• Prevent the etcd registry watcher from panicking when a DELETE event does not include PrevKv (#5040, #5041).

• stats: Expose the effective client authority (sent on the wire as the HTTP/2 :authority header) in client stats.OutHeader events. (#9296)
  • Special Thanks: @aryansk
• metadata: Add ValueFromOutgoingContext, which reads a single metadata value from outgoing context without copying the entire outgoing metadata into a new map. (#9282)
  • Special Thanks: @yuyangguo42

• transport: Refine control buffer throttling to only count peer-induced control frames, raise the default GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT from 100 to 10,000, and close client connections if reads remain throttled for 10s. (#9563)
• server: Ensure Stop() forcefully terminates the server while GracefulStop() is waiting for active handlers to complete. (#9394)
  • Special Thanks: @stanhu
• server: Unconditionally increment the highest-seen stream ID on when handling HEADERS frames to comply with RFC 7540 §5.1.1. Previously, truncated HEADERS frames left the connection in an inconsistent state and allowed stream IDs to be reused by clients without resulting in a protocol error. (#9414)
• server: Terminate streams immediately when a HEADERS frame includes the EndStream bit. Previously, this caused server handlers to hang when reading a message. (#9391)
• server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (#9365)
• xds: Fix a bug where route header matchers with non-lowercase names failed to match routes. (#9353)
  • Special Thanks: @winklemad
• client: Ensure retried RPCs use the correct :authority value specified by the LB policy instead of inheriting it from a previous attempt. (#9277)
  • Special Thanks: @nvxbug
• transport: Fail streams with io.ErrUnexpectedEOF instead of io.EOF upon receiving truncated message headers or bodies after partial data has already been received. (#9204)
  • Special Thanks: @buger

Wails v3 is here. Build desktop and mobile applications with Go and the web frontend you already know, using each platform's native WebView instead of a bundled browser.

v3 is a ground-up rework of Wails. Applications, windows, services, events and platform features are now explicit objects you create and talk to directly, so multiple windows, system trays and background services are a normal part of the model rather than workarounds. It has been nearly four years since the first v3 alpha in January 2023. Thank you to everyone who tested, reported, translated, reviewed and contributed along the way.

📣 Read the announcement: Wails v3.0.0 Released 📚 Documentation: wails.io · Migrating from v2: v2 to v3 guide

go install github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0
wails3 setup    # guided setup: checks your system and installs what Wails needs
wails3 init     # create a new project

Wails v3 requires Go 1.26 or newer. We recommend Go 1.26.10 or 1.27.3 (or later), which include a crypto/x509 security fix. Run wails3 doctor at any time to check your setup.

• Multiple windows. Create, show, hide and close any number of windows at runtime, each with its own options, events and lifecycle.
• Services. Your backend is ordinary Go: register services with the application and their exported methods become callable from the frontend. Services can have startup and shutdown hooks and can serve HTTP routes.
• Manager APIs. Windows, menus, dialogs, events, screens, the clipboard and more are reached through clear manager objects on the application, instead of a single context-bound runtime package.
• Events. Application, window and custom events, with typed payloads, available from both Go and JavaScript, plus platform system events.

• Generated with static analysis. wails3 generate bindings reads your Go source, so doc comments and real parameter names carry through to the generated TypeScript or JavaScript.
• Models and enums. Go structs become TypeScript classes or interfaces, and Go enums become TypeScript enums.
• Streams and raw messages. Stream data between Go and the frontend, or use raw messages and custom transports when you need full control.

• System tray. Tray icons with menus, light and dark icons, macOS template icons, and the option to attach a window to the tray icon.
• Menus. Application menus, context menus (including from HTML with WML attributes) and tray menus, all updatable at runtime.
• Dialogs. Native message, question, file open and save dialogs, plus custom dialogs.
• Frameless and custom windows. Frameless windows with native corners and shadows, custom title bars, drag regions and translucency, including native Liquid Glass on macOS 26 with a fallback on earlier versions.
• Notifications. Native desktop notifications with actions.
• Keyboard shortcuts. Window and application key bindings and global shortcuts; on macOS, letter accelerators follow the labelled key on AZERTY, QWERTZ, Dvorak and other layouts.
• And more:
  • clipboard;
  • file drag and drop, plus HTML drag and drop;
  • screen and environment information;
  • dock badges on macOS;
  • start at login;
  • opening URLs and files in the default browser;
  • notch windows on macOS;
  • a per-window permissions map for the camera, microphone, geolocation and notifications.

• Windows (amd64 and arm64), macOS (Intel and Apple Silicon) and Linux (amd64 and arm64).
• Linux uses GTK4 and WebKitGTK 6.0 by default. The legacy GTK3 stack is still available with -tags gtk3 until v3.1.
• iOS and Android (experimental). The same main.go and frontend can run on mobile. Try it and tell us what you find; it isn't yet covered by the stability promise.
• Server builds. Run the same application and services as an HTTP server, with no native window.

• A build system you can see. Projects use a Taskfile-based build that you can read, extend and debug, instead of one opaque command.
• Cross-compilation, with platform guides for building on and for every desktop target.
• Code signing and installers. Signing for every platform, NSIS installers and MSIX packages for Windows, DMG and app bundles for macOS, and AppImage, deb, rpm and Arch packages for Linux.
• An in-app updater. Pluggable providers (including GitHub Releases), cryptographic verification, an atomic swap with rollback, and a default UI you can theme or replace.
• Single instance, file associations and custom URL protocols, so your app opens the files and links it owns.
• Obfuscated builds and access to private macOS APIs when you need them.

• wails3 setup, a guided setup wizard that checks and installs dependencies.
• wails3 dev, live development with frontend hot reload and Go rebuilds, which stops its background processes when your app exits.
• Templates for vanilla, React, Vue and Svelte, each in JavaScript or TypeScript, plus your own custom templates.
• Testing support, including end-to-end testing guides.
• An MCP service that lets AI tools drive and inspect a running Wails app.
• A new documentation site at wails.io, built with M-Press, with tutorials, guides and API reference translated into nine languages.

v3 is a new major version, so moving to it is a real port rather than a version bump. The main changes are:

• the application and window lifecycle;
• services in place of context-bound bindings;
• direct application and window APIs in place of the v2 runtime package;
• regenerated frontend bindings.

The migration guide covers each one with before-and-after examples.

Wails v2 isn't going away. It continues to receive critical updates, and its documentation is now at v2.wails.io. The two CLIs (wails and wails3) are separate binaries with different module paths, so you can install both.

This release fixes every published Wails v3 security advisory except one: GHSA-2p5f-2gx8-mh8m is only partly fixed. Cross-origin child frames on Linux are now blocked, and the cases that remain open are listed under Known limitations below. If you are on v3.0.0-beta.30 or earlier, please upgrade.

• Block reserved wails: messages from cross-origin child frames on Linux (GTK3 and GTK4) by injecting a guard script into all frames, mitigating GHSA-2p5f-2gx8-mh8m
• Update github.com/klauspost/compress to 1.18.7 (GHSA-259r-337f-4rfw) and golang.org/x/image to 0.45.0, and build with Go 1.26.10 to pick up the crypto/x509 fix (GO-2026-6809)
• Update vite to 8.2.4 or later in the runtime package, setup wizard, examples and project templates (GHSA-9jrq-w75r-8gcw, GHSA-rq7h-c2jc-7f22, GHSA-vfpm-58rq-9qcg, GHSA-r825-w8mm-5pxw, GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv)

• Linux: the child-frame guard cannot stop a same-origin child frame (for example a srcdoc or about:blank iframe) from reaching the native message handler through its parent, because WebKitGTK gives the handler no frame information. Cross-origin frames, and sandboxed frames without allow-same-origin, are blocked. Do not embed untrusted same-origin content in a Wails window.
• Android (experimental): the window.wails JavaScript bridge is exposed to every frame in the WebView. Do not embed untrusted third-party content in the app's WebView. A fix is planned for 3.0.1.
• All platforms: bound-method calls from child frames go over HTTP to /wails/runtime, so the guard does not restrict them. Treat any iframe you embed as having access to your bound Go methods.

• Fix Windows apps crashing with panic: SetTextColor failed when painting the application menu bar on some Windows builds (#6311)
• Fix Windows apps crashing in applyDarkMode when uxtheme.dll was unloaded while its functions were still in use (#6358)
• Keep a staged update safe while a restart is pending, and validate an update before replacing the installed application, so a damaged update rolls back instead of breaking a working app (#6350, #6360)
• Fix wails3 update cli not finding v3 releases
• Project templates pin @wailsio/runtime to the version of the CLI that generated them

• Weekly releases bump the minor version (v3.1.0, v3.2.0, ...).
• Nightly pre-releases preview the next weekly (v3.1.0-nightly.YYYYMMDD).
• Hotfixes bump the patch version.

Go's @latest always resolves to the newest weekly or hotfix release, never a nightly. The @wailsio/runtime npm package always has the same version as the Wails release. Pin an exact version in production builds.

To propose a new feature or a change to public behaviour, open a draft WEP (Wails Enhancement Proposal) pull request rather than a feature-request issue.

Wails v3 exists because of the people who tested incomplete builds, reported hard bugs, translated documentation, answered questions and contributed code: see the credits page. Special thanks to Stffabi, Travis McLane, Atterpac, Lyimmi and fbbdev; to Valerio Tesei for his years of support; to our sponsors; and to JetBrains, ZSA and CodeRabbit.

If Wails is useful to you or your company, please consider sponsoring the project. 💙

Full changelog: changelog

v1.77.0 strengthens static-file confinement, fixes hijacked connection handling, and improves HTTP and cookie compatibility. It also adds an opt-in bounded stream reader, configurable body-buffer retention, and deadline support for adapted net/http handlers.

Static-file symlink behavior changes by default. The default OS-backed FS now rejects symlinks that leave Root or CompressRoot, as well as absolute symlinks even when their targets are inside the root. Relative symlinks that stay inside the root continue to work. Set FS.AllowSymlinksOutsideRoot to restore the previous behavior when external symlinks are intentional. Custom FS.FS implementations are unaffected. #2490

• Default static-file operations stay within their configured roots. File reads and compressed-cache operations use os.Root to prevent symlink traversal outside Root and CompressRoot. Each root is confined independently; empty roots with AllowEmptyRoot and whole-volume roots retain their existing behavior. #2490
• Custom filesystems no longer trigger unrelated disk deletions. A stale compressed file in a custom FS.FS previously caused an os.Remove call using its filesystem-relative name, potentially deleting a matching file in the process working directory. Custom filesystems now regenerate stale compressed content in memory without removing a disk file. #2489
• Kept hijacked connections no longer depend on a recycled request context. With both KeepHijackedConns and ReduceMemoryUsage enabled, the hijacked reader is detached from the context before the hijack handler runs. This prevents later reads from panicking or accessing another client's connection after context reuse. #2495

• An opt-in stream reader bounds copied payload buffering. NewBoundedStreamReader works with SetBodyStream and applies backpressure when consumers fall behind. Active copied payload is limited to 160 KiB per bridge, or 320 KiB across the two bridges used by its bounded compression path. These limits exclude caller buffers, codecs, sockets, and other overhead; wrapping the reader loses the combined compression bound. Existing NewStreamReader and SetBodyStreamWriter behavior is unchanged. #2488
• Request and response body buffers can be retained explicitly. The exported Request.KeepBodyBuffer and Response.KeepBodyBuffer fields preserve body buffers across resets for reuse. Releasing a request or response to the pool clears the retention setting. #2451
• Adapted handlers can configure connection deadlines. RequestCtx.SetReadDeadline and SetWriteDeadline are also exposed through fasthttpadaptor, enabling http.ResponseController deadline calls. The adaptor still buffers the request body before invoking the handler, so a read deadline set inside an adapted handler cannot govern the preceding upload. #2452

• Weighted compression codings are recognized. Accept-Encoding entries such as gzip;q=0.8 now match, while q=0 makes a coding unacceptable. Matching remains case-insensitive and requires a complete coding token; quality-based preference ordering and wildcard matching are not added. #2491
• HTTP/1.0 clients no longer receive unsupported informational responses. Expect: 100-continue is ignored for HTTP/1.0 requests, and 103 Early Hints is not sent to HTTP/1.0 clients. #2492, #2496
• Hijacking works with server keep-alive limits. DisableKeepalive and reaching MaxRequestsPerConn no longer suppress a registered hijack handler or add an unwanted Connection: close to an upgrade response. Explicit connection-close requests and other existing close conditions still apply. #2494
• Pipe connection deadlines interrupt pending operations. Updating deadlines on fasthttputil.PipeConns now affects blocked reads and writes, and write-deadline updates no longer race with writes. #2471
• Cookie parsing tolerates invalid attributes and handles names consistently. Invalid Max-Age attributes are ignored, Secure, HttpOnly, and Partitioned are recognized even with a value, and surrounding tabs are trimmed. Set-Cookie values without = are stored under the same empty key returned by Cookie.ParseBytes, keeping lookup and deletion consistent. #2497, #2498, #2500, #2501

Proxy authentication now uses decoded credentials in Proxy-Authorization, and static-file 416 Range Not Satisfiable responses include Content-Range. #2499, #2502

• fix(fs): resolve default FS paths with os.Root so they stay inside Root by @Thanatos9404 in https://github.com/valyala/fasthttp/pull/2490
• fix(fs): don't remove stale compressed files of a custom FS.FS from disk by @Thanatos9404 in https://github.com/valyala/fasthttp/pull/2489
• fix: detach kept hijacked connections from the request context's reader by @h2zi in https://github.com/valyala/fasthttp/pull/2495

• Add an opt-in bounded stream reader by @CSXizhang in https://github.com/valyala/fasthttp/pull/2488
• Export KeepBodyBuffer on Request and Response by @AdamMagued in https://github.com/valyala/fasthttp/pull/2451
• fasthttpadaptor: add support for ResponseController SetReadDeadline and SetWriteDeadline by @AdamMagued in https://github.com/valyala/fasthttp/pull/2452

• fix: accept Accept-Encoding codings that carry a quality value by @ybai08 in https://github.com/valyala/fasthttp/pull/2491
• fix: ignore Expect: 100-continue in HTTP/1.0 requests by @LuisFigueroaG in https://github.com/valyala/fasthttp/pull/2492
• fix: don't send 103 Early Hints to HTTP/1.0 clients by @LuisFigueroaG in https://github.com/valyala/fasthttp/pull/2496
• fix: run hijack handlers under DisableKeepalive and MaxRequestsPerConn by @h2zi in https://github.com/valyala/fasthttp/pull/2494
• make PipeConns deadlines interrupt pending reads and writes by @h2zi in https://github.com/valyala/fasthttp/pull/2471
• fix(cookie): ignore an invalid Max-Age attribute instead of failing to parse by @nk-batman21 in https://github.com/valyala/fasthttp/pull/2497
• fix(fasthttpproxy): send decoded proxy credentials in Proxy-Authorization by @nk-batman21 in https://github.com/valyala/fasthttp/pull/2499
• fix(cookie): recognize Secure, HttpOnly and Partitioned with a value by @LuisFigueroaG in https://github.com/valyala/fasthttp/pull/2498
• fix(cookie): trim tabs around cookie names, values and attributes by @LuisFigueroaG in https://github.com/valyala/fasthttp/pull/2500
• fix(cookie): store Set-Cookie without '=' under the key ParseBytes gives it by @LuisFigueroaG in https://github.com/valyala/fasthttp/pull/2501
• fix(fs): send Content-Range with 416 responses by @wleeaf in https://github.com/valyala/fasthttp/pull/2502

• @ybai08 made their first contribution in https://github.com/valyala/fasthttp/pull/2491
• @Thanatos9404 made their first contribution in https://github.com/valyala/fasthttp/pull/2489
• @AdamMagued made their first contribution in https://github.com/valyala/fasthttp/pull/2452
• @nk-batman21 made their first contribution in https://github.com/valyala/fasthttp/pull/2497
• @wleeaf made their first contribution in https://github.com/valyala/fasthttp/pull/2502

Full Changelog: https://github.com/valyala/fasthttp/compare/v1.76.0...v1.77.0

• Publish the v6.15.1 service-to-agent walkthrough by @asim in https://github.com/micro/go-micro/pull/5007
• Give services, MCP and chat separate starting points by @asim in https://github.com/micro/go-micro/pull/5008
• Default the OpenAI image model to gpt-image-2 by @pcbeingused333 in https://github.com/micro/go-micro/pull/5009
• feat(model): prefer MiniMax M3.1 Flash for text requests by @octo-patch in https://github.com/micro/go-micro/pull/5010
• Default the Anthropic model to claude-sonnet-5-5 by @pcbeingused333 in https://github.com/micro/go-micro/pull/5011
• Accept Anthropic streamed tool calls that have no arguments by @pcbeingused333 in https://github.com/micro/go-micro/pull/5012
• Default the Gemini model to gemini-3.8-flash by @pcbeingused333 in https://github.com/micro/go-micro/pull/5013
• Report token usage from the native Ollama stream by @pcbeingused333 in https://github.com/micro/go-micro/pull/5014
• Keep streamed tool calls without an index apart by @pcbeingused333 in https://github.com/micro/go-micro/pull/5015
• Report the token usage of every request in a tool round by @pcbeingused333 in https://github.com/micro/go-micro/pull/5016
• Return follow-up errors and sum usage in the Ollama Cloud tool round by @pcbeingused333 in https://github.com/micro/go-micro/pull/5017
• Preserve live model catalogs and streamed tool-name fragments by @asim in https://github.com/micro/go-micro/pull/5018
• Fix CI vulnerability check and service smoke checksum lookup by @asim in https://github.com/micro/go-micro/pull/5020
• Fix scaffold contract test checksum failures by @asim in https://github.com/micro/go-micro/pull/5021
• fix(server): release each request's context once it is served, not when the connection closes by @joe-blink in https://github.com/micro/go-micro/pull/5026
• feat: add LiteLLM model provider by @prodmanpd in https://github.com/micro/go-micro/pull/5030
• Report token usage and skip thoughts in the Gemini provider by @pcbeingused333 in https://github.com/micro/go-micro/pull/5022
• Fail a tool call whose arguments are not valid JSON by @pcbeingused333 in https://github.com/micro/go-micro/pull/5023
• Report usage, finish reason and output limit from Mistral, Together, MiniMax and Groq responses by @pcbeingused333 in https://github.com/micro/go-micro/pull/5028
• Fix empty tool arguments and Anthropic usage accounting by @asim in https://github.com/micro/go-micro/pull/5031
• Decouple agent execution from flows by @asim in https://github.com/micro/go-micro/pull/5033
• Host agents on services: new → run → chat by @asim in https://github.com/micro/go-micro/pull/5034
• Fix docs tests after agent hosting and update Go to 1.26.10 by @asim in https://github.com/micro/go-micro/pull/5035
• Show New → Run → Chat on the landing page by @asim in https://github.com/micro/go-micro/pull/5036
• Simplify the landing page around services and agents by @asim in https://github.com/micro/go-micro/pull/5037

• @pcbeingused333 made their first contribution in https://github.com/micro/go-micro/pull/5009
• @prodmanpd made their first contribution in https://github.com/micro/go-micro/pull/5030

Full Changelog: https://github.com/micro/go-micro/compare/v6.15.1...v6.16.0

• fix: treat IPv6 and shared-space addresses as internal by @SashaMIT in https://github.com/duke-git/lancet/pull/357
• Fix fileutil CI panic by serving ReadFile test fixtures from a local httptest server by @duke-git with @Copilot in https://github.com/duke-git/lancet/pull/358
• fix(package): [algorithm] handle empty iterative searches by @yuefdev in https://github.com/duke-git/lancet/pull/399
• fix(package): [netutil] bracket IPv6 dial addresses by @yuefdev in https://github.com/duke-git/lancet/pull/398
• fix(package): [structs] recognise directly embedded fields by @yuefdev in https://github.com/duke-git/lancet/pull/403
• fix(package): [random] handle non-positive unique slice lengths by @yuefdev in https://github.com/duke-git/lancet/pull/402
• fix(package): [netutil] skip invalid forwarded IP values by @yuefdev in https://github.com/duke-git/lancet/pull/397
• fix(package): [validator] accept supported hostless URL schemes by @yuefdev in https://github.com/duke-git/lancet/pull/395
• fix(package): [iterator] report available elements in HasNext by @yuefdev in https://github.com/duke-git/lancet/pull/392
• fix(package): [slice] report unreadable struct fields by @yuefdev in https://github.com/duke-git/lancet/pull/401
• fix(package): [stream] bound Limit capacity by source length by @yuefdev in https://github.com/duke-git/lancet/pull/400
• fix(package): [validator] match whole Chinese phone numbers by @yuefdev in https://github.com/duke-git/lancet/pull/396
• fix(package): [stream] avoid overflowing range arithmetic by @yuefdev in https://github.com/duke-git/lancet/pull/393
• fix(package): [queue] keep circular queues reusable after clear by @yuefdev in https://github.com/duke-git/lancet/pull/394
• fix(package): [list] preserve source storage during merge by @yuefdev in https://github.com/duke-git/lancet/pull/391
• fix(package): [netutil] handle upload responses by @yuefdev in https://github.com/duke-git/lancet/pull/389
• fix(package): [netutil] reject failed download responses by @yuefdev in https://github.com/duke-git/lancet/pull/388
• fix(package): [datetime] reject non-positive intervals by @yuefdev in https://github.com/duke-git/lancet/pull/386
• fix(package): [datetime] count calendar days across DST by @yuefdev in https://github.com/duke-git/lancet/pull/385
• fix(slice): return safely when DeleteAt receives no elements by @yuefdev in https://github.com/duke-git/lancet/pull/381
• fix(formatter): exclude leading plus signs from comma groups by @yuefdev in https://github.com/duke-git/lancet/pull/382
• fix(package): [queue] check membership only in active slots by @yuefdev in https://github.com/duke-git/lancet/pull/390
• fix(package): [convertor] preserve cloned scalar types by @yuefdev in https://github.com/duke-git/lancet/pull/383
• fix(package): [algorithm] keep duplicate CountSort entries by @yuefdev in https://github.com/duke-git/lancet/pull/387
• fix(package): [datetime] accept empty timezone options by @yuefdev in https://github.com/duke-git/lancet/pull/384
• fix(convertor): clone array values without slice reflection by @yuefdev in https://github.com/duke-git/lancet/pull/380
• fix(fileutil): reject copies onto the source file by @yuefdev in https://github.com/duke-git/lancet/pull/379
• fix(fileutil): preserve CSV fields and truncate replaced files by @yuefdev in https://github.com/duke-git/lancet/pull/378
• fix(strutil): clamp substring lengths before integer conversion by @yuefdev in https://github.com/duke-git/lancet/pull/377
• fix(mathutil): stop stepped ranges when values stop increasing by @yuefdev in https://github.com/duke-git/lancet/pull/376
• fix(maputil): validate MapToStruct inputs before reflection by @yuefdev in https://github.com/duke-git/lancet/pull/375
• fix(validator): reject backslashes in Base64 values by @yuefdev in https://github.com/duke-git/lancet/pull/374
• fix(slice): pass actual comparison indexes to DifferenceBy by @yuefdev in https://github.com/duke-git/lancet/pull/370
• fix(strutil): preserve IndexOffset not-found results by @yuefdev in https://github.com/duke-git/lancet/pull/367
• fix(strutil): validate Hamming distance by rune count by @yuefdev in https://github.com/duke-git/lancet/pull/368
• fix(strutil): encode default trim characters as runes by @yuefdev in https://github.com/duke-git/lancet/pull/369
• fix(mathutil): divide before multiplying LCM factors by @yuefdev in https://github.com/duke-git/lancet/pull/363
• fix(validator): correct JCB digit pattern escaping by @yuefdev in https://github.com/duke-git/lancet/pull/373
• fix(maputil): map slices into array destinations by @yuefdev in https://github.com/duke-git/lancet/pull/371
• fix(validator): exclude the correct GBK trail byte by @yuefdev in https://github.com/duke-git/lancet/pull/372
• fix(slice): handle Intersection without inputs by @yuefdev in https://github.com/duke-git/lancet/pull/366
• fix(mathutil): format TruncRound integer inputs as floats by @yuefdev in https://github.com/duke-git/lancet/pull/365
• fix(mathutil): honour Fibonacci seeds at the first positions by @yuefdev in https://github.com/duke-git/lancet/pull/362
• fix(mathutil): scale integer inputs after float conversion by @yuefdev in https://github.com/duke-git/lancet/pull/361
• fix(mathutil): preserve distances at extreme scales by @yuefdev in https://github.com/duke-git/lancet/pull/360
• fix(package): update LRU length after deletion by @yuefdev in https://github.com/duke-git/lancet/pull/359
• fix(mathutil): compute permutations without factorial division by @yuefdev in https://github.com/duke-git/lancet/pull/364

• @SashaMIT made their first contribution in https://github.com/duke-git/lancet/pull/357
• @duke-git with @Copilot made their first contribution in https://github.com/duke-git/lancet/pull/358
• @yuefdev made their first contribution in https://github.com/duke-git/lancet/pull/399

Full Changelog: https://github.com/duke-git/lancet/compare/v2.3.9...v2.4.0

• mark the fiber/v2 module as deprecated in favor of v3 by @gaby in https://github.com/gofiber/fiber/pull/4789

• cors: reject empty subdomain labels in CORS wildcard origins by @ReneWerner87 in https://github.com/gofiber/fiber/pull/4792

Full Changelog: https://github.com/gofiber/fiber/compare/v2.52.15...v2.52.16

• Require a space after the case-insensitive Basic authentication scheme. Malformed schemes such as BasicX no longer invoke the credential validator. Valid credentials are still required. This adapts the v5 correction to v4's single-header API. #3188, backport of #3138, with credit to @Shubham-Padkonde.
• Reject empty cookie tokens and empty client tokens in CSRF validation. This is defense in depth; it does not introduce a new security advisory. #3189, backport of #3135, with credit to @hoangtaiki.
• Reject CSRFConfig.TokenLookup configurations that produce no recognized token extractors. Middleware creation now returns an error instead of silently skipping token validation. #3149, thanks to @orinnz; backport of the existing v5 validation in #3067.

go get github.com/labstack/echo/v4@v4.16.2

Go 1.26 remains the module minimum. Build deployments with a supported, patched Go toolchain. No dependencies or public APIs changed in this release. Applications with invalid CSRF token lookup configuration will now fail middleware creation at startup.

The security fixes, bounded BodyDump and Decompress defaults, and dependency updates released in v4.16.1 are included unchanged. Their first patched version remains v4.16.1.

Validation: the fixes passed regression tests and upstream race-test, lint and benchmark checks on Linux, macOS and Windows with Go 1.26 and 1.27. The new regressions were also verified to fail without the fixes; local race tests and vet passed.

Full changelog: https://github.com/labstack/echo/compare/v4.16.1...v4.16.2

• Require a space after the case-insensitive Basic authentication scheme. Malformed schemes such as BasicX no longer reach credential validation or consume AllowedCheckLimit. Valid credentials are still required. #3138, thanks to @Shubham-Padkonde.
• Reject empty cookie tokens and empty client tokens in CSRF validation. This is defense in depth; it does not introduce a new security advisory. #3135, thanks to @hoangtaiki.

go get github.com/labstack/echo/v5@v5.4.2

Go 1.25 remains the module minimum. Build deployments with a supported, patched Go toolchain. No dependencies or public APIs changed in this release.

The security fixes released in v5.4.1 are included unchanged. Their first patched version remains v5.4.1.

Validation: the fixes passed regression tests and upstream race-test and lint checks on Linux, macOS and Windows with Go 1.25, 1.26 and 1.27. The new regressions were also verified to fail without the fixes.

Full changelog: https://github.com/labstack/echo/compare/v5.4.1...v5.4.2

Upgrade with go get github.com/labstack/echo/v5@v5.4.1.

• Validate the sending peer before accepting X-Real-IP in ExtractIPFromRealIPHeader, preventing client IP spoofing when that extractor is configured. GHSA-h53f-rm2w-w7rg
• Validate upstream WebSocket upgrade responses through Go's HTTP reverse proxy. Rejected upgrades no longer leave a raw tunnel that bypasses Echo routing and route middleware. GHSA-cxf3-9h37-7rr8
• Close both WebSocket connections when either side disconnects, including when an upstream ignores client EOF. GHSA-9969-6676-49h5
• Preserve the complete request body beyond the BodyDump capture limit and propagate read errors, including BodyLimit overflows. GHSA-x9ff-22gv-65f4, #3105
• Restore the original response writer before returning BodyDump buffers to the pool, preventing writes into a reused buffer during error handling. #3174
• Accept decompressed bodies exactly at the configured limit; keep overflow errors sticky. #3136
• Include the BodyLimit overflow-check correction and static-path hardening already merged since v5.4.0.

The proxy removes incoming Forwarded headers as defensive hardening. Backends relying on that header should use forwarding headers generated from the configured trusted IP extractor and scheme. WebSocket requests now honor the configured proxy transport, response modifier, target path and query in the same way as HTTP requests; ws and wss targets remain supported.

BodyDump capture limits bound logging only: handlers receive the full request, and clients receive the full response. Applications must still consume request bodies and handle read errors to enforce streaming body limits.

Go 1.25 remains the module minimum. Build deployments with a supported, patched Go toolchain.

This release also includes ValidateCtx, router fixes for escaped colons, custom methods and parameter storage, binding support for OpenAPI date formats, and documentation updates.

Thanks to @rm-Umar, @Duodum, @irisitymichaelgrundberg, @Hama1cco, @jakezwang, @Shubham-Padkonde and @rajpreetcodes for reports and contributions, and to the contributors credited in the individual commits.

Validation: upstream lint checks and race tests passed on Linux, macOS and Windows with Go 1.25, 1.26 and 1.27. Local tests on patched toolchains, vet, staticcheck and govulncheck also passed; govulncheck reported no reachable vulnerabilities.

Full changelog: https://github.com/labstack/echo/compare/v5.4.0...v5.4.1