Skip to content

ci(deps): update gohugoio/hugo action to v0.121.2 #44

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

ci(deps): update gohugoio/hugo action to v0.121.2 #44

wants to merge 1 commit into from

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Nov 18, 2024 •
edited
Loading

This PR contains the following updates:

Package Type Update Change
gohugoio/hugo action minor v0.118.2 -> v0.121.2

Release Notes

gohugoio/hugo (gohugoio/hugo)

v0.121.2

Compare Source

The main motivation behind this release is a security fix in the upstream golang.org/x/crypto library. We don't see how that CVE could be exploited via Hugo, but we do appreciate that many want to have a clean security report.

There's also some new features in this release:

What's Changed

v0.121.1

Compare Source

The only change in this release is that the release binaries are compiled with Go 1.21.5 which contains some security fixes that are relevant for Hugo.

v0.121.0

Compare Source

There are some minor new features in this release, but it's mostly a release with bug fixes and dependency updates. One notable dependency update is libweb v1.3.2 which comes with a security fix for the Webp decoder (chromium: #​1479274, CVE-2023-4863). Hugo only uses the encoder (we use Go's native Webp decoder) so we're not affected by this, but we have been contacted by some corporate Hugo users who's eager to have a clean security report.

Notes
  • kin-openapi v0.122.0 has some minor breaking API changes which, from Hugo's side of it, can be adapted by using the new .Map accessors if you get an error.
Bug fixes and enhancements
Dependency Updates
Documentation

v0.120.4

Compare Source

The only change in this release is that the release binaries are compiled with Go 1.21.4 which comes with a security fix for Windows that may be relevant for Hugo. See:

What's Changed

v0.120.3

Compare Source

What's Changed

v0.120.2

Compare Source

What's Changed

v0.120.1

Compare Source

What's Changed

v0.120.0

Compare Source

This is a full dependency refresh and a couple of new cool features:

A new Padding image filter, and a new debug.Timer template func. The new debug.Timer is useful for finding performance bottle necks in templates:

{{ $timer := debug.Timer "slowTemplate" }}
// ...
{{ $timer.Stop }}

If you then run hugo --logLevel info you should see timer info logged at the end of the build. You can have as many timers as you want and if you don't stop them, they will be stopped at the end of build.

Hugo now also builds release binaries for Solaris now that a long-living issue in the upstream ƒsnotify library has been fixed, thanks to @​nshalman.

Notes
  • The enableEmoji flag now only works for Markdown content. This is unfortunate, but the old solution has some known issues and it was too hard to make it work properly as a general thing across all formats. See #​11598
  • site.DisqusShortname is deprecated 2eca1b3
  • site.GoogleAnalytics is deprecated a692278
  • site.Author is deprecated d4016dd
  • site.Social is deprecated 4910312

Also, we have changed the string type for some of the fields and methods:

  • .Fragments.ToHTML now returns template.HTML
  • $resource.Data.Integrity now returns a string and not a template.HTMLAttr
  • delimit now returns a string and not a template.HTML See #​10876 #​11502.
  • the URL functions now returns a string, see #​11536
  • The paginator Pager now returns a string.
  • site.BaseURL now returns a string.

The above should both solve some issues and make the above types more useful and easer to reason about. But if you use the delimit function to process HTML and see some unexpected escaping after this release, e.g.:

{{ $s := slice "<i>foo</i>" }}
{{ delimit $s "," }}

Then you need to mark the type with safeHTML:

{{ $s := slice "<i>foo</i>" }}
{{ delimit $s "," | safeHTML }}
Bug fixes
Improvements
Dependency Updates
Documentation

v0.119.0

Compare Source

This version is built with Go 1.21.1 which contains some relevant security fixes for the html/template package, see Issue 62196 and Issue 62197. This is the main reason Hugo 0.119.0 is released sooner rather than later. But this release also comes with a dependency refresh and some useful image processing improvements:

  • A new general-purpose Process method and filter.
  • A new Opacity filter.

Process support all of the existing scaling operations, but it can also be used do simple format conversions (e.g. from JPG to PNG). A before/after example:

{{ $watermark := resources.Get "logo.jpg" | images.Filter  
       (images.GaussianBlur 6) 
       (images.Opacity 0.5) 
}}
{{ $watermark = $watermark.Resize (printf "%dx%d png" $watermark.Width $watermark.Height )

There are some issues with the above:

  1. The source image does not support transparency, so the transparency pixels will be filled with the configured background colour.
  2. The image will be decoded and encoded twice with a potential loss in quality.
  3. It's clumsy.

With Hugo 0.119.0 the above can be written as:

{{ $watermark := resources.Get "logo.jpg" | images.Filter  
       (images.GaussianBlur 6) 
       (images.Opacity 0.5) 
       (images.Process "png") 
}}
Bug fixes
Improvements
Dependency Updates
Documentation

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants