deps: bump HUGO to 0.168.0

[updateclibot]

deps: Bump HUGO version in Netlify configuration

deps: update hugo used by Netlify to 0.168.0

1 file(s) updated with "HUGO_VERSION = \"0.168.0\"": * netlify.toml

v0.168.0

## Notable new features

* New [`imaging.firstFrameOnly`](https://gohugo.io/configuration/imaging/#firstframeonly) option (and a matching processing flag) to only decode/encode the first frame of animated images. Hugo now also only decodes the first frame when the target format doesn't support animation, and fails early with an informative error if processing all frames would exceed the WASM memory limit.
* New [`FrameCount`](https://gohugo.io/methods/resource/framecount/) method on images, e.g. to check if an image is animated.
* [`site.Language`](https://gohugo.io/methods/site/language/) now has `Translate` and `Format*` methods, so you can e.g. range over `site.Languages` and translate into each language.
* New `charset` option for [`js.Build`](https://gohugo.io/functions/js/build/) and [`css.Build`](https://gohugo.io/functions/css/build/).
* Basic support for the OSC 7501 program status (working/done/idle/error) in terminals that support it, alongside the existing OSC 9;4 progress.

## Security fixes

This release is built with Go 1.27.2, which includes [15 security fixes](https://seclists.org/oss-sec/2026/q4/101). The most relevant for Hugo are:

* Two `html/template` escaping fixes, which also apply to Hugo's fork of the package: [CVE-2026-94448](https://github.com/golang/go/issues/81821) (context tracking not reset on consecutive expressions in JS template literals) and [CVE-2026-97030](https://github.com/golang/go/issues/81823) (`yield` not recognized as a regexp preceder keyword). Both could lead to incorrect escaping of inline JavaScript.
* Several `net/http` fixes (HTTP/2 server crash and memory exhaustion, connection desynchronization, unbounded `Range` header parsing), relevant for `hugo server` and remote resources. The corresponding HTTP/2 fixes are also included via the upgrade of `golang.org/x/net` to v0.61.0.
* [CVE-2026-56857](https://github.com/golang/go/issues/81739): `os.Root.Mkdir(All)` could follow junctions out of the root on Windows.

Also:

* `github.com/tdewolff/minify` is upgraded to v2.24.19, which fixes [GHSA-3ppm-p7r9-c5w3](https://github.com/tdewolff/minify/releases/tag/v2.24.18): `</script>` (and `<!--`) inside inline scripts was not properly escaped (case-insensitively) when minifying JS in HTML.
* Hugo now ignores `module.replacements` defined in themes; only the project can define replacements.

## Changes

* Fix PAGE.IsNode warning in jsonify 0732eadd @bep #15420 
* hugolib: Fix rebuild when content is also mounted as assets ac62c804 @taekop #12838 
* Fix deprecation issues in tests be8ffd62 @bep 
* circleci: Update config.yml to version 2.1 285d0efc @bep 
* warpc: Upgrade libavif, AOM, dav1d versions c94bdf92 @bep 
* warpc: Upgrade to javy 9.1.0 63fb71ca @bep 
* warpc: Upgrade to wasi-sdk-34 2f2f33b2 @bep 
* ci: Drop extended build tag on Windows tests 53aae446 @bep 
* Add imaging.firstFrameOnly and some animation performance improvements 13ee7e97 @bep #15433 
* js, css: Add charset option to js.Build and css.Build 0688a8cd @bep #15435 
* Add ImageResource.FrameCount c9f6e4d4 @bep #15430 
* Add Translate and Format* methods to Language df8badea @bep #7844 
* Add basic support for OSC 7501 program status d1024ae6 @bep #15425 
* modules: Ignore module.replacements defined in themes 6883b55a @bep 
* Upgrade to Go 1.27.2 f44c355e @bep #15427 
* ci: Add temporary workaround for staticcheck vs Go 1.27.2 46123a60 @bep 
* transform/metainject: Inject Hugo generator tag last in <head> 31f5395d @toddy15 
* Make tests run on GOARCH 386 6b3ba3a7 @bep #15403 
* Update vulnerability reporting instructions ec69d0e6 @bep 

## Dependency Updates

* build(deps): bump golang.org/x/image from 0.46.0 to 0.47.0 2bbad501 @dependabot[bot] 
* build(deps): bump golang.org/x/mod from 0.41.0 to 0.42.0 030619b4 @dependabot[bot] 
* build(deps): bump golang.org/x/net from 0.59.0 to 0.61.0 13ef7079 @dependabot[bot] 
* build(deps): bump github.com/bits-and-blooms/bitset 846b1d74 @dependabot[bot] 
* build(deps): bump github.com/tdewolff/minify/v2 from 2.24.17 to 2.24.19 16441d2f @dependabot[bot] 

## Build Setup

* snap: Update base to core26 8c88da37 @jmooring 

GitHub Action workflow link

deps: Bump HUGO version from GitHub Action

deps: update hugo used by Github Action to 0.168.0

1 file(s) updated with "hugo-version: 0.168.0": * .github/workflows/build.yaml

v0.168.0

## Notable new features

* New [`imaging.firstFrameOnly`](https://gohugo.io/configuration/imaging/#firstframeonly) option (and a matching processing flag) to only decode/encode the first frame of animated images. Hugo now also only decodes the first frame when the target format doesn't support animation, and fails early with an informative error if processing all frames would exceed the WASM memory limit.
* New [`FrameCount`](https://gohugo.io/methods/resource/framecount/) method on images, e.g. to check if an image is animated.
* [`site.Language`](https://gohugo.io/methods/site/language/) now has `Translate` and `Format*` methods, so you can e.g. range over `site.Languages` and translate into each language.
* New `charset` option for [`js.Build`](https://gohugo.io/functions/js/build/) and [`css.Build`](https://gohugo.io/functions/css/build/).
* Basic support for the OSC 7501 program status (working/done/idle/error) in terminals that support it, alongside the existing OSC 9;4 progress.

## Security fixes

This release is built with Go 1.27.2, which includes [15 security fixes](https://seclists.org/oss-sec/2026/q4/101). The most relevant for Hugo are:

* Two `html/template` escaping fixes, which also apply to Hugo's fork of the package: [CVE-2026-94448](https://github.com/golang/go/issues/81821) (context tracking not reset on consecutive expressions in JS template literals) and [CVE-2026-97030](https://github.com/golang/go/issues/81823) (`yield` not recognized as a regexp preceder keyword). Both could lead to incorrect escaping of inline JavaScript.
* Several `net/http` fixes (HTTP/2 server crash and memory exhaustion, connection desynchronization, unbounded `Range` header parsing), relevant for `hugo server` and remote resources. The corresponding HTTP/2 fixes are also included via the upgrade of `golang.org/x/net` to v0.61.0.
* [CVE-2026-56857](https://github.com/golang/go/issues/81739): `os.Root.Mkdir(All)` could follow junctions out of the root on Windows.

Also:

* `github.com/tdewolff/minify` is upgraded to v2.24.19, which fixes [GHSA-3ppm-p7r9-c5w3](https://github.com/tdewolff/minify/releases/tag/v2.24.18): `</script>` (and `<!--`) inside inline scripts was not properly escaped (case-insensitively) when minifying JS in HTML.
* Hugo now ignores `module.replacements` defined in themes; only the project can define replacements.

## Changes

* Fix PAGE.IsNode warning in jsonify 0732eadd @bep #15420 
* hugolib: Fix rebuild when content is also mounted as assets ac62c804 @taekop #12838 
* Fix deprecation issues in tests be8ffd62 @bep 
* circleci: Update config.yml to version 2.1 285d0efc @bep 
* warpc: Upgrade libavif, AOM, dav1d versions c94bdf92 @bep 
* warpc: Upgrade to javy 9.1.0 63fb71ca @bep 
* warpc: Upgrade to wasi-sdk-34 2f2f33b2 @bep 
* ci: Drop extended build tag on Windows tests 53aae446 @bep 
* Add imaging.firstFrameOnly and some animation performance improvements 13ee7e97 @bep #15433 
* js, css: Add charset option to js.Build and css.Build 0688a8cd @bep #15435 
* Add ImageResource.FrameCount c9f6e4d4 @bep #15430 
* Add Translate and Format* methods to Language df8badea @bep #7844 
* Add basic support for OSC 7501 program status d1024ae6 @bep #15425 
* modules: Ignore module.replacements defined in themes 6883b55a @bep 
* Upgrade to Go 1.27.2 f44c355e @bep #15427 
* ci: Add temporary workaround for staticcheck vs Go 1.27.2 46123a60 @bep 
* transform/metainject: Inject Hugo generator tag last in <head> 31f5395d @toddy15 
* Make tests run on GOARCH 386 6b3ba3a7 @bep #15403 
* Update vulnerability reporting instructions ec69d0e6 @bep 

## Dependency Updates

* build(deps): bump golang.org/x/image from 0.46.0 to 0.47.0 2bbad501 @dependabot[bot] 
* build(deps): bump golang.org/x/mod from 0.41.0 to 0.42.0 030619b4 @dependabot[bot] 
* build(deps): bump golang.org/x/net from 0.59.0 to 0.61.0 13ef7079 @dependabot[bot] 
* build(deps): bump github.com/bits-and-blooms/bitset 846b1d74 @dependabot[bot] 
* build(deps): bump github.com/tdewolff/minify/v2 from 2.24.17 to 2.24.19 16441d2f @dependabot[bot] 

## Build Setup

* snap: Update base to core26 8c88da37 @jmooring 

GitHub Action workflow link

---

Created automatically by Updatecli Options: Most of Updatecli configuration is done via its manifest(s). If you close this pull request, Updatecli will automatically reopen it, the next time it runs. If you close this pull request and delete the base branch, Updatecli will automatically recreate it, erasing all previous commits made. Feel free to report any issues at github.com/updatecli/updatecli. If you find this tool useful, do not hesitate to star our GitHub repository as a sign of appreciation, and/or to tell us directly on our chat!

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: b87eb7dd-ca1a-4e25-92e7-1985fd7d054f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}