The world’s fastest framework for building websites (with WebP encoding and Sass transpiling support)
Hugo is one of the most popular open-source static site generators.
With its amazing speed and flexibility, Hugo makes building websites fun again.
Hugo is available in two flavors: standard and extended.
With the extended flavor you can:
- Encode WebP images (decoding is also available in the standard build)
- Transpile Sass to CSS using the embedded LibSass transpiler
Notable new features
- New imaging.firstFrameOnly option (and a matching processing flag) to only decode/encode the first frame of animated images. Hugo now also only decodes the first frame when the target format doesn't support animation, and fails early with an informative error if processing all frames would exceed the WASM memory limit.
- New FrameCount method on images, e.g. to check if an image is animated.
- site.Language now has Translate and Format* methods, so you can e.g. range over site.Languages and translate into each language.
- New charset option for js.Build and css.Build.
- Basic support for the OSC 7501 program status (working/done/idle/error) in terminals that support it, alongside the existing OSC 9;4 progress.
Security fixes
This release is built with Go 1.27.2, which includes 15 security fixes. The most relevant for Hugo are:
- Two html/template escaping fixes, which also apply to Hugo's fork of the package: CVE-2026-94448 (context tracking not reset on consecutive expressions in JS template literals) and CVE-2026-97030 (yield not recognized as a regexp preceder keyword). Both could lead to incorrect escaping of inline JavaScript.
- Several net/http fixes (HTTP/2 server crash and memory exhaustion, connection desynchronization, unbounded Range header parsing), relevant for hugo server and remote resources. The corresponding HTTP/2 fixes are also included via the upgrade of golang.org/x/net to v0.61.0.
- CVE-2026-56857: os.Root.Mkdir(All) could follow junctions out of the root on Windows.
Also:
- github.com/tdewolff/minify is upgraded to v2.24.19, which fixes GHSA-3ppm-p7r9-c5w3: </script> (and <!--) inside inline scripts was not properly escaped (case-insensitively) when minifying JS in HTML.
- Hugo now ignores module.replacements defined in themes; only the project can define replacements.
Changes
- Fix PAGE.IsNode warning in jsonify 0732eadd @bep #15420
- hugolib: Fix rebuild when content is also mounted as assets ac62c804 @taekop #12838
- Fix deprecation issues in tests be8ffd62 @bep
- circleci: Update config.yml to version 2.1 285d0efc @bep
- warpc: Upgrade libavif, AOM, dav1d versions c94bdf92 @bep
- warpc: Upgrade to javy 9.1.0 63fb71ca @bep
- warpc: Upgrade to wasi-sdk-34 2f2f33b2 @bep
- ci: Drop extended build tag on Windows tests 53aae446 @bep
- Add imaging.firstFrameOnly and some animation performance improvements 13ee7e97 @bep #15433
- js, css: Add charset option to js.Build and css.Build 0688a8cd @bep #15435 …
| Publisher | The Hugo Authors |
|---|---|
| Version | 0.168.0 |
| Release date | 2026-10-13 |
| License | Apache-2.0 |
| Installer type | zip |
| Architecture | x64 |
| Package ID | Hugo.Hugo.Extended |
Install Hugo (Extended) from the command line with Windows Package Manager (winget):
winget install --id=Hugo.Hugo.Extended -e
A beginner-friendly tool for hardware and code
VSCodium is a community-driven, freely-licensed and telemetry-free rebuilt of Microsoft's Visual Studio Code.
The world’s fastest framework for building websites
A modern runtime for JavaScript and TypeScript
The OpenAPI/Swagger API toolchain for .NET and TypeScript
Diff/Patch Frontend
The Desktop API client for REST and GraphQL. Make requests, inspect responses.
This is a standalone, power tool release of TypeScript 4.3 for Visual Studio. It includes both the TypeScript experience for Visual Studio and a standalone compiler that can be used from the command l