Update dependency gohugoio/hugo to v0.125.3

[renovate]

This PR contains the following updates:

Package	Update	Change
gohugoio/hugo	patch	v0.125.2 -> v0.125.3

---

Release Notes

gohugoio/hugo (gohugoio/hugo)

v0.125.3

Compare Source

This release fixes a security issue reported by @​ejona86 that could allow XSS injection from Markdown content files if one of the internal link or image render hook templates added in Hugo 0.123.0 are enabled. You typically control and trust the content files, but according to Hugo's security model, we state that "template and configuration authors (you) are trusted, but the data you send in is not."

• markup/goldmark: Fix data race in the hugocontext wrapper 509ab08 @​bep
• Delete .hugo_build.lock 2d75f53 @​bep
• tpl: Escape .Title in built-in image and link render hooks 15a4b9b @​bep
• tpl/tplimpl: Improve embedded templates 10a8448 @​jmooring #​12396
• SECURITY.md: Update link to security model 722c486 @​ejona86
• modules: Fix potential infinite loop in module collection f40f50e @​bep #​12407

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.