Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package hugo for openSUSE:Factory checked in at 2026-10-31 23:08:17 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/hugo (Old) and /work/SRC/openSUSE:Factory/.hugo.new.1255 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "hugo" Sat Oct 31 23:08:17 2026 rev:118 rq:1393981 version:0.169.0 Changes: -------- --- /work/SRC/openSUSE:Factory/hugo/hugo.changes 2026-10-27 17:10:18.322112184 +0100 +++ /work/SRC/openSUSE:Factory/.hugo.new.1255/hugo.changes 2026-10-31 23:10:19.622781189 +0100 @@ -1,0 +2,62 @@ +Fri Oct 30 22:54:40 UTC 2026 - Dirk Müller <[email protected]> + +- update to 0.169.0: + * Templates are trusted in Hugo, but content (including front + matter) is not necessarily. This release tightens a few + places where values from content could end up rendered as + unescaped HTML: + * `pre` and `post` values in menu entries defined in **front + matter** are now HTML escaped, unless `text/html` is allowed + in `security.allowContent`, which already marks HTML in + `/content` as trusted. A warning (`warning-menu-pre-post- + html-escaped`) is logged when a value containing HTML markup + is escaped. Menu entries defined in the project configuration + are not affected. f63482bf + * `emojify` and `plainify` now return a `string` unless the + input is `template.HTML`, in which case the result is also + `template.HTML`. Previously both always returned + `template.HTML`, so e.g. `{{ .Title | emojify }}` would mark + a potentially unsafe title as safe HTML. If you relied on the + old behavior with trusted input, pipe the result through + `safeHTML`. Thanks to @Reload3d for reporting this. #15452 + * hugolib: Fix template change detection when saving via temp + file and rename 46e51f30 @bep #15484 + * markup/goldmark: Fix auto heading ID when link text starts + with a bracket c22158c1 @chanellebingham #15472 + * urls: Fix JoinPath panic with empty slice ce5d232b + @Ferdinand-MZ #15473 + * js: Fix js.Build with browser-disabled extensionless requires + 2efee511 @bep #15481 + * Fix Site.Key used in e.g. partialCached b86e0caa @bep #15466 + * ci: Fix Windows running out of disk space and simplify test + runs 77230eba @bep + * hugolib: Fix build hang after too many page render errors + 85fb23f1 @bep #15449 + * tpl/cast: Fix nil pointer panic in hugo gen docshelper + 8df31809 @jmooring #15444 + * ## Improvements + * Redirect .Params.title etc. to .Title etc. and deprecate it + 53e1fef9 @bep + * ci: Revert to plain go install + honnef.co/go/tools/cmd/staticcheck@latest 3e67572c @bep + * navigation: Escape pre/post in front matter menu entries + f63482bf @bep + * Upgrade to Go 1.27.3 7343fc9c @bep + * resources: Make processed image key stable across builds + ff4eab75 @bep #15467 + * tpl: Make StripHTML (plainify) more robust and faster + 7ec3a366 @bep #15462 + * tpl/transform: Make emojify and plainify preserve + template.HTML input type 895f5837 @bep #15452 + * Make emojify return a string 87bf5858 @bep #15452 + * Skip staticcheck in check.sh unless --full is set 9d502917 + @bep #15453 + +------------------------------------------------------------------- +Fri Oct 30 22:51:59 UTC 2026 - Dirk Müller <[email protected]> + +- update vendor.tar to address: + * bsc#1288336, CVE-2026-116585,CVE-2026-116586,CVE-2026-116587: + github.com/go-jose/go-jose/v4: multiple security issues + +------------------------------------------------------------------- Old: ---- hugo-0.168.0.tar.gz New: ---- hugo-0.169.0.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ hugo.spec ++++++ --- /var/tmp/diff_new_pack.h1sAOq/_old 2026-10-31 23:10:22.153885983 +0100 +++ /var/tmp/diff_new_pack.h1sAOq/_new 2026-10-31 23:10:22.155886066 +0100 @@ -17,7 +17,7 @@ Name: hugo -Version: 0.168.0 +Version: 0.169.0 Release: 0 Summary: Static website generator written in Go License: Apache-2.0 AND MPL-2.0 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.h1sAOq/_old 2026-10-31 23:10:22.193887640 +0100 +++ /var/tmp/diff_new_pack.h1sAOq/_new 2026-10-31 23:10:22.196887764 +0100 @@ -3,7 +3,7 @@ <param name="url">https://github.com/gohugoio/hugo.git</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">v0.168.0</param> + <param name="revision">v0.169.0</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> <param name="changesgenerate">enable</param> @@ -15,6 +15,7 @@ <param name="compression">gz</param> </service> <service name="go_modules" mode="manual"> + <param name="replace">github.com/go-jose/go-jose/v4=github.com/go-jose/go-jose/[email protected]</param> </service> </services> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.h1sAOq/_old 2026-10-31 23:10:22.220888757 +0100 +++ /var/tmp/diff_new_pack.h1sAOq/_new 2026-10-31 23:10:22.223888882 +0100 @@ -1,6 +1,6 @@ <servicedata> <service name="tar_scm"> <param name="url">https://github.com/gohugoio/hugo.git</param> - <param name="changesrevision">e27a6760c5547237f87d353aebe0580feadb20f4</param></service></servicedata> + <param name="changesrevision">1da10fc44701c566b1669cdb2d12638f155138bd</param></service></servicedata> (No newline at EOF) ++++++ hugo-0.168.0.tar.gz -> hugo-0.169.0.tar.gz ++++++ /work/SRC/openSUSE:Factory/hugo/hugo-0.168.0.tar.gz /work/SRC/openSUSE:Factory/.hugo.new.1255/hugo-0.169.0.tar.gz differ: char 12, line 1 ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/hugo/vendor.tar.gz /work/SRC/openSUSE:Factory/.hugo.new.1255/vendor.tar.gz differ: char 12, line 1
