The Hugo project released v0.170.0 on GitHub on 13 November 2026, and the "extended" edition of the site generator is gone. That edition existed mainly for LibSass, an old Sass engine long marked deprecated, which needed CGO, a way for Go programs to use C code. Hugo now ships one binary with every other feature the extended build had.
A css.Sass setting that asks for libsass now fails with an error. Dart Sass is the only engine left, so Sass users must install it. Hugo no longer publishes hugo_extended archives, but keeps aliases for the most downloaded ones and tells users to update their scripts. How long the aliases last is not stated. Of 12 security fixes in Go 1.27.4, which builds this release, the project calls a crash in the HTTP server behind hugo server the most relevant. The other 11 are in the cmd/go toolchain and mainly matter when building Hugo from source with untrusted dependencies.
The release removes a build assumption teams may not know they rely on, and Dart Sass becomes a dependency they must own. Leaders can ask who owns the scripts that download Hugo, how many still name an extended archive, and whether the build machines for Sass sites have Dart Sass.