v0.140.2

gohugoio/hugov0.140.2Dec 30, 2024by bep

AI Summary

A security update addressing a vulnerability in `golang.org/x/net`'s `html.Parse` function.

Key Highlights

Security fix in `html.Parse` function
Fixes for slice of language configs
Fix for output format validation errors

Full Release Notes

The timing of this release comes from the security fix in `golang.org/x/net`'s `html.Parse` function. This is used in two places in Hugo:

1. Extracting table of contents from Asciidoctor rendered output.
2. Collecting HTML classes etc. when build stats is [enabled](https://gohugo.io/getting-started/configuration-build/#configure-build-stats)

It's a little bit of a stretch to see how this could be exploited in Hugo, but we understand that many want a clean security report. See [this issue](https://github.com/golang/go/issues/70179) for details.


## What's Changed

* Print cli usage of `hugo gen chromastyles` alongside css 83cec785c @diwasrimal 
* build(deps): bump golang.org/x/net from 0.32.0 to 0.33.0 4e52be8b9 @dependabot[bot] 
* config/allconfig: Fix slice of language configs 7888ac585 @jmooring #13201 
* config/allconfig: Throw error when output format is not defined eb1dbe070 @jmooring #13199 
* Fix same resource file published more than once 77824d704 @bep #13164 
* markup/highlight: Add wrapperClass option ec0caaec7 @bep 
* Update README.md 845b8885d @bep