v0.159.2

gohugoio/hugov0.159.2Apr 1, 2026by bep

AI Summary

Addresses a security vulnerability regarding XSS in Markdown links and images, alongside a fix for resource file handling.

Key Highlights

Security fix: Escape dangerous URLs in Markdown links and images to prevent XSS.
Fix shared reader in `Source.ValueAsOpenReadSeekCloser`.

Full Release Notes

Note that the security fix below is not a potential threat if you either:

* Trust your Markdown content files.
* Have custom [render hook template](https://gohugo.io/render-hooks/) for links and images.

EDIT IN: This release also adds release archives for non-extended-withdeploy builds.

## What's Changed

* Fix potential content XSS by escaping dangerous URLs in Markdown links and images 479fe6c6 @bep 
* resources/page: Fix shared reader in Source.ValueAsOpenReadSeekCloser df520e31 @jmooring #14684