• mark the fiber/v2 module as deprecated in favor of v3 by @gaby in https://github.com/gofiber/fiber/pull/4789

• cors: reject empty subdomain labels in CORS wildcard origins by @ReneWerner87 in https://github.com/gofiber/fiber/pull/4792

Full Changelog: https://github.com/gofiber/fiber/compare/v2.52.15...v2.52.16

• Require a space after the case-insensitive Basic authentication scheme. Malformed schemes such as BasicX no longer invoke the credential validator. Valid credentials are still required. This adapts the v5 correction to v4's single-header API. #3188, backport of #3138, with credit to @Shubham-Padkonde.
• Reject empty cookie tokens and empty client tokens in CSRF validation. This is defense in depth; it does not introduce a new security advisory. #3189, backport of #3135, with credit to @hoangtaiki.
• Reject CSRFConfig.TokenLookup configurations that produce no recognized token extractors. Middleware creation now returns an error instead of silently skipping token validation. #3149, thanks to @orinnz; backport of the existing v5 validation in #3067.

go get github.com/labstack/echo/v4@v4.16.2

Go 1.26 remains the module minimum. Build deployments with a supported, patched Go toolchain. No dependencies or public APIs changed in this release. Applications with invalid CSRF token lookup configuration will now fail middleware creation at startup.

The security fixes, bounded BodyDump and Decompress defaults, and dependency updates released in v4.16.1 are included unchanged. Their first patched version remains v4.16.1.

Validation: the fixes passed regression tests and upstream race-test, lint and benchmark checks on Linux, macOS and Windows with Go 1.26 and 1.27. The new regressions were also verified to fail without the fixes; local race tests and vet passed.

Full changelog: https://github.com/labstack/echo/compare/v4.16.1...v4.16.2

• Require a space after the case-insensitive Basic authentication scheme. Malformed schemes such as BasicX no longer reach credential validation or consume AllowedCheckLimit. Valid credentials are still required. #3138, thanks to @Shubham-Padkonde.
• Reject empty cookie tokens and empty client tokens in CSRF validation. This is defense in depth; it does not introduce a new security advisory. #3135, thanks to @hoangtaiki.

go get github.com/labstack/echo/v5@v5.4.2

Go 1.25 remains the module minimum. Build deployments with a supported, patched Go toolchain. No dependencies or public APIs changed in this release.

The security fixes released in v5.4.1 are included unchanged. Their first patched version remains v5.4.1.

Validation: the fixes passed regression tests and upstream race-test and lint checks on Linux, macOS and Windows with Go 1.25, 1.26 and 1.27. The new regressions were also verified to fail without the fixes.

Full changelog: https://github.com/labstack/echo/compare/v5.4.1...v5.4.2

Upgrade with go get github.com/labstack/echo/v5@v5.4.1.

• Validate the sending peer before accepting X-Real-IP in ExtractIPFromRealIPHeader, preventing client IP spoofing when that extractor is configured. GHSA-h53f-rm2w-w7rg
• Validate upstream WebSocket upgrade responses through Go's HTTP reverse proxy. Rejected upgrades no longer leave a raw tunnel that bypasses Echo routing and route middleware. GHSA-cxf3-9h37-7rr8
• Close both WebSocket connections when either side disconnects, including when an upstream ignores client EOF. GHSA-9969-6676-49h5
• Preserve the complete request body beyond the BodyDump capture limit and propagate read errors, including BodyLimit overflows. GHSA-x9ff-22gv-65f4, #3105
• Restore the original response writer before returning BodyDump buffers to the pool, preventing writes into a reused buffer during error handling. #3174
• Accept decompressed bodies exactly at the configured limit; keep overflow errors sticky. #3136
• Include the BodyLimit overflow-check correction and static-path hardening already merged since v5.4.0.

The proxy removes incoming Forwarded headers as defensive hardening. Backends relying on that header should use forwarding headers generated from the configured trusted IP extractor and scheme. WebSocket requests now honor the configured proxy transport, response modifier, target path and query in the same way as HTTP requests; ws and wss targets remain supported.

BodyDump capture limits bound logging only: handlers receive the full request, and clients receive the full response. Applications must still consume request bodies and handle read errors to enforce streaming body limits.

Go 1.25 remains the module minimum. Build deployments with a supported, patched Go toolchain.

This release also includes ValidateCtx, router fixes for escaped colons, custom methods and parameter storage, binding support for OpenAPI date formats, and documentation updates.

Thanks to @rm-Umar, @Duodum, @irisitymichaelgrundberg, @Hama1cco, @jakezwang, @Shubham-Padkonde and @rajpreetcodes for reports and contributions, and to the contributors credited in the individual commits.

Validation: upstream lint checks and race tests passed on Linux, macOS and Windows with Go 1.25, 1.26 and 1.27. Local tests on patched toolchains, vet, staticcheck and govulncheck also passed; govulncheck reported no reachable vulnerabilities.

Full changelog: https://github.com/labstack/echo/compare/v5.4.0...v5.4.1

Upgrade with go get github.com/labstack/echo/v4@v4.16.1.

Go 1.26 or later is now required to use patched golang.org/x/ dependencies. Build deployments with a supported, patched Go toolchain.

• Validate upstream WebSocket upgrade responses through Go's HTTP reverse proxy. Rejected upgrades no longer leave a raw tunnel that bypasses Echo routing and route middleware. GHSA-cxf3-9h37-7rr8
• Close both WebSocket connections when either side disconnects, including when an upstream ignores client EOF. GHSA-9969-6676-49h5
• Bound BodyDump request and response captures to 5 MiB each by default while preserving complete payload delivery and request read errors. GHSA-f48p-c9v4-h7xv
• Bound decompressed request bodies to 100 MiB by default. Overflow returns HTTP 413, including through JSON and XML binding; exactly-at-limit bodies remain valid. GHSA-h7wr-284f-5qvc
• Upgrade golang.org/x/net to v0.60.0 and related dependencies, addressing GO-2026-6617, GO-2026-6612, GO-2026-6611, GO-2026-6610 and GO-2026-6603.
• Include the BodyLimit overflow-check correction and static-path hardening already merged since v4.16.0.

BodyDumpConfig.MaxRequestBytes and MaxResponseBytes control capture limits. Zero selects the 5 MiB default; -1 disables a limit. These limits affect captured logging data only: handlers and clients still receive complete bodies.

DecompressConfig.MaxDecompressedSize controls the decompressed-body limit. Zero selects the 100 MiB default; -1 disables it. Apply any smaller application body limit after decompression, and handle request-body read errors.

The proxy removes incoming Forwarded headers as defensive hardening. Backends relying on that header should use forwarding headers generated from the configured trusted IP extractor and scheme. WebSocket requests now honor the configured proxy transport, response modifier, target path and query in the same way as HTTP requests; ws and wss targets remain supported.

This release includes router fixes for escaped colons, inline verbs and parameter storage, binding support for OpenAPI date formats, and documentation updates. Benchmark comparisons now run only for pull requests with shorter samples.

Thanks to @Duodum, @irisitymichaelgrundberg, @q490107865, @Hama1cco, @jakezwang and @Shubham-Padkonde for reports and contributions, and to the contributors credited in the individual commits.

Validation: upstream lint checks and race tests passed on Linux, macOS and Windows with Go 1.26 and 1.27. Local tests on patched toolchains, vet, staticcheck and govulncheck also passed; govulncheck reported no reachable vulnerabilities. The module graph still contains an advisory for the unused, unmaintained golang.org/x/crypto/openpgp package (GO-2026-5932), which Echo does not import and for which no fixed dependency version is available.

Full changelog: https://github.com/labstack/echo/compare/v4.16.0...v4.16.1

• [v4] fix(server): release each request's context once it is served, not when the connection closes (backport #5026) by @joe-blink in https://github.com/micro/go-micro/pull/5027

Full Changelog: https://github.com/micro/go-micro/compare/v4.11.2...v4.11.3

• Fix Windows webview not regaining focus on window activation, and Tab being trapped inside the webview instead of moving to the native window and back (#3783)
• Fix internal/webview2/pkg/webview2 COM vtable structs (ICoreWebView2_2.._27 and other derived interfaces) omitting the inherited method chain, which made calls land on the wrong vtable slot (#6129)
• Fix Windows question dialogs ignoring custom button labels and never firing button callbacks; custom buttons are now shown with a TaskDialog (falling back to MessageBox with positional callback mapping when comctl32 v6 is unavailable) (#5794)
• Fix wails3 dev hanging for 60s against Vite: the automatic frontend readiness gate now uses a TCP probe instead of an HTTP GET that sent no Accept header and received a 404 (#6209)
• Keep systray menus working when updated while open in PR by @taliesin-ai
• Handle transient WebView2 COM errors gracefully in runtime operations in PR by @leaanthony

🤖 This is an automated nightly release generated from the latest changes on master.

Installation:

go install github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0-beta.34

⚠️ Beta Warning: This is pre-release software. The API is stable, but you may still encounter issues before the final 3.0 release.

This release contains new features, improvements and bug fixes.

• US-1563 US-1566 US-1567 US-1568 Complete shading rendering support: function-based (Type 1), Gouraud triangle mesh (Types 4 and 5) and Coons / tensor-product patch mesh (Types 6 and 7) shadings, plus Creator.NewFunctionBasedGradient for authoring function-based gradients
• US-1564 US-1565 PdfFunctionType3.Evaluate for stitching functions and a generic shading color sampler for all function types and colorspaces
• US-1569 Rendering of Type 1 tiling patterns
• US-1614 Rendering of the separable blend modes and non-isolated transparency group compositing
• US-1773 Rendering of ExtGState soft masks, fixing axial ICCBased Multiply shadings rendering too dark, with model.NewPdfFunctionFromPdfObject now exported
• US-1907 US-1908 Reading documents encrypted with the public-key security handler (Adobe.PubSec) via ReaderOpts.Certificate/PrivateKey, PdfReader.DecryptWithCertificate and PdfReader.CheckAccessRightsWithCertificate
• US-1909 US-1910 Encrypting documents for recipient certificates via PdfWriter.EncryptForRecipients
• US-1769 Template engine: creator.ParseTemplate returning a reusable ParsedTemplate, rendered or validated with Creator.RenderTemplate/ValidateTemplate, plus named styles (<style> and the class attribute) and typography inheritance
• US-1772 Block.SetBackground and Chapter.SetBackground, and page breaks inside a Division, also available in templates
• US-1779 SignatureValidationResult.Certificates and SignatureValidationResult.SignerCertificate for accessing certificate details
• US-1814 FDF export of form field data from a PDF with fdf.NewFromReader, fdf.NewFromForm and Data.Write/WriteToFile, plus PdfAcroForm.AllFieldValues
• US-1722 Form-field appearance generation for push buttons and signature fields with explicit clipping, and PdfAppender.SignWithAppearance

• US-1613 The sh operator shading fill now covers the clip region and honours axial/radial Extend
• US-1717 The renderer honour the transparency group colorspace, isolation and knockout, so groups with a DeviceCMYK group colorspace no longer render nothing
• US-1718 Replaced the Multiply blend mode alpha hack with real per-primitive compositing, adding the non-separable blend modes (Hue, Saturation, Color, Luminosity)
• US-1807 Template strict mode reports a missing data key by name
• US-1929 Upgraded github.com/unidoc/pkcs7 to v0.4.1, hardening BER-to-DER conversion against malformed and truncated input
• US-1945 Upgraded golang.org/x/image, x/text, x/crypto and x/net to fix reachable advisories

• US-1774 Fixed GetPreviousRevision and DocMDP revision sectioning disagreeing with RevisionEndOffsets
• US-1775 Fixed the redactor refusing page-specific edits for forms nested inside other forms
• US-1777 Fixed redaction Tj offsets under anisotropic scaling, now computed from text-space glyph advances, with TextMark.Tfs added for the Tf font size
• US-1778 Fixed the auto-repair xref health check running before authentication on encrypted files; PdfWriter now encrypts object streams
• US-1780 Fixed lazy stream encryption and reuse, Image.Crop alpha loss and Decode rescaling
• US-1795 Fixed a panic when loading a nested trailer with a non-integer /Prev
• US-1803 Fixed the ExtractPageText regression in v5.1.0 where form XObject text ignored the caller's color state
• US-1805 Fixed template text on a component that cannot take text being silently dropped
• US-1806 Fixed multiple children in a template table-cell or list-item silently keeping only the last one
• US-1811 Fixed the user password never authenticating when EncryptOptions.Permissions is zero, and added security.Permissions.Normalized
• US-1815 Fixed AES-256 (R6) passwords not being SASLprep-normalised before hashing
• US-1827 Fixed template strict mode missing malformed gradients and a lone header-start-row, and a panic on a nil template reader
• US-1833 Fixed a fatal stack overflow when rendering a self-referential form XObject
• US-1837 Fixed table cell content overflow, so nested tables in table cells split across page breaks
• US-1840 Fixed image extraction and grayscale conversion crashing on a self-referential form XObject
• US-1843 Fixed signature validation reporting IsVerified for untrusted certificates (GHSA-h4pv-x6fp-rh2w): certificate trust and revocation are now checked with PdfReader.ValidateSignaturesWithOpts and reported through IsTrusted, TrustChain, TrustErrors and RevocationStatus
• US-1844 Fixed stream decoding materializing unbounded decoded output (GHSA-2x38-rm6v-5hcj): decoding is now limited to 256 MiB per stream by default, configurable via ReaderOpts.MaxDecodedStreamSize, ReaderOpts.MaxDecodedTotalSize and core.SetDefaultMaxDecodedStreamSize
• US-1855 Fixed the R5/R6 empty-user-password fallback deriving the file key from the wrong password
• US-1860 Fixed a partial CRL revocation bypass in signature validation, with further trust and revocation fixes
• US-1862 Fixed nested tables in Grid cells, List items and Divisions dropping content or hanging at page breaks
• US-1885 Fixed AES-256 encryption with an empty owner password producing a file that opens without a password
• US-1938 Fixed ResolveReferencesDeep overflowing the stack in NewPdfReader on deeply nested PDFs
• US-1953 Fixed PubSec decryption revealing whether a recipient's RSA PKCS#1 v1.5 padding was valid (Bleichenbacher oracle)

This is a security update fixing configured decoded-byte limit bypasses and restricting local image access in create and form input.

Applications handling untrusted PDFs or create/form input should upgrade.

Decoded-byte limits — GHSA-jp42-qm45-2x6g:

Honor Limits.MaxDecodeBytes across stream decoding and combined page content, and stop cross-reference repair after limit failures. Strengthen Flate predictor, DCT and cached-content checks, with regression coverage for strict/relaxed validation and eager/deferred decoding.

The limit bounds individual decoded streams and combined page content, not total process memory.

Additive Go API change: Add StreamDict.DecodeWithLimit and StreamDict.DecodeLengthWithLimit to supply the configured decode limit explicitly.

Local image access — GHSA-44h9-p34h-2w4p:

Confine local images referenced by create, form fill, and JSON/CSV form multifill input to an allowed directory. Reject absolute paths, parent-directory components, symlink escapes and non-regular files, and report access denials as errors.

Compatibility change: API callers must set conf.LocalImageRoot to enable local images; an empty value disables them. The CLI defaults to its working directory; set localImageRoot in config.yml to select another root. Update image paths to be relative to that root. Confined local images are unavailable on js/wasm. See local image access for migration guidance and limitations.

Documentation: Updated security policy clarifies vulnerability scope, supported releases and guidance for AI-assisted reports and multiple findings. Updated pull request template clarifies contribution requirements. Added local image configuration and migration guidance to README and website.

Requires Go 1.26 or later, unchanged from v0.16.2.

• • 35ea259eb27d5a607f797edd41fd8a9e50a1f818 bump version
• • 8befe54db401e8ed0ecb9d52aec700fa67b2972f confine local images in create and form input
• • c1db2d55c0826689a129012fbac5a25d5fd3a39f honor configured decode limits across stream consumers

• Binding generator now emits a bindings/events module exporting a typed name constant for every discoverable event registered with application.RegisterEvent using a compile-time constant name (e.g. UserLogin for user:login), usable with Events.On/Emit without the Vite plugin (#5645)

• Fix Windows question dialogs ignoring custom button labels and never firing button callbacks; custom buttons are now shown with a TaskDialog (falling back to MessageBox with positional callback mapping when comctl32 v6 is unavailable) (#5794)
• Fix wails3 dev hanging for 60s against Vite: the automatic frontend readiness gate now uses a TCP probe instead of an HTTP GET that sent no Accept header and received a 404 (#6209)
• Keep systray menus working when updated while open in PR by @taliesin-ai
• Handle transient WebView2 COM errors gracefully in runtime operations in PR by @leaanthony

🤖 This is an automated nightly release generated from the latest changes on master.

Installation:

go install github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0-beta.33

⚠️ Beta Warning: This is pre-release software. The API is stable, but you may still encounter issues before the final 3.0 release.