deps: Upgrade github.com/bep/imagemeta v0.17.1 => v0.17.2

langs: Use Language.Locale as primary localization key

Localization now uses Language.Locale as the golocales lookup key,
falling back to Language.Lang, then defaultContentLanguage, then "en".

Closes #9109

config/security: Add "! " negation to Whitelist, harden default http.urls

Whitelist now treats any pattern prefixed with "! " (the same negation
prefix used by hglob/predicate) as a deny rule. Deny matches take
precedence over allow, and a whitelist made up exclusively of deny
rules implicitly allows everything it does not deny.

The default security.http.urls now reads:

    urls = ['(?i)^https?://[a-z]', '! (?i)localhost', '! @']

i.e. allow URLs whose host starts with a letter (the common
"https://example.com" shape), deny anything that looks like localhost,
and deny URLs with userinfo to foil "http://user@127.0.0.1/" bypasses.
Public IP literals are collateral blocks; users who need them (or their
own private hosts) override security.http.urls as before, mixing allow
and deny rules with the same "! " prefix, e.g.

    [security.http]
    urls = ['.*', '! ^https?://evil\.example\.com']

Fixes #14792

build(deps): bump github.com/aws/aws-sdk-go-v2/service/cloudfront (#14789)

Bumps [github.com/aws/aws-sdk-go-v2/service/cloudfront](https://github.com/aws/aws-sdk-go-v2) from 1.59.0 to 1.61.1.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/service/s3/v1.59.0...service/s3/v1.61.1)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/service/cloudfront
  dependency-version: 1.61.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

build(deps): bump github.com/mattn/go-isatty from 0.0.20 to 0.0.21 (#14788)

Bumps [github.com/mattn/go-isatty](https://github.com/mattn/go-isatty) from 0.0.20 to 0.0.21.
- [Commits](https://github.com/mattn/go-isatty/compare/v0.0.20...v0.0.21)

---
updated-dependencies:
- dependency-name: github.com/mattn/go-isatty
  dependency-version: 0.0.21
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

build(deps): bump github.com/bep/mclib (#14787)

Bumps [github.com/bep/mclib](https://github.com/bep/mclib) from 1.20400.20402 to 1.20401.20400.
- [Release notes](https://github.com/bep/mclib/releases)
- [Commits](https://github.com/bep/mclib/compare/v1.20400.20402...v1.20401.20400)

---
updated-dependencies:
- dependency-name: github.com/bep/mclib
  dependency-version: 1.20401.20400
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Harden Node tool execution with --permission flag

Add security.node.permissions config to run Node tools (PostCSS, Babel,
TailwindCSS) under Node's permission model, restricting file system access
to the working directory by default.

The binary resolution is simplified to node_modules/.bin → PATH (npx removed).
For both locations, the actual JS entry point is resolved via symlinks (macOS/Linux)
or by parsing npm wrapper scripts (Windows .cmd), then executed as
"node --permission --allow-fs-read=<path> --allow-fs-write=<path> <script>".

Users can opt out by removing "node" from security.exec.allow.

Closes #7287

tpl/collections: Honor the Eqer interface in where comparisons

The where function previously fell through to a no-op when comparing
two values whose kinds were not handled by the primitive type switches
(e.g. two Page interface values). This made `where pages "Parent" $page`
return an empty list, while the equivalent `range pages` + `if eq` worked.

Use compare.Eqer for equality operators when either side implements it,
matching the behavior of the eq/ne template funcs.

Fixes #14777

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

build(deps): bump google.golang.org/api from 0.267.0 to 0.276.0

Bumps [google.golang.org/api](https://github.com/googleapis/google-api-go-client) from 0.267.0 to 0.276.0.
- [Release notes](https://github.com/googleapis/google-api-go-client/releases)
- [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md)
- [Commits](https://github.com/googleapis/google-api-go-client/compare/v0.267.0...v0.276.0)

---
updated-dependencies:
- dependency-name: google.golang.org/api
  dependency-version: 0.276.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.41.5 to 1.41.6

Bumps [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) from 1.41.5 to 1.41.6.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/v1.41.5...v1.41.6)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2
  dependency-version: 1.41.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

modules: Ignore non-require blocks in go.mod rewrite

The Go 1.24 tool directive uses single-token entries inside a
tool ( ... ) block. The previous splitter treated any tab-indented
line as a require entry, causing an index out of range panic when
running hugo mod tidy on a module with a tool block.

Track the require block state explicitly so other blocks (tool,
replace, exclude, retract) are left untouched.

Fixes #14783

Replace the concurrent map with an identical upstream version

build(deps): bump github.com/getkin/kin-openapi from 0.134.0 to 0.135.0 (#14781)

Bumps [github.com/getkin/kin-openapi](https://github.com/getkin/kin-openapi) from 0.134.0 to 0.135.0.
- [Release notes](https://github.com/getkin/kin-openapi/releases)
- [Commits](https://github.com/getkin/kin-openapi/compare/v0.134.0...v0.135.0)

---
updated-dependencies:
- dependency-name: github.com/getkin/kin-openapi
  dependency-version: 0.135.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

build(deps): bump github.com/bep/goportabletext from 0.1.0 to 0.2.0 (#14779)

Bumps [github.com/bep/goportabletext](https://github.com/bep/goportabletext) from 0.1.0 to 0.2.0.
- [Release notes](https://github.com/bep/goportabletext/releases)
- [Commits](https://github.com/bep/goportabletext/compare/v0.1.0...v0.2.0)

---
updated-dependencies:
- dependency-name: github.com/bep/goportabletext
  dependency-version: 0.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

build(deps): bump golang.org/x/image from 0.38.0 to 0.39.0 (#14780)

Bumps [golang.org/x/image](https://github.com/golang/image) from 0.38.0 to 0.39.0.
- [Commits](https://github.com/golang/image/compare/v0.38.0...v0.39.0)

---
updated-dependencies:
- dependency-name: golang.org/x/image
  dependency-version: 0.39.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

deps: Upgrade github.com/bep/imagemeta v0.17.0 => v0.17.1 (#14775)

Close #14758

Add slice-based permalinks config with PageMatcher target

Closes #14744
Clses #4641

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

commands: Add missing import

Revert "common/hugo: Deprecate extended and extended_withdeploy editions"

This reverts commit a17bdbc5face02ed2470895bcbfe67db7749dc73.

Close #14771

Adjust the SECURITY.md slightly

create: Fix non-deterministic conflict detection in hugo new content

The contentInclusionFilter used strings.Contains to match filenames
against the target path. Because strings.Contains is a substring check,
a directory entry like "content/about" matches "content/about.md",
causing unrelated files to be pulled into the mini-build. Whether the
conflict was then detected depended on whether the filesystem walker
delivered a directory entry or a full file path.

Also adds an upfront check for the directory-conflict case, since
a corrected filter alone would allow about.md to be created alongside
an existing about/ directory.

Closes #12602
Closes #12786
Closes #14112
Closes #14769

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

build(deps): bump golang.org/x/tools from 0.43.0 to 0.44.0

Bumps [golang.org/x/tools](https://github.com/golang/tools) from 0.43.0 to 0.44.0.
- [Release notes](https://github.com/golang/tools/releases)
- [Commits](https://github.com/golang/tools/compare/v0.43.0...v0.44.0)

---
updated-dependencies:
- dependency-name: golang.org/x/tools
  dependency-version: 0.44.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

resources/page: Add passing test for Issue #14325

agents: Add a note about having the issue ID in test names

commands: Fix environment isolation for configuration settings

Closes #14763

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

build(deps): bump github.com/evanw/esbuild from 0.27.4 to 0.28.0

Bumps [github.com/evanw/esbuild](https://github.com/evanw/esbuild) from 0.27.4 to 0.28.0.
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](https://github.com/evanw/esbuild/compare/v0.27.4...v0.28.0)

---
updated-dependencies:
- dependency-name: github.com/evanw/esbuild
  dependency-version: 0.28.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.41.1 to 1.41.5

Bumps [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) from 1.41.1 to 1.41.5.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/v1.41.1...v1.41.5)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2
  dependency-version: 1.41.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

build(deps): bump github.com/pelletier/go-toml/v2 from 2.2.4 to 2.3.0

Bumps [github.com/pelletier/go-toml/v2](https://github.com/pelletier/go-toml) from 2.2.4 to 2.3.0.
- [Release notes](https://github.com/pelletier/go-toml/releases)
- [Commits](https://github.com/pelletier/go-toml/compare/v2.2.4...v2.3.0)

---
updated-dependencies:
- dependency-name: github.com/pelletier/go-toml/v2
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

build(deps): bump github.com/tdewolff/minify/v2 from 2.24.11 to 2.24.12

Bumps [github.com/tdewolff/minify/v2](https://github.com/tdewolff/minify) from 2.24.11 to 2.24.12.
- [Release notes](https://github.com/tdewolff/minify/releases)
- [Commits](https://github.com/tdewolff/minify/compare/v2.24.11...v2.24.12)

---
updated-dependencies:
- dependency-name: github.com/tdewolff/minify/v2
  dependency-version: 2.24.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Fix filename dimension identifiers (_role_X_, _version_X_) to replace mount config

Filename identifiers for roles and versions were parsed but never applied
to the SitesMatrix. Now they replace the mount's configuration for that
dimension, matching how language identifiers already worked.

Fixes #14756

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Add a more flexible filename identifier scheme that also allows setting roles and versions (#14754)

Fixes #14750

Fix it so we never auto-fallback to page resources in other roles/versions

This is some logic that's left behind from when we had only one dimension (language) where the common case would be to have one resource set (e.g. an image) and many content translation.

After this commit:

* For sites matrix defined in the content filename (e.g. data.en.js) or in its mount definition, we may use that as a fallback for e.g. German languages if we don't find a better match.
* For content adapters, this is not relevant: Here you must be explicit about this.
* We never auto-fallback on resources from a role/version to another.
* When a page bundle spans multiple roles (e.g. via roles = "*"), we clone its resources to all roles so each gets role-specific paths.

Fixes #14749
Fixes #14752

common/hugo: Deprecate extended and extended_withdeploy editions

Closes #14696

 parser/pageparser: Add a parser fuzz test

 Ran it for 40 minutes on my MacBook Pro, and it found no issues.

releaser: Bump versions for release of 0.160.1

[ci skip]

Fix panic when passthrough elements are used in headings

Fixes #14677

Co-Authored-By: xingzihai <1315258019@qq.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Fix panic on edit of legacy mapped template names that's also a valid path in the new setup

This mapping was added in Hugo `v0.146.0`.

Fixes #14740

Fix RenderShortcodes leaking context markers when indented

Strip leading whitespace from Hugo context marker lines before
Goldmark parsing to prevent them from being treated as indented
code blocks.

Fixes #12457

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Strip nested page context markers from standalone RenderShortcodes

Fixes #14732

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Rename deprecated cascade._target to cascade.target in tests

Fix auto-creation of root sections in multilingual sites

Fixes #14681

Co-authored-by: Joe Mooring <joe@mooring.com>

readme: Fix links

* docs: fix broken links in top README.md

* point at the docs site instead of github

* fix typo

Co-authored-by: Joe Mooring <joe@mooring.com>
---------

Co-authored-by: Joe Mooring <joe@mooring.com>

releaser: Prepare repository for 0.161.0-DEV

[ci skip]

releaser: Bump versions for release of 0.160.0

[ci skip]

build(deps): bump github.com/magefile/mage from 1.16.1 to 1.17.1

Bumps [github.com/magefile/mage](https://github.com/magefile/mage) from 1.16.1 to 1.17.1.
- [Release notes](https://github.com/magefile/mage/releases)
- [Commits](https://github.com/magefile/mage/compare/v1.16.1...v1.17.1)

---
updated-dependencies:
- dependency-name: github.com/magefile/mage
  dependency-version: 1.17.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Fix some recently introduced Position issues

Fixes #14710

markup/goldmark: Fix double-escaping of ampersands in link URLs

The XSS fix in 479fe6c65 accidentally called util.EscapeHTML twice
on link destinations, causing `&` to render as `&amp;amp;` instead
of `&amp;`.

Fixes #14715

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

all: Replace NewIntegrationTestBuilder with Test/TestE/TestRunning

tpl: Fix stray quotes from partial decorator in script context

Use template.JS for the falsy return value of _PopPartialDecorator
so Go's html/template JS escaper doesn't wrap the empty string in
quotes inside <script> tags.

Fixes #14711

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

readme: Revise edition descriptions and installation instructions

build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4

Bumps [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) from 4.1.3 to 4.1.4.
- [Release notes](https://github.com/go-jose/go-jose/releases)
- [Commits](https://github.com/go-jose/go-jose/compare/v4.1.3...v4.1.4)

---
updated-dependencies:
- dependency-name: github.com/go-jose/go-jose/v4
  dependency-version: 4.1.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

tpl/css: Support @import "hugo:vars" for CSS custom properties in css.Build

Closes #14699

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Improve and extend .Position handling in Goldmark render hooks

Goldmark v1.8 reports source positions in render hooks.
Use this to build a source map that translates Goldmark positions back to
the original content source.

Now all render hooks' context object implenent the `BaseContext` interface:

```go
type BaseContext interface {
Position() Position
Page() any
PageInner() any
Ordinal() int
}
```

Closes #14663

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

build(deps): bump golang.org/x/image from 0.37.0 to 0.38.0

Bumps [golang.org/x/image](https://github.com/golang/image) from 0.37.0 to 0.38.0.
- [Commits](https://github.com/golang/image/compare/v0.37.0...v0.38.0)

---
updated-dependencies:
- dependency-name: golang.org/x/image
  dependency-version: 0.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

markup/goldmark: Clean up test

releaser: Prepare repository for 0.160.0-DEV

[ci skip]

releaser: Bump versions for release of 0.159.2

[ci skip]

Fix potential content XSS by escaping dangerous URLs in links and images

* This issue in question was fixed upstream in https://github.com/yuin/goldmark/releases/tag/v1.8.2
* We do, however, have a copy of the affected functions, used as fallbacks when no render hook are defined for e.g. links and images, so we need to port these fixes to our copy of the affected functions.

releaser: Add standard withdeploy release assets

Closes #14687

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

resources/page: Fix shared reader in Source.ValueAsOpenReadSeekCloser

Closes #14684

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

testing: Simplify line ending handling in tests

readme: Update Go version to 1.25.0

releaser: Prepare repository for 0.160.0-DEV

[ci skip]

releaser: Bump versions for release of 0.159.1

[ci skip]

minifiers: Keep x-bind and blank namespace in SVG minification

Update tdewolff/minify to v2.24.11 and add "" and "x-bind" to KeepNamespaces
to prevent Alpine.js directives from being stripped in SVGs.

This is a new option in tdewolff/minify v2.24.11, and it is needed to prevent breakage of Alpine.js, and possilby others, directives in SVGs.

Fixes #14669

Adjust depreceated syntax in tests

releaser: Prepare repository for 0.160.0-DEV

[ci skip]

releaser: Bump versions for release of 0.159.0

[ci skip]

docs: Update docs.yaml

Merge commit 'e7afabb927a79b179ae57013fd5f49e32829671e'

Squashed 'docs/' changes from 80dd7b067..0755fb534

0755fb534 misc: Update docs.yaml
f0c69a38c content: Remove outdated content
43ce895b9 content: Remove outdated new-in badges
c3a382fb7 content: Improve GitLab Pages workflow example
f2a851966 content: Update Vimeo example
044565ab3 content: Fix typo
9f5e8b5f4 content: Update version references
9dc30f225 theme: Address deprecations in v0.158.0
ea0787a6b content: Document css.Build function
f98e4f55c content: Standardize Node.js references
bf683e36f content: Use consistent file system terminology
54ed4c12b content: Document strings.ReplacePairs
779d37978 all: Miscellaneous updates for v0.158.0
be1a20c27 Update HUGO_VERSION to 0.158.0
24cdd7bf7 Fix typos in module configuration documentation
ce37e7b05 content: Address Markdown linting error
592049f02 content: Remove unnecessary workflow customization section
b17b18ce1 content: Update version references in hosting guides
32ec89596 content: Improve urls.PathEscape/PathUnescape examples
9297bb6fa content: Clarify page collection sort order
60192a16f content: Add reference link to glossary term
63d4a992a content: Update documentation contribution guide
946273d67 theme: Adjust feature state notices
d70dfd651 theme: Simplify border classes per Tailwind linter
fc53c7263 theme: Refactor feature status shortcodes
850dc5b2b content: Clean up content for deprecated features
35da1aa3c content: Miscellaneous udpates for v0.157.0
05b69f84e content: More site-to-project changes
291ffc3f6 content: Add blogger2hugo migration tool
53a1bdee3 Update HUGO_VERSION to 0.157.0
808f0431d Merge branch 'tempv0.157.0'
f02222e46 docs: Regen and fix the imaging docshelper output
b0d3364f1 Merge commit '0c2fa2460f485e0eca564dcccf36d34538374922'
d1f37cc6d resources/images: Adjust WebP processing defaults
9a9f02fb8 Add per-request timeout option to `resources.GetRemote`
900c10201 docs: Fix lineNos default value in docs.yaml
0052c975a docs: Regenerate docs.yaml
3e2f98235 Merge commit '8f3c066d23f431fb2c53d97ea489e4c28b42bd82'
dbfd34a1a docs: Update docs.yaml
7e1a08e54 Merge commit '08e1ea5c709d3d49bdc3ce3c21e8fa05a33150d0'
cb6e0a42a tpl: Add missing functions to init files
05544e400 markup/asciidocext: Improve Asciidoctor integration
820b5536a github: Add ai-watchdog workflow and update other workflows' versions
3848aec5f markup/goldmark: Enhance footnote extension with backlinkHTML option
070074dac markup/goldmark: Enhance footnote extension with auto-prefixing option
f92f7ac5c config/security: Add PROGRAMDATA to the osenv allowlist
d1ab84530 minifiers: Update deprecation handling
6c911d1e5 Merge commit 'bfa74537929f409fca841540b971125b7678963a'
61916ab4c resources/page: Add :sectionslug and :sectionslugs permalink tokens
80667667c Add Ancestors (plural) method to GitInfo, rename Ancestor field to Parent
e8fdc1d4d source: Expose Ancestor in GitInfo
079671b41 Merge commit 'bb147f91ee9078e6a55e8c32ab4b2e5dbc5cee45'
9e8a08520 images: Add option for vertical alignment to images.Text
f7c795479 Merge commit 'b3d87dd0fd746f07f9afa6e6a2969aea41da6a38'
283e97783 Merge commit '5be51ac3db225d5df501ed1fa1499c41d97dbf65'
4c6ec5c19 resources/page: Revise the new contentbasename permalinks tokens
fc69d3981 resources/page: Add :contentbasename and :contentbasenameorslug permalink tokens
c5f654716 modules: Add GOAUTH to module config
2a1a832fb js/esbuild: Add drop option
d9fb55352 Merge commit 'a024bc7d76fcc5e49e8210f9b0896db9ef21861a'
84678f5af helpers: Add Chroma styles to docs.yaml
fc8d9e344 Merge commit '346b60358dd8ec2ca228e6635bff9d7914b398b7'
4e4da5e47 Merge commit '81a7b6390036138356773c87a886679c81c524e1'
5df38fde0 docs: Regen CLI docs
3b0f8034b tpl/images: Change signature of images.QR to images.QR TEXT OPTIONS
68187036f images.Text: Add "alignx" option for horizontal alignment
240a85734 docs: Regen CLI docs
21b2917c6 Merge commit 'e9fbadacc3f09191e2e19f112a49777eeb8df06c'
5cc7ad562 tpl/images: Add images.QR function
9b588ee9e Update gocloud and docs for S3-Compatible Endpoints
b24377040 tpl/tplimpl: Update details shortcode
0535f4b22 tpl/tplimpl: Add details shortcode
2dd21cf90 Merge commit 'e477373487abcccdbed95688e37aa74b9b8fc198'
869321ffa dartsass: Add silenceDeprecations option
492981933 Merge commit '838bd312b1a287bb33962ad478dbc54737654f35'
c79b7d840 docs: Regen CLI docs
101410f08 docs: Regenerate CLI docs
700846bc9 Merge commit 'de0df119b504a91c9e1f442b07954f366ffb2932'
1fb46bb7c docs: Regen CLI docs
923fd9044 commands: Add "hugo build" as an alias for "hugo"
244ea3067 Merge commit '39fd3b557014e339bc6c68a7ff34a7734a735ee0'
f2e8913d2 Add support for Obsidian type blockquote alerts
9777cfa83 Merge commit 'dec8cd4ada29218971743333f8ac662a9c06aad8'
b3f6d546c output: Fix docshelper template lookup order for AMP pages
476507712 Add config options page.nextPrevSortOrder/nextPrevInSectionSortOrder
b2507b8ab tpl/transform: Make Plainify and ToMath return template.HTML
154525780 docs: Regen docshelper
9d9a0848c Merge commit 'a6e635ca7d905d9ec3ffd708db2694f680b03aae'
b56a8baa1 math: Add trigonometric functions and some angle helper functions
59f708c0e source: Expose GitInfo Body
7a330c378 Merge commit '8b9803425e63e1b1801f8d5d676e96368d706722'
1ea10926d deploy: Add stripIndexHtml target option
903da161a markup/goldmark: Add the Hugo Goldmark Extras "delete" extension
63cf1ea35 deps: Upgrade github.com/alecthomas/chroma v2.13.0 => v2.14.0
6dcbebe11 config: Remove extraneous BuildConfig setting
1c89b76c2 docs: Regen docshelper
976b30877 markup/goldmark: Support extras extension
0da4eee49 commands: Add gen chromastyles --lineNumbersTableStyle flag
daf545b56 docs: Regen docshelper
a46a8ac97 all: Fix duplicate words in comments
9a3c76650 tpl/tplimpl: Optionally exclude content from sitemap
737b3b210 tpl/tplimpl: Update Google Analytics template and config
9283d3071 docs: Regen CLI docs
fa0437be3 docs: Regen docshelper
c318cd850 docs: Fix hyphens and grammar in synopsis of command 'hugo server'
5896f23a9 js: Support JSX and JSXImportSourceOptions
08b0bca77 Merge commit '2658a71e1b6fe24a8b754a62ce0398a09d270d86'
c4c5be6c2 docs: Regen docshelper
ec07d66fe Add images.Dither filter
3b23f2b89 docs: Regen CLI docs
d1c5d6a5e docs: Regenerate docshelper
6c8c9da77 Merge commit '6efb279bfacbd7304cef994be8181c6f804e7dd4'
5ce83ee91 docs: Make null booleans falsy in the docs helper
1185cfc71 docs: Regen docs helper
aab11aad7 Merge commit '9b0050e9aabe4be65c78ccf292a348f309d50ccd' as 'docs'

git-subtree-dir: docs
git-subtree-split: 0755fb534d8b4cde8a0227698da634e3536283ff

commands: Update docs linke to Node.js docs

create: Return error instead of panic when page not found

When `hugo new` creates a content file on a case-insensitive filesystem
where a file with the same name but different case already exists (e.g.
Floop.md vs floop.md), the internal page lookup fails because it uses
exact string comparison. This previously caused an unhelpful panic.

Replace the panic with a descriptive error message that tells the user
what went wrong and suggests checking for case-variant filenames.

Fixes #14112

Co-authored-by: easonysliu <easonysliu@tencent.com>
Co-authored-by: Bjørn Erik Pedersen <bjorn.erik.pedersen@gmail.com>

commands: Preserve non-content files in convert output

When running `hugo convert` with `--output`, copy the content tree first so non-content bundle resources are kept in the destination, then overwrite converted content files.

Also avoid recursive self-copy when the output path points inside the content tree by skipping output directories during copy.

Fixes #4621

npm: Use workspaces to simplify `hugo mod npm pack`

Rewrite `hugo mod npm pack` to use npm workspaces. Module deps are now
written to packages/hugoautogen/package.json and the root package.json
gets a "workspaces" reference. A hugo_packagemeta.json sidecar stores a
hash of all input package files so regular commands can warn when npm
deps are out of sync.

Other changes:
- Workspace glob patterns (*, **, {a,b}) are resolved via gobwas/glob.
- Workspaces defined in package.hugo.json are supported.
- package.hugo.json is only recognised at module roots, not in workspaces.
- When package.hugo.json exists, package.json is not mounted or vendored.
- packages/hugoautogen is not mounted or vendored from dependencies.
- Add usePackageJSON import option (auto/always/never) to control whether
  a module's npm deps are included. "auto" checks for Hugo config files
  or package.hugo.json.
- The staleness check is skipped when running `hugo mod npm pack` itself.

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

build(deps): bump github.com/olekukonko/tablewriter from 1.1.3 to 1.1.4 (#14641)

Bumps [github.com/olekukonko/tablewriter](https://github.com/olekukonko/tablewriter) from 1.1.3 to 1.1.4.
- [Release notes](https://github.com/olekukonko/tablewriter/releases)
- [Commits](https://github.com/olekukonko/tablewriter/compare/v1.1.3...v1.1.4)

---
updated-dependencies:
- dependency-name: github.com/olekukonko/tablewriter
  dependency-version: 1.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

commands: Close cpu profile file when StartCPUProfile fails

Replace deprecated site.Data with hugo.Data in tests

This also fixes a subtle server reload issue when changing files inside /data and using the recently added hugo.Data method.

Replace deprecated excludeFiles and includeFiles with files in tests

build(deps): bump github.com/yuin/goldmark from 1.7.16 to 1.7.17

Bumps [github.com/yuin/goldmark](https://github.com/yuin/goldmark) from 1.7.16 to 1.7.17.
- [Release notes](https://github.com/yuin/goldmark/releases)
- [Commits](https://github.com/yuin/goldmark/compare/v1.7.16...v1.7.17)

---
updated-dependencies:
- dependency-name: github.com/yuin/goldmark
  dependency-version: 1.7.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

build(deps): bump github.com/magefile/mage from 1.15.0 to 1.16.1

Bumps [github.com/magefile/mage](https://github.com/magefile/mage) from 1.15.0 to 1.16.1.
- [Release notes](https://github.com/magefile/mage/releases)
- [Commits](https://github.com/magefile/mage/compare/v1.15.0...v1.16.1)

---
updated-dependencies:
- dependency-name: github.com/magefile/mage
  dependency-version: 1.16.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

build(deps): bump golang.org/x/image from 0.36.0 to 0.37.0

Bumps [golang.org/x/image](https://github.com/golang/image) from 0.36.0 to 0.37.0.
- [Commits](https://github.com/golang/image/compare/v0.36.0...v0.37.0)

---
updated-dependencies:
- dependency-name: golang.org/x/image
  dependency-version: 0.37.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

build(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.3

Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.78.0 to 1.79.3.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](https://github.com/grpc/grpc-go/compare/v1.78.0...v1.79.3)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.79.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

tpl/tplimpl: Fix Vimeo shortcode test

Closes #14649

Remove the AI Watchdog workflow for now

It's failing with a 404 that I don't know how to fix (or don't have the time to investigate). It works fine when run locally.

Remove 'bep' from PR user logins skip list

To test it and see why it fails.

tpl/tplimpl: Comment out the Vimeo simple shortcode tests

See #14649

Replace deprecated :filename with :contentbasename in the permalinks test

releaser: Prepare repository for 0.159.0-DEV

[ci skip]

releaser: Bump versions for release of 0.158.0

[ci skip]

deps: Upgrade github.com/evanw/esbuild v0.27.3 => v0.27.4

build(deps): bump github.com/getkin/kin-openapi from 0.133.0 to 0.134.0

Bumps [github.com/getkin/kin-openapi](https://github.com/getkin/kin-openapi) from 0.133.0 to 0.134.0.
- [Release notes](https://github.com/getkin/kin-openapi/releases)
- [Commits](https://github.com/getkin/kin-openapi/compare/v0.133.0...v0.134.0)

---
updated-dependencies:
- dependency-name: github.com/getkin/kin-openapi
  dependency-version: 0.134.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

build(deps): bump golang.org/x/tools from 0.42.0 to 0.43.0

Bumps [golang.org/x/tools](https://github.com/golang/tools) from 0.42.0 to 0.43.0.
- [Release notes](https://github.com/golang/tools/releases)
- [Commits](https://github.com/golang/tools/compare/v0.42.0...v0.43.0)

---
updated-dependencies:
- dependency-name: golang.org/x/tools
  dependency-version: 0.43.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

resources: Re-publish on transformation cache hit

When a resource transformation result was served from cache (same
options as a previous build), the output file was not re-written to
disk. This caused incorrect output when toggling transformation
options (e.g. minify) back to a previously seen value in server mode.

Fixes #14629

create/skeletons: Use css.Build in theme skeleton

Closes #14626

tpl/css: Add a test case for rebuilds on CSS options changes

hugolib: Allow regular pages to cascade to self

Closes #14627

build(deps): bump gocloud.dev from 0.44.0 to 0.45.0

Bumps [gocloud.dev](https://github.com/google/go-cloud) from 0.44.0 to 0.45.0.
- [Release notes](https://github.com/google/go-cloud/releases)
- [Commits](https://github.com/google/go-cloud/compare/v0.44.0...v0.45.0)

---
updated-dependencies:
- dependency-name: gocloud.dev
  dependency-version: 0.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

build(deps): bump golang.org/x/sync from 0.19.0 to 0.20.0

Bumps [golang.org/x/sync](https://github.com/golang/sync) from 0.19.0 to 0.20.0.
- [Commits](https://github.com/golang/sync/compare/v0.19.0...v0.20.0)

---
updated-dependencies:
- dependency-name: golang.org/x/sync
  dependency-version: 0.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

tpl/css: Allow the user to override single loader entries

Fixes #14623

Co-authored-by: Joe Mooring <joe.mooring@veriphor.com>