I stuck around on Hugo for quite some time and I've never had any such issues yet, but now I've also wrapped the build in Nix. So yeah I'll do the same - if it ever stops working I'll just pin the build inputs at the last version that worked.
I _think_ the Hugo folks seem to understand the "just build my fucking HTML templates" principle. I.e. for most use cases the job of a static site generator is simple enough that breaking compatibility is literally never justified. So hopefully pinning won't be necessary.
The beauty of SSGs, in one sentence, folks.
I'm not aware of any CVEs in HTML, either.