[dependabot]

Bumps the deps group with 5 updates in the / directory:

Package	From	To
github.com/gobwas/glob	1.0.0	1.1.0
github.com/gohugoio/hugo	0.168.0	0.169.0
github.com/prometheus/common	0.72.0	0.73.1
github.com/yuin/goldmark	1.8.6	1.8.7
golang.org/x/net	0.61.0	0.62.0

Updates github.com/gobwas/glob from 1.0.0 to 1.1.0

Release notes

Sourced from github.com/gobwas/glob's releases.

v1.1.0

What's Changed

• all: modernize source code; require go 1.24 by @​gobwas in gobwas/glob#75
• tail alternatives: match stateless tail alts with a plain loop by @​gobwas in gobwas/glob#74
• glob: introduce Compiler with added Globstar option by @​gobwas in gobwas/glob#82

Full Changelog: gobwas/glob@v1.0.0...v1.1.0

v1.1.0-rc.1

What's Changed

• all: modernize source code; require go 1.24 by @​gobwas in gobwas/glob#75
• tail alternatives: match stateless tail alts with a plain loop by @​gobwas in gobwas/glob#74
• glob: introduce Compiler with added Globstar option by @​gobwas in gobwas/glob#82

Full Changelog: gobwas/glob@v1.0.0...v1.1.0-rc.1

Commits

• ff0540d glob: introduce Compiler with added Globstar option
• 013ba99 tail alternatives: match stateless tail alts with a plain loop
• ed9fb18 glob: pin that ** does not consume the adjacent separator
• abc6998 glob: document the QuoteMeta contract
• 7112f00 all: modernize source code; require go 1.24
• 986c05f .github: bump workflow versions to latest
• See full diff in compare view

Updates github.com/gohugoio/hugo from 0.168.0 to 0.169.0

Release notes

Sourced from github.com/gohugoio/hugo's releases.

v0.169.0

The main motivation behind this release is to get out a build with Go 1.27.3, which blocks trust in a small set of intermediate certificates due to specific security concerns around their operation. See the eMudhra incident for more information. This affects Hugo features that fetch remote resources over HTTPS, e.g. resources.GetRemote.

This release also contains some security hardening of the template functions and menu entries that can render content as HTML (see below), a deprecation of looking up reserved front matter fields via .Params (also below), a faster and more robust plainify, and a set of bug fixes.

Security notes

Templates are trusted in Hugo, but content (including front matter) is not necessarily. This release tightens a few places where values from content could end up rendered as unescaped HTML:

• pre and post values in menu entries defined in front matter are now HTML escaped, unless text/html is allowed in security.allowContent, which already marks HTML in /content as trusted. A warning (warning-menu-pre-post-html-escaped) is logged when a value containing HTML markup is escaped. Menu entries defined in the project configuration are not affected. f63482bf
• emojify and plainify now return a string unless the input is template.HTML, in which case the result is also template.HTML. Previously both always returned template.HTML, so e.g. {{ .Title | emojify }} would mark a potentially unsafe title as safe HTML. If you relied on the old behavior with trusted input, pipe the result through safeHTML. Thanks to @​Reload3d for reporting this. #15452

Deprecations

Reserved front matter fields such as title, date and summary are currently also stored in .Params. Lookups such as .Params.title (and ByParam "title", where .Pages "Params.title" ... etc.) are now redirected to the corresponding Page method and logged as deprecated, unless the field was set in the params section of front matter. The content of .Params is unchanged for now. 53e1fef9

Deprecated	Use instead
.Params.date	.Date
.Params.description	.Description
.Params.draft	.Draft
.Params.expirydate	.ExpiryDate
.Params.keywords	.Keywords
.Params.lastmod	.Lastmod
.Params.layout	.Layout
.Params.linktitle	.LinkTitle
.Params.publishdate	.PublishDate
.Params.slug	.Slug
.Params.summary	.RawSummary (new)
.Params.title	.Title
.Params.translationkey	.TranslationKey
.Params.type	.Type
.Params.weight	.Weight

Bug fixes

• hugolib: Fix template change detection when saving via temp file and rename 46e51f30 @​bep #15484
• markup/goldmark: Fix auto heading ID when link text starts with a bracket c22158c1 @​chanellebingham #15472
• urls: Fix JoinPath panic with empty slice ce5d232b @​Ferdinand-MZ #15473
• js: Fix js.Build with browser-disabled extensionless requires 2efee511 @​bep #15481
• Fix Site.Key used in e.g. partialCached b86e0caa @​bep #15466
• ci: Fix Windows running out of disk space and simplify test runs 77230eba @​bep
• hugolib: Fix build hang after too many page render errors 85fb23f1 @​bep #15449
• tpl/cast: Fix nil pointer panic in hugo gen docshelper 8df31809 @​jmooring #15444

Improvements

• Redirect .Params.title etc. to .Title etc. and deprecate it 53e1fef9 @​bep
• ci: Revert to plain go install honnef.co/go/tools/cmd/staticcheck@latest 3e67572c @​bep
• navigation: Escape pre/post in front matter menu entries f63482bf @​bep

... (truncated)

Commits

• 1da10fc releaser: Bump versions for release of 0.169.0
• 6e494d0 build(deps): bump github.com/getkin/kin-openapi from 0.151.0 to 0.152.0
• 46e51f3 hugolib: Fix template change detection when saving via temp file and rename
• 53e1fef Redirect .Params.title etc. to .Title etc. and deprecate it
• 8c1fdca build(deps): bump github.com/tdewolff/minify/v2 from 2.24.19 to 2.24.22
• 3e67572 ci: Revert to plain go install honnef.co/go/tools/cmd/staticcheck@latest
• c22158c markup/goldmark: Fix auto heading ID when link text starts with a bracket
• ce5d232 urls: Fix JoinPath panic with empty slice
• f63482b navigation: Escape pre/post in front matter menu entries
• 2efee51 js: Fix js.Build with browser-disabled extensionless requires
• Additional commits viewable in compare view

Updates github.com/prometheus/common from 0.72.0 to 0.73.1

Release notes

Sourced from github.com/prometheus/common's releases.

v0.73.1

What's Changed

• build(deps): bump github.com/pandatix/go-abnf from 0.5.1 to 0.5.3 by @​bwplotka in prometheus/common#1027

Full Changelog: prometheus/common@v0.73.0...v0.73.1

v0.73.0

What's Changed

• expfmt: default to allow-utf-8 escaping for OpenMetrics 2.0 by @​KR-Ravindra in prometheus/common#1008
• expfmt: add FmtOpenMetrics_2_0_0_rc format constant by @​bwplotka in prometheus/common#1020
• expfmt: add ABNF-based OpenMetrics 1.0 parser by @​bwplotka in prometheus/common#1015

New Contributors

• @​KR-Ravindra made their first contribution in prometheus/common#1008

Full Changelog: prometheus/common@v0.72.1...v0.73.0

v0.72.1

Bugfixes

• fix(config): deep copy the header in cloneRequest #982

Internal

• Fix MAINTAINERS.md link text typo in RELEASE.md #1009
• Synchronize common files from prometheus/prometheus #1010
• build(deps): bump the codeql group with 4 updates #1007

Full Changelog: prometheus/common@v0.72.0...v0.72.1

Changelog

Sourced from github.com/prometheus/common's changelog.

Changelog

main / unreleased

What's Changed

v0.72.1 / 2026-10-10

Bugfixes

• fix(config): deep copy the header in cloneRequest #982

Internal

• Fix MAINTAINERS.md link text typo in RELEASE.md #1009
• Synchronize common files from prometheus/prometheus #1010
• build(deps): bump the codeql group with 4 updates #1007

Full Changelog: prometheus/common@v0.72.0...v0.72.1

Commits

• d92d839 build(deps): bump github.com/pandatix/go-abnf from 0.5.1 to 0.5.3 (#1027)
• 983d509 expfmt: add ABNF-based OpenMetrics 1.0 parser (#1015)
• 220c51a expfmt: add FmtOpenMetrics_2_0_0_rc format constant (#1020)
• 25bdf5c expfmt: default to allow-utf-8 escaping for OpenMetrics 2.0 (#1008)
• 9eb5b04 Release v0.72.1 (#1013)
• 78ba8a4 build(deps): bump the codeql group with 4 updates (#1007)
• 687acd2 Update common Prometheus files (#1010)
• 3eb5e58 fix(config): deep copy the header in cloneRequest (#982)
• a8c86db Fix MAINTAINERS.md link text typo in RELEASE.md (#1009)
• See full diff in compare view

Updates github.com/yuin/goldmark from 1.8.6 to 1.8.7

Release notes

Sourced from github.com/yuin/goldmark's releases.

v1.8.7

• chore: bump golangci-lint to v2
• perf: cache search results, limit length
• fix(parser): #585

Commits

• 6dafb0c chore: bump golangci-lint to v2
• ddec203 perf: cache search results, limit length
• b4539c4 fix(parser): #585
• aefb206 Merge pull request #581 from chiliec/fix-linkify-trailing-punct-paren
• ad479cb fix(extension): strip trailing punctuation exposed by an unmatched ')' in lin...
• See full diff in compare view

Updates golang.org/x/net from 0.61.0 to 0.62.0

Commits

• 3de643d html: check all ancestor namespace transitions when rendering raw text
• 05c76ee ipv4, ipv6: avoid slice bounds panics on empty batch or BPF filter
• dad306f ipv6: avoid out-of-bounds panic in ICMPFilter
• 9c0565a ipv4: fix TTL control message parsing on big-endian Linux and Solaris
• 9425eb3 internal/socket, ipv4, ipv6: avoid panic on empty control message on non-Unix
• 4b10404 ipv4, ipv6: avoid nil parse function call in ControlMessage.Parse
• afcf8cd ipv4: fix several missing bounds checks
• 4af4fce html: avoid quadratic complexity when coalescing text nodes
• 7e56200 quic: per-path connection ids
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions