Python-hugo

Latest version: v24.1.1

Safety actively analyzes 682387 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 1 of 44

24.1.1

This patch release of `python-hugo` bumps the Hugo binary version to `v0.121.2` in accordance with a security fix for an upstream Golang library for Hugo that is used as a dependency at build time. This is documented in the Hugo release as follows and listed verbatim below.

Other fixes in this release include some streamlined package metadata and slightly better handling of wheel platform tags on macOS machines where a universal Python implementation is installed and used to compile Hugo from source.

<hr>

> [!TIP]
> For the changes behind this release, please refer to the [Hugo `v0.121.2` release notes](https://github.com/gohugoio/hugo/releases/tag/v0.121.2).

"_The main motivation behind this release is a security fix in the upstream [golang.org/x/crypto](https://github.com/golang/crypto/commit/9d2ee975ef9fe627bf0a6f01c1f69e8ef1d4f05d) library. We don't see how that CVE could be exploited via Hugo, but we do appreciate that many want to have a clean security report._"

**Full range of commits**: https://github.com/agriyakhetarpal/hugo-python-distributions/compare/v24.1.0...v24.1.1

24.1.0

This is the first release for `python-hugo`, a Python package that embeds binaries for the extended version of the static site generator Hugo written in Golang – allowing users to install it with `pip`, Python's primary package management tool. Please refer to the [README](https://github.com/agriyakhetarpal/hugo-python-distributions) document for: installation instructions and usage, a list of supported platforms and architectures, and a variety of use cases and some limitations.

For more information on Hugo and its usage as a static site generator, please refer to the official Hugo documentation, available at: https://gohugo.io/documentation.

This project will be versioned separately yet along Hugo's own releases and plans to follow modified CalVer versioning standards with the version specification as `YEAR.MONTH.PATCH`, where patch releases may either correspond to a Hugo release in the same month or perform a bug fix or maintenance operations for the package.

<hr>

Some initial PRs that brought this to fruition

* Add and debug workflows by agriyakhetarpal in https://github.com/agriyakhetarpal/hugo-python-distributions/pull/1
* Debug and add Windows support by agriyakhetarpal in https://github.com/agriyakhetarpal/hugo-python-distributions/pull/4
* Cache Hugo build files by agriyakhetarpal in https://github.com/agriyakhetarpal/hugo-python-distributions/pull/9
* Add user manual – quickstart, use cases, known limitations, building from source, licensing by agriyakhetarpal in https://github.com/agriyakhetarpal/hugo-python-distributions/pull/11
* Packaging revamp, introduce cleaner installation, add cross-compilation by agriyakhetarpal in https://github.com/agriyakhetarpal/hugo-python-distributions/pull/12
* Refactor GitHub Actions workflows, get wheels ready, cross-compile macOS wheels by agriyakhetarpal in https://github.com/agriyakhetarpal/hugo-python-distributions/pull/14

**Full range of commits**: https://github.com/agriyakhetarpal/hugo-python-distributions/commits/v24.1.0

1.19

use .
use ../gohugoioTheme


Using the `use` directive, list all the modules you want to work on, pointing to its relative location. As in the example above, it's recommended to always include the main project (the ".") in the list.

With that you can start the Hugo server with that workspace enabled:


HUGO_MODULE_WORKSPACE=hugo.work hugo server --ignoreVendorPaths "**"


The `--ignoreVendorPaths` flag is added above to ignore any of the vendored dependencies inside `_vendor`. If you don't use vendoring, you don't need that flag. But now the server is set up watching the files and directories in the workspace and you can see your local edits reloaded.

Breadcrumbs

We have added a new `.Ancestors` method on `Page` that walks up the tree to the home page. With this, breadcrumbs templates can be greatly simplified:

handlebars
<ol>
<ul>
{{- range .Ancestors.Reverse }}
<li><a href="{{ .Permalink }}">{{ .Title }}</a></li>
{{- end }}
<li class="active" aria-current="page">
<a href="{{ .Permalink }}">{{ .Title }}</a>
</li>
</ul>
</ol>


The path to /public now available in PostCSS

So you can do `process.env.HUGO_PUBLISHDIR` in your `postcss.config.js` to figure out where Hugo publishes
its files.

Note that the value will always be an absolute file path and will point to a directory on disk even when running `hugo server` in memory mode.

If you write to this folder from PostCSS when running the server, you could run the server with one of these flags:


hugo server --renderToDisk
hugo server --renderStaticToDisk


Note

* modules: Make the module.workspace=off as default (note) 0d4b17d4 bep 10553
* release: Add a note section in release notes 3afaca75 bep
* helpers: Allow at signs in UnicodeSanitize (note) 2d217cba jmooring 10548
* Also consider wrapped errors when checking for file IsNotExist errors ad205987 bep 10534

Bug fixes

* If you use the legacy `libsass` transpiler in `toCSS` and uses the cached build to avoid having the extended version installed on the CI server, you need to rebuild those assets and commit them to source control (e.g. with `hugo --gc`).
* tpl/resources: Fix data race in ToCSS aa2c7241 bep 10542
* tocss: Fix unquote case with double quotes 5d5f0a23 septs 10555
* resources/js: Fix some import discrepancies between Hugo and ESBuild b54de1bd bep 10527
* parser/metadecoders: Fix spelling e0e63f35 lacamera

Improvements

* Adjust "you need the extended version" error message 180dfeba bep
* resource/page: Slight adjustment of Page.Ancestors eb0c8f9d bep 10567
* resource/page: Add Page.Ancestors 3a216186 septs 10567
* Annotate test assertions 71832328 jmooring
* hugolib: Exclude non-linkable pages from translations map 37ab1cf1 jmooring 9073
* Add HUGO_PUBLISHDIR to the Node environment 59af05ca bep 10554
* Revert "tpl/tplimpl: Use https in sitemap templates" 4989da65 jmooring
* tocss: Add some more test cases effa6a42 bep 10555
* Allow "fast render mode" even if --disableLiveReload is set d20d2651 bep 10561
* tocss: Add vars option 41a080b2 bep 10555
* modules: Improve "module workspace" not found error eda1e720 bep
* modules: Adjust watch logic vs workspace use definitions 330fa894 bep
* Add any configured Go Workspace file to the config watcher 6db52748 bep 10556
* parser/metadecoders: Remove superflous cast in test 17055d1f bep
* parser/metadecoders: Simplify nil check in Unmarshal 2a81a494 bep
* parser/metadecoders: Add empty /data JSON file as empty map e30d711c acclassic 8601
* tpl/openapi3: Wrap *kopenapi3.T 87e898a1 bep
* github: Use ruby/setup-ruby d8942698 bep 10517
* tpl/tplimpl: Use https in sitemap templates 3fd0b784 jmooring 10515

Dependency Updates

* build(deps): bump golang.org/x/tools from 0.3.0 to 0.4.0 7874b968 dependabot[bot]

Documentation

* docs: Regen docs helper JSON 10bb29d7 bep
* tpl: Improve template funcs GoDoc cd1ed563 bep

Build Setup

* github: Update to Dart Sass 1.56.2 c9354d54 bep

[^1]: We're working on some bigger and even more exiting Hugo features that will be ready early next year. Stay tuned!

0.121.2

The main motivation behind this release is a security fix in the upstream [golang.org/x/crypto](https://github.com/golang/crypto/commit/9d2ee975ef9fe627bf0a6f01c1f69e8ef1d4f05d) library. We don't see how that CVE could be exploited via Hugo, but we do appreciate that many want to have a clean security report.

There's also some new features in this release:

* [AutoOrient image filter](https://gohugo.io/functions/images/autoorient/)
* [math.Rand](https://gohugo.io/functions/math/rand/)

What's Changed

* build(deps): bump golang.org/x/crypto from 0.16.0 to 0.17.0 1ccd3147a dependabot[bot]
* tpl/math: Add math.Rand template function e40b9fbbc jmooring 11833
* resources/images: Create AutoOrient image filter 648d00c7d jmooring 11717
* all: Remove unused code 8adba648c bep

0.121.1

The only change in this release is that the release binaries are compiled with [Go 1.21.5](https://github.com/golang/go/issues?q=milestone%3AGo1.21.5+label%3ACherryPickApproved) which contains some [security fixes](https://groups.google.com/g/golang-announce/c/iLGK3x6yuNo) that are relevant for Hugo.

* Upgrade to Go 1.21.5 eb9f1eb65 bep 11786

0.121.0

There are some minor new features in this release, but it's mostly a release with bug fixes and dependency updates. One notable dependency update is [libweb v1.3.2](https://github.com/webmproject/libwebp/releases/tag/v1.3.2) which comes with a security fix for the Webp _decoder_ (chromium: #1479274, CVE-2023-4863). Hugo only uses the encoder (we use Go's native Webp decoder) so we're not affected by this, but we have been contacted by some corporate Hugo users who's eager to have a clean security report.

Notes

* [kin-openapi v0.122.0](https://github.com/getkin/kin-openapi#v01220) has some minor breaking API changes which, from Hugo's side of it, can be adapted by using the new `.Map` accessors if you get an error.

Bug fixes and enhancements

* github: Fix CI build on Windows 6d4b01241 bep
* Fix handling of dropped error in test 26a8ec207 alrs
* resources/resource: Fix GroupByParamDate with raw TOML dates dd6cd6268 jmooring 11563
* helpers: Fix TrimShortHTML used by markdownify and RenderString 0bde6931a jmooring 11698
* Pull in the latest code from Go's template packages (11771) 9f978d387 bep 10707 11507
* tpl: Allow using page resources on the images page parameter for `opengraph`, `schema` and `twitter_cards` templates 14d85ec13 razonyang
* hugolib: Apply titleCaseStyle to automatic section pages 171836cdf jmooring 11547
* tpl/urls: Retain query and fragment with absURL and absLangURL 9ea7103db jmooring 11772
* markup: Add Level to Heading struct 3fc42da3d jmooring 10776
* tpl/fmt: Print suppression help with erroridf d24da1712 jmooring 11506
* tpl/transform: Display Chroma highlighting errors 4583b4130 jmooring 9642
* common/para: Skip flaky test on CI e2a624dd6 bep
* watcher: Skip flaky test for now 30a18e882 bep
* tpl/transform: Add transform.XMLEscape template function b4c5df42f jmooring 3268
* tpl/tplimpl: Remove superfluous type attr on script elements 8d32ca223 jmooring 6379
* common/para: Skip flaky tests on Windows 27620daa2 bep
* navigation: Unexport menu entry methods 80d2fdbaa jmooring 11670
* markup/goldmark: Sync image render hook code with Goldmark 805cc1773 jmooring 11681

Dependency Updates

* build(deps): bump github.com/alecthomas/chroma/v2 from 2.11.1 to 2.12.0 558f3258a dependabot[bot]
* build(deps): bump github.com/tdewolff/minify/v2 from 2.20.8 to 2.20.9 507f4e356 dependabot[bot]
* build(deps): bump github.com/spf13/cast from 1.5.1 to 1.6.0 a7e721e02 dependabot[bot]
* build(deps): bump github.com/getkin/kin-openapi from 0.121.0 to 0.122.0 2627b91d3 dependabot[bot]
* build(deps): bump golang.org/x/image from 0.13.0 to 0.14.0 e536d461a dependabot[bot]
* deps: Update github.com/tdewolff/minify/v2 v2.20.7 => v2.20.8 bfc325f56 jmooring 5748
* build(deps): bump github.com/spf13/afero from 1.10.0 to 1.11.0 36a60f65d dependabot[bot]
* build(deps): bump github.com/evanw/esbuild from 0.19.7 to 0.19.8 de2fcc5e1 dependabot[bot]
* build(deps): bump google.golang.org/api from 0.151.0 to 0.152.0 9ca889ba4 dependabot[bot]
* deps: Upgrade to libwebp 1.3.2 4fb40ee87 bep 11746
* build(deps): bump github.com/aws/aws-sdk-go from 1.48.4 to 1.48.6 bc93a3613 dependabot[bot]
* build(deps): bump golang.org/x/tools from 0.15.0 to 0.16.0 3e5bc6f3b dependabot[bot]
* build(deps): bump github.com/getkin/kin-openapi from 0.120.0 to 0.121.0 7c47036f1 dependabot[bot]
* build(deps): bump github.com/bep/logg from 0.3.0 to 0.4.0 4d07e1fe8 dependabot[bot]
* deps: Upgrade to github.com/bep/simplecobra v0.4.0 1c41232e6 bep
* build(deps): bump github.com/aws/aws-sdk-go from 1.48.2 to 1.48.4 f11ca0fad dependabot[bot]
* build(deps): bump golang.org/x/tools from 0.14.0 to 0.15.0 d7a2f3f98 dependabot[bot]
* build(deps): bump github.com/gorilla/websocket from 1.5.0 to 1.5.1 ef12d169c dependabot[bot]
* build(deps): bump github.com/fatih/color from 1.15.0 to 1.16.0 a62bbfa9e dependabot[bot]
* build(deps): bump golang.org/x/net from 0.17.0 to 0.18.0 5887230b7 dependabot[bot]
* build(deps): bump github.com/evanw/esbuild from 0.19.5 to 0.19.7 a4a66b821 dependabot[bot]
* build(deps): bump github.com/alecthomas/chroma/v2 from 2.10.0 to 2.11.1 813390b5a dependabot[bot]
* build(deps): bump github.com/tdewolff/minify/v2 from 2.20.5 to 2.20.7 d528bbd6d dependabot[bot]
* build(deps): bump google.golang.org/api from 0.138.0 to 0.151.0 af7f6c8b3 dependabot[bot]
* build(deps): bump github.com/aws/aws-sdk-go from 1.45.14 to 1.48.2 (11724) e70849ea7 dependabot[bot] 11723

Documentation

* docs: Regen docshelper 255e0a971 bep
* docs: Adjust last merge from docs repository 6580cd30a jmooring
* docs: Regen docs helper 7617de86c bep

Page 1 of 44

Links

Releases

Has known vulnerabilities

© 2024 Safety CLI Cybersecurity Inc. All Rights Reserved.