• Fuse bind and first step into one CGO crossing by @mattn in https://github.com/mattn/go-sqlite3/pull/1455
• Fuse step and column fetch into one CGO crossing in Next by @mattn in https://github.com/mattn/go-sqlite3/pull/1460
• fix: release replaced authorizer callbacks by @ryanchou1994 in https://github.com/mattn/go-sqlite3/pull/1458
• Return an error instead of crashing when a connection is used after Close by @mattn in https://github.com/mattn/go-sqlite3/pull/1462
• Report missing arguments when Exec has no arguments by @laodouya in https://github.com/mattn/go-sqlite3/pull/1471
• Upgrade SQLite to version 3540100 by @mattn in https://github.com/mattn/go-sqlite3/pull/1472

• @ryanchou1994 made their first contribution in https://github.com/mattn/go-sqlite3/pull/1458
• @laodouya made their first contribution in https://github.com/mattn/go-sqlite3/pull/1471

Full Changelog: https://github.com/mattn/go-sqlite3/compare/v1.14.52...v1.14.53

Fix: a command that is still pending when the browser detaches its target, for example when the page closes, now returns an error that wraps the new ErrTargetDetached. Before, Chrome sent no reply and the command waited until its context ended. A command that starts on a detached target fails at once. The issue was reported by onsi in discussion #1645.

New: Listen and ListenBrowser call a func for each event of the tab or the browser, in the order in which the events arrive from Chrome. The target calls the func before it reads the next message, so the func sees an event that arrived before the reply to a command before that command returns. Events and BrowserEvents give one iterator for each event type and give neither guarantee, so they stay the recommended API, and Listen is the lower level tool for code that needs the order across event types. The func gets the typed events of cdproto and no replies to commands. It runs in the loop that reads the messages of the tab, so it must return fast, must not run a command, must not call Listen and must not panic. See docs/API.md, example 28, and the decision docs/decisions/2026-11-04-export-the-ordered-event-listener.md. The idea comes from discussion #1645 by onsi.

Nightly preview of the upcoming v3.2.0.

• [v3] refresh systray menus on Menu.Update in PR by @johnmaguire
• [v3/Windows] Implement SetIcon for windows in PR by @hypherionmc

🤖 This is an automated nightly pre-release generated from the latest changes on master. It is not selected by @latest; install it by its exact tag.

Installation:

go install github.com/wailsapp/wails/v3/cmd/wails3@v3.2.0-nightly.20261103

Tip: always pin an exact version (e.g. @v3.2.0-nightly.20261103) in go.mod and CI rather than @latest.

Nightly preview of the upcoming v3.2.0.

• DisableOverscroll instead of DisableBounce in PR by @lethusang

🤖 This is an automated nightly pre-release generated from the latest changes on master. It is not selected by @latest; install it by its exact tag.

Installation:

go install github.com/wailsapp/wails/v3/cmd/wails3@v3.2.0-nightly.20261102

Tip: always pin an exact version (e.g. @v3.2.0-nightly.20261102) in go.mod and CI rather than @latest.

We are pleased to announce the release of version 2.11.1. Featured are a handful of new areas of functionality and numerous bug fixes.

A summary of changes is available in the Release Notes. A full list of changes is available in the changelog.

The most notable changes in this release are:

• Upgraded requirement: Go language version is Go 1.26.0 or later, due to upgrading dependency package golang.org/x/crypto

• Fixed a panic when getting a cell value with a negative shared string index (CVE-2026-104819), related security advisory GHSA-48hm-4h8j-58fg
• Fixed a GetPivotTables panic on invalid pivot table field indices (CVE-2026-107211), related security advisory GHSA-mx22-3794-2vpv
• Fixed an unbounded row number in the rows iterator (CVE-2026-107212), related security advisory GHSA-jw42-f3rr-4cc3
• Fixed a GetSlicers panic when getting slicers from a worksheet without a drawing part (CVE-2026-107213), related security advisory GHSA-r7x5-4969-99p7
• Fixed a panic when decrypting a malformed workbook (CVE-2026-107214), related security advisory GHSA-2j4c-ffch-9f23
• Fixed unbounded EncryptionInfo and EncryptedPackage stream sizes being allocated when decrypting a workbook (CVE-2026-107215), related security advisory GHSA-x2q3-8cjh-766f
• Fixed a CalcCellValue stack overflow caused by circular ANCHORARRAY formula references (CVE-2026-107216), related security advisory GHSA-wp2g-vpjj-g53r
• Fixed ColumnNameToNumber and JoinCellName accepting invalid column names, which caused integer overflow (CVE-2026-107217), related security advisory GHSA-c85p-xxjj-2r75
• Fixed Unicode handling and count overflow in the LEFT, LEFTB, RIGHT, and RIGHTB formula functions (CVE-2026-107218), related security advisory GHSA-8jjq-8j9w-m2v6
• Fixed an unbounded spin count when deriving the agile decryption key (CVE-2026-107219), related security advisory GHSA-jrfj-fhj2-jjvm
• Fixed a panic on a worksheet with an empty merged cell reference (CVE-2026-107220), related security advisory GHSA-g27h-8qhm-6pff
• Fixed a panic on a row whose cells are not in ascending column order (CVE-2026-107221), related security advisory GHSA-8mcq-6wmr-jrjv
• Fixed a GetConditionalFormats panic on malformed conditional formatting rules (CVE-2026-107222), related security advisory GHSA-rxcj-4pj5-74gr
• Fixed an overflow of the minimum and maximum column numbers (CVE-2026-107223), related security advisory GHSA-fq3v-74gv-27gm
• Fixed a panic by rejecting Zip64 uncompressed sizes that do not fit in a signed int64 (CVE-2026-107224), related security advisory GHSA-fw94-4wwp-w8pw
• Fixed a panic when getting styles with a negative style index (CVE-2026-107225), related security advisory GHSA-5h23-36rv-pm65

• Added new EmbeddedObject data type
• Added 2 new constants, MaxCFBStreamSizeV3 and MaxCFBStreamSizeV4
• Added new function GetShapes to support get shape, related issue #436
• Added new functions GetEmbeddedObjects and SetGetEmbeddedObject to support get and set embedded objects, related issues #158 and #2186
• The CalcCellValue function now supports matrix arguments in the AND formula function
• The SetConditionalFormat function now validates the style index, related issue #2400

• Aligned the numeric precision of values stored by the SetCellValue function with Microsoft Excel™, related issue #1757

• Fixed the GetPictures function not returning the edit positioning in some cases, resolved issue #2217
• Fixed the CalcCellValue function returning incorrect results when error values appear inside parentheses or operators, resolved issues #1164 and #2344
• Fixed the CalcCellValue function not returning the expected error in some cases, resolved issues #2349 and #2432
• Fixed the CalcCellValue function returning incorrect results for 16 formula functions: COUNT, COUNTA, EDATE, HLOOKUP, IF, INDIRECT, ISNUMBER, MDETERM, MINVERSE, OR, SUM, TRIM, VALUE, VLOOKUP, WEEKDAY and XLOOKUP, resolved issues #2411, #2412, #2413, #2414, #2415, #2416, #2417, #2430, #2436, #2439, and #2445
• Fixed a CalcCellValue panic on unbalanced closing parentheses in a formula, resolved issue #2409
• Fixed a CalcCellValue panic when calculating the AVERAGEIFS, COUNTIFS, MAXIFS, MINIFS, PERCENTILE.EXC and SUMIFS formula functions with invalid arguments, resolved issue #2426
• Fixed the AddChart and AddChartSheet functions generating invalid charts that corrupted the workbook in some cases, resolved issues #2355 and #2356
• Fixed stream writer not applying number formatting to duration cell values, resolved issue #2371
• Fixed precision loss when setting cell values with time.Duration, resolved issue #2372
• Fixed the AddSlicer function reusing the pivot table slicer cache for different fields, resolved issue #2383
• Fixed the GetStyle function returning an invalid style for fills without a pattern, resolved issue #2384
• Fixed the GetFormControls and GetTables functions being unable to get form controls and tables when the workbook uses absolute paths, resolved issue #2386
• Fixed the GetPanes function being unable to get split panes in some cases, resolved issue #2387
• Fixed the SetCalcProps function being unable to set calculation properties to false, resolved issue #2404
• Fixed the ExcelDateToTime function returns dates one day early for January and February 1900, resolved issue #2466

• Updated dependencies
• Updated unit tests and godoc
• Updated the documentation website, which is available in 12 languages: Arabic, German, English, Spanish, French, Italian, Japanese, Korean, Portuguese, Russian, Simplified Chinese and Traditional Chinese
• Released an updated excelize-wasm NPM package for WebAssembly / JavaScript support
• Released an updated excelize-py PyPI package for Python
• Released an updated ExcelizeCs NuGet package for C# / .NET

Thanks to all the contributors to Excelize. Below is a list of contributors who made code contributions in this version:

• @Aprax14 (Damiano Scarpellini)
• @xixixi1118
• @zhouxuanyu1204-bot (ZHOU XUANYU)
• @lzoeydzdnn
• @arpitjain099 (Arpit Jain)
• @n0liu (Roland)
• @1436761858 (LP-LDY)
• @yashisrani (Yash Israni)
• @alliasgher (Ali Asghar)
• @ensiouel
• @a3190778733-pixel (shixia)
• @Nayjest (Vitalii Stepanenko)
• @ValeryVerkhoturov (Valery)
• @freeeve (Eve Freeman)
• @saifulferoz (Feroz)
• @lmonstergg
• @pcvelz (Peter van Velzen)
• @askalf (Thomas Sprayberry)
• @zac-scheiwe (Zac Scheiwe)
• @lrweck (Luis)
• @akashchamp
• @PhilflowIO (Philipp Lütje)
• @White0xdi3 (Jnyandeep Koyya)
• @keithadler (Keith Adler)
• @EpicHigh (Prasit Tongpradit)
• @wangyica879112 (ChangAo)
• @yl030628 (YL)
• @prostomarkeloff (prostomarkeloff)
• @Gabik21
• @Alifarid0011 (AliFarid)

Fix a panic, close of closed channel, in the handling of DOM.documentUpdated. When DOM.getDocument failed, for example because the tab was closing, the frame kept its old root node, and the next DOM.documentUpdated event closed the channel of that root again. The frame now clears the root first. Thanks to Dhruv Jain (#1644). The module also requires cdproto v0.159.0 now.

Nightly preview of the upcoming v3.2.0.

• add experimental CGO-free macOS and Linux backends in PR by @taliesin-ai
• native YAML builds, portable packaging and signing in PR by @taliesin-ai

• Fix assorted v3 nightly build issues and clean up dependencies in PR by @taliesin-ai
• repair v3 release validation and fixture classification in PR by @taliesin-ai
• resolve cross-platform release validation failures in PR by @taliesin-ai

🤖 This is an automated nightly pre-release generated from the latest changes on master. It is not selected by @latest; install it by its exact tag.

Installation:

go install github.com/wailsapp/wails/v3/cmd/wails3@v3.2.0-nightly.20261101

Tip: always pin an exact version (e.g. @v3.2.0-nightly.20261101) in go.mod and CI rather than @latest.

• add experimental CGO-free macOS and Linux backends in PR by @taliesin-ai
• native YAML builds, portable packaging and signing in PR by @taliesin-ai

• avoid copying discarded desktop metadata in PR by @taliesin-ai
• format content lengths without fmt in PR by @taliesin-ai
• select index roots without collecting candidates in PR by @taliesin-ai
• reuse non-seekable file copy buffers in PR by @taliesin-ai
• avoid allocating a reader for sniffing prefixes in PR by @taliesin-ai
• skip MIME sniff reads for known extensions in PR by @taliesin-ai
• prevent queue growth and shrink oscillation in PR by @taliesin-ai
• avoid allocating discarded request contexts in PR by @taliesin-ai
• skip disabled debug log preparation in PR by @taliesin-ai
• allocate MIME sniff buffers lazily in PR by @taliesin-ai
• reduce hyperlink formatting allocations in PR by @taliesin-ai
• remove temporary bullet formatting allocations in PR by @taliesin-ai
• reduce UUID string conversion to one allocation in PR by @taliesin-ai
• reduce statement-handle formatting allocations in PR by @taliesin-ai
• eliminate temporary name-based UUID digest allocation in PR by @taliesin-ai
• avoid copying unfinished command-output lines in PR by @taliesin-ai
• stream executable copies during package staging in PR by @taliesin-ai
• avoid rescanning unfinished output lines in PR by @taliesin-ai
• reuse compiled command routing patterns in PR by @taliesin-ai
• avoid metadata lookups during runtime discovery in PR by @taliesin-ai
• reduce localized fallback page allocations in PR by @taliesin-ai
• avoid recompiling patterns for each processor in PR by @taliesin-ai

• implement SetTooltip for the system tray in PR by @fan711
• read dark mode from the settings portal in PR by @TechHutTV
• let Window.SetZoom go below 1.0 in PR by @APshenkin
• deliver to each Go listener in emit order in PR by @DevLumuz
• read event hooks under hookLock in Emit in PR by @DevLumuz
• always advertise the tray Menu property so a tray created after Run is not dropped in PR by @AlbinoGeek
• hold main-thread work sent before Run until Run starts in PR by @AlbinoGeek
• use correct asset url in github updater provider in PR by @gavidroselj
• keep request body when WebView2 omits Content-Length in PR by @strraaa
• report macOS and GTK screens in DIP space (mixed-DPI bounds) in PR by @julianstorer
• don't report a dismissed notification as a click in PR by @bercedev
• stop dev processes when the terminal closes in PR by @xmasdev
• map changelog runs to squash-merge commits in the evidence check in PR by @taliesin-ai
• hold the taskbar-restart debounce for a second in PR by @taliesin-ai
• keep size constraints through a fullscreen that starts there in PR by @taliesin-ai
• do not resize a fullscreen or maximised window to fit a new constraint in PR by @taliesin-ai
• do not raise a dialog before Run in the liquid-glass example in PR by @taliesin-ai
• a dialog asked for before Run does nothing instead of waiting forever in PR by @taliesin-ai
• fall back when desktop entry has no command in PR by @taliesin-ai
• sniff current content without retaining filenames in PR by @taliesin-ai
• recognize mixed-case asset extensions in PR by @taliesin-ai
• release consumed content-sniffer buffers in PR by @taliesin-ai
• release removed ringqueue references in PR by @taliesin-ai
• honor header deletions before fallback selection in PR by @taliesin-ai
• commit fallback response headers before flush in PR by @taliesin-ai
• discover only exact index files in PR by @taliesin-ai
• avoid bodies and full reads for non-seekable HEAD in PR by @taliesin-ai
• fill MIME sniffing prefix across short reads in PR by @taliesin-ai
• commit successful empty non-seekable responses in PR by @taliesin-ai
• avoid duplicating expanded URI targets in PR by @taliesin-ai
• preserve paths during field expansion in PR by @taliesin-ai
• respect XDG desktop-file search directories in PR by @taliesin-ai
• commit sniffer headers on empty flush in PR by @taliesin-ai
• skip directories shadowing desktop entries in PR by @taliesin-ai
• preserve targets found inside executable paths in PR by @taliesin-ai
• release callback captures after timer fires in PR by @taliesin-ai
• avoid false ldconfig library matches in PR by @taliesin-ai
• constrain filesystem library fallback matches in PR by @taliesin-ai
• remove cache invalidation data race in PR by @taliesin-ai
• honor the optional logger configuration in PR by @taliesin-ai
• avoid shared start URL mutation and stale ports in PR by @taliesin-ai
• stop dev proxy retries on request cancellation in PR by @taliesin-ai
• return 404 for missing bundled assets in PR by @taliesin-ai
• handle bundled runtime HEAD requests in PR by @taliesin-ai
• preserve escaped paths when routing services in PR by @taliesin-ai
• order oversized numeric prerelease identifiers correctly in PR by @taliesin-ai
• reject HTTP errors before saving tooling downloads in PR by @taliesin-ai
• honor the launch deadline during desktop discovery in PR by @taliesin-ai
• preserve request bodies across development proxy retries in PR by @taliesin-ai
• close HTTP response bodies on every return path in PR by @taliesin-ai
• preserve cancellation errors in parallel library searches in PR by @taliesin-ai
• reject failed GitHub tag responses before decoding in PR by @taliesin-ai
• preserve literal bracketed template paths in PR by @taliesin-ai
• install wails3 once and preserve installer errors in PR by @taliesin-ai
• ignore hidden entries and headers in comment blocks in PR by @taliesin-ai
• surface stable release lookup errors in PR by @taliesin-ai
• print plain messages without format interpretation in PR by @taliesin-ai
• avoid write panics after loading JSON null in PR by @taliesin-ai
• return snapshots for whole-store reads in PR by @taliesin-ai
• propagate errors after partial row iteration in PR by @taliesin-ai
• keep extraction destination paths literal in PR by @taliesin-ai
• release prepared-statement handles on close and reopen in PR by @taliesin-ai
• handle preparation racing with close or reopen in PR by @taliesin-ai
• honor HEAD requests for the fallback index page in PR by @taliesin-ai
• require complete hexadecimal statement handles in PR by @taliesin-ai
• preserve the default in-memory database under concurrency in PR by @taliesin-ai
• separate stderr from parsed HEAD output in PR by @taliesin-ai
• generate runtime assets from embedded bundles in PR by @taliesin-ai
• detect TODO, FIXME and TBD placeholders in PR by @taliesin-ai
• validate release notes API responses in PR by @taliesin-ai
• respect task directories in status checks in PR by @taliesin-ai
• prevent same-file copy data loss in PR by @taliesin-ai
• include the task directory in cache identity in PR by @taliesin-ai
• probe ports once per check in PR by @taliesin-ai
• avoid a panic when cache entries decode as null in PR by @taliesin-ai
• increment numeric prereleases without integer limits in PR by @taliesin-ai
• prevent legacy checks from hiding cache misses in PR by @taliesin-ai
• run default tasks in the executor base directory in PR by @taliesin-ai
• preserve literal percent signs in explorer commands in PR by @taliesin-ai
• align precondition and task command directories in PR by @taliesin-ai
• replace symlinks with generated regular files in PR by @taliesin-ai
• preserve existing DMGs when builds fail in PR by @taliesin-ai
• preserve quoted regex and path backslashes in PR by @taliesin-ai
• validate generated icon sizes before image allocation in PR by @taliesin-ai
• route command chains and redirections through the shell in PR by @taliesin-ai
• preserve previous Linux packages on build failure in PR by @taliesin-ai
• use platform-specific shell fallback execution in PR by @taliesin-ai
• serve assets with repeated leading path slashes in PR by @taliesin-ai
• recognize stable versions with build metadata in PR by @taliesin-ai
• report resource-generation failures accurately in PR by @taliesin-ai
• prevent races when replacing the active reporter in PR by @taliesin-ai
• serialize concurrent cache-file saves in PR by @taliesin-ai
• support multiple template equality candidates in PR by @taliesin-ai
• normalize null saved category maps in PR by @taliesin-ai
• show diagnostics from failed variable shell commands in PR by @taliesin-ai
• keep shell chains out of the implicit Go cache in PR by @taliesin-ai
• serialize Linux category persistence in PR by @taliesin-ai
• cache Go outputs with quoted or escaped spaces in PR by @taliesin-ai
• preserve Mac icons when encoding fails in PR by @taliesin-ai
• stop discarding invalid Go test count flags in PR by @taliesin-ai
• retain source permissions for new file copies in PR by @taliesin-ai
• Fix assorted v3 nightly build issues and clean up dependencies in PR by @taliesin-ai
• repair v3 release validation and fixture classification in PR by @taliesin-ai
• resolve cross-platform release validation failures in PR by @taliesin-ai

🗓️ This is a weekly release. Minor version numbers advance with time, not with features: a new minor is not a feature milestone. Nightly previews are published between weekly releases as -nightly pre-releases.

Installation:

go install github.com/wailsapp/wails/v3/cmd/wails3@v3.1.0

Tip: always pin an exact version (e.g. @v3.1.0) in go.mod and CI rather than @latest.

go install github.com/wailsapp/wails/v2/cmd/wails@v2.17.1

• Linux: child frames (iframes) embedded in the application window can no longer post to the privileged window.webkit.messageHandlers.external IPC bridge. WebKitGTK does not tell the native message handler which frame sent a message, so the bridge could be reached from cross-origin or sandboxed frames and the OriginValidator check ran against the top-level page rather than the calling frame. A guard script is now injected into every frame at document start and neutralises the bridge in non-top frames. Same-origin child frames still share their parent's origin and retain access to its bridge, so applications that embed untrusted same-origin content should not rely on this boundary. Affects Linux builds of v2.17.0 and earlier. Tracked as GHSA-r5j2-ghh9-2jqw

• test(v2/linux): verify native frame loading and document origin boundary (0d660b45a)
• fix(v2/linux): prevent child frames entering privileged IPC (99fd52407)
• chore(v2): update labstack/echo to 4.16.1 and goldmark to 1.7.17 (#6343) (1bb8882b3)