We are pleased to announce the release of version 2.11.1. Featured are a handful of new areas of functionality and numerous bug fixes.

A summary of changes is available in the Release Notes. A full list of changes is available in the changelog.

The most notable changes in this release are:

• Upgraded requirement: Go language version is Go 1.26.0 or later, due to upgrading dependency package golang.org/x/crypto

• Fixed a panic when getting a cell value with a negative shared string index (CVE-2026-104819), related security advisory GHSA-48hm-4h8j-58fg
• Fixed a GetPivotTables panic on invalid pivot table field indices (CVE-2026-107211), related security advisory GHSA-mx22-3794-2vpv
• Fixed an unbounded row number in the rows iterator (CVE-2026-107212), related security advisory GHSA-jw42-f3rr-4cc3
• Fixed a GetSlicers panic when getting slicers from a worksheet without a drawing part (CVE-2026-107213), related security advisory GHSA-r7x5-4969-99p7
• Fixed a panic when decrypting a malformed workbook (CVE-2026-107214), related security advisory GHSA-2j4c-ffch-9f23
• Fixed unbounded EncryptionInfo and EncryptedPackage stream sizes being allocated when decrypting a workbook (CVE-2026-107215), related security advisory GHSA-x2q3-8cjh-766f
• Fixed a CalcCellValue stack overflow caused by circular ANCHORARRAY formula references (CVE-2026-107216), related security advisory GHSA-wp2g-vpjj-g53r
• Fixed ColumnNameToNumber and JoinCellName accepting invalid column names, which caused integer overflow (CVE-2026-107217), related security advisory GHSA-c85p-xxjj-2r75
• Fixed Unicode handling and count overflow in the LEFT, LEFTB, RIGHT, and RIGHTB formula functions (CVE-2026-107218), related security advisory GHSA-8jjq-8j9w-m2v6
• Fixed an unbounded spin count when deriving the agile decryption key (CVE-2026-107219), related security advisory GHSA-jrfj-fhj2-jjvm
• Fixed a panic on a worksheet with an empty merged cell reference (CVE-2026-107220), related security advisory GHSA-g27h-8qhm-6pff
• Fixed a panic on a row whose cells are not in ascending column order (CVE-2026-107221), related security advisory GHSA-8mcq-6wmr-jrjv
• Fixed a GetConditionalFormats panic on malformed conditional formatting rules (CVE-2026-107222), related security advisory GHSA-rxcj-4pj5-74gr
• Fixed an overflow of the minimum and maximum column numbers (CVE-2026-107223), related security advisory GHSA-fq3v-74gv-27gm
• Fixed a panic by rejecting Zip64 uncompressed sizes that do not fit in a signed int64 (CVE-2026-107224), related security advisory GHSA-fw94-4wwp-w8pw
• Fixed a panic when getting styles with a negative style index (CVE-2026-107225), related security advisory GHSA-5h23-36rv-pm65

• Added new EmbeddedObject data type
• Added 2 new constants, MaxCFBStreamSizeV3 and MaxCFBStreamSizeV4
• Added new function GetShapes to support get shape, related issue #436
• Added new functions GetEmbeddedObjects and SetGetEmbeddedObject to support get and set embedded objects, related issues #158 and #2186
• The CalcCellValue function now supports matrix arguments in the AND formula function
• The SetConditionalFormat function now validates the style index, related issue #2400

• Aligned the numeric precision of values stored by the SetCellValue function with Microsoft Excel™, related issue #1757

• Fixed the GetPictures function not returning the edit positioning in some cases, resolved issue #2217
• Fixed the CalcCellValue function returning incorrect results when error values appear inside parentheses or operators, resolved issues #1164 and #2344
• Fixed the CalcCellValue function not returning the expected error in some cases, resolved issues #2349 and #2432
• Fixed the CalcCellValue function returning incorrect results for 16 formula functions: COUNT, COUNTA, EDATE, HLOOKUP, IF, INDIRECT, ISNUMBER, MDETERM, MINVERSE, OR, SUM, TRIM, VALUE, VLOOKUP, WEEKDAY and XLOOKUP, resolved issues #2411, #2412, #2413, #2414, #2415, #2416, #2417, #2430, #2436, #2439, and #2445
• Fixed a CalcCellValue panic on unbalanced closing parentheses in a formula, resolved issue #2409
• Fixed a CalcCellValue panic when calculating the AVERAGEIFS, COUNTIFS, MAXIFS, MINIFS, PERCENTILE.EXC and SUMIFS formula functions with invalid arguments, resolved issue #2426
• Fixed the AddChart and AddChartSheet functions generating invalid charts that corrupted the workbook in some cases, resolved issues #2355 and #2356
• Fixed stream writer not applying number formatting to duration cell values, resolved issue #2371
• Fixed precision loss when setting cell values with time.Duration, resolved issue #2372
• Fixed the AddSlicer function reusing the pivot table slicer cache for different fields, resolved issue #2383
• Fixed the GetStyle function returning an invalid style for fills without a pattern, resolved issue #2384
• Fixed the GetFormControls and GetTables functions being unable to get form controls and tables when the workbook uses absolute paths, resolved issue #2386
• Fixed the GetPanes function being unable to get split panes in some cases, resolved issue #2387
• Fixed the SetCalcProps function being unable to set calculation properties to false, resolved issue #2404
• Fixed the ExcelDateToTime function returns dates one day early for January and February 1900, resolved issue #2466

• Updated dependencies
• Updated unit tests and godoc
• Updated the documentation website, which is available in 12 languages: Arabic, German, English, Spanish, French, Italian, Japanese, Korean, Portuguese, Russian, Simplified Chinese and Traditional Chinese
• Released an updated excelize-wasm NPM package for WebAssembly / JavaScript support
• Released an updated excelize-py PyPI package for Python
• Released an updated ExcelizeCs NuGet package for C# / .NET

Thanks to all the contributors to Excelize. Below is a list of contributors who made code contributions in this version:

• @Aprax14 (Damiano Scarpellini)
• @xixixi1118
• @zhouxuanyu1204-bot (ZHOU XUANYU)
• @lzoeydzdnn
• @arpitjain099 (Arpit Jain)
• @n0liu (Roland)
• @1436761858 (LP-LDY)
• @yashisrani (Yash Israni)
• @alliasgher (Ali Asghar)
• @ensiouel
• @a3190778733-pixel (shixia)
• @Nayjest (Vitalii Stepanenko)
• @ValeryVerkhoturov (Valery)
• @freeeve (Eve Freeman)
• @saifulferoz (Feroz)
• @lmonstergg
• @pcvelz (Peter van Velzen)
• @askalf (Thomas Sprayberry)
• @zac-scheiwe (Zac Scheiwe)
• @lrweck (Luis)
• @akashchamp
• @PhilflowIO (Philipp Lütje)
• @White0xdi3 (Jnyandeep Koyya)
• @keithadler (Keith Adler)
• @EpicHigh (Prasit Tongpradit)
• @wangyica879112 (ChangAo)
• @yl030628 (YL)
• @prostomarkeloff (prostomarkeloff)
• @Gabik21
• @Alifarid0011 (AliFarid)

Fix a panic, close of closed channel, in the handling of DOM.documentUpdated. When DOM.getDocument failed, for example because the tab was closing, the frame kept its old root node, and the next DOM.documentUpdated event closed the channel of that root again. The frame now clears the root first. Thanks to Dhruv Jain (#1644). The module also requires cdproto v0.159.0 now.

Nightly preview of the upcoming v3.2.0.

• add experimental CGO-free macOS and Linux backends in PR by @taliesin-ai
• native YAML builds, portable packaging and signing in PR by @taliesin-ai

• Fix assorted v3 nightly build issues and clean up dependencies in PR by @taliesin-ai
• repair v3 release validation and fixture classification in PR by @taliesin-ai
• resolve cross-platform release validation failures in PR by @taliesin-ai

🤖 This is an automated nightly pre-release generated from the latest changes on master. It is not selected by @latest; install it by its exact tag.

Installation:

go install github.com/wailsapp/wails/v3/cmd/wails3@v3.2.0-nightly.20261101

Tip: always pin an exact version (e.g. @v3.2.0-nightly.20261101) in go.mod and CI rather than @latest.

• add experimental CGO-free macOS and Linux backends in PR by @taliesin-ai
• native YAML builds, portable packaging and signing in PR by @taliesin-ai

• avoid copying discarded desktop metadata in PR by @taliesin-ai
• format content lengths without fmt in PR by @taliesin-ai
• select index roots without collecting candidates in PR by @taliesin-ai
• reuse non-seekable file copy buffers in PR by @taliesin-ai
• avoid allocating a reader for sniffing prefixes in PR by @taliesin-ai
• skip MIME sniff reads for known extensions in PR by @taliesin-ai
• prevent queue growth and shrink oscillation in PR by @taliesin-ai
• avoid allocating discarded request contexts in PR by @taliesin-ai
• skip disabled debug log preparation in PR by @taliesin-ai
• allocate MIME sniff buffers lazily in PR by @taliesin-ai
• reduce hyperlink formatting allocations in PR by @taliesin-ai
• remove temporary bullet formatting allocations in PR by @taliesin-ai
• reduce UUID string conversion to one allocation in PR by @taliesin-ai
• reduce statement-handle formatting allocations in PR by @taliesin-ai
• eliminate temporary name-based UUID digest allocation in PR by @taliesin-ai
• avoid copying unfinished command-output lines in PR by @taliesin-ai
• stream executable copies during package staging in PR by @taliesin-ai
• avoid rescanning unfinished output lines in PR by @taliesin-ai
• reuse compiled command routing patterns in PR by @taliesin-ai
• avoid metadata lookups during runtime discovery in PR by @taliesin-ai
• reduce localized fallback page allocations in PR by @taliesin-ai
• avoid recompiling patterns for each processor in PR by @taliesin-ai

• implement SetTooltip for the system tray in PR by @fan711
• read dark mode from the settings portal in PR by @TechHutTV
• let Window.SetZoom go below 1.0 in PR by @APshenkin
• deliver to each Go listener in emit order in PR by @DevLumuz
• read event hooks under hookLock in Emit in PR by @DevLumuz
• always advertise the tray Menu property so a tray created after Run is not dropped in PR by @AlbinoGeek
• hold main-thread work sent before Run until Run starts in PR by @AlbinoGeek
• use correct asset url in github updater provider in PR by @gavidroselj
• keep request body when WebView2 omits Content-Length in PR by @strraaa
• report macOS and GTK screens in DIP space (mixed-DPI bounds) in PR by @julianstorer
• don't report a dismissed notification as a click in PR by @bercedev
• stop dev processes when the terminal closes in PR by @xmasdev
• map changelog runs to squash-merge commits in the evidence check in PR by @taliesin-ai
• hold the taskbar-restart debounce for a second in PR by @taliesin-ai
• keep size constraints through a fullscreen that starts there in PR by @taliesin-ai
• do not resize a fullscreen or maximised window to fit a new constraint in PR by @taliesin-ai
• do not raise a dialog before Run in the liquid-glass example in PR by @taliesin-ai
• a dialog asked for before Run does nothing instead of waiting forever in PR by @taliesin-ai
• fall back when desktop entry has no command in PR by @taliesin-ai
• sniff current content without retaining filenames in PR by @taliesin-ai
• recognize mixed-case asset extensions in PR by @taliesin-ai
• release consumed content-sniffer buffers in PR by @taliesin-ai
• release removed ringqueue references in PR by @taliesin-ai
• honor header deletions before fallback selection in PR by @taliesin-ai
• commit fallback response headers before flush in PR by @taliesin-ai
• discover only exact index files in PR by @taliesin-ai
• avoid bodies and full reads for non-seekable HEAD in PR by @taliesin-ai
• fill MIME sniffing prefix across short reads in PR by @taliesin-ai
• commit successful empty non-seekable responses in PR by @taliesin-ai
• avoid duplicating expanded URI targets in PR by @taliesin-ai
• preserve paths during field expansion in PR by @taliesin-ai
• respect XDG desktop-file search directories in PR by @taliesin-ai
• commit sniffer headers on empty flush in PR by @taliesin-ai
• skip directories shadowing desktop entries in PR by @taliesin-ai
• preserve targets found inside executable paths in PR by @taliesin-ai
• release callback captures after timer fires in PR by @taliesin-ai
• avoid false ldconfig library matches in PR by @taliesin-ai
• constrain filesystem library fallback matches in PR by @taliesin-ai
• remove cache invalidation data race in PR by @taliesin-ai
• honor the optional logger configuration in PR by @taliesin-ai
• avoid shared start URL mutation and stale ports in PR by @taliesin-ai
• stop dev proxy retries on request cancellation in PR by @taliesin-ai
• return 404 for missing bundled assets in PR by @taliesin-ai
• handle bundled runtime HEAD requests in PR by @taliesin-ai
• preserve escaped paths when routing services in PR by @taliesin-ai
• order oversized numeric prerelease identifiers correctly in PR by @taliesin-ai
• reject HTTP errors before saving tooling downloads in PR by @taliesin-ai
• honor the launch deadline during desktop discovery in PR by @taliesin-ai
• preserve request bodies across development proxy retries in PR by @taliesin-ai
• close HTTP response bodies on every return path in PR by @taliesin-ai
• preserve cancellation errors in parallel library searches in PR by @taliesin-ai
• reject failed GitHub tag responses before decoding in PR by @taliesin-ai
• preserve literal bracketed template paths in PR by @taliesin-ai
• install wails3 once and preserve installer errors in PR by @taliesin-ai
• ignore hidden entries and headers in comment blocks in PR by @taliesin-ai
• surface stable release lookup errors in PR by @taliesin-ai
• print plain messages without format interpretation in PR by @taliesin-ai
• avoid write panics after loading JSON null in PR by @taliesin-ai
• return snapshots for whole-store reads in PR by @taliesin-ai
• propagate errors after partial row iteration in PR by @taliesin-ai
• keep extraction destination paths literal in PR by @taliesin-ai
• release prepared-statement handles on close and reopen in PR by @taliesin-ai
• handle preparation racing with close or reopen in PR by @taliesin-ai
• honor HEAD requests for the fallback index page in PR by @taliesin-ai
• require complete hexadecimal statement handles in PR by @taliesin-ai
• preserve the default in-memory database under concurrency in PR by @taliesin-ai
• separate stderr from parsed HEAD output in PR by @taliesin-ai
• generate runtime assets from embedded bundles in PR by @taliesin-ai
• detect TODO, FIXME and TBD placeholders in PR by @taliesin-ai
• validate release notes API responses in PR by @taliesin-ai
• respect task directories in status checks in PR by @taliesin-ai
• prevent same-file copy data loss in PR by @taliesin-ai
• include the task directory in cache identity in PR by @taliesin-ai
• probe ports once per check in PR by @taliesin-ai
• avoid a panic when cache entries decode as null in PR by @taliesin-ai
• increment numeric prereleases without integer limits in PR by @taliesin-ai
• prevent legacy checks from hiding cache misses in PR by @taliesin-ai
• run default tasks in the executor base directory in PR by @taliesin-ai
• preserve literal percent signs in explorer commands in PR by @taliesin-ai
• align precondition and task command directories in PR by @taliesin-ai
• replace symlinks with generated regular files in PR by @taliesin-ai
• preserve existing DMGs when builds fail in PR by @taliesin-ai
• preserve quoted regex and path backslashes in PR by @taliesin-ai
• validate generated icon sizes before image allocation in PR by @taliesin-ai
• route command chains and redirections through the shell in PR by @taliesin-ai
• preserve previous Linux packages on build failure in PR by @taliesin-ai
• use platform-specific shell fallback execution in PR by @taliesin-ai
• serve assets with repeated leading path slashes in PR by @taliesin-ai
• recognize stable versions with build metadata in PR by @taliesin-ai
• report resource-generation failures accurately in PR by @taliesin-ai
• prevent races when replacing the active reporter in PR by @taliesin-ai
• serialize concurrent cache-file saves in PR by @taliesin-ai
• support multiple template equality candidates in PR by @taliesin-ai
• normalize null saved category maps in PR by @taliesin-ai
• show diagnostics from failed variable shell commands in PR by @taliesin-ai
• keep shell chains out of the implicit Go cache in PR by @taliesin-ai
• serialize Linux category persistence in PR by @taliesin-ai
• cache Go outputs with quoted or escaped spaces in PR by @taliesin-ai
• preserve Mac icons when encoding fails in PR by @taliesin-ai
• stop discarding invalid Go test count flags in PR by @taliesin-ai
• retain source permissions for new file copies in PR by @taliesin-ai
• Fix assorted v3 nightly build issues and clean up dependencies in PR by @taliesin-ai
• repair v3 release validation and fixture classification in PR by @taliesin-ai
• resolve cross-platform release validation failures in PR by @taliesin-ai

🗓️ This is a weekly release. Minor version numbers advance with time, not with features: a new minor is not a feature milestone. Nightly previews are published between weekly releases as -nightly pre-releases.

Installation:

go install github.com/wailsapp/wails/v3/cmd/wails3@v3.1.0

Tip: always pin an exact version (e.g. @v3.1.0) in go.mod and CI rather than @latest.

go install github.com/wailsapp/wails/v2/cmd/wails@v2.17.1

• Linux: child frames (iframes) embedded in the application window can no longer post to the privileged window.webkit.messageHandlers.external IPC bridge. WebKitGTK does not tell the native message handler which frame sent a message, so the bridge could be reached from cross-origin or sandboxed frames and the OriginValidator check ran against the top-level page rather than the calling frame. A guard script is now injected into every frame at document start and neutralises the bridge in non-top frames. Same-origin child frames still share their parent's origin and retain access to its bridge, so applications that embed untrusted same-origin content should not rely on this boundary. Affects Linux builds of v2.17.0 and earlier. Tracked as GHSA-r5j2-ghh9-2jqw

• test(v2/linux): verify native frame loading and document origin boundary (0d660b45a)
• fix(v2/linux): prevent child frames entering privileged IPC (99fd52407)
• chore(v2): update labstack/echo to 4.16.1 and goldmark to 1.7.17 (#6343) (1bb8882b3)

• 8e0c105e5842d8b6035feba23da204cc4d4e30ea: ci(lint): adopt golangci-lint v2.14.0 tooling and strict lint config (#314) (@appleboy)
• 5f59538c2b1037acd17080c2a23c62fb2b4c5c88: build: upgrade Go and resolve security findings (#316) (@appleboy)

The proxy now retains its derived X-Real-IP header when an incoming request includes Connection: X-Real-IP, including mixed-case and duplicate Connection values. The value is restored after Go removes hop-by-hop headers, before the upstream transport runs.

The same captured identity is preserved across retries and balancer request replacement, and the protection applies to WebSocket upgrades. Default and custom transports and extractors remain supported.

Released v5.4.3 can omit the identity header for those requests. Identity spoofing additionally depends on an upstream that falls back to an untrusted source when the header is absent. This release does not change v5’s direct-peer default or the affected ranges of the earlier default-IP CVEs.

No new client-IP migration is required for v5. Applications behind proxies should continue using an extractor that trusts their own proxies. No public API, dependency, or minimum Go-version changes.

The implementation passed fresh independent Claude review, full race tests on Go 1.25 and 1.27, vet, staticcheck, golint, and govulncheck. Permanent tests cover HTTP/default/custom transports, raw WebSocket negotiation, duplicate/mixed-case header nominations, and a stateful extractor across request-swapping retries.

Implementation: #3200. This ports the additional proxy identity protection released in v4.16.3.

Full Changelog: https://github.com/labstack/echo/compare/v5.4.3...v5.4.4

Applications behind proxies must configure Echo#IPExtractor to trust their own proxies before upgrading. Without an extractor, clients behind one proxy share its address for rate limiting, IP-based access controls, logging, and proxy forwarding. The safe default now ignores client-supplied IP headers.

This release fixes the remaining v4 exposure for:

• CVE-2026-118651: Proxy always derives upstream X-Real-IP from Context.RealIP(), including after hop-by-hop header stripping and on WebSocket upgrades. One derived identity is preserved across retries.
• CVE-2026-118653: Context.RealIP() uses the connection peer when IPExtractor is unset, so rotating spoofed forwarded-IP headers cannot create fresh default rate-limit buckets.

Use echo.ExtractIPDirect() without a proxy. Behind a proxy, use ExtractIPFromXFFHeader or ExtractIPFromRealIPHeader with trust restricted to your proxies. Configure the outermost proxy to replace client-supplied identity headers. Explicit extractors and custom rate-limit identifiers retain their behavior.

Migration example with explicit proxy trust ranges

• Resolve bare IPv4 and IPv6 connection addresses without a port.
• Document v4 support dates (#3194).

No dependency or minimum Go-version changes; Go 1.26 or later remains required.

The security fix (#3197) passed independent agent and Claude reviews, full race tests on Go 1.26 and 1.27, and GitHub Linux/macOS/Windows checks.

Full Changelog: https://github.com/labstack/echo/compare/v4.16.2...v4.16.3

Upgrade to v5.4.3 to fix a static route-guard bypass involving encoded empty path segments in non-default path-matching or unescaping configurations. The confirmed impact is access to protected files inside a static root. The fix validates raw and decoded request paths and wildcard boundaries, including singly and doubly encoded leading slashes and guarded directory indexes.

Advisory: https://github.com/labstack/echo/security/advisories/GHSA-v97q-3xf5-rj74

• Decode path parameters only once when UnescapePathParamValues is enabled, preserving literal percent-containing values.
• Correct UseEscapedPathForMatching documentation without changing its behavior.
• Preserve correctly escaped filenames and static prefixes such as /assets*.

Thanks to MyWorld319 for the static bypass report and alexreid for the parameter-decoding report.

• Publish v4 support dates and the Echo Support offer (#3193).
• Mention Echo Pro in the Sponsors section (#3192).

Full Changelog: https://github.com/labstack/echo/compare/v5.4.2...v5.4.3

Nightly preview of the upcoming v3.1.0.

• Improve changelog generation speed by reusing compiled regex patterns in PR by @taliesin-ai
• Reduce allocations when serving localized fallback pages in PR by @taliesin-ai
• Speed up AppImage runtime discovery by avoiding unnecessary metadata lookups in PR by @taliesin-ai
• Reuse compiled command routing patterns to improve wake performance in PR by @taliesin-ai
• Improve performance by avoiding rescanning of unfinished output lines in PR by @taliesin-ai
• Stream executable copies during MSIX package staging to reduce memory use and speed up builds in PR by @taliesin-ai
• Avoid copying unfinished command-output lines to improve performance in PR by @taliesin-ai
• Reduce allocations when generating name-based UUIDs in PR by @taliesin-ai
• Reduce allocations when formatting SQLite statement handles in PR by @taliesin-ai
• Reduce UUID string conversion to a single allocation in PR by @taliesin-ai
• Reduce allocations when formatting changelog bullet entries in PR by @taliesin-ai
• Reduce allocations when formatting terminal hyperlinks in PR by @taliesin-ai
• Reduce allocations when serving assets by sniffing MIME buffers lazily in PR by @taliesin-ai
• Skip debug log preparation in the asset server when debug logging is disabled in PR by @taliesin-ai
• Reduce allocations in webview request handling by avoiding discarded request contexts in PR by @taliesin-ai
• Speed up asset serving by skipping MIME sniffing for known file extensions in PR by @taliesin-ai
• Reduce allocations when serving assets by avoiding a reader for content sniffing in PR by @taliesin-ai
• Reduce allocations when serving non-seekable asset files in PR by @taliesin-ai
• Speed up asset server index root selection by avoiding candidate collection in PR by @taliesin-ai
• Improve asset server performance by formatting content lengths without fmt in PR by @taliesin-ai
• Reduce memory copying when reading desktop file explorer metadata in PR by @taliesin-ai

• Retain source file permissions when copying to new destination files in PR by @taliesin-ai
• Keep fullscreen and maximised windows from resizing when min or max size constraints change in PR by @taliesin-ai
• Publish scheduled star history updates for the wailsapp/wails repository in PR by @taliesin-ai
• Stop discarding invalid Go test count flags in wake in PR by @taliesin-ai
• Preserve Mac icons when encoding fails in PR by @taliesin-ai
• Fix build cache misses for Go outputs with quoted or escaped spaces in PR by @taliesin-ai
• Serialize notification category persistence on Linux to prevent concurrent write races in PR by @taliesin-ai
• Keep shell command chains out of the implicit Go build cache in PR by @taliesin-ai
• Fix notification category maps failing to load when saved data is null in PR by @taliesin-ai
• Show diagnostics from failed variable shell commands in PR by @taliesin-ai
• Fix wake template matching when multiple equality candidates exist in PR by @taliesin-ai
• Serialize concurrent cache-file saves to prevent corrupted cache writes in PR by @taliesin-ai
• Prevent races when replacing the active reporter in PR by @taliesin-ai
• Report resource-generation failures accurately in the CLI in PR by @taliesin-ai
• Recognize stable versions that include build metadata in the CLI in PR by @taliesin-ai
• Serve assets whose request paths contain repeated leading slashes in PR by @taliesin-ai
• Fix shell fallback execution for wake on each platform in PR by @taliesin-ai
• Preserve previous Linux packages when a build fails in PR by @taliesin-ai
• Route command chains and redirections through the shell in PR by @taliesin-ai
• Preserve quoted regex and path backslashes in wake command parsing in PR by @taliesin-ai
• Preserve existing DMG files when packaging builds fail in PR by @taliesin-ai
• Replace symlinks with generated regular files in bindings output in PR by @taliesin-ai
• Preserve literal percent signs in Linux explorer commands in PR by @taliesin-ai
• Align precondition and task command directories so they resolve consistently in PR by @taliesin-ai
• Run default tasks in the executor base directory in PR by @taliesin-ai
• Prevent legacy checks from hiding cache misses in PR by @taliesin-ai
• Fix CLI prerelease numbering to increment without integer overflow limits in PR by @taliesin-ai
• Avoid a panic when cache entries decode as null in PR by @taliesin-ai
• Probe ports once per check in the CLI in PR by @taliesin-ai
• Include the task directory in cache identity to avoid stale wake results in PR by @taliesin-ai
• Prevent data loss when packaging copies a file onto itself in PR by @taliesin-ai
• Make status checks respect task directories in PR by @taliesin-ai
• Detect TODO, FIXME and TBD placeholders in changelog entries in PR by @taliesin-ai
• Generate runtime assets from embedded bundles in the CLI in PR by @taliesin-ai
• Separate stderr from parsed HEAD output in git commands in PR by @taliesin-ai
• Preserve the default in-memory SQLite database under concurrent access in PR by @taliesin-ai
• Return correct responses to HEAD requests for the fallback index page in PR by @taliesin-ai
• Handle SQLite statement preparation racing with database close or reopen in PR by @taliesin-ai
• Release prepared-statement handles when SQLite database is closed or reopened in PR by @taliesin-ai
• Keep extraction destination paths literal when using gosod in PR by @taliesin-ai
• Propagate errors from SQLite queries after partial row iteration in PR by @taliesin-ai
• Return snapshots for whole-store reads in kvstore in PR by @taliesin-ai
• Prevent write panics in kvstore after loading a JSON null value in PR by @taliesin-ai
• Print plain terminal messages without interpreting format verbs in PR by @taliesin-ai
• Surface errors when looking up the latest stable release in the updater in PR by @taliesin-ai
• Ignore hidden entries and headers in changelog comment blocks in PR by @taliesin-ai
• Install wails3 once and surface installer errors in the updater in PR by @taliesin-ai
• Preserve literal bracketed template paths in gosod in PR by @taliesin-ai
• Reject failed GitHub tag responses before decoding them in the updater in PR by @taliesin-ai
• Preserve cancellation errors during parallel library searches in PR by @taliesin-ai
• Close HTTP response bodies on every return path to prevent resource leaks in PR by @taliesin-ai
• Preserve request bodies when the development proxy retries requests in PR by @taliesin-ai
• Honor the launch deadline during desktop file explorer discovery in PR by @taliesin-ai
• Reject HTTP errors before saving AppImage tooling downloads in PR by @taliesin-ai
• Order oversized numeric prerelease identifiers correctly in semver comparisons in PR by @taliesin-ai
• Preserve escaped paths when routing services in the asset server in PR by @taliesin-ai
• Handle HEAD requests for the bundled runtime in the asset server in PR by @taliesin-ai
• Return 404 for missing bundled assets instead of an incorrect response in PR by @taliesin-ai
• Stop dev proxy retries when a request is cancelled in PR by @taliesin-ai
• Avoid shared start URL mutation and stale ports in the asset server in PR by @taliesin-ai
• Honor the optional logger configuration in the asset server in PR by @taliesin-ai
• Remove data race in library path cache invalidation in PR by @taliesin-ai
• Avoid false library matches when searching ldconfig output in PR by @taliesin-ai
• Prevent asset server queue growth and shrink oscillation under load in PR by @taliesin-ai
• Release callback captures after the debounce timer fires to avoid retaining stale references in PR by @taliesin-ai
• Preserve file explorer targets found inside executable paths in PR by @taliesin-ai
• Skip directories that shadow desktop entries in file explorer in PR by @taliesin-ai
• Fix asset server headers not being sent when a response body is empty in PR by @taliesin-ai
• Respect XDG desktop-file search directories when locating application icons in PR by @taliesin-ai
• Preserve file paths during field expansion in the file explorer in PR by @taliesin-ai
• Avoid duplicating expanded URI targets in file explorer in PR by @taliesin-ai
• Commit successful empty non-seekable asset responses instead of leaving them pending in PR by @taliesin-ai
• Fill MIME sniffing prefix correctly across short reads in the asset server in PR by @taliesin-ai
• Avoid reading full response bodies for non-seekable HEAD requests in the asset server in PR by @taliesin-ai
• Only serve exact index files when resolving directory requests in the asset server in PR by @taliesin-ai
• Fix dismissed Linux notifications being reported as clicks on servers without action support in PR by @bercedev
• Stop dev processes when the terminal closes in PR by @xmasdev
• Hold Windows taskbar restart debounce for one second before clearing the flag in PR by @taliesin-ai
• Fix fallback response headers being lost in the asset server in PR by @taliesin-ai
• Honor header deletions before fallback selection in the asset server in PR by @taliesin-ai
• Release removed ring queue references in the asset server to avoid memory leaks in PR by @taliesin-ai
• Release consumed content-sniffer buffers in the asset server to reduce memory use in PR by @taliesin-ai
• Recognize mixed-case asset file extensions when serving assets in PR by @taliesin-ai
• Correctly detect content type in asset server without retaining filenames in PR by @taliesin-ai
• Fall back to a default when a desktop entry has no command in PR by @taliesin-ai
• Stop the liquid-glass example from showing a dialog before the app starts on non-macOS in PR by @taliesin-ai
• Keep window size constraints when fullscreen starts from a constrained size on Windows in PR by @taliesin-ai
• Fix dialogs called before Run blocking forever instead of returning in PR by @taliesin-ai

• Validate generated icon sizes before image allocation to prevent excessive memory use in PR by @taliesin-ai
• Validate release notes API responses before use in PR by @taliesin-ai
• Require complete hexadecimal statement handles in SQLite plugin in PR by @taliesin-ai
• Constrain filesystem library fallback matches to prevent loading unintended libraries in PR by @taliesin-ai

🤖 This is an automated nightly pre-release generated from the latest changes on master. It is not selected by @latest; install it by its exact tag.

Installation:

go install github.com/wailsapp/wails/v3/cmd/wails3@v3.1.0-nightly.20261028

Tip: always pin an exact version (e.g. @v3.1.0-nightly.20261028) in go.mod and CI rather than @latest.