go install github.com/wailsapp/wails/v2/cmd/wails@v2.17.0

• Windows notifications no longer fall back to PowerShell when the WinRT toast API fails; the error is returned instead
• wails init now warns that remote templates are code: the frontend:* commands in wails.json and the scripts they call run during wails build and wails dev. The warning lists the commands found in the generated wails.json and is also shown with -q. The template docs now describe this trust boundary.
• Hardened the wails dev server against cross-origin and DNS-rebinding attacks on the IPC WebSocket. It previously accepted any origin and forwarded straight to the bound-method dispatcher, so a malicious page in the developer's browser could connect to ws://localhost:34115/wails/ipc and invoke the entire bound Go API. Every request's Host header is now checked against an allowlist (localhost, IP literals, the configured bind address, plus any hosts named in WAILS_DEV_ALLOWED_HOSTS), the IPC upgrade requires a same-origin Origin header, and a per-launch capability cookie (HttpOnly, SameSite=Strict) is required on the upgrade as defense in depth; the cookie is named per dev server port and refreshed before each reconnect, so open browser tabs reconnect after wails dev restarts the app. This protects against browser-based attacks; other processes running as the developer's own user are outside the dev server's threat model by @nft

• Replaced the github.com/wailsapp/mimetype fork with upstream github.com/gabriel-vasile/mimetype v1.4.16 for asset MIME type detection

The wails dev hardening comes from #6036 by @nft, merged as part of #6288.

v2.15.0 and v2.16.0 were tagged without GitHub releases. Their changes are part of this release:

• Fixed a memory leak in the macOS and Linux frontends where Calloc never freed the C strings it allocated for dialogs, menus and window setup by @4RH1T3CT0R7

• Added EnableAutoplayWithoutUserAction macOS webview preference to allow HTML5 media to autoplay without a user gesture #5512 by @Eyalm321

• fix: security hardening for v2 and v3 by @taliesin-ai in https://github.com/wailsapp/wails/pull/6288
• fix(v2/release): pin pnpm 10 for the versioned docs step by @taliesin-ai in https://github.com/wailsapp/wails/pull/6293 Full Changelog: https://github.com/wailsapp/wails/compare/v2.14.0...v2.17.0

• Expose the @wailsio/runtime/cancellable subpath export so CancellablePromise can be imported without evaluating the root runtime entry (#6153)

• Require Go 1.26 or later: the v3 module now declares go 1.26.0, and projects generated by wails3 init and wails3 service init declare the same minimum

• Fix binding generator output changing when building with Go 1.27, where encoding/json types such as Marshaler, Unmarshaler and RawMessage became aliases of encoding/json/v2 and encoding/json/jsontext types: they are rendered as any again and no models are emitted for encoding/json/v2 (#6292)
• Validate remote template URLs passed to wails3 init -t before cloning: only https://, http://, ssh://, git:// and user@host:path URLs are accepted, values are passed to git after --, and git is restricted to those transports during the clone
• Reject out-of-range x-wails-window-id header values in the HTTP runtime transport instead of silently truncating them to another window's ID
• Harden the updater's archive extraction against zip-slip: entry paths are now checked with filepath.IsLocal plus a containment check on the joined path, with tests for nested .., backslash, absolute-path and symlink write-through entries in zip and tar.gz archives
• Fix AppImages from wails3 generate appimage crashing on start outside Debian and Ubuntu with "Unable to spawn a new child process: … WebKitNetworkProcess". The bundled WebKit now runs the helper processes shipped in the AppImage. WebKit's bubblewrap sandbox stays on
• Fix -tags server builds failing to compile for Android and iOS, fixing #6271
• Fix the updater failing to swap on Linux when the temp dir is on another filesystem (such as a tmpfs /tmp) by staging beside the installed binary and copying across filesystems
• Fix the updater trying to replace the read-only mount of an AppImage instead of the .AppImage file
• Fix reserved wails: window control messages being accepted from iframes on macOS and iOS. They are now only accepted from the window's main frame; other messages from iframes still reach RawMessageHandler with their origin info
• Stop posting WindowDidUpdate and WindowWillUpdate on macOS: NSWindowDidUpdateNotification fires on every run-loop pass, so the page received ~120 empty evaluateJavaScript: calls per second, and on macOS 27.0 each of them consumed the transient activation of the user's click — navigator.clipboard.writeText() and other activation-gated APIs rejected with NotAllowedError from real clicks (#6170) by @APshenkin
• Fix default Windows info.json language to en-US (0409) so Explorer shows version details (#6210)
• Fix the Linux DMA-BUF renderer being turned off on laptops with an NVIDIA dGPU beside an AMD or Intel iGPU: on Wayland it is now turned off only when WebKit renders on NVIDIA (the app was offloaded to the dGPU, or the compositor runs on it), not whenever the nvidia module is loaded, which slowed rendering to a crawl on the iGPU; X11 sessions keep the old behaviour, since Xorg's render GPU is set by its configuration
• Handle cross-device rename failures in Linux updater with staged copy fallback in PR by @john-okeefe
• Fix WebviewWindow.SetMenu on Windows not redrawing the menu bar unless a menubar theme was configured, fixing #6103
• Fix WebviewWindow.SetMenu(nil) panicking on Windows instead of being a no-op like on macOS, fixing #6104
• Preserve changelog entries across competing pushes with retries in PR by @leaanthony
• Fix go mod vendor failing with pattern arm64/WebView2Loader.dll: no matching files found on every platform, by removing the embeds that referenced binaries never shipped in the module, fixing #5782 and #5376, in PR by @Grantmartin2002
• Prevent duplicate window teardown on macOS in PR by @charlesbalderson
• Handle WM_CONTEXTMENU for systray menu to open on right-click in PR by @wzk2025
• Fix all five InvokeSync* variants blocking their caller forever when the dispatched callback panics, fixing #6107, in PR by @RALIST
• Rebuilds destroyed GTK3 submenus safely in PR by @leaanthony
• Implement Windows worker forwarding shim for nested workers in PR by @taliesin-ai
• Fix OpenFile() on Windows ignoring PromptForMultipleSelection() when CanChooseDirectories(true): users can now pick several folders at once, as on macOS and Linux (#6263)
• Fix by-value double arguments to WebView2 COM methods on windows/arm64 — ZoomFactor, RasterizationScale, cookie Expires, and the print settings scale, page size and margins were affected there (the print-settings setters previously returned ErrDoubleArgUnsupported): affected calls now goes through a runtime.cgocall trampoline that loads d0, which Go's syscall path cannot (golang.org/issue/62583) by @APshenkin

• Server mode (-tags server) now accepts /wails/runtime calls only as POST requests from the server's own origin or an origin listed in ServerOptions.WebSocketOriginPatterns; other methods receive HTTP 405 and other browser origins HTTP 403. Deployments behind a reverse proxy that rewrites the Host header should add their public origin to WebSocketOriginPatterns
• Server mode (-tags server) bound to a loopback address (the default localhost, 127.0.0.0/8 or ::1) now rejects requests with HTTP 403 unless the Host header is localhost, an IP literal, the bind host, or a host matching ServerOptions.WebSocketOriginPatterns, blocking DNS rebinding attacks against /wails/runtime and the WebSocket endpoints
• Windows notifications no longer fall back to PowerShell when the WinRT toast API fails; the error is returned instead

🤖 This is an automated nightly release generated from the latest changes on master.

Installation:

go install github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0-beta.31

⚠️ Beta Warning: This is pre-release software. The API is stable, but you may still encounter issues before the final 3.0 release.

• Fix the updater trying to replace the read-only mount of an AppImage instead of the .AppImage file
• Stop posting WindowDidUpdate and WindowWillUpdate on macOS: NSWindowDidUpdateNotification fires on every run-loop pass, so the page received ~120 empty evaluateJavaScript: calls per second, and on macOS 27.0 each of them consumed the transient activation of the user's click — navigator.clipboard.writeText() and other activation-gated APIs rejected with NotAllowedError from real clicks (#6170) by @APshenkin
• Fix default Windows info.json language to en-US (0409) so Explorer shows version details (#6210)
• Handle cross-device rename failures in Linux updater with staged copy fallback in PR by @john-okeefe
• Fix WebviewWindow.SetMenu on Windows not redrawing the menu bar unless a menubar theme was configured, fixing #6103
• Fix WebviewWindow.SetMenu(nil) panicking on Windows instead of being a no-op like on macOS, fixing #6104
• Preserve changelog entries across competing pushes with retries in PR by @leaanthony
• Fix go mod vendor failing with pattern arm64/WebView2Loader.dll: no matching files found on every platform, by removing the embeds that referenced binaries never shipped in the module, fixing #5782 and #5376, in PR by @Grantmartin2002
• Prevent duplicate window teardown on macOS in PR by @charlesbalderson
• Handle WM_CONTEXTMENU for systray menu to open on right-click in PR by @wzk2025
• Fix all five InvokeSync* variants blocking their caller forever when the dispatched callback panics, fixing #6107, in PR by @RALIST

🤖 This is an automated nightly release generated from the latest changes on master.

Installation:

go install github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0-beta.30

⚠️ Beta Warning: This is pre-release software. The API is stable, but you may still encounter issues before the final 3.0 release.

• Consolidate media-type parameter parsing into internal/mediatype (#4750)
• Fix modernize and revive lint issues (#4759)

• Fix client, session, basicauth and other bugs found in the audit (#4752)

• bump github.com/gofiber/utils/v2 from 2.6.1 to 2.6.2 (#4760)
• bump github.com/klauspost/compress from 1.20.1 to 1.20.3 (#4757)
• bump github.com/molecule-man/go-brrr from 1.2.0 to 1.3.0 (#4758)
• bump the golang-modules group with 3 updates (#4755)
• bump release-drafter/release-drafter from 7.9.0 to 7.10.0 (#4756)
• bump actions/setup-node from 7.0.0 to 7.1.0 (#4754)

• Sync the documentation with the v3.6.0 code (#4751)

📒 Documentation: https://docs.gofiber.io/

💬 Discord: https://gofiber.io/discord

Full Changelog: https://github.com/gofiber/fiber/compare/v3.6.0...v3.6.1

Thank you @alexandear, @gaby, @ninadsutrave and @ReneWerner87 for making this release possible.

• Global shortcuts on macOS are now keyboard-layout aware: letter accelerators bind to the labelled key on non-QWERTY layouts (AZERTY, QWERTZ, Dvorak, ...) via UCKeyTranslate, instead of the fixed QWERTY physical position.

• Initialize native menu before setting it on Linux in PR by @abhicodes-007
• Resolve macOS GA readiness regressions in output handling and setup wizard in PR by @taliesin-ai
• Fix WebView2 COM AddRef/Release wrappers on Windows reporting a stale thread last-error as a failure. They now return the reference count, so a release can no longer abort the application or fail an asset request (#3931)
• Fix ICoreWebView2Deferral.Release calling the AddRef slot, which leaked the deferral of every deferred asset request on Windows (#3931)

🤖 This is an automated nightly release generated from the latest changes on master.

Installation:

go install github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0-beta.29

⚠️ Beta Warning: This is pre-release software. The API is stable, but you may still encounter issues before the final 3.0 release.

• fix(core): publish multi-architecture images to ACR by @dsx137 in https://github.com/openimsdk/open-im-server/pull/3815

Full Changelog: https://github.com/openimsdk/open-im-server/compare/v3.8.3-patch.17...v3.8.3-patch.18

• fix(core): publish multi-architecture images to ACR by @dsx137 in https://github.com/openimsdk/open-im-server/pull/3815

Full Changelog: https://github.com/openimsdk/open-im-server/compare/v3.8.3-patch.17...v3.8.3-patch.18

Fiber v3.6.0 ships with fasthttp v1.75.0. With it, Fiber v3 is back on par with the speed of v2, despite the additional security mechanisms built in since then.

Negative is faster than v2. v3.6.0 was measured on main three days before the release. All scenarios are published on our benchmarks page, where we now continuously make sure that v3 does not get slower again. https://gofiber.github.io/benchmarks/

• Add csrf.NewCrossOriginProtection for tokenless CSRF protection (#4596) New tokenless middleware that rejects unsafe cross-origin browser requests by their Sec-Fetch-Site and Origin headers; no cookie, token or storage needed.

  app.Use(csrf.NewCrossOriginProtection(csrf.CrossOriginConfig{
      TrustedOrigins: []string{"https://admin.example.com"},
  }))

  https://docs.gofiber.io/middleware/csrf#cross-origin-protection-without-tokens
• Update fasthttp to v1.75.0 (#4667, #4740) fasthttp v1.75.0 (from v1.73.0) parses and validates request headers in one pass, writes responses with fewer copies, serves cached files up to 8 KiB from memory and speeds up URI processing. https://github.com/valyala/fasthttp/releases/tag/v1.75.0
• Raise default ReadBufferSize and WriteBufferSize to 8 KB (#4715) ReadBufferSize and WriteBufferSize now default to 8192 bytes (was 4096), which also raises the default request header limit; explicitly configured values are kept.

  app := fiber.New(fiber.Config{
      ReadBufferSize:  4096, // previous default, now 8192
      WriteBufferSize: 4096, // previous default, now 8192
  })

  https://docs.gofiber.io/api/fiber#readbuffersize
• Expand context, response and request helpers (#4638) New helpers on Req, Res and Ctx such as Bearer, Origin, IsSafe, Del, StatusCode, GetCookies, Elapsed and RouteName; request helpers are now also reachable through c.Req().

  token := c.Bearer()   // "abc123" for "Authorization: Bearer abc123"
  c.Del("X-Powered-By") // remove a response header
  took := c.Elapsed()   // time spent on this request so far

  https://docs.gofiber.io/api/ctx
• Add Endpoint() for middleware look-ahead (#4601) New c.Endpoint() returns the route that will handle the request without advancing the handler chain (nil on 404/405).

  app.Use(func(c fiber.Ctx) error {
      if route := c.Endpoint(); route != nil {
          // enforce access control using route.Path or route.Name
      }
      return c.Next()
  })

  https://docs.gofiber.io/api/ctx#endpoint
• Add ordered RuleList to the redirect and rewrite middleware (#4621, #4633) New RuleList []Rule in redirect and rewrite is tried in the order written, first match wins; the Rules map is deprecated and setting both panics.

  app.Use(redirect.New(redirect.Config{
      RuleList: []redirect.Rule{
          {From: "/old", To: "/new"},      // checked first
          {From: "/old/*", To: "/new/$1"}, // takes everything else
      },
  }))

  https://docs.gofiber.io/middleware/redirect#rule-order
• Render configured templates to a writer (#4594) New app.Render writes a template through the configured view engine to any io.Writer without creating an HTTP response, e.g. for SSE or HTMX partials.

  var buf bytes.Buffer
  if err := app.Render(&buf, "partial", fiber.Map{"Title": "update"}); err != nil {
      return err
  }

  https://docs.gofiber.io/api/app#render
• Add final request hooks to the HTTP client (#4595) New AddFinalRequestHook runs after the built-in hooks, immediately before the request is sent, when RawRequest holds the resolved URL, merged headers and serialized body.

  cc.AddFinalRequestHook(func(_ *client.Client, req *client.Request) error {
      raw := req.RawRequest
      raw.Header.Set("X-Signature", sign(raw.URI().RequestURI(), raw.URI().Host(), raw.Body()))
      return nil
  })

  https://docs.gofiber.io/client/hooks#final-request-hooks
• Add SetLocal, a request-local store without the variadic's heap slice (#4687) New c.SetLocal(key, value) stores a request-local value exactly like c.Locals(key, value), without the one-element slice that call allocates. https://docs.gofiber.io/api/ctx#setlocal
• Add DisableFlashMessages and filter route candidates with a probe constant (#4655) New fiber.Config option DisableFlashMessages turns off redirect flash messages and the per-request fiber_flash cookie scan (off by default); the router gains a precomputed probe-constant filter.

  app := fiber.New(fiber.Config{
      DisableFlashMessages: true, // default: false
  })

  https://docs.gofiber.io/api/fiber#disableflashmessages
• Add source-aware extraction to extractors without a new struct field (#4603) New extractors.Resolve returns the value together with the Source and Key of the chain child that produced it; the Extractor struct is unchanged.

  ex := extractors.Chain(extractors.FromHeader("X-API-Key"), extractors.FromQuery("api_key"))
  res, err := extractors.Resolve(ex, c)
  // res.Value, plus res.Source and res.Key of the child that won

  https://docs.gofiber.io/guide/extractors#source-aware-extraction

• Require Go 1.26 (#4654)
• Filter large route buckets before loading routes and bind without building a map (#4705)
• Filter a route bucket by static path before loading the route (#4688)
• Consolidate route pattern preprocessing (#4710)
• Share route and client :name path delimiters (#4636)
• Normalize header keys in one pass and match canonical media types directly (#4690)
• Share streaming header join logic (#4734)
• Consolidate comma-list header scanning into internal/headerlist (#4637)
• Consolidate entity-tag parsing into internal/etag (#4632)
• Adopt utils/v2 helpers and cut per-request allocations in the hot path (#4666)
• cors/csrf: Consolidate origin matching into internal/origin (#4653)
• limiter: Lock keys per shard instead of globally (#4702)
• redirect/rewrite: Share capture substitution (#4749)
• session: Skip the gob re-encode when a session was only read (#4703)
• Cut the per-request cost of the extractors (#4678)
• Stabilize flaky tests in limiter, binder, cache, basicauth and the request sweeps (#4729)
• Close three test coverage gaps in logger, shutdown and docs (#4615)
• Add a regression test and docs example for CustomCtx overrides behind middleware (#4598)
• Add a regression test and docs note that Context() is not canceled on graceful shutdown (#4599)
• Trigger Dependabot in gofiber/benchmarks after releases (#4682)

• Normalize request paths per RFC 3986 before routing and serve the routed path from the static middleware (#4695)
• Keep stray percents from forging escapes, root every request target and take the SendFile name literally (#4719)
• Let empty optional params yield to later required segments (#4722)
• Fix panic on route pattern with trailing escape character (#4717)
• Preserve names for merged multi-method routes (#4663)
• Fix nil pointer dereference when a domain-mounted sub-app contains a nested mount (#4620)
• Preserve path rewrites whose source aliases the current path, such as c.Path(c.Path()[4:]) (#4674)
• Escape parameter values in generated route URLs (#4629)
• Return ErrRouteNotRepresentable for parameter values a generated route URL cannot represent (#4721)
• Accept tab OWS in X-Forwarded-For and share one OWS trim helper (#4735)
• Treat Vary field names as case-insensitive (#4642)
• Unify cookie SameSite handling (#4630)
• Prevent unbounded handler growth when SendFile serves a function-backed fs.FS (#4656)
• Prevent typed-nil view engine panics (#4662)
• Report the real status for fasthttp-level request errors (#4614)
• Drain in-flight requests before Listen returns (#4701)
• basicauth: Equalize verification time across mixed hash algorithms (#4726)
• basicauth: Refuse a repeated Authorization field (#4738)
• basicauth/keyauth: Use HTTP quoted strings in auth challenges (#4631)
• cache: Delete stale entries after uncacheable revalidation (#4590)
• cache: Key entries by request scheme and host (#4736)
• cache: Replay Vary on cache hits and mark credential-keyed entries private (#4744)
• compress: Honor repeated Accept-Encoding and Cache-Control lines with the new HasHeaderValue helper (#4708)
• idempotency: Keep replayed response headers unsplit under EnableSplittingOnParsers (#4693)
• limiter: Bound the rate-limit key before it reaches storage (#4677)
• proxy: Apply the client's Connection listing to the request as received (#4745)
• proxy: Fold DomainForward's configured hostname to Punycode (#4673)
• proxy: Overwrite X-Real-IP in proxy.Balancer like the other forwarding helpers (#4725)
• proxy: Preserve IPv6 brackets in domain forwarding (#4689)
• redirect/rewrite: Read "$10" as the tenth capture in targets (#4692)
• session: Honor chain-level extractors and close three write-back holes (#4679)
• static: Align file resolution with routed paths (#4712)
• static: Reject partial wildcard matches that cross a path segment boundary (#4728)
• Decode a path parameter exactly once in FromParam (#4626)
• Anchor and escape client path parameter substitution (#4625)
• Keep a stale client Response from releasing a reused Request on Close (#4659)
• Parse malformed Set-Cookie attributes in the client in linear time (#4658)
• Make static, proxy, adaptor and rewrite act on the path the router matched (#4720)
• Fix RFC 9110/9112 compliance gaps in core, static and timeout (#4747)
• Fix correctness issues across core, router, binder, client and middleware (#4652)

• Clarify that c.IP() walks the proxy chain only with EnableIPValidation (#4737)
• Explain what MIMETypes does to an existing format (#4664)
• Document the nested and array field notations in Bind (#4616)
• Add a minimal CRUD and healthcheck guide (#4696)
• Fix British to American English spellings across docs (#4697)
• Update README documentation links (#4711)

📒 Documentation: https://docs.gofiber.io/

💬 Discord: https://gofiber.io/discord

Full Changelog: https://github.com/gofiber/fiber/compare/v3.5.0...v3.6.0

Thank you @00200200, @Arvin-Lee, @AshSgDe29071999, @BitWeaverDev, @Dev-next-gen, @Rachit-Gandhi, @ReneWerner87, @Rohilalala, @RubenPari, @VedantMadane, @ZihxS, @aditya-rohilla, @drakeo338, @evgenyponomarev, @fadiromdhan3, @fadiroot, @gaby, @h2zi, @haimingZZ, @ibraah007, @jabrailkhalil, @lazerg, @official-burak and @truongbo17 for making this release possible.

Hello!

We ship important security, stability, and PDF compatibility fixes with no breaking Go API changes. The release requires Go 1.26 or later. Upgrading is highly recommended!

• Harden parsing and decoding against excessive work, circular references, malformed fonts, and invalid image parameters. Enforce resource limits and prevent several malformed-input panics.
• Reduce repeated validation of shared objects and memory allocations when parsing large certificate revocation lists.
• Correct AES-256 password preparation and owner authentication, encryption revision checks, and extraction permissions.
• Fix named and Identity crypt-filter handling, crypt-filter length units and validation, and encryption of strings rewritten from object streams.

• Preserve catalog data, inherited page boxes and resources, shared stamp resources, name-tree values, and named destinations during processing. Correct compressed-object reference renumbering during merging.
• Fix PDF whitespace, text and hexadecimal-string decoding, inline-image parsing, cross-reference handling, and effective PDF version detection.
• Improve form field inheritance, checkbox/radio handling, export ordering, JSON matching, list-box clearing, and Unicode text-length checks.
• Correct CMYK rendering, RGBA image import, Flate/TIFF predictor handling, and Crypt filter pipelines.
• Fix ToUnicode mappings, TrueType widths and style detection, and XMP date parsing.
• Complete required standard-font metrics for PDF 2.0 output and enforce required annotation appearances.
• Strengthen validation of images, graphics values, colour spaces, functions, destinations, PageLabels, and PDF 2.0 entries. Restore targeted multimedia compatibility and improve action reporting.

Existing Go API signatures remain unchanged; supporting packages receive additive exports. Strict validation now rejects additional malformed inputs, while applicable relaxed compatibility is retained with notices. PDF 2.0 writes report an error when required annotation appearances are missing; automatic appearance generation remains incomplete. Encryption defaults are unchanged.

Thanks everyone who opened issues. Shoutout to @qoke and the IQ Hive team for providing a heavy load of critical fixes for this release.

The package remote has its own WebSocket client, and it is a package of the core module now. The nested module remote and the dependency github.com/gobwas/ws are gone. The core module still needs only the standard library and cdproto.

The import path is the same: github.com/chromedp/chromedp/remote. The public API of the package is the same.

Upgrade: if your go.mod has a line for github.com/chromedp/chromedp/remote, remove it (go mod tidy does that). Go reports an ambiguous import while both the old nested module and the core module provide the package. The tag remote/v0.2.0 is the last version of the nested module.

The client follows RFC 6455: it checks the handshake, joins fragmented messages, checks UTF-8 and the size of a message, answers pings, and does the close handshake. It does not support extensions such as permessage-deflate. Go 1.25 and later are supported.

The main headline here is that the mouse is supported on the Linux console with GPM. There are performance improvements and some bug fixes, plus improved reporting of pixel sizes on window resize events as well.

• fix(vt): let the segmenter decide clustering, not Go's unicode tables by @dylanpulver in https://github.com/gdamore/tcell/pull/1170
• chore(deps): bump golang.org/x/term from 0.45.0 to 0.46.0 by @dependabot[bot] in https://github.com/gdamore/tcell/pull/1173
• chore(deps): bump golang.org/x/text from 0.41.0 to 0.42.0 by @dependabot[bot] in https://github.com/gdamore/tcell/pull/1174
• fix: invalidate blank cells after resizing CellBuffer by @jakezwang in https://github.com/gdamore/tcell/pull/1176
• fix(st): re-enable SGR mouse (1006) and focus (1004) reporting by @akashchamp in https://github.com/gdamore/tcell/pull/1179
• perf(cell): fill areas without an allocation per cell by @ayn2op in https://github.com/gdamore/tcell/pull/1184
• fix(resize): report the pixel size in resize events by @ayn2op in https://github.com/gdamore/tcell/pull/1186
• fix(input): extend bare Escape timeout on Windows by @gdamore in https://github.com/gdamore/tcell/pull/1188
• feat(gpm): support Linux console mouse by @gdamore in https://github.com/gdamore/tcell/pull/1190
• perf: reuse SetContent strings for Unicode glyphs by @gdamore in https://github.com/gdamore/tcell/pull/1191

• @dylanpulver made their first contribution in https://github.com/gdamore/tcell/pull/1170
• @jakezwang made their first contribution in https://github.com/gdamore/tcell/pull/1176
• @akashchamp made their first contribution in https://github.com/gdamore/tcell/pull/1179

Full Changelog: https://github.com/gdamore/tcell/compare/v3.5.0...v3.6.0