Hugo's New CSS Powers
brycewray.com
brycewray.com
And this is really not a production problem. As stated in the comments before, just don't upgrade if you don't want to / have no time yet. It is a self-contained static site generator without external dependencies. It won't break. And the security of an old Hugo binary is mostly a non-issue if you do not load remote content.
And, if you have some time: Their changes are really well documented. The changelogs are really good.
The main problem is sticking with an unmaintained template of a third party which breaks when you finally want to upgrade and don't want to fork / don't know when a an template update comes along. But that's the reason I write my own. It was worth the effort.
I have a docker image with a given version of Hugo and I've been using it for years now.
That's the beauty of building HTML: you don't HAVE to stay up to date to get security fixes.
~/.local/bin/hugo0.145.0
~/.local/bin/hugo0.148.0
~/.local/bin/hugo0.149.0
~/.local/bin/hugo0.150.0
[...]
and a convenience symlink ~/.local/bin/hugo, pointing to my "production" version. I can easliy call whichever version I like with hugo<tab><tab>. What am I missing? - sharing it easily between computers/users (docker pull registry/image:tag)
- having the appropriate binary version embedded in your code through a docker-compose in your repo
- having custom aliases dedicated to hugo included (build/serve/run...)
- using the exact same image in your CI/CD
- not "polluting" your local computer with some more stuffI think that's what OP complains about here
[0]: https://www.getzola.org/documentation/content/sass/
[1]: https://github.com/gohugoio/hugo/releases/tag/v0.43 (July, 2018)