LoginSign Up
← Back to all sparks
H

Hugo

MKT AUTO
Velocity2.5

Fast open-source static site generator

gohugo.io ↗

Steady feature-then-patch cadence, with security reports rising because AI tools are finding them

static-site-generatortemplatingimage-processingsecurity-patchessyntax-highlighting
◆Current state
Hugo is running its usual rhythm: a feature minor followed by a short run of patches. v0.164.0 added dark/light pairs for Chroma highlighter styles with matching flags on `hugo gen chromastyles`, new encoding.HexEncode, encoding.HexDecode and crypto.Hash template functions, an rst syntax-highlight option, Pandoc citation support, and sub-path support in layouts passed to Page.Render. Before it, v0.163.0 was largely a correction pass on the AVIF handling introduced in 0.162.0 — default quality dropped to 60 on the finding that JPEG and WebP at 75 are comparable, with per-format and per-image quality now configurable.
◆Where it's heading
The work in this window is refinement rather than expansion: image encoding defaults tuned after real-world use, template function surface extended one primitive at a time, external converter behaviour standardized. The most notable observation comes from the maintainer in v0.163.1, who attributes a rise in security reports to new AI tooling being pointed at the codebase rather than to any decline in the code — and that release, plus the code-block language escaping fix in 0.163.3, is where those reports land.
◆Prediction
The pattern across this window points to another patch run consolidating 0.164.0 before the next minor. If the reported uptick in AI-assisted security findings continues, more of those patches will be security-driven, as 0.163.1 already was.

◆Recent moves

  1. 25d ago

    Hugo 0.164.0: dark/light Chroma styles, Pandoc citations, new template funcs

    The feature release of this window: Chroma highlighter styles gain dark/light pairs with new gen chromastyles flags, three template functions arrive (HexEncode, HexDecode, crypto.Hash), Pandoc citations are supported, and layouts passed to Page.Render can use sub paths. Real additions to what a theme author can do, none of which changes what Hugo is.

    View source ↗
  2. 1mo ago

    Hugo 0.163.3 patch: code block escaping and parser fixes

    A patch run covering language escaping in default code block rendering, non-ASCII whitespace preservation after the summary divider, babel and postcss config variants, and a page/section name collision regression. Ordinary cleanup between minors.

    View source ↗
  3. 1mo ago

    Hugo 0.163.2 patch: resolver and missing-converter handling

    Two fixes only: continue resolving on ERR_ACCESS_DENIED in Node's resolver, and standardize behaviour when external converters are missing. The smallest release in the window.

    View source ↗
  4. 1mo ago

    Hugo 0.163.1: security fixes including upstream x/image

    Mostly a security patch, including an upstream golang.org/x/image fix and two issues from an external reporter. The release note is unusually candid about cause: the maintainer attributes the recent uptick in reports to AI tooling being run against the codebase rather than to any regression in it.

    View source ↗
  5. 1mo ago

    Hugo 0.163.0 retunes AVIF quality defaults and adds per-format control

    A correction pass on the AVIF support introduced in 0.162.0: default quality drops to 60 after finding JPEG and WebP at 75 are comparable, and quality becomes configurable per image format in project config and per processed image. Shipping a format then retuning its defaults once real output has been compared.

    View source ↗
  6. 2mo ago

    Hugo 0.162.1 patch: npm, time locale and dict revert

    A small patch fixing a false stale warning after npm pack, locale-specific month abbreviations, and reverting a dict change from the previous release. Housekeeping ahead of the 0.163 line.

    View source ↗