JavaGolangJavaScriptSwiftAndroidRustMiddleware
1 days ago
wails
wailsapp

Wails v3.1.0-nightly.20261028

Wails v3 Nightly - v3.1.0-nightly.20261028

Nightly preview of the upcoming v3.1.0.

Changed

  • Improve changelog generation speed by reusing compiled regex patterns in PR by @taliesin-ai
  • Reduce allocations when serving localized fallback pages in PR by @taliesin-ai
  • Speed up AppImage runtime discovery by avoiding unnecessary metadata lookups in PR by @taliesin-ai
  • Reuse compiled command routing patterns to improve wake performance in PR by @taliesin-ai
  • Improve performance by avoiding rescanning of unfinished output lines in PR by @taliesin-ai
  • Stream executable copies during MSIX package staging to reduce memory use and speed up builds in PR by @taliesin-ai
  • Avoid copying unfinished command-output lines to improve performance in PR by @taliesin-ai
  • Reduce allocations when generating name-based UUIDs in PR by @taliesin-ai
  • Reduce allocations when formatting SQLite statement handles in PR by @taliesin-ai
  • Reduce UUID string conversion to a single allocation in PR by @taliesin-ai
  • Reduce allocations when formatting changelog bullet entries in PR by @taliesin-ai
  • Reduce allocations when formatting terminal hyperlinks in PR by @taliesin-ai
  • Reduce allocations when serving assets by sniffing MIME buffers lazily in PR by @taliesin-ai
  • Skip debug log preparation in the asset server when debug logging is disabled in PR by @taliesin-ai
  • Reduce allocations in webview request handling by avoiding discarded request contexts in PR by @taliesin-ai
  • Speed up asset serving by skipping MIME sniffing for known file extensions in PR by @taliesin-ai
  • Reduce allocations when serving assets by avoiding a reader for content sniffing in PR by @taliesin-ai
  • Reduce allocations when serving non-seekable asset files in PR by @taliesin-ai
  • Speed up asset server index root selection by avoiding candidate collection in PR by @taliesin-ai
  • Improve asset server performance by formatting content lengths without fmt in PR by @taliesin-ai
  • Reduce memory copying when reading desktop file explorer metadata in PR by @taliesin-ai

Fixed

  • Retain source file permissions when copying to new destination files in PR by @taliesin-ai
  • Keep fullscreen and maximised windows from resizing when min or max size constraints change in PR by @taliesin-ai
  • Publish scheduled star history updates for the wailsapp/wails repository in PR by @taliesin-ai
  • Stop discarding invalid Go test count flags in wake in PR by @taliesin-ai
  • Preserve Mac icons when encoding fails in PR by @taliesin-ai
  • Fix build cache misses for Go outputs with quoted or escaped spaces in PR by @taliesin-ai
  • Serialize notification category persistence on Linux to prevent concurrent write races in PR by @taliesin-ai
  • Keep shell command chains out of the implicit Go build cache in PR by @taliesin-ai
  • Fix notification category maps failing to load when saved data is null in PR by @taliesin-ai
  • Show diagnostics from failed variable shell commands in PR by @taliesin-ai
  • Fix wake template matching when multiple equality candidates exist in PR by @taliesin-ai
  • Serialize concurrent cache-file saves to prevent corrupted cache writes in PR by @taliesin-ai
  • Prevent races when replacing the active reporter in PR by @taliesin-ai
  • Report resource-generation failures accurately in the CLI in PR by @taliesin-ai
  • Recognize stable versions that include build metadata in the CLI in PR by @taliesin-ai
  • Serve assets whose request paths contain repeated leading slashes in PR by @taliesin-ai
  • Fix shell fallback execution for wake on each platform in PR by @taliesin-ai
  • Preserve previous Linux packages when a build fails in PR by @taliesin-ai
  • Route command chains and redirections through the shell in PR by @taliesin-ai
  • Preserve quoted regex and path backslashes in wake command parsing in PR by @taliesin-ai
  • Preserve existing DMG files when packaging builds fail in PR by @taliesin-ai
  • Replace symlinks with generated regular files in bindings output in PR by @taliesin-ai
  • Preserve literal percent signs in Linux explorer commands in PR by @taliesin-ai
  • Align precondition and task command directories so they resolve consistently in PR by @taliesin-ai
  • Run default tasks in the executor base directory in PR by @taliesin-ai
  • Prevent legacy checks from hiding cache misses in PR by @taliesin-ai
  • Fix CLI prerelease numbering to increment without integer overflow limits in PR by @taliesin-ai
  • Avoid a panic when cache entries decode as null in PR by @taliesin-ai
  • Probe ports once per check in the CLI in PR by @taliesin-ai
  • Include the task directory in cache identity to avoid stale wake results in PR by @taliesin-ai
  • Prevent data loss when packaging copies a file onto itself in PR by @taliesin-ai
  • Make status checks respect task directories in PR by @taliesin-ai
  • Detect TODO, FIXME and TBD placeholders in changelog entries in PR by @taliesin-ai
  • Generate runtime assets from embedded bundles in the CLI in PR by @taliesin-ai
  • Separate stderr from parsed HEAD output in git commands in PR by @taliesin-ai
  • Preserve the default in-memory SQLite database under concurrent access in PR by @taliesin-ai
  • Return correct responses to HEAD requests for the fallback index page in PR by @taliesin-ai
  • Handle SQLite statement preparation racing with database close or reopen in PR by @taliesin-ai
  • Release prepared-statement handles when SQLite database is closed or reopened in PR by @taliesin-ai
  • Keep extraction destination paths literal when using gosod in PR by @taliesin-ai
  • Propagate errors from SQLite queries after partial row iteration in PR by @taliesin-ai
  • Return snapshots for whole-store reads in kvstore in PR by @taliesin-ai
  • Prevent write panics in kvstore after loading a JSON null value in PR by @taliesin-ai
  • Print plain terminal messages without interpreting format verbs in PR by @taliesin-ai
  • Surface errors when looking up the latest stable release in the updater in PR by @taliesin-ai
  • Ignore hidden entries and headers in changelog comment blocks in PR by @taliesin-ai
  • Install wails3 once and surface installer errors in the updater in PR by @taliesin-ai
  • Preserve literal bracketed template paths in gosod in PR by @taliesin-ai
  • Reject failed GitHub tag responses before decoding them in the updater in PR by @taliesin-ai
  • Preserve cancellation errors during parallel library searches in PR by @taliesin-ai
  • Close HTTP response bodies on every return path to prevent resource leaks in PR by @taliesin-ai
  • Preserve request bodies when the development proxy retries requests in PR by @taliesin-ai
  • Honor the launch deadline during desktop file explorer discovery in PR by @taliesin-ai
  • Reject HTTP errors before saving AppImage tooling downloads in PR by @taliesin-ai
  • Order oversized numeric prerelease identifiers correctly in semver comparisons in PR by @taliesin-ai
  • Preserve escaped paths when routing services in the asset server in PR by @taliesin-ai
  • Handle HEAD requests for the bundled runtime in the asset server in PR by @taliesin-ai
  • Return 404 for missing bundled assets instead of an incorrect response in PR by @taliesin-ai
  • Stop dev proxy retries when a request is cancelled in PR by @taliesin-ai
  • Avoid shared start URL mutation and stale ports in the asset server in PR by @taliesin-ai
  • Honor the optional logger configuration in the asset server in PR by @taliesin-ai
  • Remove data race in library path cache invalidation in PR by @taliesin-ai
  • Avoid false library matches when searching ldconfig output in PR by @taliesin-ai
  • Prevent asset server queue growth and shrink oscillation under load in PR by @taliesin-ai
  • Release callback captures after the debounce timer fires to avoid retaining stale references in PR by @taliesin-ai
  • Preserve file explorer targets found inside executable paths in PR by @taliesin-ai
  • Skip directories that shadow desktop entries in file explorer in PR by @taliesin-ai
  • Fix asset server headers not being sent when a response body is empty in PR by @taliesin-ai
  • Respect XDG desktop-file search directories when locating application icons in PR by @taliesin-ai
  • Preserve file paths during field expansion in the file explorer in PR by @taliesin-ai
  • Avoid duplicating expanded URI targets in file explorer in PR by @taliesin-ai
  • Commit successful empty non-seekable asset responses instead of leaving them pending in PR by @taliesin-ai
  • Fill MIME sniffing prefix correctly across short reads in the asset server in PR by @taliesin-ai
  • Avoid reading full response bodies for non-seekable HEAD requests in the asset server in PR by @taliesin-ai
  • Only serve exact index files when resolving directory requests in the asset server in PR by @taliesin-ai
  • Fix dismissed Linux notifications being reported as clicks on servers without action support in PR by @bercedev
  • Stop dev processes when the terminal closes in PR by @xmasdev
  • Hold Windows taskbar restart debounce for one second before clearing the flag in PR by @taliesin-ai
  • Fix fallback response headers being lost in the asset server in PR by @taliesin-ai
  • Honor header deletions before fallback selection in the asset server in PR by @taliesin-ai
  • Release removed ring queue references in the asset server to avoid memory leaks in PR by @taliesin-ai
  • Release consumed content-sniffer buffers in the asset server to reduce memory use in PR by @taliesin-ai
  • Recognize mixed-case asset file extensions when serving assets in PR by @taliesin-ai
  • Correctly detect content type in asset server without retaining filenames in PR by @taliesin-ai
  • Fall back to a default when a desktop entry has no command in PR by @taliesin-ai
  • Stop the liquid-glass example from showing a dialog before the app starts on non-macOS in PR by @taliesin-ai
  • Keep window size constraints when fullscreen starts from a constrained size on Windows in PR by @taliesin-ai
  • Fix dialogs called before Run blocking forever instead of returning in PR by @taliesin-ai

Security

  • Validate generated icon sizes before image allocation to prevent excessive memory use in PR by @taliesin-ai
  • Validate release notes API responses before use in PR by @taliesin-ai
  • Require complete hexadecimal statement handles in SQLite plugin in PR by @taliesin-ai
  • Constrain filesystem library fallback matches to prevent loading unintended libraries in PR by @taliesin-ai

🤖 This is an automated nightly pre-release generated from the latest changes on master. It is not selected by @latest; install it by its exact tag.

Installation:

go install github.com/wailsapp/wails/v3/cmd/wails3@v3.1.0-nightly.20261028

Tip: always pin an exact version (e.g. @v3.1.0-nightly.20261028) in go.mod and CI rather than @latest.

1 days ago
lego
go-acme

v5.6.0

lego is an independent, free, and open-source project, if you value it, consider supporting it! ❤️

Everybody thinks that the others will donate, but in the end, nobody does.

So if you think that lego is worth it, please consider donating.

For key updates, see the changelog.

Changelog

  • 28d85a793c285465d314705cfcd6b72908ccb0d1 Add DNS provider for CloudPress (#3326)
  • 5e1b2fbbcc097818fb41d694961523ed9173492c Add DNS provider for GoDaddy v3 (#3315)
  • 7cb485f75410efec1001ab45b11645e2cb18205c Add DNS provider for Netcup v1 (#3327)
  • a787f6f1e5d79c85ed8156832732daad4eecae70 Add DNS provider for NordName (#3324)
  • 6f7ab9d384e43a1f56dad9bff907d4a322c82b21 Add DNS provider for PrimeDNS (#3310)
  • bbd3736f4f78967bfae3cb91022106c742d2b5f1 Add DNS provider for Selfhost v2 (#3298)
  • 2e4cb1bdba3b6dc2bfa33f74a5c9e3245dcd8bfd curanet: use oAuth2 (#3333)
  • d84578afc6becba57de9bdff0a79b3b1f7590a51 dnscale: fix zone endpoint response (#3294)
  • 6bd887cb1c8263fb2c4172e2edac8c0eee0de58d docs: update sponsors section (#3318)
  • 11ba36eadd21228e4e3d96c8215c249bec7034c7 feat(cli): use build tags to improve DCE (#3328)
  • 9389f0e583e335e562b3f8b53b200ef4110a0c7e feat(dnspersist01): add workaround for Google Trust Services (#3317)
  • 6e2d926baac3fdb5ead1a9097cd6d4489a9cc336 feat: experimental conditional DNS builder (#3305)
  • f32809dcece7ba03843a898c25c72ac1470f3527 fix(cli): clean account when refusing ToS (#3301)
  • 88c3d7d81f0a456ec7805be71bdc575a318f680b fix(cli): log flag supersede config file (#3300)
  • 748e608a68442e91424a1f330a6dd16427c33d1e fix: add digitalSignature to TLSALPN01 temp certificate (#3304)
  • 4f00c959d650c055c697d3662e0dccf93c4eb7d0 fix: ari return error when end <= start (#3292)
  • 133369de0b0f4220ec4080a22bbe0fbef94c32e1 ionoscloud: fix zone detection (#3290)
  • 871fe1ba02d0518d68fbbfcb968bfe2628f6fa0f simply: authenticate with a Bearer token (#3320)
  • afd620edcb7ba5716676e4c82028f48c598d4dd4 simply: fix zone name encoding (#3322)
  • d3f5b8ae5f335a6c407ee523b0885c10591b6a25 yandexcloud: extend zone detection
2 days ago
pdfcpu
pdfcpu

v0.16.4

pdfcpu v0.16.4

This is a security update for crafted PDFs and form or create data that could cause excessive CPU or memory use or terminate a process.

Additive Go API Changes: types.DecodeStreamFunc and types.NewLazyObjectStreamObjectWithDecoder. Existing constructors and signatures remain unchanged. Requires Go 1.26 or later.

Release binaries were built with Go 1.27.3, which includes security fixes for crypto/x509.

1) Unbounded object traversal — GHSA-2623-w998-vcr4:

Long chains of PDF objects could exhaust the Go stack and terminate the process during optimization while reading, annotation removal, or page migration. These paths now use iterative traversal. The fix preserves long valid chains, handles objects whose value is another reference, and bounds error-path output.

Fix: 0bb00190.

2) Repeated stream data — GHSA-pr6x-vqwr-4hj2:

Shared or nested stream aliases and oversized declared lengths could make a small PDF retain unbounded encoded or decoded data. Encoded streams now count toward the existing per-read budget, lengths past the end of the input no longer size buffers, and compressed xref entries that share one current object-stream index are rejected.

Filtered decodes through XRefTable.DecodeStream and lazy object streams each receive a separate cumulative allowance A = max(1 GiB, 2 × MaxDecodeBytes); both default to 1 GiB. The allowances count cumulative decoding, not live memory. Object streams remain lazy, image extraction remains subject to its per-stream and image limits, and a negative MaxDecodeBytes disables these limits.

Fix: 82c88cec.

3) Poster tile grids — GHSA-g5q6-53hx-f68j:

A crafted page size could make poster create an unbounded number of tile definitions and output pages, consuming excessive CPU and memory. Poster output is now limited to 1,000 tiles per source page, and oversized grids are rejected before page content is transformed or tile objects are allocated. Zero, negative and non-finite page or tile dimensions are rejected.

Tiles produced by poster, cut and ndown now share one resource dictionary per source page instead of carrying a copy each. With a margin, each tile references the shared page content through a content array instead of embedding a copy of it. Rendered output is unchanged.

Fix: a9725db6.

4) Create table dimensions — GHSA-cphg-88q6-whwh:

Table rows and cols in a create template were unbounded, so a few hundred bytes of JSON could make create allocate and render without limit. All tables of a template now share a limit of 100,000 rows plus columns. A table whose anchor is invalid, or given together with pos, is now rejected; previously its remaining validation was skipped.

Fix: 5367e878.

5) Unbounded page numbers — GHSA-gx4m-7r76-vpww:

A large page number in a create template or form-fill data could make pdfcpu allocate excessive memory or stall. create now limits additions to 1,000 pages beyond the existing document; form fill and form multifill accept image page numbers only within the document. Both paths reject page numbers below 1.

Fix: ebac361a.

6) Bookmark split page numbers — GHSA-p2r6-9jcq-fp7v:

An outline destination with a very large page number could make split -m bookmark allocate memory proportional to that number, or panic for library callers. Bookmark page spans are now checked against the page count before their pages are listed; such files fail with the same "invalid page number" error as before.

Fix: 70f1a860.

7) Shared resource graphs — GHSA-vwmc-mhq7-fqhc:

Validation could repeatedly process the same shared object through different paths in resource, pattern, property-list and visibility-expression graphs. A small PDF could therefore keep validation busy for an extended time. The fix reuses successful validation results while preserving checks on deeper paths and existing cycle handling. Commands that validate PDFs during reading benefit from the fix.

Fix: 7653f158.

8) Shared object comparison graphs — GHSA-8pv5-h3hv-xhc9:

Object comparison could repeatedly process the same pair of indirect objects when font, image, form XObject or content-stream dictionaries contained shared reference graphs. The comparison is used by default for font, image and form XObject deduplication, validation's info-dictionary reconciliation and image reuse during create; content-stream deduplication is optional. A small PDF could therefore cause exponential comparison work. Object comparison now memoizes indirect-reference pairs for the duration of each comparison, limits distinct pairs to the document's object table size and enforces the existing recursion-depth limit. Reaching either limit conservatively treats the objects as different, so callers keep both objects instead of failing the command; the optimize log reports the cutoff.

Fix: d6abb27e.

Thanks

Special thanks to Black Water (@Manyo9) for reporting these vulnerabilities.

Changelog

  • 0f5ac76def20e130ab8ffbf39d378613ff71ff91 bump version
  • a9725db622f32c519fee90c1733b779ccd5dd598 fix GHSA-g5q6-53hx-f68j: bound poster tile grids
  • d6abb27eb84361de96bcc5674ce361ab3b157509 fix GHSA-8pv5-h3hv-xhc9: memoize indirect-reference pairs in object comparison
  • 5367e878f7766b94dd5f7e9e3128e1ab5f9b30b6 fix GHSA-cphg-88q6-whwh: bound create table rows and columns
  • 70f1a8604f9529962486e75ba82d1e93f10e3cde fix GHSA-p2r6-9jcq-fp7v: check bookmark page spans before splitting
  • 82c88cecdee7dac398bebf06d0bdd28728235a57 fix GHSA-pr6x-vqwr-4hj2: bound repeated stream data while reading
  • ebac361ac40798d81a97299c8231e7248e0094ab fix GHSA-gx4m-7r76-vpww: bound page numbers in create and form fill
  • 0bb001901ef160aa75e882d839ee2997d56fdcb2 fix GHSA-2623-w998-vcr4: walk object graphs without recursion
  • 7653f15888400d02c97d933effbf8a4a128245c4 fix GHSA-vwmc-mhq7-fqhc: validate shared resource graphs once per depth
  • 358a9a9f528ce1ba428c819683d25434f1caf4a4 add GHSA regression tests and use ghsa_ test naming
2 days ago
wails
wailsapp

Wails v3.1.0-nightly.20261027

Wails v3 Nightly - v3.1.0-nightly.20261027

Nightly preview of the upcoming v3.1.0.

Changed

  • Link the 404 page to matching Wails v2 documentation pages on v2.wails.io in PR by @taliesin-ai
  • Move the v2 documentation site to v2.wails.io in PR by @taliesin-ai
  • Serve v3 documentation from wails.io and v2 documentation from v2.wails.io in PR by @taliesin-ai
  • Update v3.0.0 release notes and correct the security advisory claim in PR by @taliesin-ai

Fixed

  • Deliver Go event listener callbacks serially in emit order in PR by @DevLumuz
  • Always advertise the tray Menu property so trays created after Run are not dropped on Linux in PR by @AlbinoGeek
  • Hold main-thread work submitted before Run until the application starts in PR by @AlbinoGeek
  • Use the correct asset API URL when downloading GitHub updater release assets in PR by @gavidroselj
  • Fix screen bounds and positions on mixed-DPI macOS and Linux setups in PR by @julianstorer
  • Preserve request bodies on Windows when WebView2 omits the Content-Length header in PR by @strraaa
  • Fix data race in event hook emission by snapshotting hooks under lock in PR by @DevLumuz
  • Fix SystemTray.SetTooltip() doing nothing on Linux: the StatusNotifierItem tooltip description is now set (#6017)
  • Run changelog evidence check in the weekly release workflow in PR by @taliesin-ai
  • Fix release changelog evidence check to map runs to squash-merge commits in PR by @taliesin-ai
  • Fix Linux dark mode detection returning light on a dark desktop until the colour scheme changed, and linux:SystemThemeChanged never firing on the GTK4 backend. Both backends now share one implementation, backed by the org.freedesktop.appearance portal namespace (#6072)
  • Window.SetZoom no longer raises factors below 1.0 to 1.0 on framed windows (Windows, macOS, Linux): WebView2 ZoomFactor, WKWebView magnification and WebKitGTK's zoom level accept any positive value, and the Zoom window option already passed such values through. Frameless windows keep the 1.0 floor because their drag and resize regions are not adjusted for zoom (#4590); non-positive, NaN and Inf factors are now ignored instead of being raised to 1.0 — by @APshenkin

🤖 This is an automated nightly pre-release generated from the latest changes on master. It is not selected by @latest; install it by its exact tag.

Installation:

go install github.com/wailsapp/wails/v3/cmd/wails3@v3.1.0-nightly.20261027

Tip: always pin an exact version (e.g. @v3.1.0-nightly.20261027) in go.mod and CI rather than @latest.

2 days ago
go-micro
micro

v5.30.1

Bug fixes

  • Prevent the etcd registry watcher from panicking when a DELETE event does not include PrevKv (#5040, #5041).
2 days ago
grpc-go
grpc

Release 1.85.0

New Features

  • stats: Expose the effective client authority (sent on the wire as the HTTP/2 :authority header) in client stats.OutHeader events. (#9296)
    • Special Thanks: @aryansk
  • metadata: Add ValueFromOutgoingContext, which reads a single metadata value from outgoing context without copying the entire outgoing metadata into a new map. (#9282)
    • Special Thanks: @yuyangguo42

Bug Fixes

  • transport: Refine control buffer throttling to only count peer-induced control frames, raise the default GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT from 100 to 10,000, and close client connections if reads remain throttled for 10s. (#9563)
  • server: Ensure Stop() forcefully terminates the server while GracefulStop() is waiting for active handlers to complete. (#9394)
    • Special Thanks: @stanhu
  • server: Unconditionally increment the highest-seen stream ID on when handling HEADERS frames to comply with RFC 7540 §5.1.1. Previously, truncated HEADERS frames left the connection in an inconsistent state and allowed stream IDs to be reused by clients without resulting in a protocol error. (#9414)
  • server: Terminate streams immediately when a HEADERS frame includes the EndStream bit. Previously, this caused server handlers to hang when reading a message. (#9391)
  • server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (#9365)
  • xds: Fix a bug where route header matchers with non-lowercase names failed to match routes. (#9353)
    • Special Thanks: @winklemad
  • client: Ensure retried RPCs use the correct :authority value specified by the LB policy instead of inheriting it from a previous attempt. (#9277)
    • Special Thanks: @nvxbug
  • transport: Fail streams with io.ErrUnexpectedEOF instead of io.EOF upon receiving truncated message headers or bodies after partial data has already been received. (#9204)
    • Special Thanks: @buger
3 days ago
wails
wailsapp

Wails v3.0.0

Wails v3.0.0

Wails v3 is here. Build desktop and mobile applications with Go and the web frontend you already know, using each platform's native WebView instead of a bundled browser.

v3 is a ground-up rework of Wails. Applications, windows, services, events and platform features are now explicit objects you create and talk to directly, so multiple windows, system trays and background services are a normal part of the model rather than workarounds. It has been nearly four years since the first v3 alpha in January 2023. Thank you to everyone who tested, reported, translated, reviewed and contributed along the way.

📣 Read the announcement: Wails v3.0.0 Released 📚 Documentation: wails.io · Migrating from v2: v2 to v3 guide

Install

go install github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0
wails3 setup    # guided setup: checks your system and installs what Wails needs
wails3 init     # create a new project

Wails v3 requires Go 1.26 or newer. We recommend Go 1.26.10 or 1.27.3 (or later), which include a crypto/x509 security fix. Run wails3 doctor at any time to check your setup.

What's new in v3

Application model

  • Multiple windows. Create, show, hide and close any number of windows at runtime, each with its own options, events and lifecycle.
  • Services. Your backend is ordinary Go: register services with the application and their exported methods become callable from the frontend. Services can have startup and shutdown hooks and can serve HTTP routes.
  • Manager APIs. Windows, menus, dialogs, events, screens, the clipboard and more are reached through clear manager objects on the application, instead of a single context-bound runtime package.
  • Events. Application, window and custom events, with typed payloads, available from both Go and JavaScript, plus platform system events.

Bindings

  • Generated with static analysis. wails3 generate bindings reads your Go source, so doc comments and real parameter names carry through to the generated TypeScript or JavaScript.
  • Models and enums. Go structs become TypeScript classes or interfaces, and Go enums become TypeScript enums.
  • Streams and raw messages. Stream data between Go and the frontend, or use raw messages and custom transports when you need full control.

Native user interface

  • System tray. Tray icons with menus, light and dark icons, macOS template icons, and the option to attach a window to the tray icon.
  • Menus. Application menus, context menus (including from HTML with WML attributes) and tray menus, all updatable at runtime.
  • Dialogs. Native message, question, file open and save dialogs, plus custom dialogs.
  • Frameless and custom windows. Frameless windows with native corners and shadows, custom title bars, drag regions and translucency, including native Liquid Glass on macOS 26 with a fallback on earlier versions.
  • Notifications. Native desktop notifications with actions.
  • Keyboard shortcuts. Window and application key bindings and global shortcuts; on macOS, letter accelerators follow the labelled key on AZERTY, QWERTZ, Dvorak and other layouts.
  • And more:
    • clipboard;
    • file drag and drop, plus HTML drag and drop;
    • screen and environment information;
    • dock badges on macOS;
    • start at login;
    • opening URLs and files in the default browser;
    • notch windows on macOS;
    • a per-window permissions map for the camera, microphone, geolocation and notifications.

Platforms

  • Windows (amd64 and arm64), macOS (Intel and Apple Silicon) and Linux (amd64 and arm64).
  • Linux uses GTK4 and WebKitGTK 6.0 by default. The legacy GTK3 stack is still available with -tags gtk3 until v3.1.
  • iOS and Android (experimental). The same main.go and frontend can run on mobile. Try it and tell us what you find; it isn't yet covered by the stability promise.
  • Server builds. Run the same application and services as an HTTP server, with no native window.

Build, ship and update

  • A build system you can see. Projects use a Taskfile-based build that you can read, extend and debug, instead of one opaque command.
  • Cross-compilation, with platform guides for building on and for every desktop target.
  • Code signing and installers. Signing for every platform, NSIS installers and MSIX packages for Windows, DMG and app bundles for macOS, and AppImage, deb, rpm and Arch packages for Linux.
  • An in-app updater. Pluggable providers (including GitHub Releases), cryptographic verification, an atomic swap with rollback, and a default UI you can theme or replace.
  • Single instance, file associations and custom URL protocols, so your app opens the files and links it owns.
  • Obfuscated builds and access to private macOS APIs when you need them.

Developer experience

  • wails3 setup, a guided setup wizard that checks and installs dependencies.
  • wails3 dev, live development with frontend hot reload and Go rebuilds, which stops its background processes when your app exits.
  • Templates for vanilla, React, Vue and Svelte, each in JavaScript or TypeScript, plus your own custom templates.
  • Testing support, including end-to-end testing guides.
  • An MCP service that lets AI tools drive and inspect a running Wails app.
  • A new documentation site at wails.io, built with M-Press, with tutorials, guides and API reference translated into nine languages.

Moving from v2

v3 is a new major version, so moving to it is a real port rather than a version bump. The main changes are:

  • the application and window lifecycle;
  • services in place of context-bound bindings;
  • direct application and window APIs in place of the v2 runtime package;
  • regenerated frontend bindings.

The migration guide covers each one with before-and-after examples.

Wails v2 isn't going away. It continues to receive critical updates, and its documentation is now at v2.wails.io. The two CLIs (wails and wails3) are separate binaries with different module paths, so you can install both.

Security

This release fixes every published Wails v3 security advisory except one: GHSA-2p5f-2gx8-mh8m is only partly fixed. Cross-origin child frames on Linux are now blocked, and the cases that remain open are listed under Known limitations below. If you are on v3.0.0-beta.30 or earlier, please upgrade.

  • Block reserved wails: messages from cross-origin child frames on Linux (GTK3 and GTK4) by injecting a guard script into all frames, mitigating GHSA-2p5f-2gx8-mh8m
  • Update github.com/klauspost/compress to 1.18.7 (GHSA-259r-337f-4rfw) and golang.org/x/image to 0.45.0, and build with Go 1.26.10 to pick up the crypto/x509 fix (GO-2026-6809)
  • Update vite to 8.2.4 or later in the runtime package, setup wizard, examples and project templates (GHSA-9jrq-w75r-8gcw, GHSA-rq7h-c2jc-7f22, GHSA-vfpm-58rq-9qcg, GHSA-r825-w8mm-5pxw, GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv)

Known limitations

  • Linux: the child-frame guard cannot stop a same-origin child frame (for example a srcdoc or about:blank iframe) from reaching the native message handler through its parent, because WebKitGTK gives the handler no frame information. Cross-origin frames, and sandboxed frames without allow-same-origin, are blocked. Do not embed untrusted same-origin content in a Wails window.
  • Android (experimental): the window.wails JavaScript bridge is exposed to every frame in the WebView. Do not embed untrusted third-party content in the app's WebView. A fix is planned for 3.0.1.
  • All platforms: bound-method calls from child frames go over HTTP to /wails/runtime, so the guard does not restrict them. Treat any iframe you embed as having access to your bound Go methods.

Changes since v3.0.0-beta.34

  • Fix Windows apps crashing with panic: SetTextColor failed when painting the application menu bar on some Windows builds (#6311)
  • Fix Windows apps crashing in applyDarkMode when uxtheme.dll was unloaded while its functions were still in use (#6358)
  • Keep a staged update safe while a restart is pending, and validate an update before replacing the installed application, so a damaged update rolls back instead of breaking a working app (#6350, #6360)
  • Fix wails3 update cli not finding v3 releases
  • Project templates pin @wailsio/runtime to the version of the CLI that generated them

Releases from here on

  • Weekly releases bump the minor version (v3.1.0, v3.2.0, ...).
  • Nightly pre-releases preview the next weekly (v3.1.0-nightly.YYYYMMDD).
  • Hotfixes bump the patch version.

Go's @latest always resolves to the newest weekly or hotfix release, never a nightly. The @wailsio/runtime npm package always has the same version as the Wails release. Pin an exact version in production builds.

To propose a new feature or a change to public behaviour, open a draft WEP (Wails Enhancement Proposal) pull request rather than a feature-request issue.

Thank you

Wails v3 exists because of the people who tested incomplete builds, reported hard bugs, translated documentation, answered questions and contributed code: see the credits page. Special thanks to Stffabi, Travis McLane, Atterpac, Lyimmi and fbbdev; to Valerio Tesei for his years of support; to our sponsors; and to JetBrains, ZSA and CodeRabbit.

If Wails is useful to you or your company, please consider sponsoring the project. 💙

Full changelog: changelog

3 days ago
fasthttp
valyala

v1.77.0

v1.77.0 strengthens static-file confinement, fixes hijacked connection handling, and improves HTTP and cookie compatibility. It also adds an opt-in bounded stream reader, configurable body-buffer retention, and deadline support for adapted net/http handlers.

Static-file symlink behavior changes by default. The default OS-backed FS now rejects symlinks that leave Root or CompressRoot, as well as absolute symlinks even when their targets are inside the root. Relative symlinks that stay inside the root continue to work. Set FS.AllowSymlinksOutsideRoot to restore the previous behavior when external symlinks are intentional. Custom FS.FS implementations are unaffected. #2490

Security fixes and hardening

  • Default static-file operations stay within their configured roots. File reads and compressed-cache operations use os.Root to prevent symlink traversal outside Root and CompressRoot. Each root is confined independently; empty roots with AllowEmptyRoot and whole-volume roots retain their existing behavior. #2490
  • Custom filesystems no longer trigger unrelated disk deletions. A stale compressed file in a custom FS.FS previously caused an os.Remove call using its filesystem-relative name, potentially deleting a matching file in the process working directory. Custom filesystems now regenerate stale compressed content in memory without removing a disk file. #2489
  • Kept hijacked connections no longer depend on a recycled request context. With both KeepHijackedConns and ReduceMemoryUsage enabled, the hijacked reader is detached from the context before the hijack handler runs. This prevents later reads from panicking or accessing another client's connection after context reuse. #2495

Features and resource management

  • An opt-in stream reader bounds copied payload buffering. NewBoundedStreamReader works with SetBodyStream and applies backpressure when consumers fall behind. Active copied payload is limited to 160 KiB per bridge, or 320 KiB across the two bridges used by its bounded compression path. These limits exclude caller buffers, codecs, sockets, and other overhead; wrapping the reader loses the combined compression bound. Existing NewStreamReader and SetBodyStreamWriter behavior is unchanged. #2488
  • Request and response body buffers can be retained explicitly. The exported Request.KeepBodyBuffer and Response.KeepBodyBuffer fields preserve body buffers across resets for reuse. Releasing a request or response to the pool clears the retention setting. #2451
  • Adapted handlers can configure connection deadlines. RequestCtx.SetReadDeadline and SetWriteDeadline are also exposed through fasthttpadaptor, enabling http.ResponseController deadline calls. The adaptor still buffers the request body before invoking the handler, so a read deadline set inside an adapted handler cannot govern the preceding upload. #2452

HTTP compatibility and connection handling

  • Weighted compression codings are recognized. Accept-Encoding entries such as gzip;q=0.8 now match, while q=0 makes a coding unacceptable. Matching remains case-insensitive and requires a complete coding token; quality-based preference ordering and wildcard matching are not added. #2491
  • HTTP/1.0 clients no longer receive unsupported informational responses. Expect: 100-continue is ignored for HTTP/1.0 requests, and 103 Early Hints is not sent to HTTP/1.0 clients. #2492, #2496
  • Hijacking works with server keep-alive limits. DisableKeepalive and reaching MaxRequestsPerConn no longer suppress a registered hijack handler or add an unwanted Connection: close to an upgrade response. Explicit connection-close requests and other existing close conditions still apply. #2494
  • Pipe connection deadlines interrupt pending operations. Updating deadlines on fasthttputil.PipeConns now affects blocked reads and writes, and write-deadline updates no longer race with writes. #2471
  • Cookie parsing tolerates invalid attributes and handles names consistently. Invalid Max-Age attributes are ignored, Secure, HttpOnly, and Partitioned are recognized even with a value, and surrounding tabs are trimmed. Set-Cookie values without = are stored under the same empty key returned by Cookie.ParseBytes, keeping lookup and deletion consistent. #2497, #2498, #2500, #2501

Proxy authentication now uses decoded credentials in Proxy-Authorization, and static-file 416 Range Not Satisfiable responses include Content-Range. #2499, #2502

What's Changed

Security and hardening

Features

Fixes

New Contributors

Full Changelog: https://github.com/valyala/fasthttp/compare/v1.76.0...v1.77.0

4 days ago
go-micro
micro

v6.16.0

What's Changed

New Contributors

Full Changelog: https://github.com/micro/go-micro/compare/v6.15.1...v6.16.0

5 days ago
lancet
duke-git

v2.4.0

What's Changed

New Contributors

Full Changelog: https://github.com/duke-git/lancet/compare/v2.3.9...v2.4.0