[dependabot]

Bumps github.com/gohugoio/hugo from 0.146.3 to 0.160.0.

Release notes

Sourced from github.com/gohugoio/hugo's releases.

v0.160.0

Now you can inject CSS vars, e.g. from the configuration, into your stylesheets when building with css.Build. Also, now all the render hooks has a .Position method, now also more accurate and effective.

Bug fixes

• Fix some recently introduced Position issues 4e91e14c @​bep #14710
• markup/goldmark: Fix double-escaping of ampersands in link URLs dc9b51d2 @​bep #14715
• tpl: Fix stray quotes from partial decorator in script context 43aad711 @​bep #14711

Improvements

• all: Replace NewIntegrationTestBuilder with Test/TestE/TestRunning 481baa08 @​bep
• tpl/css: Support @​import "hugo:vars" for CSS custom properties in css.Build 5d09b5e3 @​bep #14699
• Improve and extend .Position handling in Goldmark render hooks 303e443e @​bep #14663
• markup/goldmark: Clean up test 638262ce @​bep

Dependency Updates

• build(deps): bump github.com/magefile/mage from 1.16.1 to 1.17.1 bf6e35a7 @​dependabot[bot]
• build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 0eda24e6 @​dependabot[bot]
• build(deps): bump golang.org/x/image from 0.37.0 to 0.38.0 beb57a68 @​dependabot[bot]

Documentation

• readme: Revise edition descriptions and installation instructions 9f1f1be0 @​jmooring

v0.159.2

Note that the security fix below is not a potential threat if you either:

• Trust your Markdown content files.
• Have custom render hook template for links and images.

EDIT IN: This release also adds release archives for non-extended-withdeploy builds.

What's Changed

• Fix potential content XSS by escaping dangerous URLs in Markdown links and images 479fe6c6 @​bep
• resources/page: Fix shared reader in Source.ValueAsOpenReadSeekCloser df520e31 @​jmooring #14684

v0.159.1

The regression fixed in this release isn't new, but it's so subtle that we thought we'd release this sooner rather than later. For some time now, the minifier we use have stripped namespaced attributes in SVGs, which broke dynamic constructs using e.g. AlpineJS' x-bind: namespace (library used by Hugo's documentation site).

To fix this, the upstream library has hadded a keepNamespaces slice option. It was not possible to find a default that would make all happy, so we opted for an option that at least would make AlpineJS sites work out of the box:

</tr></table> 

... (truncated)

Commits

• 652fc5a releaser: Bump versions for release of 0.160.0
• bf6e35a build(deps): bump github.com/magefile/mage from 1.16.1 to 1.17.1
• 4e91e14 Fix some recently introduced Position issues
• dc9b51d markup/goldmark: Fix double-escaping of ampersands in link URLs
• 481baa0 all: Replace NewIntegrationTestBuilder with Test/TestE/TestRunning
• 43aad71 tpl: Fix stray quotes from partial decorator in script context
• 9f1f1be readme: Revise edition descriptions and installation instructions
• 0eda24e build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4
• 5d09b5e tpl/css: Support @​import "hugo:vars" for CSS custom properties in css.Build
• 303e443 Improve and extend .Position handling in Goldmark render hooks
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.