Skip to content

chore(deps): update ralphex-fe toolchain - #135

Merged
renovate[bot] merged 1 commit into
masterfrom
renovate/ralphex-fe-toolchain
Sep 9, 2026
Merged

chore(deps): update ralphex-fe toolchain#135
renovate[bot] merged 1 commit into
masterfrom
renovate/ralphex-fe-toolchain

Conversation

@renovate

@renovate renovate Bot commented Sep 9, 2026

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Update Pending
bun (source) 1.3.9 → 1.4.2 age confidence minor
gohugoio/hugo 0.156.0 → 0.165.0 age confidence minor 0.166.0

Release Notes

oven-sh/bun (bun)

v1.4.2: Bun v1.4.2

Compare Source

To install Bun v1.4.2

curl -fsSL https://bun.sh/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.4.2:

bun upgrade
Read Bun v1.4.2's release notes on Bun's blog
Thanks to 3 contributors!

v1.4.1

Compare Source

v1.4.0: Bun v1.4

Compare Source

To install Bun v1.4

curl -fsSL https://bun.com/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.com/install.ps1|iex"

To upgrade to Bun v1.4.0:

bun upgrade

Read the blog post: image (1)

Thank you

Bun is free, open source, and MIT-licensed. We receive a lot of contributions from the community, and we'd like to thank everyone who fixed a bug or contributed since Bun v1.3.

v1.3.14: Bun v1.3.14

Compare Source

To install Bun v1.3.14

curl -fsSL https://bun.sh/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.3.14:

bun upgrade
Read Bun v1.3.14's release notes on Bun's blog
Thanks to 11 contributors!

v1.3.13: Bun v1.3.13

Compare Source

To install Bun v1.3.13

curl -fsSL https://bun.sh/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.3.13:

bun upgrade
Read Bun v1.3.13's release notes on Bun's blog
Thanks to 8 contributors!

v1.3.12: Bun v1.3.12

Compare Source

To install Bun v1.3.12

curl -fsSL https://bun.sh/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.3.12:

bun upgrade
Read Bun v1.3.12's release notes on Bun's blog
Thanks to 8 contributors!

v1.3.11: Bun v1.3.11

Compare Source

To install Bun v1.3.11

curl -fsSL https://bun.sh/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.3.11:

bun upgrade
Read Bun v1.3.11's release notes on Bun's blog
Thanks to 15 contributors!

v1.3.10: Bun v1.3.10

Compare Source

To install Bun v1.3.10

curl -fsSL https://bun.sh/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.3.10:

bun upgrade
Read Bun v1.3.10's release notes on Bun's blog
Thanks to 11 contributors!
gohugoio/hugo (gohugoio/hugo)

v0.165.0

Compare Source

The two main new things is the new css.ChromaStyles template func and the new importContext option demonstrated below.

{{ $light := css.ChromaStyles (dict "targetPath" "css/components/chroma-light.css" "style" "github" "mode" "light") }}
{{ $dark := css.ChromaStyles (dict "targetPath" "css/components/chroma-dark.css" "style" "github" "mode" "dark") }}
{{ $opts := dict "minify" true "importContext" (slice $light $dark) }}
{{ $css := resources.Get "css/main.css" | css.Build $opts }}

The importContext is relevant for css.Build, js.Build, css.Sass, and css.PostCSS. and it allows you to make resources (e.g. built from resources.FromString) resolvable in e.g. CSS @import statements.

Note

Bug fixes

Improvements

Dependency Updates

Documentation

v0.164.0

Compare Source

Notable new features in this release are:

Notes

Changes

Dependency Updates

v0.163.3

Compare Source

What's Changed

v0.163.2

Compare Source

What's Changed

v0.163.1

Compare Source

The majority of the fixes in this release are security related (including the upstream fix in 93c8c7d (golang.org/x/image)). Thanks to @​vnth4nhnt for finding the issues fixed in a00b5c7 and cf9c8f9 (I will do the CVE work on this later). There has been a uptick in security reports lately, which doesn't mean that Hugo has gotten less secure, this is mostly the work of the new and powerful AI tools using Hugo's restrictive security model as their baseline. Just take a look at Go's recent security issue list to see a demonstration of this.

What's Changed

v0.163.0

Compare Source

The main topic in this release is improvements to the AVIF image handling that we introduced in v0.162.0. See the docs for details, but:

  • We have turned down the default quality for AVIF to 60. Turns out, JPEG/WebP with quality 75 is comparable to AVIF with quality 60. You can now also set quality per image format in your project config (and also per image processed if needed).
  • We have added a hint to the AVIF with the same values as for WEBP. For lossy compression, the photo/picture hints (and the default) encodes with YUV420 chroma subsampling instead of YUV444, keeping 444 for text/icon/drawing. This greatly reduces the memory needed to encode these images.

Improvements

Dependency Updates

v0.162.1

Compare Source

What's Changed

v0.162.0

Compare Source

The notable new feature in this release is support for AVIF images (both encoder and decoder). There's a demo site set up that demonstrates the difference between HDR AVIF and SDR JPEG images. Note that that demo is only really interesting if viewed on an HDR capable screen (e.g. Apple Retina).

Security fixes

There are some notable security fixes in this release.

Security fixes in Go

This release upgrades from Go 1.26.1 to 126.3, which brings a set of security fixes. Some relevant for Hugo are:

  • XSS in html/template (CVE-2026-39826 & CVE-2026-39823): Two separate vulnerabilities where escaper bypasses in html/template could lead to Cross-Site Scripting (XSS).
  • html/template: Fixes an issue where JS template literal contexts were incorrectly tracked across template branches, which could lead to improper content escaping.
Security fixes and hardening in Hugo

The following changes either fix a concrete issue or reduce the default attack surface of hugo builds.

  • Disallow text/html content files by default (e41a064). A new security.allowContent policy gates which content media types may be used for pages under /content. text/html is denied by default; sites that rely on hand-authored or adapter-emitted HTML content can opt back in with security.allowContent = ['.*'].
  • Re-check security.http.urls on every redirect hop in resources.GetRemote (86fbb0f).
  • Reject symlinked entries in resources.Get (f8b5fa0).

We will update this section later with links to CVEs where applicable.

All changes

[`v

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot enabled auto-merge (squash) September 9, 2026 18:10
@renovate
renovate Bot merged commit 757ce33 into master Sep 9, 2026
11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants