This release contains new features, improvements and bug fixes.

• US-1643 Print and page setup API for the spreadsheet package
• US-1642 Animation API for the presentation package (on-click entrance effects: Appear, Fade, Fly In)
• US-1639 Speaker notes API for the presentation package
• US-1659 Word section formatting API (columns, page borders, line numbering, page-number format, title page)
• US-1709 Support for tables inside a Structured Document Tag (SDT)
• US-1707 Support for threaded comment replies and comment metadata getters
• US-1708 Support for custom text highlight colors through the run shading API

• US-1393 DOCX to PDF rendering of table rows taller than a page improvement
• US-1671 DOCX to PDF rendering of vertically merged table cells taller than a page improvement
• US-1697 DOCX to PDF XObject deduplication, reducing output file size
• US-1689 UniPDF dependency update to v5
• US-1678 CI/CD pipeline publishing the latest SBOM files with each release

• US-1617 Negative chart axis IDs (c:axId / c:crossAx) failing to read fix
• US-1690 Table of contents not rendering until a manual field refresh fix

• presentation.New() now emits a <p:sldSz> element with the standard 16:9 slide size, which previously was omitted. This changes the serialized bytes of every deck created by New(), so byte-for-byte or golden-file comparisons against output from earlier versions need to be regenerated. See US-1642.

• Harden proxy middleware (#4405) New proxy.SecurityPolicy with secure defaults: private/loopback upstreams, non-http(s) schemes and HTTPS-to-HTTP redirect downgrades are rejected and hop-by-hop headers stripped.

  proxy.WithSecurityPolicy(proxy.SecurityPolicy{
      AllowPrivateIPs: true, // internal upstreams are blocked by default
  })

  https://docs.gofiber.io/middleware/proxy#security
• Add support for custom binding precedence (#4544) New binding_source struct tag overrides the Bind().All() source order per struct; the resolved order is cached per reflect.Type.

  type SearchReq struct {
      Name string `binding_source:"query,header,cookie,body,uri" query:"name" header:"x-name" json:"name"`
  }

  https://docs.gofiber.io/api/bind#custom-precedence
• Add SkipUnmatchedRoutes with two-tier 404/405 fast path (#4486) New fiber.Config option that answers unregistered paths with 404/405 before the middleware chain runs (CORS preflight exempt, off by default).

  app := fiber.New(fiber.Config{
      SkipUnmatchedRoutes: true, // default: false
  })

  https://docs.gofiber.io/api/fiber#skipunmatchedroutes

• Speed up route matching with a flat tree index, leading-byte candidate rejection and a specialized /const/:param matcher (#4558)
• Quick-reject routes on precomputed slash-count bounds (#4517)
• Restore Route inlining lost in the RFC 9110 changes (#4501)
• Skip the Accept join allocation in the Format emptiness check (#4503)
• Skip the ip.String() allocation in IsProxyTrusted for CIDR-only trust configs (#4500)
• Adopt SWAR-accelerated utils helpers in hot-path scanners (#4536)
• Adopt gofiber/utils v2.2.0 helpers across hot paths (#4542)
• Adopt gofiber/utils v2.4.0 helpers and optimize adaptor/proxy hot paths (#4557)
• adaptor: Cut allocations on the net/http bridge (#4559)
• cache: Optimize key generation and allocation (#4608)
• cors: Fold preflight Vary calls into one header scan (#4502)
• csrf: Optimize trusted subdomain matching (#4543)
• proxy: Optimize balancer round-robin (#4549)
• session: Use make() to preallocate relevantExtractors (#4562)
• De-flake the clock-sensitive tests (#4575)

• Fix open redirects in composed route URLs and redirect rules (#4584)
• Preserve published route buckets during rebuilds (#4579)
• URL-encode query values in Redirect.Route (#4529)
• Accept the full float64 range in the float route constraint (#4528)
• Match HTTP field names the way a recipient must (#4585)
• Honor Accept weights followed by whitespace before the comma (#4550)
• Compare Accept media types case-insensitively (#4493)
• Honor q=0 rejections in content negotiation (#4508)
• Honor duplicate Content-Encoding after empty values (#4514)
• Improve RFC 9110 compliance across req/res/ctx, helpers and middleware (#4494)
• Avoid reading omitted request bodies in Bind.All (#4565)
• Combine repeated proxy headers for client IP extraction (#4568)
• Close the listener on Listen error paths to avoid FD leaks (#4532)
• Fire OnPostShutdown once with the real shutdown error (#4531)
• Keep all NewErrorf args when the first isn't a format string (#4530)
• adaptor: Preserve Connection tokens (#4606)
• cache: Honor only-if-cached for non-shareable entries (#4589)
• cache: Stop charging its own latency as response age (#4578)
• healthcheck: Answer HEAD probes with the GET status (#4577)
• limiter: Floor sub-second expiration in the sliding window (#4564)
• proxy: Classify IPv6 transition addresses correctly in upstream validation (#4553)
• proxy: Guard runtime helpers against DNS rebinding (#4518)
• proxy: Preserve empty-query URL semantics (#4513)
• redirect: Rank wildcards behind character classes in rule ordering (#4607)
• static: Fix leading-slash normalization for fs.FS root paths (#4507)
• Fix client redirect handling, TLS diagnostics and the JSONP callback (#4586)
• Fix correctness issues across log injection, cookie jar, routing and Content-Type handling (#4570)

• Explain adjacent multi-param capture rules (#4597)
• Document Ctx as a never-cancelable context (#4560)
• Move README.md to the repo root so pkg.go.dev renders it (#4505)
• logger: Explain when the error tag is populated (#4592)

📒 Documentation: https://docs.gofiber.io/

💬 Discord: https://gofiber.io/discord

Full Changelog: https://github.com/gofiber/fiber/compare/v3.4.0...v3.5.0

Thank you @0xghost42, @ATKasem, @Rachit-Gandhi, @ReneWerner87, @RubenPari, @SivaPA08, @aryan-finbox, @aryan262, @gaby, @james-yusuke, @nikolauspschuetz, @sueun-dev and @sunghyun1999 for making this release possible.

• idempotency: release MemoryLock keys on unlock #4569

Full Changelog: https://github.com/gofiber/fiber/compare/v2.52.14...v2.52.15

• Add documentation URL generation to automatic changelog entries in PR by @taliesin-ai
• Add Streams: bidirectional byte streams between Go and JavaScript with the WebSocket programming model and no listening socket. Declare a stream in Go with app.HandleStream(name, handler) and connect from the frontend with Stream(name), which returns a WebSocket-shaped object. Go→JS is carried by one held poll per window over the asset server, JS→Go by a normal POST; nothing binds a TCP port and nothing goes through evaluateJavaScript. In server builds (-tags server) the same handler is served over a real WebSocket instead, so application code is identical across builds. by @leaanthony
• Move mailbox changelog entry to Unreleased in PR by @leaanthony

• Update docs sidebar autogeneration and blog author type derivation in PR by @leaanthony

• WebView2 initialization uses a deadline and message pump in PR by @leaanthony
• WebView2 cookie test skips in CI unless opt-in and locks execution to current OS thread in PR by @leaanthony
• Windows menu builders restore command IDs for submenu parent items in PR by @gilad-ch
• Align the official cross-compilation image with the GTK 4.14+ Linux support baseline (#5928)
• Configure iOS Xcode project to retain inherited linker flags and add -ObjC in PR by @mortenolsrud
• Fix excessive TCP connection churn in the wails3 dev asset proxy on large frontends, which could exhaust the host's ephemeral ports and make unrelated processes fail with EADDRNOTAVAIL
• Queue per-window event JavaScript for ordered dispatch and backpressure in PR by @leaanthony

• Remove the desktop binary release pipeline: v3 releases are tag-only and the wails3 CLI is installed with go install. Deletes release-v3.yml and the nightly step that dispatched it in PR by @leaanthony

🤖 This is an automated nightly release generated from the latest changes on master.

Installation:

go install github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0-beta.8

⚠️ Beta Warning: This is pre-release software. The API is stable, but you may still encounter issues before the final 3.0 release.

This release is a focused follow-up to v0.14.0 improving diagnostics and observability for validating large PDF corpora. It also includes PDF processing hardening, CJK text wrapping for watermarks, and clearer signature-validation behavior.

v0.15.0 follows v0.14.0 by only one week because post-release corpus testing made an existing operational gap clear: large wildcard-driven validation runs delayed failure diagnostics until the full input set completed and provided no quiet-mode indication of the file currently being processed.

The changes are targeted and immediately useful to corpus testers, so holding them for a later feature release would unnecessarily delay feedback. The short interval is intentional and does not establish a weekly release routine.

Multi-file CLI validation now reports each failed input as soon as the failure is detected, continues with the remaining inputs, and exits nonzero with a compact summary:

validation failed: 66 of 463 files invalid

The new --progress flag identifies the active input during quiet validation runs. This is useful when a long-running corpus job stalls on a particular file:

pdfcpu validate -q --progress "**/*.pdf"

The quotes are intentional. They pass the recursive pattern to pdfcpu for internal expansion instead of asking the shell to expand thousands of paths into one command line, which may exceed the operating system's argument-size limit.

With -q --progress, progress and validation failures are written to standard error while standard output remains clean:

validating(mode=relaxed) path/to/input.pdf ...
validate path/to/input.pdf: validation error: ...

There is a new Corpus Validation guide documenting quick assessment, progress monitoring, logging, validation modes, result interpretation, and focused issue reporting.

A failed corpus run is diagnostic input, not an issue backlog. Public reports must isolate one manually verified and independently reproduced problem with the smallest shareable PDF. Include the relevant error and final summary, and attach large logs as compressed files instead of pasting them into an issue.

AI-generated, bulk-generated, or mechanically reformatted corpus reports will be closed immediately without investigation. Corpus-wide analysis, failure classification, confidential-file investigation, and scheduled remediation are separate engineering work and may require a paid engagement.

Limited corpus investigation and remediation work may be available by arrangement.

Malformed and inconsistent PDF structures now produce more contextual errors across reading, dereferencing, validation, optimization, fonts, forms, and XObjects. Integer conversion and encryption handling have been tightened, and additional guards reduce the risk of panics while processing damaged input.

This work is backed by expanded malformed-input, error-path, and optimization regression coverage.

Text watermarks now support automatic wrapping for CJK text, including long runs without spaces. Oversized text is wrapped to the configured width instead of forcing unintended font-size reduction. This resolves issue #1427 and includes expanded CJK wrapping and layout coverage.

Signature validation output is clearer for legacy and unsupported cases. Evidence handling, PKCS#1 and PKCS#7 processing, and related error classification have also been tightened.

The pkg/api multi-file validation contract is unchanged: API callers continue to receive joined errors after processing. The CLI now streams individual multi-file validation failures and returns a final summary, so scripts that compare complete stderr strings should be updated to rely on exit status and stable error classification instead.

Existing non-quiet validation already reports the active input. --progress extends that visibility to quiet corpus runs without duplicating normal progress output.

• f2686555086a2e76dc19f602ea1897f6e3baae4d bump version
• dcc168d28225f7f3266836668483a3cdaced729a update issue reporting guidelines
• f5f3edf37f9642c4403300db88109521085006f2 harden PDF validation and add progress reporting
• afc357e23773c32d61b8c18601f77aa8ffcb6dab clarify signature validation output and legacy handling
• c9c07d0fcd19439f967cfff96203ebe41a1e8327 harden crypto integer conversions
• 198382701afee53f783aaf425cc240ee26170ae4 upgrade gh workflows
• 4e5f3aba056aebb721d7334032b378aeba1708b8 harden crypto integer conversions
• b57300b5f79f9139a7a6534fce7cbc96633ae025 clean up for #1427
• a2c33719c6aa55593d0316e50247388a3763b5f2 add CJK auto-wrap support for text watermarks (#1427)

• Add macOS autoplay preference to disable user action requirement for media playback in PR by @Eyalm321
• Move mailbox changelog entry to Unreleased in PR by @leaanthony

• macOS zoom animation uses CADisplayLink or NSTimer for smoother performance in PR by @savely-krasovsky

• Configure iOS Xcode project to retain inherited linker flags and add -ObjC in PR by @mortenolsrud
• Fix excessive TCP connection churn in the wails3 dev asset proxy on large frontends, which could exhaust the host's ephemeral ports and make unrelated processes fail with EADDRNOTAVAIL
• Queue per-window event JavaScript for ordered dispatch and backpressure in PR by @leaanthony

🤖 This is an automated nightly release generated from the latest changes on master.

Installation:

go install github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0-beta.7

⚠️ Beta Warning: This is pre-release software. The API is stable, but you may still encounter issues before the final 3.0 release.

go install github.com/wailsapp/wails/v2/cmd/wails@v2.14.0

• Fixed nil pointer crash and swallowed network error when downloading the WebView2 bootstrapper, which made the app exit instead of showing the installation error dialog by @jannskiee

• Implement bounded host-side storage for oversized events and ordered JavaScript delivery in PR by @leaanthony
• Implement macOS Dock bounce for window flashing in PR by @julianstorer

• Asset server preserves content-type sniffer errors and unwritten prefixes during flushing in PR by @leaanthony
• Prevent macOS applications from crashing when replacing the application menu from a Wails callback
• Fix unreadable native menus on Windows 10 1809 / Windows Server 2019 (build 17763). The dark-mode uxtheme exports were gated on build 18334, so the app-level dark-mode opt-in never ran on those hosts: the menu background was painted dark but Windows kept drawing menu text in the light theme, leaving dark text on a dark background. The ordinals exist from 17763, so the gate now matches.
• Fix w32.GetStockObject calling GetDeviceCaps instead of GetStockObject, which made it return 0 for every stock object.
• Improve WebView2 bootstrapper download error handling and reporting in PR by @jannskiee

🤖 This is an automated nightly release generated from the latest changes on master.

Installation:

go install github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0-beta.6

⚠️ Beta Warning: This is pre-release software. The API is stable, but you may still encounter issues before the final 3.0 release.

• macOS app activation now respects activation policy for regular apps only in PR by @julianstorer
• Guard uninitialized GTK windows in Linux builds in PR by @julianstorer
• Set explicit opaque background color for Linux WebKit windows before URL load in PR by @julianstorer

🤖 This is an automated nightly release generated from the latest changes on master.

Installation:

go install github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0-beta.5

⚠️ Beta Warning: This is pre-release software. The API is stable, but you may still encounter issues before the final 3.0 release.

• fix(website): uglyURLs on main, update documentation by @alex-dna-tech in https://github.com/micro/go-micro/pull/4871
• fix: preserve AtlasCloud conformance markers across text tool fallbacks by @mvanhorn in https://github.com/micro/go-micro/pull/4878
• cmd/micro gateway HTTP->RPC proxy: Endpoint handling via URL parsing is not implemented by @alex-dna-tech in https://github.com/micro/go-micro/pull/4879

• @mvanhorn made their first contribution in https://github.com/micro/go-micro/pull/4878

Full Changelog: https://github.com/micro/go-micro/compare/v6.9.0...v6.10.0