Hugo v0.168.0 Adds First-Frame Image Processing, i18n Translation Methods and Go 1.27.2 Security Fixes

Hugo v0.168.0 is out, and it focuses on image processing control, richer multilingual tooling and a build-chain security refresh. The release ships compiled with Go 1.27.2, which bundles 15 security fixes upstream, so upgrading Hugo also upgrades the runtime guarantees behind your site builds.

New imaging.firstFrameOnly option (with a matching processing flag) that decodes and encodes only the first frame of animated images.
Hugo now automatically decodes just the first frame whenever the target format cannot represent animation, and fails early with an informative error if processing every frame would exceed the WASM memory limit.
New FrameCount method on images, useful for detecting whether an image is animated.
site.Language gains Translate and Format* methods, so you can range over site.Languages and render translated strings per language.
New charset option for js.Build and css.Build.
Basic support for the OSC 7501 program status (working, done, idle, error) in terminals that implement it, alongside the existing OSC 9;4 progress reporting.
Security: two html/template escaping fixes inherited by Hugo's fork of the package, CVE-2026-94448 (context tracking not reset across consecutive expressions in JS template literals) and CVE-2026-97030 (yield not recognized as a regexp preceder keyword).
Several net/http fixes, including HTTP/2 serving issues.

The practical impact is twofold. First, animated-image pipelines become cheaper and more predictable: dropping to a single frame avoids burning memory on work you discard, and the early failure mode turns an opaque OOM into a readable error. Second, the new site.Language methods remove a long-standing awkwardness in multilingual templates, letting you translate into each language while iterating site.Languages instead of wiring lookups manually. The charset option for js.Build and css.Build gives finer control over emitted asset encoding. Given the escaping and HTTP fixes, this is a sensible release to adopt sooner rather than later.

Source: https://github.com/gohugoio/hugo/releases/tag/v0.168.0