chore: bump github.com/gohugoio/hugo from 0.147.0 to 0.163.1

[dependabot]

Bumps github.com/gohugoio/hugo from 0.147.0 to 0.163.1.

Release notes

Sourced from github.com/gohugoio/hugo's releases.

v0.163.1

The majority of the fixes in this release are security related (including the upstream fix in 93c8c7d3 (golang.org/x/image)). Thanks to @​vnth4nhnt for finding the issues fixed in a00b5c72 and cf9c8f93 (I will do the CVE work on this later). There has been a uptick in security reports lately, which doesn't mean that Hugo has gotten less secure, this is mostly the work of the new and powerful AI tools using Hugo's restrictive security model as their baseline. Just take a look at Go's recent security issue list to see a demonstration of this.

What's Changed

• build(deps): bump golang.org/x/image from 0.41.0 to 0.42.0 93c8c7d3 @​dependabot[bot]
• Fix multi --renderSegments merge behavior 95e5e9f4 @​bep #15024
• security: Normalize integer IPv4 host encodings in http.urls check a00b5c72 @​bep
• Drop symlinks in os.ReadDir, os.ReadFile, os.Stat and os.FileExists cf9c8f93 @​bep #15019
• commands: Fix convert command 2602796c @​jmooring #15012

v0.163.0

The main topic in this release is improvements to the AVIF image handling that we introduced in v0.162.0. See the docs for details, but:

• We have turned down the default quality for AVIF to 60. Turns out, JPEG/WebP with quality 75 is comparable to AVIF with quality 60. You can now also set quality per image format in your project config (and also per image processed if needed).
• We have added a hint to the AVIF with the same values as for WEBP. For lossy compression, the photo/picture hints (and the default) encodes with YUV420 chroma subsampling instead of YUV444, keeping 444 for text/icon/drawing. This greatly reduces the memory needed to encode these images.

Improvements

• resources/jsconfig: Remove deprecated baseUrl setting ff2903a9 @​bep #14991 #14996
• all: Adjust tests for deprecated link and image render hook settings ca68936d @​jmooring
• all: Run go fix ./... 781fabf4 @​bep
• pagesfromdata: Use relative path for content adapter template metrics 1d018ef8 @​anupamojha-eng #14999
• ci: Re-add macos-latest to the test matrix 121bc6ce @​bep
• images: Deprecate Imaging.Compression and move it down to webp and avif configs cf18b827 @​bep #14998
• Only support the latest Go version 98ad9b3c @​bep #14997
• page: Add IsBranch and deprecate IsNode b89e7fe6 @​bep #11574
• images: Force cache invalidation for AVIF target e8fefc83 @​bep #14990
• images: Add a per-format AVIF hint setting a043d3ec @​bep #14992
• images: Make AVIF chroma subsampling content-aware via the hint 341f575d @​bep #14987
• Cap AVIF lossy quality at 99 248241b6 @​bep #14981
• config: Deprecate the glogal imaging quality setting 4e47d95d @​bep #14979
• images: Make 60 the default quality for AVIF 03b4b542 @​bep #14979
• livereload: Disconnect from websocket server on pageswap 79be0532 @​bep #14983
• tpl/tplimpl/embedded: Prevent leading newline in sitemap template 0f440460 @​bep #14977
• images: Recover from memory alloc errors in WASM image processors 4e17421e @​bep #14985
• images: Add quality setting per image format b01ecd4c @​bep #14957
• misc: Remove duplicate words in comments 45c00b7c @​jmooring #14936 #14950 #14965
• Add some PNG to AVIF golden test cases 28d882ab @​bep

Dependency Updates

• build(deps): bump github.com/bits-and-blooms/bitset 0d29fc81 @​dependabot[bot]
• build(deps): bump github.com/tetratelabs/wazero bb57404f @​dependabot[bot]
• build(deps): bump github.com/rogpeppe/go-internal from 1.14.1 to 1.15.0 7d1b1fb3 @​dependabot[bot]
• build(deps): bump github.com/getkin/kin-openapi from 0.138.0 to 0.139.0 77a11470 @​dependabot[bot]

... (truncated)

Commits

• 2a4fd58 releaser: Bump versions for release of 0.163.1
• 93c8c7d build(deps): bump golang.org/x/image from 0.41.0 to 0.42.0
• 95e5e9f Fix multi --renderSegments merge behavior
• a00b5c7 security: Normalize integer IPv4 host encodings in http.urls check
• cf9c8f9 Drop symlinks in os.ReadDir, os.ReadFile, os.Stat and os.FileExists
• 11f09f5 Update CI workflow to exclude macOS
• 2602796 commands: Fix convert command
• 72495f9 releaser: Prepare repository for 0.164.0-DEV
• 4a94853 releaser: Bump versions for release of 0.163.0
• 1d018ef pagesfromdata: Use relative path for content adapter template metrics
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
❌ Deployment failed View logs	codeserver	49177e5	Jun 15 2026, 11:08 AM

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​github.com/​gohugoio/​hugo@​v0.147.0 ⏵ v0.163.1	+1	+3			-30
	golang/​golang.org/​x/​oauth2@​v0.29.0 ⏵ v0.36.0	+1
	golang/​github.com/​aws/​aws-sdk-go-v2@​v1.36.3 ⏵ v1.41.6	+1
	golang/​github.com/​aws/​smithy-go@​v1.22.3 ⏵ v1.25.0	+1
	golang/​golang.org/​x/​crypto@​v0.39.0 ⏵ v0.51.0	+1	+3
	golang/​golang.org/​x/​net@​v0.41.0 ⏵ v0.55.0		+2
	golang/​golang.org/​x/​tools@​v0.33.0 ⏵ v0.45.0
	golang/​google.golang.org/​grpc@​v1.73.0 ⏵ v1.80.0	+1	+75
	golang/​google.golang.org/​protobuf@​v1.36.6 ⏵ v1.36.11	+1
	golang/​go.opentelemetry.io/​otel@​v1.37.0 ⏵ v1.43.0	+1	+15
	golang/​golang.org/​x/​text@​v0.26.0 ⏵ v0.38.0
	golang/​google.golang.org/​api@​v0.231.0 ⏵ v0.276.0	+1
	golang/​github.com/​prometheus/​client_model@​v0.6.1 ⏵ v0.6.2
	golang/​golang.org/​x/​sys@​v0.33.0 ⏵ v0.45.0
	golang/​github.com/​aws/​aws-sdk-go-v2/​config@​v1.29.14 ⏵ v1.32.2
	golang/​github.com/​stretchr/​testify@​v1.10.0 ⏵ v1.11.1	+1
	golang/​golang.org/​x/​mod@​v0.25.0 ⏵ v0.36.0	+1
	golang/​github.com/​spf13/​pflag@​v1.0.6 ⏵ v1.0.10
	golang/​github.com/​go-jose/​go-jose/​v4@​v4.1.0 ⏵ v4.1.4		+16
	golang/​cloud.google.com/​go/​compute/​metadata@​v0.7.0 ⏵ v0.9.0	+1
	golang/​go.opentelemetry.io/​otel/​sdk@​v1.37.0 ⏵ v1.43.0	+1	+22
	golang/​go.opentelemetry.io/​otel/​exporters/​otlp/​otlptrace/​otlptracegrpc@​v1.35.0 ⏵ v1.38.0	+1
	golang/​golang.org/​x/​sync@​v0.15.0 ⏵ v0.21.0
	golang/​go.opentelemetry.io/​otel/​trace@​v1.37.0 ⏵ v1.43.0	+1
	golang/​golang.org/​x/​term@​v0.32.0 ⏵ v0.43.0	+1
	golang/​github.com/​aws/​aws-sdk-go-v2/​feature/​rds/​auth@​v1.5.1 ⏵ v1.6.14
	golang/​github.com/​mattn/​go-isatty@​v0.0.20 ⏵ v0.0.22
	golang/​go.opentelemetry.io/​otel/​exporters/​otlp/​otlptrace@​v1.35.0 ⏵ v1.38.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: golang github.com/googleapis/enterprise-certificate-proxy is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → golang/google.golang.org/api@v0.276.0 → golang/github.com/golang-migrate/migrate/v4@v4.18.1 → golang/github.com/aquasecurity/trivy-iac@v0.8.0 → golang/cdr.dev/slog@v1.6.2-0.20250703074222-9df5e0a6c145 → golang/github.com/coder/aisdk-go@v0.0.9 → golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.14 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/googleapis/enterprise-certificate-proxy@v0.3.14. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: golang github.com/pelletier/go-toml/v2 is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → golang/github.com/gohugoio/hugo@v0.163.1 → golang/github.com/pelletier/go-toml/v2@v2.3.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/pelletier/go-toml/v2@v2.3.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: golang golang.org/x/tools is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: go.mod → golang/golang.org/x/tools@v0.45.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/golang.org/x/tools@v0.45.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[dependabot]

Superseded by #790.