惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

Forbes - Security
Forbes - Security
The GitHub Blog
The GitHub Blog
腾讯CDC
GbyAI
GbyAI
宝玉的分享
宝玉的分享
The Register - Security
The Register - Security
B
Blog RSS Feed
freeCodeCamp Programming Tutorials: Python, JavaScript, Git & More
T
Tailwind CSS Blog
AWS News Blog
AWS News Blog
S
Schneier on Security
P
Proofpoint News Feed
C
Check Point Blog
T
Threat Research - Cisco Blogs
Threat Intelligence Blog | Flashpoint
Threat Intelligence Blog | Flashpoint
Last Week in AI
Last Week in AI
NISL@THU
NISL@THU
H
Hacker News: Front Page
Blog — PlanetScale
Blog — PlanetScale
T
The Exploit Database - CXSecurity.com
S
Security Affairs
www.infosecurity-magazine.com
www.infosecurity-magazine.com
H
Hackread – Cybersecurity News, Data Breaches, AI and More
Latest news
Latest news
MongoDB | Blog
MongoDB | Blog
T
Tenable Blog
C
CERT Recently Published Vulnerability Notes
Security Latest
Security Latest
C
Cisco Blogs
Exploit-DB.com RSS Feed
Exploit-DB.com RSS Feed
CTFtime.org: upcoming CTF events
CTFtime.org: upcoming CTF events
N
News and Events Feed by Topic
人人都是产品经理
人人都是产品经理
Cyber Security Advisories - MS-ISAC
Cyber Security Advisories - MS-ISAC
M
MIT News - Artificial intelligence
Google DeepMind News
Google DeepMind News
F
Full Disclosure
L
LINUX DO - 热门话题
博客园 - Franky
K
Kaspersky official blog
C
Cyber Attacks, Cyber Crime and Cyber Security
U
Unit 42
Recorded Future
Recorded Future
Google DeepMind News
Google DeepMind News
WordPress大学
WordPress大学
aimingoo的专栏
aimingoo的专栏
Project Zero
Project Zero
F
Fortinet All Blogs
O
OpenAI News
Recent Announcements
Recent Announcements

Hugo News

Release v0.164.0 · gohugoio/hugo Release v0.163.3 · gohugoio/hugo Release v0.163.2 · gohugoio/hugo Release v0.163.1 · gohugoio/hugo Release v0.163.0 · gohugoio/hugo Release v0.162.1 · gohugoio/hugo Release v0.161.1 · gohugoio/hugo Release v0.161.0 · gohugoio/hugo Release v0.160.1 · gohugoio/hugo Release v0.160.0 · gohugoio/hugo Release v0.159.2 · gohugoio/hugo Release v0.159.1 · gohugoio/hugo Release v0.159.0 · gohugoio/hugo Release v0.158.0 · gohugoio/hugo Release v0.157.0 · gohugoio/hugo Release v0.156.0 · gohugoio/hugo Release v0.155.3 · gohugoio/hugo Release v0.155.2 · gohugoio/hugo Release v0.155.1 · gohugoio/hugo Release v0.155.0 · gohugoio/hugo Release v0.154.5 · gohugoio/hugo Release v0.154.4 · gohugoio/hugo Release v0.154.3 · gohugoio/hugo Release v0.154.2 · gohugoio/hugo Release v0.154.1 · gohugoio/hugo Release v0.154.0 · gohugoio/hugo Release v0.153.5 · gohugoio/hugo Release v0.153.4 · gohugoio/hugo Release v0.153.3 · gohugoio/hugo
Release v0.162.0 · gohugoio/hugo
2026-05-26 · via Hugo News

The notable new feature in this release is support for AVIF images (both encoder and decoder). There's a demo site set up that demonstrates the difference between HDR AVIF and SDR JPEG images. Note that that demo is only really interesting if viewed on an HDR capable screen (e.g. Apple Retina).

Security fixes

There are some notable security fixes in this release.

Security fixes in Go

This release upgrades from Go 1.26.1 to 126.3, which brings a set of security fixes. Some relevant for Hugo are:

  • XSS in html/template (CVE-2026-39826 & CVE-2026-39823): Two separate vulnerabilities where escaper bypasses in html/template could lead to Cross-Site Scripting (XSS).
  • html/template: Fixes an issue where JS template literal contexts were incorrectly tracked across template branches, which could lead to improper content escaping.

Security fixes and hardening in Hugo

The following changes either fix a concrete issue or reduce the default attack surface of hugo builds.

  • Disallow text/html content files by default (e41a064). A new security.allowContent policy gates which content media types may be used for pages under /content. text/html is denied by default; sites that rely on hand-authored or adapter-emitted HTML content can opt back in with security.allowContent = ['.*'].
  • Re-check security.http.urls on every redirect hop in resources.GetRemote (86fbb0f).
  • Reject symlinked entries in resources.Get (f8b5fa0).

We will update this section later with links to CVEs where applicable.

All changes