Sourced from github.com/gohugoio/hugo's releases.

v0.152.2

In v0.152.0 we tightened the source validation for file mounts. We always said that project mounts can mount with absolute file/directorynames, modules/themes are restricted to relative. In v0.152.0 we narrowed module/themes mounts to be local, which made the setup in the bug report listed below fail:

[[module.mounts]]
source = '../../node_modules/bootstrap'
target = 'assets/vendor/bootstrap'

One part of this is security. But the construct above is usually very odd (the project uses files in a theme/module, not the other way around) and not very portable. But the example above demonstrates a valid exception, that we now have added support for in a portable way. The above example now works as it did before v0.152.0, but going forward you can also write:

[[module.mounts]]
source = 'node_modules/bootstrap'
target = 'assets/vendor/bootstrap'

We now have the node_modules as a special case: For themes/modules we first check if the mounted source exists locally, if not we try relative to the project root.

What's Changed

• deps: Update github.com/tdewolff/minify v2.24.4 => v2.24.5 1c8c21e45 @​jmooring #14086
• hugofs: Make node_modules a "special case" mount 809ebe01f @​bep #14089
• github: Fix typo in stale PR message 08a0679a8 @​jordelver

v0.152.1

These fixes are are all related to the YAML library upgrade in v0.152.0.

• Expand the numeric conversions to template funcs/methods e08278d16 @​bep #14079
• Fix where with uint64 df4f80d54 @​bep #14081
• Fix it so YAML integer types can be used where Go int types are expected d4c78885a @​bep #14079
• tpl/compare: Fix compare/sort of uint64s 29e2c2fa9 @​bep #14078
• Fix "assignment to entry in nil map" on empty YAML config files 0579afc3c @​bep #14074

v0.152.0

The big new thing and the motivation behind this release is the upgrade to a more modern YAML library in @​goccy 's github.com/goccy/go-yaml. It's been a surprisingly long and winding road to get here. Note that this upgrade comes with some minor breaking changes, most notably that the old YAML 1.1 spec listed a set of strings that, when unquoted, were treated as boolean true or false. So if you're using any of the values in the table below as booleans, you need to adjust your YAML, but I suspect that fixing this very surprising behavior will fix more issues than it introduces. A big new thing with this new YAML library is the support for YAML anchors and aliases which helps to reduce duplication in e.g. your configuration. There are some examples in Hugo's release build configuration and in the Hugo's CI release setup.

Values	Old meaning	New meaning
yes, Yes, YES, y, Y, on, On, ON	true (bool)	yes, Yes, YES, y, Y, on, On, ON (string)
no, No, NO, n, N, off, Off, OFF	false (bool)	no, No, NO, n, N, off, Off, OFF (string)

Note

• Replace to gopkg.in/yaml with github.com/goccy/go-yaml (note) a3d954846 @​bep #8822 #13043 #14053

... (truncated)

• 6abdaca releaser: Bump versions for release of 0.152.2
• 1c8c21e deps: Update github.com/tdewolff/minify v2.24.4 => v2.24.5
• 809ebe0 hugofs: Make node_modules a "special case" mount
• 08a0679 github: Fix typo in stale PR message
• 524b986 releaser: Prepare repository for 0.153.0-DEV
• 5869cbd releaser: Bump versions for release of 0.152.1
• e08278d Expand the numeric conversions to template funcs/methods
• df4f80d Fix where with uint64
• d4c7888 Fix it so YAML integer types can be used where Go int types are expected
• 29e2c2f tpl/compare: Fix compare/sort of uint64s
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)