fix(deps): update module github.com/gohugoio/hugo to v0.163.3

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/gohugoio/hugo	v0.162.1 → v0.163.3

---

Release Notes

gohugoio/hugo (github.com/gohugoio/hugo)

v0.163.3

Compare Source

What's Changed

• markup/highlight: Escape lang in default code block rendering ce1a7e0 @​bep thanks to @​k0ngj1 for reporting this issue.
• parser/pageparser: Preserve non-ASCII whitespace after e.g. summary divider 70a9068 @​bep
• resources: Support babel/postcss config variants 9d66d51 @​jmooring #​15039 #​15040 #​15043
• hugolib: Fix page/section name collision regression f013346 @​jmooring #​15046

v0.163.2

Compare Source

What's Changed

• Continue resolving on ERR_ACCESS_DENIED in Node's resolver 134674f @​bep #​15041
• markup: Standardize behavior when external converters are missing 147f605 @​jmooring #​14222

v0.163.1

Compare Source

The majority of the fixes in this release are security related (including the upstream fix in 93c8c7d (golang.org/x/image)). Thanks to @​vnth4nhnt for finding the issues fixed in a00b5c7 and cf9c8f9 (I will do the CVE work on this later). There has been a uptick in security reports lately, which doesn't mean that Hugo has gotten less secure, this is mostly the work of the new and powerful AI tools using Hugo's restrictive security model as their baseline. Just take a look at Go's recent security issue list to see a demonstration of this.

What's Changed

• build(deps): bump golang.org/x/image from 0.41.0 to 0.42.0 93c8c7d @​dependabot[bot]
• Fix multi --renderSegments merge behavior 95e5e9f @​bep #​15024
• security: Normalize integer IPv4 host encodings in http.urls check a00b5c7 @​bep
• Drop symlinks in os.ReadDir, os.ReadFile, os.Stat and os.FileExists cf9c8f9 @​bep #​15019
• commands: Fix convert command 2602796 @​jmooring #​15012

v0.163.0

Compare Source

The main topic in this release is improvements to the AVIF image handling that we introduced in v0.162.0. See the docs for details, but:

• We have turned down the default quality for AVIF to 60. Turns out, JPEG/WebP with quality 75 is comparable to AVIF with quality 60. You can now also set quality per image format in your project config (and also per image processed if needed).
• We have added a hint to the AVIF with the same values as for WEBP. For lossy compression, the photo/picture hints (and the default) encodes with YUV420 chroma subsampling instead of YUV444, keeping 444 for text/icon/drawing. This greatly reduces the memory needed to encode these images.

Improvements

• resources/jsconfig: Remove deprecated baseUrl setting ff2903a @​bep #​14991 #​14996
• all: Adjust tests for deprecated link and image render hook settings ca68936 @​jmooring
• all: Run go fix ./... 781fabf @​bep
• pagesfromdata: Use relative path for content adapter template metrics 1d018ef @​anupamojha-eng #​14999
• ci: Re-add macos-latest to the test matrix 121bc6c @​bep
• images: Deprecate Imaging.Compression and move it down to webp and avif configs cf18b82 @​bep #​14998
• Only support the latest Go version 98ad9b3 @​bep #​14997
• page: Add IsBranch and deprecate IsNode b89e7fe @​bep #​11574
• images: Force cache invalidation for AVIF target e8fefc8 @​bep #​14990
• images: Add a per-format AVIF hint setting a043d3e @​bep #​14992
• images: Make AVIF chroma subsampling content-aware via the hint 341f575 @​bep #​14987
• Cap AVIF lossy quality at 99 248241b @​bep #​14981
• config: Deprecate the glogal imaging quality setting 4e47d95 @​bep #​14979
• images: Make 60 the default quality for AVIF 03b4b54 @​bep #​14979
• livereload: Disconnect from websocket server on pageswap 79be053 @​bep #​14983
• tpl/tplimpl/embedded: Prevent leading newline in sitemap template 0f44046 @​bep #​14977
• images: Recover from memory alloc errors in WASM image processors 4e17421 @​bep #​14985
• images: Add quality setting per image format b01ecd4 @​bep #​14957
• misc: Remove duplicate words in comments 45c00b7 @​jmooring #​14936 #​14950 #​14965
• Add some PNG to AVIF golden test cases 28d882a @​bep

Dependency Updates

• build(deps): bump github.com/bits-and-blooms/bitset 0d29fc8 @​dependabot[bot]
• build(deps): bump github.com/tetratelabs/wazero bb57404 @​dependabot[bot]
• build(deps): bump github.com/rogpeppe/go-internal from 1.14.1 to 1.15.0 7d1b1fb @​dependabot[bot]
• build(deps): bump github.com/getkin/kin-openapi from 0.138.0 to 0.139.0 77a1147 @​dependabot[bot]

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: deps/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 3 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.25 -> 1.26.0
github.com/bep/overlayfs	v0.10.0 -> v0.11.0
github.com/bits-and-blooms/bitset	v1.24.4 -> v1.24.5
golang.org/x/text	v0.37.0 -> v0.38.0

[github-actions]

🚀 Deployed on https://6a346c059f7e9b0920f24fe3--hugo-theme-iris.netlify.app