发布日期: 2026-05-26
版本号: v0.162.0

此版本新增AVIF图像编解码支持并提供了HDR效果对比演示站点。安全方面升级了Go版本以修复XSS等漏洞，同时Hugo自身也增强了安全策略，包括默认禁止HTML内容文件、重定向检查URL安全性及拒绝符号链接。此外还包括多项功能优化与依赖更新，如改进资源获取逻辑、简化模板、修复页面元数据处理等问题。

更新内容 （中文）

此版本中值得注意的新功能是支持AVIF图像（包括编码器和解码器）。已设置一个演示站点，展示了HDR AVIF与SDR JPEG图像之间的差异。请注意，该演示仅在支持HDR的屏幕（例如Apple Retina）上查看时才有实际意义。

安全修复

此版本包含若干重要安全修复。

Go中的安全修复

此版本将Go从1.26.1升级至126.3，带来一系列安全修复。其中与Hugo相关的包括：

  • html/template中的XSS漏洞（CVE-2026-39826和CVE-2026-39823）：html/template中两处独立的转义器绕过漏洞可能导致跨站脚本攻击（XSS）。
  • html/template：修复了JS模板字面量上下文在模板分支中被错误跟踪的问题，这可能导致内容转义不当。

Hugo中的安全修复与加固

以下变更要么修复了具体问题，要么减少了hugo构建的默认攻击面。

  • 默认禁止text/html内容文件（e41a064）。新的security.allowContent策略控制/content下页面可使用的内容媒体类型。默认禁止text/html；依赖手工编写或适配器生成HTML内容的站点可通过security.allowContent = ['.*']重新启用。
  • 在resources.GetRemote的每次重定向跳转时重新检查security.http.urls（86fbb0f）。
  • 在resources.Get中拒绝符号链接条目（f8b5fa0）。

我们将在后续更新中补充相关CVE链接。

全部变更

  • hugolib：修复仓库子目录中go.mod模块的Page.GitInfo问题 df542191 @bep #14942
  • 修复CONTRIBUTING.md中的拼写错误 4bc7caea @bep
  • resources：修复:counter占位符问题 5d51b82a @jmooring #14921
  • commands：修复从Jekyll导入的问题 81d77620 @jmooring #14795 #14906
  • 修复resources.Get中直接符号链接读取的阻止机制 f8b5fa09 @bep
  • commands：修复github-dark代码高亮样式 88d838a9 @xndvaz #14831
  • 默认禁止HTML内容 e41a0644 @bep
  • 添加AVIF图像处理支持 90d9f812 @bep #7837
  • config：保留有意的空映射 80e60847 @jmooring #14944
  • hugolib：设置renderSegments时合并现有hugo_stats.json aeb9a5cc @bep #14939
  • all：用ConcurrentMap替换RWMutex结构体缓存 c4bbc280 @bep
  • tpl/tplimpl：整合并改进嵌入式模板集成测试 d8c70218 @jmooring #14932
  • parser：从Hugo配置输出中移除空子映射 ee4f1acd @bep #14855
  • markup/highlight：允许通过选项覆盖类型和代码 b6133657 @bep #11872
  • 更新AI辅助披露要求 d2c821b5 @bep
  • hugolib：在IsTranslated中使用AllTranslated 4ed7600f @bep
  • tpl：简化sitemap模板 cbe4339a @bep #14912
  • tpl：在sitemap模板中使用AllTranslations 6475d308 @bep #14912 #14917
  • tpl/collections：当未提供值时使dict返回nil 67aede43 @bep
  • 同步Go模板包至1.26.3版本 87f194b2 @bep #14897
  • 升级至Go 1.26.3 d81e3c29 @bep #14897
  • ci：使用gotmplfmt检查嵌入式模板格式 7c65a4db @bep
  • tpl：运行gotmplfmt -w . d31a9275 @bep
  • markup/goldmark/codeblocks：始终将Chroma选项拆分为.Options c36608c5 @jmooring #14909
  • hugolib：允许空params前置元数据 2f361a8e @xndvaz #14886
  • common/hmaps：将切片值的模块配置合并到站点配置 55592633 @jmooring #13869
  • tpl：对本地和全局图像资源使用GetMatch 656fc040 @bep #14062
  • 回退"markup/tableofcontents：跳过空目录层级"提交 a20cb5b1 @bep #14898
  • tpl/templates：拒绝在partialCached中使用Defer 4d775cbe @bep #13492
  • common/hexec：将NODE_PATH作为ESM裸导入的后备方案 ae7bf74b @bep #13987
  • config：允许在/config文件中重复根键 ba5d8126 @bep #12899 #14882
  • 修订AGENTS.md中的测试命名指南 be4a0df3 @bep
  • 更新AGENTS.md e4cf565c @bep
  • js：对缺失的批处理导入返回错误 9e649533 @xndvaz #13737
  • resources/images：保持智能裁剪目标尺寸 f0cfc28c @xndvaz #13688
  • testing：在相关场景使用synctest 16e854a4 @bep
  • security：根据security.http.urls验证重定向 86fbb0f7 @bep #14871
  • markup/tableofcontents：跳过空目录层级 7d4af7a1 @xndvaz #7128
  • 在非VCS构建中回退使用hugo.BuildDate()的hugo.buildDate 28147cb0 @bep #14862
  • css：使css.Build的文件加载器URL基于Web上下文根目录绝对路径 e51e761d @bep #14849
  • hugolib：不对来自cascade.params的lang/kind/path发出警告 70112392 @bep #14848
  • markup/goldmark：为普通代码块解包内部HTML 694906f6 @cyphercodes #14820
  • tpl/tplimpl：扩展页面图像查找以包含全局资源 d27b9c06 @ogulcanaydogan #14062
  • security：在默认http.urls中允许以数字开头的主机名 62cef367 @bep #14837
  • commands：改进命令标志描述 ff22c62a @jmooring #14817
  • build(deps)：升级golang.org/x/net从0.54.0至0.55.0 4f444c81 @dependabot[bot]
  • build(deps)：升级golang.org/x/image从0.40.0至0.41.0 fe6c7265 @dependabot[bot]
  • build(deps)：升级github.com/getkin/kin-openapi从0.137.0至0.138.0 6a2a0380 @dependabot[bot]
  • build(deps)：升级github.com/JohannesKaufmann/html-to-markdown/v2 cf1de598 @dependabot[bot]
  • build(deps)：升级golang.org/x/image从0.39.0至0.40.0 97f990cc @dependabot[bot]
  • build(deps)：升级golang.org/x/tools从0.44.0至0.45.0 b99634e2 @dependabot[bot]
  • build(deps)：升级github.com/aws/aws-sdk-go-v2/service/s3 fdd977e9 @dependabot[bot]
  • build(deps)：升级github.com/pelletier/go-toml/v2从2.3.0至2.3.1 123018de @dependabot[bot]
  • deps：升级至Chroma v2.24.1 b88fa8cc @bep #14839

更新内容 （原始）

The notable new feature in this release is support for AVIF images (both encoder and decoder). There’s a demo site set up that demonstrates the difference between HDR AVIF and SDR JPEG images. Note that that demo is only really interesting if viewed on an HDR capable screen (e.g. Apple Retina).

Security fixes

There are some notable security fixes in this release.

Security fixes in Go

This release upgrades from Go 1.26.1 to 126.3, which brings a set of security fixes. Some relevant for Hugo are:

  • XSS in html/template (CVE-2026-39826 & CVE-2026-39823): Two separate vulnerabilities where escaper bypasses in html/template could lead to Cross-Site Scripting (XSS).
  • html/template: Fixes an issue where JS template literal contexts were incorrectly tracked across template branches, which could lead to improper content escaping.

Security fixes and hardening in Hugo

The following changes either fix a concrete issue or reduce the default attack surface of hugo builds.

  • Disallow text/html content files by default (e41a064). A new security.allowContent policy gates which content media types may be used for pages under /content. text/html is denied by default; sites that rely on hand-authored or adapter-emitted HTML content can opt back in with security.allowContent = ['.*'].
  • Re-check security.http.urls on every redirect hop in resources.GetRemote (86fbb0f).
  • Reject symlinked entries in resources.Get (f8b5fa0).

We will update this section later with links to CVEs where applicable.

All changes

  • hugolib: Fix Page.GitInfo for modules with go.mod in a repo subdirectory df542191 @bep #14942
  • Fix typo in CONTRIBUTING.md 4bc7caea @bep
  • resources: Fix the :counter placeholder 5d51b82a @jmooring #14921
  • commands: Fix import from Jekyll 81d77620 @jmooring #14795 #14906
  • Fix prevention of direct symlink reads in resources.Get f8b5fa09 @bep
  • commands: Fix github-dark chromastyles 88d838a9 @xndvaz #14831
  • Disallow HTML content by default e41a0644 @bep
  • Add image processing support for AVIF 90d9f812 @bep #7837
  • config: Preserve intentionally empty maps 80e60847 @jmooring #14944
  • hugolib: Merge existing hugo_stats.json when renderSegments is set aeb9a5cc @bep #14939
  • all: Replace RWMutex struct caches with ConcurrentMap c4bbc280 @bep
  • tpl/tplimpl: Consolidate and improve embedded template integration tests d8c70218 @jmooring #14932
  • parser: Drop empty sub maps from hugo config output ee4f1acd @bep #14855
  • markup/highlight: Allow overriding type and code via options b6133657 @bep #11872
  • Update AI assistance disclosure requirements d2c821b5 @bep
  • hugolib: Use AllTranslated in IsTranslated 4ed7600f @bep
  • tpl: Simplify sitemap template cbe4339a @bep #14912
  • tpl: Use AllTranslations in sitemap template 6475d308 @bep #14912 #14917
  • tpl/collections: Make dict return nil when no values are provided 67aede43 @bep
  • Sync Go template package to 1.26.3 87f194b2 @bep #14897
  • Upgrade to Go 1.26.3 d81e3c29 @bep #14897
  • ci: Check embedded template formatting with gotmplfmt 7c65a4db @bep
  • tpl: Run gotmplfmt -w . d31a9275 @bep
  • markup/goldmark/codeblocks: Always split Chroma options into .Options c36608c5 @jmooring #14909
  • hugolib: Allow empty params front matter 2f361a8e @xndvaz #14886
  • common/hmaps: Merge slice-valued module config into site config 55592633 @jmooring #13869
  • tpl: Use GetMatch for both local and global image resources 656fc040 @bep #14062
  • Revert “markup/tableofcontents: Skip empty TOC levels” a20cb5b1 @bep #14898
  • tpl/templates: Reject Defer inside partialCached 4d775cbe @bep #13492
  • common/hexec: Make NODE_PATH a fallback for ESM bare imports ae7bf74b @bep #13987
  • config: Allow repeating the root key in /config files ba5d8126 @bep #12899 #14882
  • Revise test naming guidelines in AGENTS.md be4a0df3 @bep
  • Update AGENTS.md e4cf565c @bep
  • js: Return error for missing batch imports 9e649533 @xndvaz #13737
  • resources/images: Keep smart crop target size f0cfc28c @xndvaz #13688
  • testing: Use synctest where relevant 16e854a4 @bep
  • security: Validate redirects against security.http.urls 86fbb0f7 @bep #14871
  • markup/tableofcontents: Skip empty TOC levels 7d4af7a1 @xndvaz #7128
  • Fall back to hugo.buildDate in hugo.BuildDate() in non-vcs builds 28147cb0 @bep #14862
  • css: Make css.Build’s file-loader URLs absolute to web context root e51e761d @bep #14849
  • hugolib: Don’t warn about lang/kind/path coming from cascade.params 70112392 @bep #14848
  • markup/goldmark: Unwrap inner HTML for plain code blocks 694906f6 @cyphercodes #14820
  • tpl/tplimpl: Extend page image lookup to include global resources d27b9c06 @ogulcanaydogan #14062
  • security: Allow hostnames starting with digits in default http.urls 62cef367 @bep #14837
  • commands: Improve description of command flags ff22c62a @jmooring #14817
  • build(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 4f444c81 @dependabot[bot]
  • build(deps): bump golang.org/x/image from 0.40.0 to 0.41.0 fe6c7265 @dependabot[bot]
  • build(deps): bump github.com/getkin/kin-openapi from 0.137.0 to 0.138.0 6a2a0380 @dependabot[bot]
  • build(deps): bump github.com/JohannesKaufmann/html-to-markdown/v2 cf1de598 @dependabot[bot]
  • build(deps): bump golang.org/x/image from 0.39.0 to 0.40.0 97f990cc @dependabot[bot]
  • build(deps): bump golang.org/x/tools from 0.44.0 to 0.45.0 b99634e2 @dependabot[bot]
  • build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 fdd977e9 @dependabot[bot]
  • build(deps): bump github.com/pelletier/go-toml/v2 from 2.3.0 to 2.3.1 123018de @dependabot[bot]
  • deps: Upgrade to Chroma v2.24.1 b88fa8cc @bep #14839

下载链接