Hugo v0.169.0 is out, and its primary motivation is shipping a binary built with Go 1.27.3, which blocks trust in a small set of intermediate certificates over specific security concerns about their operation (see the eMudhra incident). This directly affects any Hugo feature that fetches remote resources over HTTPS, most notably resources.GetRemote. On top of the compiler bump, the release adds security hardening for template functions and menus that can render content as HTML, deprecates a front matter lookup pattern, and delivers a faster, more robust plainify plus assorted bug fixes.
The concrete changes:
- Build now uses Go 1.27.3, which no longer trusts certain intermediate certificates, so remote HTTPS fetches via
resources.GetRemotemay fail against sites chaining through them. - Menu entries defined in front matter now have their
preandpostvalues HTML escaped, unlesstext/htmlis listed insecurity.allowContent(which already marks HTML in the content directory as trusted). - A warning,
warning-menu-pre-post-html-escaped, is logged when a value containing HTML markup is escaped. Menu entries defined in project configuration are unaffected. - Looking up reserved front matter fields via
.Paramsis deprecated; use the dedicated methods instead. plainifyis now faster and more robust.- The release includes a set of bug fixes.
For developers, the certificate change is the one to watch: sites that pull remote assets or data at build time could start failing after upgrading, so verify your resources.GetRemote targets resolve through trusted chains. The menu escaping change reflects Hugo's stance that templates are trusted but content is not, meaning front-matter-authored pre/post menu values can no longer inject raw HTML by default. Audit any theme or config that relied on that behavior, and watch build logs for the new warning. The .Params deprecation is a good prompt to migrate custom templates now, before it becomes a breaking change.
Source: https://github.com/gohugoio/hugo/releases/tag/v0.169.0