phoenix/hugo
1
0
Fork 0
mirror of https://github.com/gohugoio/hugo.git synced 2024-07-07 17:46:05 +00:00
Code Issues Packages Projects Releases Wiki Activity
6796 commits 122 branches 277 tags 213 MiB
Commit graph

203 commits

Author SHA1 Message Date
hugoreleaser ff7689ce02 releaser: Prepare repository for 0.93.0-DEV 
[ci skip]
 2022-01-27 12:22:31 +00:00
hugoreleaser 85e2e86266 releaser: Bump versions for release of 0.92.1 
[ci skip]
 2022-01-27 11:44:40 +00:00
hugoreleaser ed04ed5745 releaser: Prepare repository for 0.93.0-DEV 
[ci skip]
 2022-01-12 08:58:07 +00:00
hugoreleaser b354940369 releaser: Bump versions for release of 0.92.0 
[ci skip]
 2022-01-12 08:23:17 +00:00
Bjørn Erik Pedersen 7396aa945a Add hugo.Deps 
Fixes #8949
 2022-01-11 18:06:23 +01:00
hugoreleaser 1dbfc0f930 releaser: Prepare repository for 0.92.0-DEV 
[ci skip]
 2021-12-23 16:10:18 +00:00
hugoreleaser 1798bd3fd1 releaser: Bump versions for release of 0.91.2 
[ci skip]
 2021-12-23 15:33:33 +00:00
hugoreleaser 759cdf3fc8 releaser: Prepare repository for 0.92.0-DEV 
[ci skip]
 2021-12-22 16:07:34 +00:00
hugoreleaser f423505746 releaser: Bump versions for release of 0.91.1 
[ci skip]
 2021-12-22 15:31:05 +00:00
hugoreleaser 728feaecf0 releaser: Prepare repository for 0.92.0-DEV 
[ci skip]
 2021-12-17 10:31:22 +00:00
hugoreleaser d1dc0e9a54 releaser: Bump versions for release of 0.91.0 
[ci skip]
 2021-12-17 09:50:19 +00:00
Bjørn Erik Pedersen f4389e48ce
Add some basic security policies with sensible defaults 
This ommmit contains some security hardening measures for the Hugo build runtime.

There are some rarely used features in Hugo that would be good to have disabled by default. One example would be the "external helpers".

For `asciidoctor` and some others we use Go's `os/exec` package to start a new process.

These are a predefined set of binary names, all loaded from `PATH` and with a predefined set of arguments. Still, if you don't use `asciidoctor` in your project, you might as well have it turned off.

You can configure your own in the new `security` configuration section, but the defaults are configured to create a minimal amount of site breakage. And if that do happen, you will get clear instructions in the loa about what to do.

The default configuration is listed below. Note that almost all of these options are regular expression _whitelists_ (a string or a slice); the value `none` will block all.

```toml
[security]
  enableInlineShortcodes = false
  [security.exec]
    allow = ['^dart-sass-embedded$', '^go$', '^npx$', '^postcss$']
    osEnv = ['(?i)^(PATH|PATHEXT|APPDATA|TMP|TEMP|TERM)$']

  [security.funcs]
    getenv = ['^HUGO_']

  [security.http]
    methods = ['(?i)GET|POST']
    urls = ['.*']
```
 2021-12-16 09:40:22 +01:00
hugoreleaser 3f0d49e502 releaser: Prepare repository for 0.91.0-DEV 
[ci skip]
 2021-12-10 11:42:18 +00:00
hugoreleaser 4890788974 releaser: Bump versions for release of 0.90.1 
[ci skip]
 2021-12-10 10:56:40 +00:00
hugoreleaser 34a96290fa releaser: Prepare repository for 0.91.0-DEV 
[ci skip]
 2021-12-08 10:11:31 +00:00
hugoreleaser dd0d3fdbbe releaser: Bump versions for release of 0.90.0 
[ci skip]
 2021-12-08 09:33:46 +00:00
hugoreleaser 0b70b46aad releaser: Prepare repository for 0.90.0-DEV 
[ci skip]
 2021-11-17 09:05:38 +00:00
hugoreleaser cc08c09592 releaser: Bump versions for release of 0.89.4 
[ci skip]
 2021-11-17 08:24:08 +00:00
hugoreleaser 1ed8069a3a releaser: Prepare repository for 0.90.0-DEV 
[ci skip]
 2021-11-15 12:56:41 +00:00
hugoreleaser e1064d2195 releaser: Bump versions for release of 0.89.3 
[ci skip]
 2021-11-15 12:17:45 +00:00
hugoreleaser 805c24c32c releaser: Prepare repository for 0.90.0-DEV 
[ci skip]
 2021-11-08 15:56:14 +00:00
hugoreleaser eaa6c96a79 releaser: Bump versions for release of 0.89.2 
[ci skip]
 2021-11-08 15:22:23 +00:00
hugoreleaser 9232e28446 releaser: Prepare repository for 0.90.0-DEV 
[ci skip]
 2021-11-05 16:24:06 +00:00
hugoreleaser 84de0c3255 releaser: Bump versions for release of 0.89.1 
[ci skip]
 2021-11-05 15:44:32 +00:00
hugoreleaser 41e9e9fe14 releaser: Prepare repository for 0.90.0-DEV 
[ci skip]
 2021-11-02 10:40:00 +00:00
hugoreleaser a93d4ba64e releaser: Bump versions for release of 0.89.0 
[ci skip]
 2021-11-02 10:00:17 +00:00
hugoreleaser 3efc2e2af8 releaser: Prepare repository for 0.89.0-DEV 
[ci skip]
 2021-09-04 10:33:09 +00:00
hugoreleaser bb3254385a releaser: Bump versions for release of 0.88.1 
[ci skip]
 2021-09-04 09:39:19 +00:00
hugoreleaser 5b59b9c171 releaser: Prepare repository for 0.89.0-DEV 
[ci skip]
 2021-09-02 09:57:36 +00:00
hugoreleaser 6cacfa329c releaser: Bump versions for release of 0.88.0 
[ci skip]
 2021-09-02 09:27:27 +00:00
hugoreleaser dfe54d3216 releaser: Prepare repository for 0.88.0-DEV 
[ci skip]
 2021-08-03 12:11:56 +00:00
hugoreleaser 2ed7be295c releaser: Bump versions for release of 0.87.0 
[ci skip]
 2021-08-03 10:57:26 +00:00
hugoreleaser 11bb67dcfd releaser: Prepare repository for 0.87.0-DEV 
[ci skip]
 2021-07-21 11:13:04 +00:00
hugoreleaser d270eaf4fc releaser: Bump versions for release of 0.86.0 
[ci skip]
 2021-07-21 09:53:11 +00:00
Bjørn Erik Pedersen 022c479551
hugofs: Make FileMeta a struct 
This commit started out investigating a `concurrent map read write` issue, ending by replacing the map with a struct.

This is easier to reason about, and it's more effective:

```
name                                  old time/op    new time/op    delta
SiteNew/Regular_Deep_content_tree-16    71.5ms ± 3%    69.4ms ± 5%    ~     (p=0.200 n=4+4)

name                                  old alloc/op   new alloc/op   delta
SiteNew/Regular_Deep_content_tree-16    29.7MB ± 0%    27.9MB ± 0%  -5.82%  (p=0.029 n=4+4)

name                                  old allocs/op  new allocs/op  delta
SiteNew/Regular_Deep_content_tree-16      313k ± 0%      303k ± 0%  -3.35%  (p=0.029 n=4+4)
```

See #8749
 2021-07-15 17:14:26 +02:00
hugoreleaser 8ddbc95466 releaser: Prepare repository for 0.86.0-DEV 
[ci skip]
 2021-07-05 11:37:38 +00:00
hugoreleaser 875fe4050c releaser: Bump versions for release of 0.85.0 
[ci skip]
 2021-07-05 10:46:25 +00:00
hugoreleaser b4d60b3db1 releaser: Prepare repository for 0.85.0-DEV 
[ci skip]
 2021-07-01 12:59:47 +00:00
hugoreleaser 4c34faf426 releaser: Bump versions for release of 0.84.4 
[ci skip]
 2021-07-01 11:51:53 +00:00
hugoreleaser bffa2a2a98 releaser: Prepare repository for 0.85.0-DEV 
[ci skip]
 2021-06-29 12:27:15 +00:00
hugoreleaser bc6f84c581 releaser: Bump versions for release of 0.84.3 
[ci skip]
 2021-06-29 11:40:19 +00:00
hugoreleaser 8290720107 releaser: Prepare repository for 0.85.0-DEV 
[ci skip]
 2021-06-28 11:41:38 +00:00
hugoreleaser f6b9ce6ebd releaser: Bump versions for release of 0.84.2 
[ci skip]
 2021-06-28 10:59:18 +00:00
hugoreleaser efb6ee6c1c releaser: Prepare repository for 0.85.0-DEV 
[ci skip]
 2021-06-24 12:33:45 +00:00
hugoreleaser ff2266300a releaser: Bump versions for release of 0.84.1 
[ci skip]
 2021-06-24 11:44:21 +00:00
hugoreleaser 3d544c9ae4 releaser: Prepare repository for 0.85.0-DEV 
[ci skip]
 2021-06-18 15:36:43 +00:00
hugoreleaser 9c0860f749 releaser: Bump versions for release of 0.84.0 
[ci skip]
 2021-06-18 14:55:51 +00:00
Bjørn Erik Pedersen 31fb29fb3f
Do not read config from os.Environ when running tests 
Fixes #8655
 2021-06-16 18:58:40 +02:00
Bjørn Erik Pedersen bc1e05286a deps: Update to LibSASS 3.6.5 
See https://github.com/sass/libsass/releases/tag/3.6.5
 2021-05-23 10:33:56 +02:00
hugoreleaser e1c328df25 releaser: Prepare repository for 0.84.0-DEV 
[ci skip]
 2021-05-02 15:28:40 +00:00