fix: upgrade adm-zip to 0.6.0 (CVE-2026-39244)

.github/workflows/auto-merge.yml

@@ -9,9 +9,7 @@ permissions:
 jobs:
   review-dependabot-pr:
     runs-on: ubuntu-latest
-    # remove next line and uncomment the line after to enable auto merge
-    if: false
-    # if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}
+    if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}
     steps:
       - name: Dependabot metadata
         id: metadata

.github/workflows/lint-build.yml

@@ -21,10 +21,10 @@ jobs:
 
     steps:
     - name: Check out repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
 
     - name: Set up Node.js
-      uses: actions/setup-node@v6
+      uses: actions/setup-node@v7
       with:
         node-version: lts/*
         cache: 'npm'
@@ -60,15 +60,15 @@ jobs:
 
     steps:
     - name: Check out repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
 
     - name: Install Go
-      uses: actions/setup-go@v6
+      uses: actions/setup-go@v7
       with:
         go-version: "stable"
 
     - name: Set up Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v6
+      uses: actions/setup-node@v7
       with:
         node-version: ${{ matrix.node-version }}
         cache: 'npm'
@@ -115,13 +115,27 @@ jobs:
       shell: pwsh
 
     # Cache Hugo cachedir and resourcedir (configured in config/ci/hugo.toml) for each OS.
-    # Rolling key restores the previous snapshot as a warm start, then saves a fresh one after build.
+    # The key restores the previous snapshot as a warm start, then saves a fresh one after build.
     # No additional content-based invalidation is needed; Hugo uses checksums itself.
+    #
+    # The suffix rotates weekly rather than per run. A run_id suffix saves a fresh entry every run and
+    # never reclaims the previous one, and a repository's Actions cache is a single ~10 GB LRU pool
+    # shared by every workflow in it — so those entries fill the pool and GitHub then evicts by last
+    # access, taking out the small caches other jobs depend on rather than the ones causing the
+    # pressure. An ISO-week suffix caps this prefix at roughly two live entries per OS per branch.
+    #
+    # %G/%V are the ISO year and week and must be paired — %Y/%V is wrong across a year boundary. The
+    # step needs an explicit bash shell because the Windows legs of the matrix default to pwsh.
+    - name: Compute the weekly cache epoch
+      id: cache-epoch
+      run: echo "week=$(date -u +%G-W%V)" >> "$GITHUB_OUTPUT"
+      shell: bash
+
     - name: Use Hugo cache
-      uses: actions/cache@v5
+      uses: actions/cache@v6
       with:
         path: ${{ env.HUGO_CACHEDIR }}
-        key: ${{ runner.os }}-${{ env.CACHE_KEY }}-${{ github.run_id }}
+        key: ${{ runner.os }}-${{ env.CACHE_KEY }}-${{ steps.cache-epoch.outputs.week }}
         restore-keys: |
           ${{ runner.os }}-${{ env.CACHE_KEY }}-
 

.github/workflows/mod-update.yml

@@ -14,10 +14,10 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
 
     - name: Setup Node.js
-      uses: actions/setup-node@v6
+      uses: actions/setup-node@v7
       with:
         node-version: lts/*
         cache: 'npm'
@@ -38,7 +38,7 @@ jobs:
         echo 'EOF' >> $GITHUB_OUTPUT
 
     - name: Create Pull Request
-      uses: gethinode/create-pull-request@v7
+      uses: gethinode/create-pull-request@v8
       with:
         token: ${{ secrets.HUGO_MOD_PR }}
         commit-message: 'fix: update Hugo module dependencies'

.gitignore

@@ -8,4 +8,8 @@ resources/
 node_modules/
 
 .DS_store
-.hugo_build.lock
+.hugo_build.lock
+# Generated by build.buildStats; regenerated each build, never committed
+hugo_stats.json
+# Generated by js.Build for editor intellisense; regenerated each build
+assets/jsconfig.json

README.md

@@ -65,6 +65,74 @@ Hinode is a theme that uses [Hugo modules][hugo_modules] to install and maintain
 
 You can now run `npm run start` to start a local development server.
 
+## Using pnpm (optional)
+
+This template uses **npm** by default. If you prefer [pnpm](https://pnpm.io) — faster installs, a shared package store, a 24-hour supply-chain quarantine, and stricter dependency isolation — switch with the following steps.
+
+1. Replace the lockfile:
+
+   ```bash
+   pnpm import          # seed pnpm-lock.yaml from package-lock.json
+   rm package-lock.json
+   ```
+
+2. Pin pnpm in `package.json` (use your installed pnpm version):
+
+   ```json
+   "packageManager": "pnpm@10.0.0"
+   ```
+
+3. Add a `.npmrc` for the supply-chain quarantine:
+
+   ```ini
+   # Reject any version published less than 24h ago.
+   minimum-release-age=1440
+   ```
+
+4. Add `pnpm-workspace.yaml`:
+
+   ```yaml
+   allowBuilds:
+     hugo-extended: true # downloads the platform-specific Hugo binary
+   minimumReleaseAgeExclude:
+     - "@gethinode/*"
+   ```
+
+5. Restore PostCSS compatibility. Hugo needs an npm-format `postcss` bin shim, which pnpm does not create. Add `cmd-shim` and a postinstall step:
+
+   ```bash
+   pnpm add -D cmd-shim
+   ```
+
+   Create `scripts/fix-postcss-bin.cjs`:
+
+   ```js
+   const fs = require('fs');
+   const path = require('path');
+   const cmdShim = require('cmd-shim');
+
+   const entry = path.join('node_modules', 'postcss-cli', 'index.js');
+   const target = path.join('node_modules', '.bin', 'postcss');
+   if (fs.existsSync(entry)) {
+     fs.mkdirSync(path.dirname(target), { recursive: true });
+     cmdShim(entry, target).catch((e) => {
+       console.error('fix-postcss-bin:', e.message);
+       process.exit(1);
+     });
+   }
+   ```
+
+   Then add to your `package.json` scripts: `"postinstall": "node scripts/fix-postcss-bin.cjs"`.
+
+6. Install and build:
+
+   ```bash
+   pnpm install
+   pnpm run build
+   ```
+
+If you use the bundled GitHub Actions workflows, update them to use pnpm as well — replace the `npm ci`/`npm i` install steps with `pnpm install` (which runs the `postinstall` shim above).
+
 <!-- MARKDOWN LINKS -->
 [docs]: https://gethinode.com/docs
 [git_download]: https://git-scm.com

config/_default/hugo.toml

@@ -91,7 +91,6 @@ home = ["HTML", "RSS", "REDIR", "netlify", "server"]
 
 [minify]
   [minify.tdewolff.js]
-    keepVarNames = true
     precision = 0
     version = 2022
   [minify.tdewolff.html]
@@ -123,9 +122,9 @@ home = ["HTML", "RSS", "REDIR", "netlify", "server"]
     source = "static"
     target = "static"
   [[module.imports]]
-    path = "github.com/gethinode/mod-blocks"
+    path = "github.com/gethinode/mod-blocks/v2"
   [[module.imports]]
-    path = "github.com/gethinode/hinode/v2"
+    path = "github.com/gethinode/hinode/v3"
 
 [segments]
   [segments.headers]

config/_default/params.toml

@@ -104,7 +104,6 @@
     # themeFontPath = "https://fonts.googleapis.com/css2?family=Inter:wght@200;300;600&display=swap" # external path
     themeFontPath = "/fonts" # local path
     fontSizeBase = "1rem"
-    purge = true
 
 [schema]
     type = "Organization"

config/postcss.config.js

@@ -1,11 +1,3 @@
-const autoprefixer = require('autoprefixer')({})
-const cssnano = require('cssnano')({
-  preset: ['advanced', {
-    discardUnused: {
-      fontFace: false  // Preserve all @font-face declarations
-    }
-  }]
-})
 const purgeImport = require('@fullhuman/postcss-purgecss')
 const purgeCSSPlugin = purgeImport.purgeCSSPlugin || purgeImport.default || purgeImport
 const purgecss = purgeCSSPlugin({
@@ -17,18 +9,25 @@ const purgecss = purgeCSSPlugin({
   dynamicAttributes: ['aria-expanded', 'data-bs-theme', 'data-bs-main-theme', 'data-bs-theme-animate', 'data-transparent', 'role'],
   fontFace: false,
   safelist: {
+    // Every entry below is a class PurgeCSS cannot see in hugo_stats.json because it is
+    // added by JavaScript at runtime (or by a third-party library). Classes that Hugo DOES
+    // emit into the markup — and therefore into hugo_stats.json — are intentionally NOT
+    // listed: purge now always runs against complete, current stats (production
+    // post-process; dev does not purge), so they survive on their own. In particular the
+    // former `/^d-(sm|md|lg|xl|xxl)-table-cell$/` entry is gone — render-table.html emits
+    // the configured breakpoint's class into the markup, so it reaches the stats naturally.
     standard: [
-      // Bootstrap form validation
+      // Bootstrap form validation — added by JS on submit, never in the source markup
       'was-validated',
-      // Bootstrap dynamic states
+      // Bootstrap component state classes toggled by JS (modal/dropdown/collapse/etc.)
       'show',
       'showing',
       'hiding',
       'active',
       'disabled',
       'collapsed',
       'collapsing',
-      // SimpleDatatables modifier classes
+      // SimpleDatatables modifier classes (set by the datatables JS)
       'no-header',
       'no-footer',
       // SimpleDatatables table rendering classes (added by JS)
@@ -38,6 +37,15 @@ const purgecss = purgeCSSPlugin({
       'both',
       'desc',
       'asc',
+      // Hinode wrapped tables: on a DATA table, `table-wrap` / `table-border-bottom-wrap`
+      // are applied in the browser by SimpleDatatables' tableRender hook, so on a site whose
+      // only wrapped tables are data tables they never reach hugo_stats.json and would
+      // otherwise be purged.
+      'table-wrap',
+      'table-border-bottom-wrap',
+      // `d-none` is also applied by that hook; kept to record the wrap's dependency on it
+      // (a dozen core layouts emit it too, so in practice it is always in the stats).
+      'd-none',
       // SimpleDatatables search component
       'search-data-table',
       'search-input',
@@ -103,20 +111,30 @@ const purgecss = purgeCSSPlugin({
       // Bootstrap responsive tables
       /table-responsive/,  // All table-responsive-* variants and attribute selectors
 
-      // Color mode toggle - d-none-main-* classes plus [data-bs-main-theme="dark"] compound selectors
-      /d-none-main/,
+      // Color mode toggle - d-none-* and d-none-inline-* (logo modes, navbar mode switcher,
+      // [data-bs-main-theme="dark"] compound selectors)
+      /^d-none-/,
 
       // Bootstrap transitions and utilities that get added via JS
       /fade/,
       /^translate/         // Bootstrap utilities
     ]
   }
 })
+const autoprefixer = require('autoprefixer')({})
+const cssnano = require('cssnano')({
+  // Default preset: structural minification (rule/declaration merging) that Hugo's own
+  // minify does not do. The `advanced` preset was measured to add < 0.2% over `default`,
+  // so it — and the cssnano-preset-advanced dependency — was dropped.
+  preset: 'default'
+})
 
 module.exports = {
+  // Order matters: purge first (drop unused rules) so autoprefixer and cssnano only work
+  // on what ships; cssnano last so it minifies the already-prefixed output.
   plugins: [
+    purgecss,
     autoprefixer,
-    cssnano,
-    purgecss
+    cssnano
   ]
 }

data/netlify.toml

@@ -3,9 +3,12 @@
     publish = "public"
     command = "npm run build"
 
+# HUGO_VERSION is deliberately absent. The build invokes `hugo` from an npm script, which
+# resolves to node_modules/.bin/hugo provided by the hugo-extended dependency, so the
+# binary Netlify installs would be downloaded and then never used. The pin lives in
+# package.json, which is the single source of truth for the Hugo version.
 [build.environment]
     DART_SASS_VERSION = "1.98.0"
-    HUGO_VERSION = "0.158.0"
     HUGO_ENV = "production"
     HUGO_ENABLEGITINFO = "true"
     NODE_VERSION = "24.12.0"

go.mod

@@ -3,22 +3,22 @@ module github.com/gethinode/template
 go 1.20
 
 require (
-	github.com/FortAwesome/Font-Awesome v0.0.0-20260210181720-337dd2045d56 // indirect
+	github.com/FortAwesome/Font-Awesome v0.0.0-20260715180930-14c65a3747d0 // indirect
 	github.com/airbnb/lottie-web v5.13.0+incompatible // indirect
-	github.com/cloudcannon/bookshop/hugo/v3 v3.18.2 // indirect
-	github.com/gethinode/hinode/v2 v2.2.7 // indirect
-	github.com/gethinode/mod-blocks v1.19.1 // indirect
-	github.com/gethinode/mod-bootstrap v1.3.5 // indirect
-	github.com/gethinode/mod-csp v1.0.9 // indirect
-	github.com/gethinode/mod-flexsearch/v4 v4.1.0 // indirect
-	github.com/gethinode/mod-fontawesome/v5 v5.1.0 // indirect
-	github.com/gethinode/mod-google-analytics/v2 v2.0.1 // indirect
-	github.com/gethinode/mod-katex v1.1.4 // indirect
-	github.com/gethinode/mod-leaflet/v2 v2.1.0 // indirect
-	github.com/gethinode/mod-lottie/v2 v2.1.0 // indirect
-	github.com/gethinode/mod-mermaid/v4 v4.3.0 // indirect
-	github.com/gethinode/mod-simple-datatables/v3 v3.0.0 // indirect
-	github.com/gethinode/mod-utils/v5 v5.20.0 // indirect
-	github.com/nextapps-de/flexsearch v0.0.0-20250907103239-defb38b083f0 // indirect
+	github.com/cloudcannon/bookshop/hugo/v3 v3.19.0 // indirect
+	github.com/gethinode/hinode/v3 v3.20.0 // indirect
+	github.com/gethinode/mod-blocks/v2 v2.4.0 // indirect
+	github.com/gethinode/mod-bootstrap v1.5.0 // indirect
+	github.com/gethinode/mod-csp v1.0.14 // indirect
+	github.com/gethinode/mod-flexsearch/v5 v5.3.2 // indirect
+	github.com/gethinode/mod-fontawesome/v6 v6.1.4 // indirect
+	github.com/gethinode/mod-google-analytics/v2 v2.0.4 // indirect
+	github.com/gethinode/mod-katex v1.1.7 // indirect
+	github.com/gethinode/mod-leaflet/v3 v3.1.3 // indirect
+	github.com/gethinode/mod-lottie/v3 v3.0.4 // indirect
+	github.com/gethinode/mod-mermaid/v5 v5.0.4 // indirect
+	github.com/gethinode/mod-simple-datatables/v4 v4.1.1 // indirect
+	github.com/gethinode/mod-utils/v6 v6.9.0 // indirect
+	github.com/nextapps-de/flexsearch v0.0.0-20260529083235-f7ed963096a0 // indirect
 	github.com/twbs/bootstrap v5.3.8+incompatible // indirect
 )