The big new feature in this release is js.Batch – this enables JavaScript bundle groups (e.g. scripts per section) with global code splitting and flexible hooks/runners setup.

Bug fixes

• Fix panic on server rebuilds when using both base templates and template.Defer a5e5be2 @bep #12963
• js: Fix js.Batch for multihost setups 565c30e @bep #13151
• parser/pageparser: Fix Org Mode summary delimiter assignment 48dd6a9 @jmooring #13152
• Fix a rebuild on resource rename case 744b856 @bep
• tpl/tplimpl: Fix title attribute in details shortcode a32c889 @jmooring
• Fix Sass imports on the form index.{scss,sass} 5ab38de @bep #13123
• markup/goldmark: Fix blockquote render hook text parsing 3437340 @jmooring #12913 #13119

Improvements

• js/esbuild: Add missing es2024 target 5c80cb0 @bep
• js/esbuild: Add runners after scripts 7de5317 @bep
• js/esbuild: Batch: Avoid nil Instances slice 4cbd4ef @bep
• tpl/tplimpl: Update youtube shortcode 852d868 @jmooring
• tpl/tplimpl: Update details shortcode 1e34e5b @jmooring
• tpl/collections: Allow querify to accept a map argument 641d261 @jmooring #13131
• js/esbuild: Build groups in order of their ID a834bb9 @bep
• tpl/tplimpl: Add details shortcode 4f130f6 @racehd
• Write all logging (INFO, WARN, ERROR) to stderr 9dfa112 @bep #13074
• js/esbuild: Add platform option ec1933f @bep #13136
• Add config option disableDefaultLanguageRedirect 75ad9cd @bep #13133
• Add js.Batch e293e7c @bep #12626 #7499 #9978 #12879 #13113 #13116
• Upgrade to Go 1.23.4 6be2530 @bep #13130
• Remove some old and unused shell scripts 989b299 @bep

Dependency Updates

• build(deps): bump golang.org/x/crypto from 0.30.0 to 0.31.0 157d864 @dependabot[bot]
• build(deps): bump golang.org/x/tools from 0.27.0 to 0.28.0 947e4e6 @dependabot[bot]
• build(deps): bump github.com/hairyhenderson/go-codeowners 5f89786 @dependabot[bot]
• build(deps): bump golang.org/x/net from 0.31.0 to 0.32.0 7b69218 @dependabot[bot]

This is a release created for technical reasons, see #13147

It's the same as https://github.com/gohugoio/hugo/releases/tag/v0.139.4 -- go there for release archives.

This release contains a security fix. See this Security Advisory for details. Note that this is only relevant if you don't trust your content (e.g. Markdown) files.

What's Changed

• tpl/tplimpl: Escape Markdown attributes in render hooks and shortcodes 54398f8 @jmooring
• deps: Upgrade github.com/bep/godartsass/v2 v2.3.1 => v2.3.2 b8c15f2 @bep
• common/maps: Simplify TestScratchSetInMap/DeleteInMap d0dc518 @alexandear
• markup/tableofcontents: Cast Fragments.ToHTML args to int b529859 @jmooring #13107

What's Changed

• Fix server edits of resources included in shortcode/hooks c1dc35d @bep #13093
• commands: Fix flaw in the livereload logic dea158c @bep
• build(deps): bump github.com/bep/godartsass/v2 from 2.3.0 to 2.3.1 7e130e3 @dependabot[bot]
• build(deps): bump github.com/tetratelabs/wazero from 1.8.1 to 1.8.2 88b7868 @dependabot[bot]
• Fix some typos fc3d1cb @thirdkeyword

Note that this is the second patch release today. See v0.139.1. We had to do this release to get the Hugo Docs build running.

What's Changed

• modules: Skip empty lines in modules.txt 0ab8189 @bep #13084

What's Changed

• Revert "build(deps): bump github.com/tdewolff/minify/v2 from 2.20.37 to 2.21.1" aa3dd19 @bep #13082
• minifiers: Add failing test for upstream bug 5a50eee @bep #13082
• dartsass: Fix nilpointer on Close when Dart Sass isn't installed 8d017a6 @bep #13076

This release is mostly about removing code that has been deprecated for a long time. This has been shown as an ERROR in the build log and failed the build for at least the last 6 minor Hugo versions, in most cases much longer.

But this is also a full dependency refresh, and there are also some new stuff. For one, we added a -O flag to hugo server to open up the site in your browser after start. This is now my (@bep) shortcut to start the server:

function h() {
  hugo server  -F -O -N -D
}

Note

• dartsass: Remove support for v1 of the protocol/binary (note) 1fd845e @bep
• Remove deprecations <= v0.122.0 (note) ad43d13 @bep

Bug fixes

• dartsass: Fix error message 8d92042 @bep #13065
• Fix extra newline/paragraphs issue with .RenderShortcodes d4de780 @bep #13051
• markup/goldmark: Fix typo in error message e79ee0d @deining

Improvements

• Make sure term is always set e917401 @bep #13063
• dartsass: Add silenceDeprecations option 3b6eaf9 @bep #13045
• Run go mod tidy 5e3133a @bep
• commands: Add -O flag to server to open browser ac6962d @bep #13040
• Preserve input type. 23d21b0 @KN4CK3R
• server: Strip ANSI escape codes from browser error log ce9cf88 @bep #13037
• parser/metadecoders: Add benchmark 8aba6dc @bep
• Add site.Store and hugo.Store and Shortcode.Store a7df536 @bep #13021
• markup/goldmark: Improve the raw HTML omitted warning 2b97a2a @jmooring #13023

Dependency Updates

• build(deps): bump github.com/aws/aws-sdk-go-v2/service/cloudfront eb29814 @dependabot[bot]
• build(deps): bump google.golang.org/api from 0.191.0 to 0.206.0 61e2ce2 @dependabot[bot]
• build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.30.3 to 1.32.4 2d503f8 @dependabot[bot]
• build(deps): bump github.com/fsnotify/fsnotify from 1.7.0 to 1.8.0 3a6b2e6 @dependabot[bot]
• deps: Upgrade github.com/bep/imagemeta v0.8.1 => v0.8.3 6bde8ab @bep
• build(deps): bump golang.org/x/tools from 0.26.0 to 0.27.0 2c54c32 @dependabot[bot]
• build(deps): bump github.com/tdewolff/minify/v2 from 2.20.37 to 2.21.1 7a2f04e @dependabot[bot]
• build(deps): bump github.com/fatih/color from 1.17.0 to 1.18.0 7921777 @dependabot[bot]
• build(deps): bump golang.org/x/image from 0.21.0 to 0.22.0 33e964d @dependabot[bot]
• deps: Upgrade github.com/yuin/goldmark v1.7.4 => v1.7.8 588c901 @bep #12958
• build(deps): bump golang.org/x/sync from 0.8.0 to 0.9.0 46e1705 @dependabot[bot]
• build(deps): bump github.com/hairyhenderson/go-codeowners cb6580d @dependabot[bot]

Documentation

• docs: Regen CLI docs 66dd6ec @bep
• docs: Regenerate CLI docs 58a3c91 @bep

Build Setup

• release: Add missing withdeploy archive for arm64 Linux f7fc6cc @bep #13029

What's Changed

• Fix concurrent map read and map write in short page lookups 95e2d5b @bep #13019
• Alias Page.Scratch to Page.Store (note) 2c3efc8 @bep #13016

What's Changed

• common/hugo: Add withdeploy to the version string printed in hugo version ca4fc58 @bep
• markup: Goldmark log "Raw HTML omitted" warning also for inline HTML 4faaaf9 @bep #13013
• build: Add missing withdeploy archive for Windows 94b46c3 @bep #13009
• commands: Print the "deploy not available" error message even if flags provided 2b0b3b8 @bep #13012
• tpl/tplimpl: Create an embedded comment shortcode 801035b @jmooring #13010

Note that we have no longer build the deploy feature in the standard and extended archives. If you need that, download archives with withdeploy in the filename. See instalation for details. You can read #12994 for more on the motivation behind this, but for one, it shaves off about 40% of the binary size.

Bug fixes

• Fix stale pages on rebuilds in GetPage with short refs 30d9aea @bep #13004
• Fix some RenderShortcodes error cases 1f23b49 @bep #12854 #12998
• dynacache: Fix potential deadlocks on panics in GetOrCreate e10915f @bep

Improvements

• Do not watch directories with no mounted files in it fcdc454 @bep #12912 #13007
• markup/goldmark: Only log Raw HTML omitted WARN on block entering 6cf23bf @bep #12997
• markup/goldmark: Add warning (using Warnidf) on Goldmark 62a96ce @bep #12997
• resources: Address Dart Sass deprecation of global built-in functions 889308d @jmooring #12961
• github: Adjust test workflow to install Dart Sass v1.80.3 72352f2 @jmooring
• Build without the deploy feature by default 89bd025 @bep #12994 #12994

Dependency Updates

• deps: Upgrade github.com/bep/godartsass/v2 v2.1.0 => v2.2.0 e3304db @bep
• deps: Upgrade github.com/bep/lazycache v0.6.0 => v0.7.0 62567d3 @bep

Documentation

• Update README.md 5fc1639 @jmooring
• Update README.md 1ec6fa3 @bep