6 hours ago
wails

Wails v3.0.0-beta.30

Wails v3 Beta Release - v3.0.0-beta.30

Fixed

  • Fix the updater trying to replace the read-only mount of an AppImage instead of the .AppImage file
  • Stop posting WindowDidUpdate and WindowWillUpdate on macOS: NSWindowDidUpdateNotification fires on every run-loop pass, so the page received ~120 empty evaluateJavaScript: calls per second, and on macOS 27.0 each of them consumed the transient activation of the user's click — navigator.clipboard.writeText() and other activation-gated APIs rejected with NotAllowedError from real clicks (#6170) by @APshenkin
  • Fix default Windows info.json language to en-US (0409) so Explorer shows version details (#6210)
  • Handle cross-device rename failures in Linux updater with staged copy fallback in PR by @john-okeefe
  • Fix WebviewWindow.SetMenu on Windows not redrawing the menu bar unless a menubar theme was configured, fixing #6103
  • Fix WebviewWindow.SetMenu(nil) panicking on Windows instead of being a no-op like on macOS, fixing #6104
  • Preserve changelog entries across competing pushes with retries in PR by @leaanthony
  • Fix go mod vendor failing with pattern arm64/WebView2Loader.dll: no matching files found on every platform, by removing the embeds that referenced binaries never shipped in the module, fixing #5782 and #5376, in PR by @Grantmartin2002
  • Prevent duplicate window teardown on macOS in PR by @charlesbalderson
  • Handle WM_CONTEXTMENU for systray menu to open on right-click in PR by @wzk2025
  • Fix all five InvokeSync* variants blocking their caller forever when the dispatched callback panics, fixing #6107, in PR by @RALIST

🤖 This is an automated nightly release generated from the latest changes on master.

Installation:

go install github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0-beta.30

⚠️ Beta Warning: This is pre-release software. The API is stable, but you may still encounter issues before the final 3.0 release.

1 days ago
fiber

v3.6.1

🧹 Updates

  • Consolidate media-type parameter parsing into internal/mediatype (#4750)
  • Fix modernize and revive lint issues (#4759)

🐛 Fixes

  • Fix client, session, basicauth and other bugs found in the audit (#4752)

🛠️ Maintenance

  • bump github.com/gofiber/utils/v2 from 2.6.1 to 2.6.2 (#4760)
  • bump github.com/klauspost/compress from 1.20.1 to 1.20.3 (#4757)
  • bump github.com/molecule-man/go-brrr from 1.2.0 to 1.3.0 (#4758)
  • bump the golang-modules group with 3 updates (#4755)
  • bump release-drafter/release-drafter from 7.9.0 to 7.10.0 (#4756)
  • bump actions/setup-node from 7.0.0 to 7.1.0 (#4754)

📚 Documentation

  • Sync the documentation with the v3.6.0 code (#4751)

📒 Documentation: https://docs.gofiber.io/

💬 Discord: https://gofiber.io/discord

Full Changelog: https://github.com/gofiber/fiber/compare/v3.6.0...v3.6.1

Thank you @alexandear, @gaby, @ninadsutrave and @ReneWerner87 for making this release possible.

2 days ago
wails

Wails v3.0.0-beta.29

Wails v3 Beta Release - v3.0.0-beta.29

Added

  • Global shortcuts on macOS are now keyboard-layout aware: letter accelerators bind to the labelled key on non-QWERTY layouts (AZERTY, QWERTZ, Dvorak, ...) via UCKeyTranslate, instead of the fixed QWERTY physical position.

Fixed

  • Initialize native menu before setting it on Linux in PR by @abhicodes-007
  • Resolve macOS GA readiness regressions in output handling and setup wizard in PR by @taliesin-ai
  • Fix WebView2 COM AddRef/Release wrappers on Windows reporting a stale thread last-error as a failure. They now return the reference count, so a release can no longer abort the application or fail an asset request (#3931)
  • Fix ICoreWebView2Deferral.Release calling the AddRef slot, which leaked the deferral of every deferred asset request on Windows (#3931)

🤖 This is an automated nightly release generated from the latest changes on master.

Installation:

go install github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0-beta.29

⚠️ Beta Warning: This is pre-release software. The API is stable, but you may still encounter issues before the final 3.0 release.

2 days ago
Open-IM-Server

v3.8.3-patch.18

What's Changed

Full Changelog: https://github.com/openimsdk/open-im-server/compare/v3.8.3-patch.17...v3.8.3-patch.18

What's Changed

Full Changelog: https://github.com/openimsdk/open-im-server/compare/v3.8.3-patch.17...v3.8.3-patch.18

3 days ago
fiber

v3.6.0

⚡ Performance

Fiber v3.6.0 ships with fasthttp v1.75.0. With it, Fiber v3 is back on par with the speed of v2, despite the additional security mechanisms built in since then.

Time per request vs. v2 v3.5.0 (fasthttp v1.73.0) v3.6.0 (fasthttp v1.75.0)
fasthttp only +18% -5%
Static route +16% -14%
Route parameter +15% -13%
Middleware chain +13% -12%
Header lookup +29% +3%
Locals +33% +5%
JSON response +6% -3%
JSON bind +14% -2%
Median of all 22 scenarios +10% -5%

Negative is faster than v2. v3.6.0 was measured on main three days before the release. All scenarios are published on our benchmarks page, where we now continuously make sure that v3 does not get slower again. https://gofiber.github.io/benchmarks/

🚀 New

  • Add csrf.NewCrossOriginProtection for tokenless CSRF protection (#4596) New tokenless middleware that rejects unsafe cross-origin browser requests by their Sec-Fetch-Site and Origin headers; no cookie, token or storage needed.
    app.Use(csrf.NewCrossOriginProtection(csrf.CrossOriginConfig{
        TrustedOrigins: []string{"https://admin.example.com"},
    }))
    https://docs.gofiber.io/middleware/csrf#cross-origin-protection-without-tokens
  • Update fasthttp to v1.75.0 (#4667, #4740) fasthttp v1.75.0 (from v1.73.0) parses and validates request headers in one pass, writes responses with fewer copies, serves cached files up to 8 KiB from memory and speeds up URI processing. https://github.com/valyala/fasthttp/releases/tag/v1.75.0
  • Raise default ReadBufferSize and WriteBufferSize to 8 KB (#4715) ReadBufferSize and WriteBufferSize now default to 8192 bytes (was 4096), which also raises the default request header limit; explicitly configured values are kept.
    app := fiber.New(fiber.Config{
        ReadBufferSize:  4096, // previous default, now 8192
        WriteBufferSize: 4096, // previous default, now 8192
    })
    https://docs.gofiber.io/api/fiber#readbuffersize
  • Expand context, response and request helpers (#4638) New helpers on Req, Res and Ctx such as Bearer, Origin, IsSafe, Del, StatusCode, GetCookies, Elapsed and RouteName; request helpers are now also reachable through c.Req().
    token := c.Bearer()   // "abc123" for "Authorization: Bearer abc123"
    c.Del("X-Powered-By") // remove a response header
    took := c.Elapsed()   // time spent on this request so far
    https://docs.gofiber.io/api/ctx
  • Add Endpoint() for middleware look-ahead (#4601) New c.Endpoint() returns the route that will handle the request without advancing the handler chain (nil on 404/405).
    app.Use(func(c fiber.Ctx) error {
        if route := c.Endpoint(); route != nil {
            // enforce access control using route.Path or route.Name
        }
        return c.Next()
    })
    https://docs.gofiber.io/api/ctx#endpoint
  • Add ordered RuleList to the redirect and rewrite middleware (#4621, #4633) New RuleList []Rule in redirect and rewrite is tried in the order written, first match wins; the Rules map is deprecated and setting both panics.
    app.Use(redirect.New(redirect.Config{
        RuleList: []redirect.Rule{
            {From: "/old", To: "/new"},      // checked first
            {From: "/old/*", To: "/new/$1"}, // takes everything else
        },
    }))
    https://docs.gofiber.io/middleware/redirect#rule-order
  • Render configured templates to a writer (#4594) New app.Render writes a template through the configured view engine to any io.Writer without creating an HTTP response, e.g. for SSE or HTMX partials.
    var buf bytes.Buffer
    if err := app.Render(&buf, "partial", fiber.Map{"Title": "update"}); err != nil {
        return err
    }
    https://docs.gofiber.io/api/app#render
  • Add final request hooks to the HTTP client (#4595) New AddFinalRequestHook runs after the built-in hooks, immediately before the request is sent, when RawRequest holds the resolved URL, merged headers and serialized body.
    cc.AddFinalRequestHook(func(_ *client.Client, req *client.Request) error {
        raw := req.RawRequest
        raw.Header.Set("X-Signature", sign(raw.URI().RequestURI(), raw.URI().Host(), raw.Body()))
        return nil
    })
    https://docs.gofiber.io/client/hooks#final-request-hooks
  • Add SetLocal, a request-local store without the variadic's heap slice (#4687) New c.SetLocal(key, value) stores a request-local value exactly like c.Locals(key, value), without the one-element slice that call allocates. https://docs.gofiber.io/api/ctx#setlocal
  • Add DisableFlashMessages and filter route candidates with a probe constant (#4655) New fiber.Config option DisableFlashMessages turns off redirect flash messages and the per-request fiber_flash cookie scan (off by default); the router gains a precomputed probe-constant filter.
    app := fiber.New(fiber.Config{
        DisableFlashMessages: true, // default: false
    })
    https://docs.gofiber.io/api/fiber#disableflashmessages
  • Add source-aware extraction to extractors without a new struct field (#4603) New extractors.Resolve returns the value together with the Source and Key of the chain child that produced it; the Extractor struct is unchanged.
    ex := extractors.Chain(extractors.FromHeader("X-API-Key"), extractors.FromQuery("api_key"))
    res, err := extractors.Resolve(ex, c)
    // res.Value, plus res.Source and res.Key of the child that won
    https://docs.gofiber.io/guide/extractors#source-aware-extraction

🧹 Updates

  • Require Go 1.26 (#4654)
  • Filter large route buckets before loading routes and bind without building a map (#4705)
  • Filter a route bucket by static path before loading the route (#4688)
  • Consolidate route pattern preprocessing (#4710)
  • Share route and client :name path delimiters (#4636)
  • Normalize header keys in one pass and match canonical media types directly (#4690)
  • Share streaming header join logic (#4734)
  • Consolidate comma-list header scanning into internal/headerlist (#4637)
  • Consolidate entity-tag parsing into internal/etag (#4632)
  • Adopt utils/v2 helpers and cut per-request allocations in the hot path (#4666)
  • cors/csrf: Consolidate origin matching into internal/origin (#4653)
  • limiter: Lock keys per shard instead of globally (#4702)
  • redirect/rewrite: Share capture substitution (#4749)
  • session: Skip the gob re-encode when a session was only read (#4703)
  • Cut the per-request cost of the extractors (#4678)
  • Stabilize flaky tests in limiter, binder, cache, basicauth and the request sweeps (#4729)
  • Close three test coverage gaps in logger, shutdown and docs (#4615)
  • Add a regression test and docs example for CustomCtx overrides behind middleware (#4598)
  • Add a regression test and docs note that Context() is not canceled on graceful shutdown (#4599)
  • Trigger Dependabot in gofiber/benchmarks after releases (#4682)

🐛 Fixes

  • Normalize request paths per RFC 3986 before routing and serve the routed path from the static middleware (#4695)
  • Keep stray percents from forging escapes, root every request target and take the SendFile name literally (#4719)
  • Let empty optional params yield to later required segments (#4722)
  • Fix panic on route pattern with trailing escape character (#4717)
  • Preserve names for merged multi-method routes (#4663)
  • Fix nil pointer dereference when a domain-mounted sub-app contains a nested mount (#4620)
  • Preserve path rewrites whose source aliases the current path, such as c.Path(c.Path()[4:]) (#4674)
  • Escape parameter values in generated route URLs (#4629)
  • Return ErrRouteNotRepresentable for parameter values a generated route URL cannot represent (#4721)
  • Accept tab OWS in X-Forwarded-For and share one OWS trim helper (#4735)
  • Treat Vary field names as case-insensitive (#4642)
  • Unify cookie SameSite handling (#4630)
  • Prevent unbounded handler growth when SendFile serves a function-backed fs.FS (#4656)
  • Prevent typed-nil view engine panics (#4662)
  • Report the real status for fasthttp-level request errors (#4614)
  • Drain in-flight requests before Listen returns (#4701)
  • basicauth: Equalize verification time across mixed hash algorithms (#4726)
  • basicauth: Refuse a repeated Authorization field (#4738)
  • basicauth/keyauth: Use HTTP quoted strings in auth challenges (#4631)
  • cache: Delete stale entries after uncacheable revalidation (#4590)
  • cache: Key entries by request scheme and host (#4736)
  • cache: Replay Vary on cache hits and mark credential-keyed entries private (#4744)
  • compress: Honor repeated Accept-Encoding and Cache-Control lines with the new HasHeaderValue helper (#4708)
  • idempotency: Keep replayed response headers unsplit under EnableSplittingOnParsers (#4693)
  • limiter: Bound the rate-limit key before it reaches storage (#4677)
  • proxy: Apply the client's Connection listing to the request as received (#4745)
  • proxy: Fold DomainForward's configured hostname to Punycode (#4673)
  • proxy: Overwrite X-Real-IP in proxy.Balancer like the other forwarding helpers (#4725)
  • proxy: Preserve IPv6 brackets in domain forwarding (#4689)
  • redirect/rewrite: Read "$10" as the tenth capture in targets (#4692)
  • session: Honor chain-level extractors and close three write-back holes (#4679)
  • static: Align file resolution with routed paths (#4712)
  • static: Reject partial wildcard matches that cross a path segment boundary (#4728)
  • Decode a path parameter exactly once in FromParam (#4626)
  • Anchor and escape client path parameter substitution (#4625)
  • Keep a stale client Response from releasing a reused Request on Close (#4659)
  • Parse malformed Set-Cookie attributes in the client in linear time (#4658)
  • Make static, proxy, adaptor and rewrite act on the path the router matched (#4720)
  • Fix RFC 9110/9112 compliance gaps in core, static and timeout (#4747)
  • Fix correctness issues across core, router, binder, client and middleware (#4652)

🛠️ Maintenance

41 changes
  • bump the golang-modules group with 2 updates (#4748)
  • bump github.com/fxamacker/cbor/v2 from 2.9.4 to 2.9.6 (#4746)
  • bump github.com/mattn/go-colorable from 0.1.15 to 0.1.16 (#4743)
  • bump github.com/valyala/fasthttp from 1.74.0 to 1.75.0 in the fasthttp-modules group (#4740)
  • bump github.com/molecule-man/go-brrr from 1.1.1 to 1.2.0 (#4741)
  • bump release-drafter/release-drafter from 7.7.0 to 7.9.0 (#4739)
  • bump github.com/tinylib/msgp from 1.6.4 to 1.6.5 (#4723)
  • bump github.com/klauspost/compress from 1.20.0 to 1.20.1 (#4709)
  • bump github.com/gofiber/schema from 1.8.7 to 1.8.8 (#4706)
  • bump github.com/gofiber/utils/v2 from 2.6.0 to 2.6.1 (#4707)
  • bump github.com/gofiber/utils/v2 from 2.5.3 to 2.6.0 (#4704)
  • bump github.com/gofiber/utils/v2 from 2.5.2 to 2.5.3 (#4700)
  • bump codecov/codecov-action from 7.1.0 to 7.1.1 (#4699)
  • bump github.com/molecule-man/go-brrr from 1.1.0 to 1.1.1 (#4698)
  • bump codecov/codecov-action from 7.0.0 to 7.1.0 (#4691)
  • bump github.com/gofiber/schema from 1.8.6 to 1.8.7 (#4686)
  • bump github.com/fxamacker/cbor/v2 from 2.9.3 to 2.9.4 (#4685)
  • bump github.com/gofiber/utils/v2 from 2.5.1 to 2.5.2 (#4681)
  • bump github.com/shamaton/msgpack/v3 from 3.2.2 to 3.2.3 (#4680)
  • bump github.com/molecule-man/go-brrr from 1.0.1 to 1.1.0 (#4676)
  • bump the golang-modules group with 3 updates (#4672)
  • bump golang.org/x/sys from 0.47.0 to 0.48.0 in the golang-modules group (#4670)
  • bump github.com/gofiber/schema from 1.8.5 to 1.8.6 (#4671)
  • bump github.com/gofiber/utils/v2 from 2.5.0 to 2.5.1 (#4668)
  • bump github.com/valyala/fasthttp from 1.73.0 to 1.74.0 in the fasthttp-modules group (#4667)
  • bump streetsidesoftware/cspell-action from 9.0.1 to 9.1.0 (#4665)
  • bump github.com/shamaton/msgpack/v3 from 3.2.1 to 3.2.2 (#4660)
  • bump github.com/gofiber/utils/v2 from 2.4.3 to 2.5.0 (#4661)
  • bump golang.org/x/crypto from 0.55.0 to 0.56.0 in the golang-modules group (#4651)
  • bump github.com/gofiber/utils/v2 from 2.4.2 to 2.4.3 (#4650)
  • bump github.com/klauspost/compress from 1.19.2 to 1.20.0 (#4649)
  • bump github.com/gofiber/schema from 1.8.4 to 1.8.5 (#4647)
  • bump github.com/shamaton/msgpack/v3 from 3.2.0 to 3.2.1 (#4645)
  • bump github.com/andybalholm/brotli from 1.2.2 to 1.2.3 (#4639)
  • bump github.com/gofiber/utils/v2 from 2.4.1 to 2.4.2 (#4634)
  • bump github.com/stretchr/testify from 1.12.0 to 1.12.1 (#4627)
  • bump streetsidesoftware/cspell-action from 8.4.0 to 9.0.1 (#4624)
  • bump github.com/fxamacker/cbor/v2 from 2.9.2 to 2.9.3 (#4623)
  • bump github.com/stretchr/testify from 1.11.1 to 1.12.0 (#4622)
  • bump the golang-modules group with 3 updates (#4611)
  • bump github.com/gofiber/schema from 1.8.3 to 1.8.4 (#4609)

📚 Documentation

  • Clarify that c.IP() walks the proxy chain only with EnableIPValidation (#4737)
  • Explain what MIMETypes does to an existing format (#4664)
  • Document the nested and array field notations in Bind (#4616)
  • Add a minimal CRUD and healthcheck guide (#4696)
  • Fix British to American English spellings across docs (#4697)
  • Update README documentation links (#4711)

📒 Documentation: https://docs.gofiber.io/

💬 Discord: https://gofiber.io/discord

Full Changelog: https://github.com/gofiber/fiber/compare/v3.5.0...v3.6.0

Thank you @00200200, @Arvin-Lee, @AshSgDe29071999, @BitWeaverDev, @Dev-next-gen, @Rachit-Gandhi, @ReneWerner87, @Rohilalala, @RubenPari, @VedantMadane, @ZihxS, @aditya-rohilla, @drakeo338, @evgenyponomarev, @fadiromdhan3, @fadiroot, @gaby, @h2zi, @haimingZZ, @ibraah007, @jabrailkhalil, @lazerg, @official-burak and @truongbo17 for making this release possible.

4 days ago
pdfcpu

v0.16.2

pdfcpu v0.16.2

Hello!

We ship important security, stability, and PDF compatibility fixes with no breaking Go API changes. The release requires Go 1.26 or later. Upgrading is highly recommended!

Security

  • Harden parsing and decoding against excessive work, circular references, malformed fonts, and invalid image parameters. Enforce resource limits and prevent several malformed-input panics.
  • Reduce repeated validation of shared objects and memory allocations when parsing large certificate revocation lists.
  • Correct AES-256 password preparation and owner authentication, encryption revision checks, and extraction permissions.
  • Fix named and Identity crypt-filter handling, crypt-filter length units and validation, and encryption of strings rewritten from object streams.

Fixes and improvements

  • Preserve catalog data, inherited page boxes and resources, shared stamp resources, name-tree values, and named destinations during processing. Correct compressed-object reference renumbering during merging.
  • Fix PDF whitespace, text and hexadecimal-string decoding, inline-image parsing, cross-reference handling, and effective PDF version detection.
  • Improve form field inheritance, checkbox/radio handling, export ordering, JSON matching, list-box clearing, and Unicode text-length checks.
  • Correct CMYK rendering, RGBA image import, Flate/TIFF predictor handling, and Crypt filter pipelines.
  • Fix ToUnicode mappings, TrueType widths and style detection, and XMP date parsing.
  • Complete required standard-font metrics for PDF 2.0 output and enforce required annotation appearances.
  • Strengthen validation of images, graphics values, colour spaces, functions, destinations, PageLabels, and PDF 2.0 entries. Restore targeted multimedia compatibility and improve action reporting.

Compatibility

Existing Go API signatures remain unchanged; supporting packages receive additive exports. Strict validation now rejects additional malformed inputs, while applicable relaxed compatibility is retained with notices. PDF 2.0 writes report an error when required annotation appearances are missing; automatic appearance generation remains incomplete. Encryption defaults are unchanged.

Thanks

Thanks everyone who opened issues. Shoutout to @qoke and the IQ Hive team for providing a heavy load of critical fixes for this release.

4 days ago
chromedp

v0.21.0

The package remote has its own WebSocket client, and it is a package of the core module now. The nested module remote and the dependency github.com/gobwas/ws are gone. The core module still needs only the standard library and cdproto.

The import path is the same: github.com/chromedp/chromedp/remote. The public API of the package is the same.

Upgrade: if your go.mod has a line for github.com/chromedp/chromedp/remote, remove it (go mod tidy does that). Go reports an ambiguous import while both the old nested module and the core module provide the package. The tag remote/v0.2.0 is the last version of the nested module.

The client follows RFC 6455: it checks the handshake, joins fragmented messages, checks UTF-8 and the size of a message, answers pings, and does the close handshake. It does not support extensions such as permessage-deflate. Go 1.25 and later are supported.

5 days ago
tcell

Version 3.6.0 Feature Release

The main headline here is that the mouse is supported on the Linux console with GPM. There are performance improvements and some bug fixes, plus improved reporting of pixel sizes on window resize events as well.

What's Changed

New Contributors

Full Changelog: https://github.com/gdamore/tcell/compare/v3.5.0...v3.6.0

5 days ago
go-micro

v6.15.0

What's Changed

Full Changelog: https://github.com/micro/go-micro/compare/v6.14.0...v6.15.0

5 days ago
Open-IM-Server

v3.8.3-patch.17

What's Changed

Full Changelog: https://github.com/openimsdk/open-im-server/compare/v3.8.3...v3.8.3-patch.17