Bump gohugoio/hugo from v0.168.0 to v0.169.0 - #55

Sourced from gohugoio/hugo's releases.

v0.169.0

The main motivation behind this release is to get out a build with Go 1.27.3, which blocks trust in a small set of intermediate certificates due to specific security concerns around their operation. See the eMudhra incident for more information. This affects Hugo features that fetch remote resources over HTTPS, e.g. resources.GetRemote.

This release also contains some security hardening of the template functions and menu entries that can render content as HTML (see below), a deprecation of looking up reserved front matter fields via .Params (also below), a faster and more robust plainify, and a set of bug fixes.

Security notes

Templates are trusted in Hugo, but content (including front matter) is not necessarily. This release tightens a few places where values from content could end up rendered as unescaped HTML:

• pre and post values in menu entries defined in front matter are now HTML escaped, unless text/html is allowed in security.allowContent, which already marks HTML in /content as trusted. A warning (warning-menu-pre-post-html-escaped) is logged when a value containing HTML markup is escaped. Menu entries defined in the project configuration are not affected. f63482bf
• emojify and plainify now return a string unless the input is template.HTML, in which case the result is also template.HTML. Previously both always returned template.HTML, so e.g. {{ .Title | emojify }} would mark a potentially unsafe title as safe HTML. If you relied on the old behavior with trusted input, pipe the result through safeHTML. Thanks to @​Reload3d for reporting this. #15452

Deprecations

Reserved front matter fields such as title, date and summary are currently also stored in .Params. Lookups such as .Params.title (and ByParam "title", where .Pages "Params.title" ... etc.) are now redirected to the corresponding Page method and logged as deprecated, unless the field was set in the params section of front matter. The content of .Params is unchanged for now. 53e1fef9

Deprecated	Use instead
.Params.date	.Date
.Params.description	.Description
.Params.draft	.Draft
.Params.expirydate	.ExpiryDate
.Params.keywords	.Keywords
.Params.lastmod	.Lastmod
.Params.layout	.Layout
.Params.linktitle	.LinkTitle
.Params.publishdate	.PublishDate
.Params.slug	.Slug
.Params.summary	.RawSummary (new)
.Params.title	.Title
.Params.translationkey	.TranslationKey
.Params.type	.Type
.Params.weight	.Weight

Bug fixes

• hugolib: Fix template change detection when saving via temp file and rename 46e51f30 @​bep #15484
• markup/goldmark: Fix auto heading ID when link text starts with a bracket c22158c1 @​chanellebingham #15472
• urls: Fix JoinPath panic with empty slice ce5d232b @​Ferdinand-MZ #15473
• js: Fix js.Build with browser-disabled extensionless requires 2efee511 @​bep #15481
• Fix Site.Key used in e.g. partialCached b86e0caa @​bep #15466
• ci: Fix Windows running out of disk space and simplify test runs 77230eba @​bep
• hugolib: Fix build hang after too many page render errors 85fb23f1 @​bep #15449
• tpl/cast: Fix nil pointer panic in hugo gen docshelper 8df31809 @​jmooring #15444

Improvements

• Redirect .Params.title etc. to .Title etc. and deprecate it 53e1fef9 @​bep
• ci: Revert to plain go install honnef.co/go/tools/cmd/staticcheck@latest 3e67572c @​bep
• navigation: Escape pre/post in front matter menu entries f63482bf @​bep

... (truncated)

• 1da10fc releaser: Bump versions for release of 0.169.0
• 6e494d0 build(deps): bump github.com/getkin/kin-openapi from 0.151.0 to 0.152.0
• 46e51f3 hugolib: Fix template change detection when saving via temp file and rename
• 53e1fef Redirect .Params.title etc. to .Title etc. and deprecate it
• 8c1fdca build(deps): bump github.com/tdewolff/minify/v2 from 2.24.19 to 2.24.22
• 3e67572 ci: Revert to plain go install honnef.co/go/tools/cmd/staticcheck@latest
• c22158c markup/goldmark: Fix auto heading ID when link text starts with a bracket
• ce5d232 urls: Fix JoinPath panic with empty slice
• f63482b navigation: Escape pre/post in front matter menu entries
• 2efee51 js: Fix js.Build with browser-disabled extensionless requires
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)