v0.139.4

gohugoio/hugov0.139.4Dec 9, 2024by bep

AI Summary

A security release fixing a vulnerability related to Markdown attributes in render hooks and shortcodes.

Key Highlights

Security Advisory GHSA-c2xf-9v2r-r2rx
Fixes for Markdown attribute escaping

Full Release Notes

This release contains a security fix. See this [Security Advisory](https://github.com/gohugoio/hugo/security/advisories/GHSA-c2xf-9v2r-r2rx) for details. Note that this is only relevant if you don't trust your content (e.g. Markdown) files.

## What's Changed

* tpl/tplimpl: Escape Markdown attributes in render hooks and shortcodes 54398f8d5 @jmooring 
* deps: Upgrade github.com/bep/godartsass/v2 v2.3.1 => v2.3.2 b8c15f245 @bep 
* common/maps: Simplify TestScratchSetInMap/DeleteInMap d0dc51884 @alexandear 
* markup/tableofcontents: Cast Fragments.ToHTML args to int b52985900 @jmooring #13107