Skip to content

chore(deps): update dependency gohugoio/hugo from 0.140.1' to v0.140.2 (.github/workflows/validate_docs_build.yml)#13478

Closed
renovate[bot] wants to merge 1 commit intodevfrom
renovate/gohugoio-hugo-0.140.x
Closed

chore(deps): update dependency gohugoio/hugo from 0.140.1' to v0.140.2 (.github/workflows/validate_docs_build.yml)#13478
renovate[bot] wants to merge 1 commit intodevfrom
renovate/gohugoio-hugo-0.140.x

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented Oct 20, 2025

This PR contains the following updates:

Package Update Change
gohugoio/hugo patch 0.140.1' -> v0.140.2

Release Notes

gohugoio/hugo (gohugoio/hugo)

v0.140.2

Compare Source

The timing of this release comes from the security fix in golang.org/x/net's html.Parse function. This is used in two places in Hugo:

  1. Extracting table of contents from Asciidoctor rendered output.
  2. Collecting HTML classes etc. when build stats is enabled

It's a little bit of a stretch to see how this could be exploited in Hugo, but we understand that many want a clean security report. See this issue for details.

What's Changed


Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

….140.2 (.github/workflows/validate_docs_build.yml)
@renovate renovate Bot requested a review from Maffooch as a code owner October 20, 2025 17:34
@renovate renovate Bot added the dependencies Pull requests that update a dependency file label Oct 20, 2025
@renovate renovate Bot requested a review from mtesauro as a code owner October 20, 2025 17:34
@kiblik
Copy link
Copy Markdown
Contributor

kiblik commented Oct 20, 2025

Same here #13479 (comment)

@Maffooch Maffooch closed this Oct 23, 2025
@renovate
Copy link
Copy Markdown
Contributor Author

renovate Bot commented Oct 23, 2025

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (v0.140.2). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

@renovate renovate Bot deleted the renovate/gohugoio-hugo-0.140.x branch October 23, 2025 06:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants