LoginSign Up
← Back to all sparks
H

Hugo

MKT AUTO
Velocity2.5

Fast open-source static site generator

gohugo.io ↗

Hugo's releases are almost entirely asset pipeline work now: AVIF, Chroma, and import resolution.

static site generatorasset pipelinesyntax highlightingavifsecurity hardeningtemplate functions
◆Current state
Hugo's recent line is dominated by the asset pipeline and the markup layer rather than the site model. 0.165.0 adds css.ChromaStyles for generating highlighter stylesheets and an importContext option that makes in-memory resources resolvable from CSS @import statements across css.Build, js.Build, css.Sass, css.PostCSS and css.TailwindCSS. The releases before it tuned AVIF encoding defaults, added dark/light Chroma pairs, and closed a batch of security reports in the file and URL handling.
◆Where it's heading
The through-line is making Hugo's build pipeline self-sufficient — resources generated at build time can now feed the CSS and JS bundlers directly, and highlighter themes are generated rather than vendored. In parallel the project keeps tightening its security model: 0.163.1 normalized integer IPv4 host encodings and dropped symlinks from the os.* template functions, and 0.165.0 removes tailwindcss from the default security.exec.allow list, moving toward explicit opt-in for external binaries.
◆Prediction
Expect the importContext mechanism to spread to the remaining resource transformers and further deprecations to land, given resources.PostProcess was already deprecated in favor of templates.Defer. Sites relying on the implicit tailwindcss exec permission will need to add it to their config explicitly.

◆Recent moves

  1. 6d ago

    Hugo 0.165 adds importContext and css.ChromaStyles

    Two real additions: css.ChromaStyles generates highlighter stylesheets to a target path with light/dark modes, and importContext lets resources built in memory be resolved from @import statements in css.Build, js.Build, css.Sass and css.PostCSS. The release also drops tailwindcss from the default security.exec.allow list, which is a behavior change for sites that relied on it implicitly.

    View source ↗
  2. 1mo ago

    Hugo 0.164 adds Pandoc citations, crypto.Hash and dark/light Chroma pairs

    Chroma highlighter styles gain dark/light pairs, and the template surface grows with encoding.HexEncode, encoding.HexDecode and crypto.Hash. Pandoc citation support and a markup.rst.syntaxHighlight option extend the markup layer, and a performance regression dating to v0.128.0 is fixed — most visible on larger sites.

    View source ↗
  3. 2mo ago

    Hugo 0.163.3 fixes code block lang escaping and postcss config variants

    A short patch release: escape the lang attribute in default code block rendering, preserve non-ASCII whitespace after the summary divider, support babel and postcss config variants, and fix a page/section name collision regression. Maintenance within the same asset-pipeline and markup areas the minor releases have been working.

    View source ↗
  4. 2mo ago

    Hugo 0.163.2 fixes Node resolver and missing external converters

    Two fixes only — continue resolving on ERR_ACCESS_DENIED in Node's resolver, and standardize behavior when external converters are missing. Neither changes what a site can express.

    View source ↗
  5. 2mo ago

    Hugo 0.163.1 hardens URL and filesystem handling after security reports

    Mostly security work: integer IPv4 host encodings are normalized in the http.urls check, symlinks are dropped from os.ReadDir, os.ReadFile, os.Stat and os.FileExists, and golang.org/x/image is bumped for an upstream fix. The maintainer notes an uptick in reports driven by automated tooling probing Hugo's restrictive security model, which is the context for the hardening that continues into 0.165.

    View source ↗
  6. 2mo ago

    Hugo 0.163 retunes AVIF quality and adds per-format encoding hints

    Follows up the AVIF support introduced in 0.162 with practical defaults: quality drops to 60 to match JPEG/WebP at 75, quality becomes settable per image format, and a hint option switches lossy photo encoding to YUV420 chroma subsampling while keeping 444 for text and icons — cutting encode memory substantially. The same release deprecates Imaging.Compression and IsNode.

    View source ↗