From 9345b2313e67707059bca614813846ba70767f93 Mon Sep 17 00:00:00 2001 From: Timur Tukaev Date: Mon, 3 Aug 2026 17:19:56 +0500 Subject: [PATCH] build(hugo): let newer Hugo versions build the site at all MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Hugo's default content policy is `! ^text/html$` — everything except HTML — so from 0.161 onwards an .html file is refused as a page source. This site's landing pages are exactly that, content//_index.html in all five locales, so any build on a newer Hugo dies on the first one it reaches with access denied: "text/html" is not whitelisted in policy "security.allowContent" before rendering a single page, and the message never mentions a version. Anyone whose system Hugo is newer than the pin cannot run `hugo server` or a plain `hugo` build on this repo — which is a poor first encounter for a contributor arriving to fix a typo. Allow every content type back. Not narrowed to '^text/html$' deliberately: allowContent is an allowlist, so that value permits HTML and nothing else, and every markdown page fails instead. The pin stays at 0.160.1 and CI is untouched. A production build (`hugo --gc --minify`) on 0.161+ hits a second, unrelated wall: Hugo runs PostCSS under Node's permission model with allowRead defaulting to the project directory, while Docsy's SCSS is read from the module cache outside it, so the transform fails with "Access to this API has been restricted". Neither security.node.permissions.allowRead (the config does not expand $HOME or $HUGO_CACHEDIR) nor an in-project cacheDir cleared it. Bumping the pin therefore needs that solved first, and is left for its own change; the comment in hugo.yaml records where the next person should start. Verified: 0.160.1 and 0.164.0 both build in dev/preview mode with this config, and the pinned 0.160.1 production build is unchanged — same 2592 pages, no errors. Signed-off-by: Timur Tukaev --- hugo.yaml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/hugo.yaml b/hugo.yaml index f5d555d7..3ef76ae0 100644 --- a/hugo.yaml +++ b/hugo.yaml @@ -24,6 +24,26 @@ enableMissingTranslationPlaceholders: true # Provide .LastMod values enableGitInfo: true +# Hugo's default content policy is `! ^text/html$`, i.e. everything except HTML, +# so from 0.161 onwards an .html file is refused as a page source. This site's +# landing pages are exactly that — content//_index.html in all five +# locales — so a newer Hugo fails on the first one it reaches, before rendering +# anything, with a message that never mentions a version. Allow every content +# type back, so `hugo server` and a plain `hugo` build work on any version. +# +# Do NOT narrow this to '^text/html$': the list is an allowlist, so that value +# permits HTML and nothing else, and every markdown page then fails instead. +# +# This does not make the pinned version optional. A production build +# (`hugo --gc --minify`) still requires 0.160.1: from 0.161 Hugo runs PostCSS +# under Node's permission model, and Docsy's SCSS is read from the module cache +# outside the project directory, so the transform fails with "Access to this API +# has been restricted". Neither security.node.permissions.allowRead nor an +# in-project cacheDir resolved it here; that migration is its own piece of work. +security: + allowContent: + - '.*' + module: proxy: direct hugoVersion: