--- title: Release v0.169.0 · gohugoio/hugo | daily.dev description: Hugo v0.169.0 ships mainly to bundle Go 1.27.3, which blocks trust in a small set of intermediate certificates due to specific security concerns around their... canonical: https://daily.dev/posts/release-v0-169-0-gohugoio-hugo-nc2lmfofn twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Release v0.169.0 · gohugoio/hugo | daily.dev og:description: Hugo v0.169.0 ships mainly to bundle Go 1.27.3, which blocks trust in a small set of intermediate certificates due to specific security concerns around their... og:url: https://daily.dev/posts/release-v0-169-0-gohugoio-hugo-nc2lmfofn og:image: https://api.daily.dev/og/posts/nC2lMfOFn.png og:image:alt: Release v0.169.0 · gohugoio/hugo og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Release v0.169.0 · gohugoio/hugo **[Hugo](https://daily.dev/sources/hugo)** · 4 min read · 1 upvotes · 0 comments ## Summary Hugo v0.169.0 ships mainly to bundle Go 1.27.3, which blocks trust in a small set of intermediate certificates due to specific security concerns around their operation, affecting features like resources.GetRemote that fetch remote resources over HTTPS. The release also hardens security: menu entry pre/post values from front matter are now HTML escaped, and emojify/plainify now return a plain string instead of always returning template.HTML, so an untrusted title is no longer marked safe by default. Reserved front matter fields like .Params.title are deprecated in favor of .Title and similar Page methods. It also includes eight bug fixes and five dependency updates. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why did Hugo bump to Go 1.27.3 in a recent release? Go 1.27.3 blocks trust in a small set of intermediate certificates due to security concerns documented in the eMudhra incident. Hugo needed this update because it affects features that fetch remote resources over HTTPS, such as resources.GetRemote, which rely on certificate trust to work correctly. _Developers tracking Go toolchain security fixes can follow release notes like this on daily.dev._ ### Will emojify and plainify in Hugo still return template.HTML after upgrading? No, as of Hugo v0.169.0, emojify and plainify return a plain string unless the input is already template.HTML, in which case the result stays template.HTML. Previously both always returned template.HTML, which meant piping an untrusted title through emojify could mark it as safe HTML. Anyone relying on the old behavior with trusted input should pipe the result through safeHTML. _Hugo site maintainers weighing template changes can check breaking-change notes like this on daily.dev._ ### Is .Params.title still usable in Hugo templates? It still works but is deprecated as of Hugo v0.169.0. Reserved front matter fields such as title, date, and summary are still stored in .Params, but lookups like .Params.title are now redirected to the corresponding Page method (.Title) and logged as a deprecation warning, unless the field was explicitly set in the params section of front matter. _Developers migrating Hugo templates away from deprecated fields can reference changes like this on daily.dev._ ## Similar posts on daily.dev - [Golang Weekly Issue 594: March 20, 2026](https://daily.dev/posts/golang-weekly-issue-594-march-20-2026-t0g6ncteb) · Golang Weekly · 5 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#golang](https://daily.dev/tags/golang) [View this post on daily.dev](https://daily.dev/posts/release-v0-169-0-gohugoio-hugo-nc2lmfofn) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Release v0.169.0 · gohugoio/hugo","url":"https://daily.dev/posts/release-v0-169-0-gohugoio-hugo-nc2lmfofn","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/release-v0-169-0-gohugoio-hugo-nc2lmfofn"},"datePublished":"2026-10-27T16:38:14.789Z","dateModified":"2026-10-27T16:52:24.809Z","description":"Hugo v0.169.0 ships mainly to bundle Go 1.27.3, which blocks trust in a small set of intermediate certificates due to specific security concerns around their...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/042c8a5fe5aefce4e8ae010df1afaca2?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/042c8a5fe5aefce4e8ae010df1afaca2?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hugo","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hugo","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/0b9e9e4bd6dc4a96bba3ca9663c6d6b7","url":"https://daily.dev/sources/hugo"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/release-v0-169-0-gohugoio-hugo-nc2lmfofn","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,golang","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hugo","item":"https://daily.dev/sources/hugo"},{"@type":"ListItem","position":3,"name":"Release v0.169.0 · gohugoio/hugo"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/release-v0-169-0-gohugoio-hugo-nc2lmfofn#faq","mainEntity":[{"@type":"Question","name":"Why did Hugo bump to Go 1.27.3 in a recent release?","acceptedAnswer":{"@type":"Answer","text":"Go 1.27.3 blocks trust in a small set of intermediate certificates due to security concerns documented in the eMudhra incident. Hugo needed this update because it affects features that fetch remote resources over HTTPS, such as resources.GetRemote, which rely on certificate trust to work correctly. Developers tracking Go toolchain security fixes can follow release notes like this on daily.dev."}},{"@type":"Question","name":"Will emojify and plainify in Hugo still return template.HTML after upgrading?","acceptedAnswer":{"@type":"Answer","text":"No, as of Hugo v0.169.0, emojify and plainify return a plain string unless the input is already template.HTML, in which case the result stays template.HTML. Previously both always returned template.HTML, which meant piping an untrusted title through emojify could mark it as safe HTML. Anyone relying on the old behavior with trusted input should pipe the result through safeHTML. Hugo site maintainers weighing template changes can check breaking-change notes like this on daily.dev."}},{"@type":"Question","name":"Is .Params.title still usable in Hugo templates?","acceptedAnswer":{"@type":"Answer","text":"It still works but is deprecated as of Hugo v0.169.0. Reserved front matter fields such as title, date, and summary are still stored in .Params, but lookups like .Params.title are now redirected to the corresponding Page method (.Title) and logged as a deprecation warning, unless the field was explicitly set in the params section of front matter. Developers migrating Hugo templates away from deprecated fields can reference changes like this on daily.dev."}}]} ```