Hugo theme for my journal. https://git.nicholasjohnson.ch/hugo-theme-journal/atom?h=2026.09.19 2026-09-19T20:34:32Z 2026-09-19T20:34:32Z Nicholas Johnson 2026-09-18T00:00:00Z urn:sha256:61d07d87a9b54cd102699e065a349d5c3fc4a06fbe7a96c255e43aa182c02be7 Both render hooks passed the destination through safeURL, which bypasses the sanitising that html/template would otherwise apply, so a javascript: or data:text/html destination in Markdown became a live scripting URL in the page. That matters for any site built from content its author did not write. safeURL cannot simply be dropped: it is what allows gemini:// and other schemes html/template does not recognise to survive, which this theme depends on. Reject the scripting schemes explicitly instead, render the link text on its own, and warn during the build so the author can see what was dropped. data: is still allowed for images, where it is a legitimate way to inline one. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> 2025-07-26T00:00:00Z Nicholas Johnson 2025-07-26T00:00:00Z urn:sha256:9bb9989fca490bfac69ea4387ccae1e9ec3ec23cf7f47a401e241ee43562f8a3 This was the only way I could get term pages to consistently render correctly.