[dependabot]

Bumps hugo-extended from 0.166.0 to 0.169.0.

Commits

• f81db3f chore: bump to Hugo v0.169.0
• d1e9bd3 chore: bump to Hugo v0.168.0
• 4c3c190 chore: bump to Hugo v0.167.0
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[strix-security]

Strix Security Review

✅ No open security findings.

PR summary: Bumps the dev dependency `hugo-extended` from 0.166.0 to 0.169.0 in `package.json` and `package-lock.json`, with no source code changes.

Review summary

This PR contains only a Dependabot version bump of the development dependency hugo-extended from 0.166.0 to 0.169.0, updating the version pin in package.json and the corresponding version, registry URL, and integrity hash in package-lock.json. No application source, build scripts, CI configuration, or runtime code paths are modified, so there is no new attack surface or security-relevant logic to review. The lockfile integrity hash was updated in step with the new tarball, and no security issues are introduced by the change.

_{Review 1 on this PR · ced1f4a · requested Nov 2 20:02 UTC when the PR was opened}

---

Reviewed by Strix
_{Re-run review · Configure security review settings}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: c5fe3d42-7952-48ad-85c6-af31b66a7cc3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-02T20:06:56.377735Z	ced1f4a	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

Preview Deployment

Status	URL
✅ Deployed	pr-534.navidrome-website.pages.dev

Built from ced1f4a

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ced1f4a377

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Update the Hugo executables along with the npm pin

This changes only the npm package, but every project build still executes Hugo 0.166.0: both GitHub workflows install that version explicitly (prod-build-deploy.yml:21-25 and preview-build.yml:20-24), while npm run build uses the 0.166.0 Docker image in docker-compose.yaml:3. Because direct shell invocations of hugo do not resolve node_modules/.bin, CI can pass without ever exercising 0.169.0, and production receives none of this upgrade's fixes; update these runtime pins together so the newly declared version is actually tested and deployed.

Useful? React with 👍 / 👎.