV420 chroma subsampling instead of YUV444, keeping 444 for text/icon/drawing. This greatly reduces the memory needed to encode these images.Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
modules/npm: Fix false stale warning after npm pack 59f35cd @jmooring #14959
Nothing published for this version
There are some notable security fixes in this release.
The notable new feature in this release is support for AVIF images (both encoder and decoder). There's a demo site set up that demonstrates the difference between HDR AVIF and SDR JPEG images. Note that that demo is only really interesting if viewed on an HDR capable screen (e.g. Apple Retina).
There are some notable security fixes in this release.
This release upgrades from Go 1.26.1 to 126.3, which brings a set of security fixes. Some relevant for Hugo are:
The following changes either fix a concrete issue or reduce the default attack surface of hugo builds.
text/html content files by default (e41a064). A new security.allowContent policy gates which content media types may be used for pages under /content. text/html is denied by default; sites that rely on hand-authored or adapter-emitted HTML content can opt back in with security.allowContent = ['.*'].security.http.urls on every redirect hop in resources.GetRemote (86fbb0f).resources.Get (f8b5fa0).We will update this section later with links to CVEs where applicable.
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
resources: Honor Retry-After header in resources.GetRemote retries c4eba92 @bep #14828
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Revert "common/hugo: Deprecate extended and extended_withdeploy editions" b01cc14 @bep #14771
This release contains two security hardening fixes:
--permission flag with the permissions defined in security.node.permissions. This means that you need Node >= 22 installed and that css.TailwindCSS now requires that the Tailwind CSS CLI must be installed as a Node.js package. The standalone executable is no longer supportedBut there are some notable new features, as well:
A practical example in css.Build would be to have something like this in hugo.toml:
[params.style]
primary = "#000000"
background = "#ffffff"
[params.style.dark]
primary = "#ffffff"
background = "#000000"And in the stylesheet:
@import "hugo:vars";
@import "hugo:vars/dark" (prefers-color-scheme: dark);
:root {
color-scheme: light dark;
}The permalinks configuration is now much more flexible (the old setup still works). It uses the same target matchers as in the cascade config, meaning you can now do:
permalinks:
- target:
kind: page
path: "/books/**"
pattern: /books/:year/:slug/
- target:
kind: section
path: "/{books,books/**}"
pattern: /libros/:sections[1:]
- target:
kind: page
pattern: /other/:slug/The above example isn't great, but it at least shows the gist of it.
What we had before was e.g. content/mypost.en.md which told Hugo that the content files was in English. With the new setup you could also name the file content/mypost._language_en_.md. This alone doesn't sound very useful, but this allows you to use more prefixes:
| Prefix | Description | Relevant for |
|---|---|---|
| language_ | Language | Content and layout files. |
| role_ | Role | Content and layout files. |
| version_ | Version | Content and layout files. |
| outputformat_ | Output format | Layout files. |
| mediatype_ | Media type | Layout files. |
| kind_ | Page kind | Layout files. |
| layout_ | Layout | Layout files. |
Nothing published for this version
Your coding agent can read these notes before it upgrades. Set up the MCP server →