Hugo — Dependencies#

Module info#

• Module: github.com/gohugoio/hugo
• Go version: 1.25.0
• Direct dependencies: 80
• Indirect dependencies: ~103 (second require block in go.mod)
• go.sum entries: 896 lines (~448 unique module checksums)

Dependency categories#

Core infrastructure#

• github.com/bep/simplecobra — thin, opinionated wrapper around Cobra that the Hugo authors wrote themselves; used for all CLI command wiring
• github.com/spf13/cobra — underlying CLI framework (pulled in via simplecobra)
• github.com/spf13/pflag — POSIX-style flag parsing; paired with Cobra
• github.com/bep/logg — structured logging library (another bep/* custom package; Hugo moved away from logrus)
• github.com/fatih/color — terminal color output
• github.com/mattn/go-isatty — TTY detection for color decisions
• github.com/spf13/afero — virtual filesystem abstraction; the entire Hugo filesystem stack is built on top of it
• github.com/spf13/fsync — filesystem sync utility
• github.com/bep/overlayfs — afero-compatible overlay FS enabling Hugo Modules source composition
• github.com/bep/helpers — general-purpose helpers (another bep/* utility)
• github.com/bep/clocks — clock abstraction for deterministic time in tests
• github.com/bep/debounce — event debounce for the filesystem watcher
• github.com/pelletier/go-toml/v2 — TOML config parsing
• github.com/goccy/go-yaml — YAML config parsing
• github.com/mitchellh/mapstructure — config key/value maps → typed structs
• github.com/spf13/cast — lenient type coercion used throughout config and template functions
• github.com/BurntSushi/locker — named mutex locks (per-page lock during build)
• go.uber.org/automaxprocs — auto-sets GOMAXPROCS to match container CPU quota
• github.com/pbnjay/memory — reads total system RAM (used for cache sizing heuristics)
• github.com/magefile/mage — Magefile build system (dev / CI tooling only)

Content / Markup Processing#

• github.com/yuin/goldmark — primary Markdown renderer (replaced Blackfriday); extension-based architecture
• github.com/yuin/goldmark-emoji — emoji extension for Goldmark
• github.com/gohugoio/hugo-goldmark-extensions/extras — Hugo-specific Goldmark extensions (custom blocks, etc.)
• github.com/gohugoio/hugo-goldmark-extensions/passthrough — passthrough raw content extension (e.g. LaTeX)
• github.com/niklasfasching/go-org — Org-mode (Emacs) parser; Hugo supports Org as a first-class content format
• github.com/JohannesKaufmann/html-to-markdown/v2 — HTML → Markdown conversion
• github.com/microcosm-cc/bluemonday — HTML sanitizer (used when rendering unsafe HTML in Markdown)
• github.com/alecthomas/chroma/v2 — syntax highlighting for code blocks (supports 200+ languages)
• github.com/jdkato/prose — NLP text analysis (word count, readability stats for template functions)
• github.com/bep/goat — ASCII diagram → SVG conversion (GoAT diagram support in Markdown)
• github.com/bep/goportabletext — portable text format support
• github.com/kyokomi/emoji/v2 — emoji shortcode lookup

JavaScript / CSS / Asset Pipeline#

• github.com/evanw/esbuild — JS/TS bundler embedded into Hugo’s js.Build function; enables TypeScript, JSX, code splitting in the asset pipeline without a Node.js dependency
• github.com/bep/godartsass/v2 — Go bindings for Dart Sass via gRPC subprocess; used in extended edition for modern Sass/SCSS
• github.com/bep/golibsass — CGO bindings for LibSass; legacy Sass support in extended edition
• github.com/tdewolff/minify/v2 — HTML, CSS, JS, JSON, SVG minification
• github.com/tdewolff/parse/v2 — tokenizer/parser underlying tdewolff/minify
• github.com/tetratelabs/wazero — pure-Go WebAssembly runtime; used for running WASM plugins (e.g., Dart Sass can run as WASM instead of native subprocess)

Image Processing#

• github.com/bep/imagemeta — image EXIF/XMP metadata extraction
• github.com/gohugoio/gift — image transformation filters (resize, crop, rotate, overlay)
• github.com/muesli/smartcrop — content-aware smart image cropping
• github.com/makeworld-the-better-one/dither/v2 — image dithering for GIF/palette-limited formats
• github.com/marekm4/color-extractor — dominant color extraction from images
• golang.org/x/image — WebP, TIFF, BMP support beyond stdlib image package
• github.com/bits-and-blooms/bitset — bitset data structure (used in image processing internals)

Data / Serialization#

• github.com/clbanning/mxj/v2 — XML ↔ map[string]any conversion; supports XML data files in Hugo
• github.com/gohugoio/hashstructure — struct-to-hash for cache keys (Hugo fork with custom behavior)
• github.com/cespare/xxhash/v2 — fast non-cryptographic hashing
• rsc.io/qr — QR code image generation (exposed as a template function)
• github.com/olekukonko/tablewriter — ASCII table rendering

Caching#

• github.com/bep/lazycache — generics-based lazy cache with TTL and LRU eviction
• github.com/gohugoio/httpcache — HTTP response caching (for remote data sources, resources.GetRemote)

Networking / Web / Live Reload#

• github.com/gorilla/websocket — WebSocket server for Hugo’s LiveReload feature during hugo server
• github.com/fsnotify/fsnotify — cross-platform filesystem event watching; drives content rebuild on change
• github.com/pkg/browser — open browser to Hugo server URL on startup

Hugo Modules System#

• golang.org/x/mod — Go module file parsing; Hugo Modules reuse go.mod semantics
• golang.org/x/tools — Go tooling APIs (module graph resolution)
• github.com/bep/gitmap — maps Git history to filesystem paths (for .GitInfo in templates)
• github.com/hairyhenderson/go-codeowners — CODEOWNERS file parsing (file ownership metadata)

Internationalization#

• github.com/gohugoio/go-i18n/v2 — i18n translation strings (Hugo fork of nicksnyder/go-i18n with Hugo-specific behavior)
• github.com/bep/golocales — locale/language tag support
• golang.org/x/text — Unicode normalization, text segmentation, CLDR data

Cloud / Deployment (extended/deploy edition only)#

• github.com/aws/aws-sdk-go-v2 — AWS SDK core; used for S3 deployment targets
• github.com/aws/aws-sdk-go-v2/service/cloudfront — CloudFront invalidation after deploy
• gocloud.dev — Go Cloud Development Kit; provides a unified interface for S3, GCS, and Azure Blob deployment backends
• google.golang.org/api — Google Cloud APIs (GCS, etc.)

Testing#

• github.com/frankban/quicktest — lightweight test assertions (used pervasively instead of testify)
• github.com/google/go-cmp — deep value comparison (underpins quicktest)
• github.com/fortytw2/leaktest — goroutine leak detection in tests
• github.com/rogpeppe/go-internal — testscript framework for golden-file integration tests
• github.com/bep/mclib — Hugo-specific test helper library
• github.com/getkin/kin-openapi — OpenAPI spec parsing (used in generated API docs validation)

Other#

• github.com/gobuffalo/flect — English word inflection (singular/plural/title-case) for content taxonomy URLs
• github.com/gobwas/glob — glob pattern matching (template/file matching logic)
• github.com/gohugoio/go-radix — radix tree (routing / URL prefix matching)
• github.com/dustin/go-humanize — human-friendly number/size/date formatting in templates
• github.com/bep/tmc — template module client (Hugo module composition)
• github.com/bep/textandbinarywriter — dual text/binary output writer

Stdlib reliance#

Hugo uses stdlib heavily as its foundation. The ~1,037 stdlib import usages (across non-test .go files) reflect deep reliance on:

• text/template / html/template — the entire Hugo template engine is built on top of Go’s stdlib templates with a large function library layered on top
• io, os, path/filepath — filesystem operations throughout; wrapped by afero but stdlib used at many layers
• sync, sync/atomic — concurrency primitives throughout the parallel build pipeline
• fmt, errors — standard error handling idioms
• net/http — the development server (hugo server) uses stdlib HTTP
• context — cancellation propagation through the build pipeline
• maps, slices — modern Go generics stdlib packages (visible in site.go imports)

Hugo’s philosophy is to use stdlib wherever possible and reach for third-party only when the stdlib offering is genuinely insufficient (e.g., template functions, format parsing, image operations).

Shared dependencies#

Dependencies Hugo shares with other major Go projects in the research set:

Vendoring#

Hugo does not vendor its dependencies. There is no vendor/ directory. This is consistent with Hugo’s position as a developer tool (not an embedded library): users are expected to have module download capability and Hugo’s authors maintain tight version control via go.sum pinning. The lack of vendoring keeps the repository size manageable given the 80+ direct deps.

Notable dependency decisions#

1. The bep/ universe:* Hugo’s lead maintainer (Bjørn Erik Pedersen, bep) has authored 15+ of Hugo’s direct dependencies (bep/logg, bep/overlayfs, bep/lazycache, bep/simplecobra, bep/imagemeta, etc.). This is an unusual pattern — the project effectively owns its critical path dependencies, enabling rapid iteration and tailored APIs without negotiating with upstream maintainers. The tradeoff is bus-factor risk on those packages.

2. esbuild embedded: Using evanw/esbuild as a Go library (not a subprocess call) is architecturally bold — Hugo bundles one of the fastest JS bundlers without requiring Node.js at all. This is a key differentiator from other SSGs that require a Node ecosystem.

3. gocloud.dev for multi-cloud deploy: Rather than hardcoding S3/GCS/Azure logic, the deploy subsystem uses the Go CDK’s uniform blob storage interface. New cloud backends can be added without changing the deploy logic.

4. Two Sass strategies: Hugo supports both LibSass (CGO, older, golibsass) and Dart Sass (godartsass via gRPC subprocess or WASM via wazero). The WASM path is notable: Dart Sass compiled to WASM runs inside Hugo’s embedded wazero runtime, eliminating the external subprocess requirement for pure-Go deployments.

5. quicktest over testify: Hugo’s test code uses frankban/quicktest instead of the ubiquitous testify. This is a deliberate choice — quicktest is less verbose and integrates with go-cmp for diffs; it’s also maintained by a Canonical engineer and reflects the project’s preference for lighter dependencies.

6. No ORM, no database, no gRPC server: Hugo is a build tool, not a service. There are no database, gRPC service, or HTTP client framework dependencies in the core. The dependency list is dominated by content processing and asset pipeline concerns, which accurately reflects the project’s nature.