JavaGolangJavaScriptSwiftAndroidRustMiddleware
19 hours ago
wails
wailsapp

Wails v3.0.0-beta.34

Wails v3 Beta Release - v3.0.0-beta.34

Fixed

  • Fix Windows webview not regaining focus on window activation, and Tab being trapped inside the webview instead of moving to the native window and back (#3783)
  • Fix internal/webview2/pkg/webview2 COM vtable structs (ICoreWebView2_2.._27 and other derived interfaces) omitting the inherited method chain, which made calls land on the wrong vtable slot (#6129)
  • Fix Windows question dialogs ignoring custom button labels and never firing button callbacks; custom buttons are now shown with a TaskDialog (falling back to MessageBox with positional callback mapping when comctl32 v6 is unavailable) (#5794)
  • Fix wails3 dev hanging for 60s against Vite: the automatic frontend readiness gate now uses a TCP probe instead of an HTTP GET that sent no Accept header and received a 404 (#6209)
  • Keep systray menus working when updated while open in PR by @taliesin-ai
  • Handle transient WebView2 COM errors gracefully in runtime operations in PR by @leaanthony

🤖 This is an automated nightly release generated from the latest changes on master.

Installation:

go install github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0-beta.34

⚠️ Beta Warning: This is pre-release software. The API is stable, but you may still encounter issues before the final 3.0 release.

1 days ago
unipdf
unidoc

v5.2.0

Release notes - UniPDF v5.2.0

This release contains new features, improvements and bug fixes.

New Features

  • US-1563 US-1566 US-1567 US-1568 Complete shading rendering support: function-based (Type 1), Gouraud triangle mesh (Types 4 and 5) and Coons / tensor-product patch mesh (Types 6 and 7) shadings, plus Creator.NewFunctionBasedGradient for authoring function-based gradients
  • US-1564 US-1565 PdfFunctionType3.Evaluate for stitching functions and a generic shading color sampler for all function types and colorspaces
  • US-1569 Rendering of Type 1 tiling patterns
  • US-1614 Rendering of the separable blend modes and non-isolated transparency group compositing
  • US-1773 Rendering of ExtGState soft masks, fixing axial ICCBased Multiply shadings rendering too dark, with model.NewPdfFunctionFromPdfObject now exported
  • US-1907 US-1908 Reading documents encrypted with the public-key security handler (Adobe.PubSec) via ReaderOpts.Certificate/PrivateKey, PdfReader.DecryptWithCertificate and PdfReader.CheckAccessRightsWithCertificate
  • US-1909 US-1910 Encrypting documents for recipient certificates via PdfWriter.EncryptForRecipients
  • US-1769 Template engine: creator.ParseTemplate returning a reusable ParsedTemplate, rendered or validated with Creator.RenderTemplate/ValidateTemplate, plus named styles (<style> and the class attribute) and typography inheritance
  • US-1772 Block.SetBackground and Chapter.SetBackground, and page breaks inside a Division, also available in templates
  • US-1779 SignatureValidationResult.Certificates and SignatureValidationResult.SignerCertificate for accessing certificate details
  • US-1814 FDF export of form field data from a PDF with fdf.NewFromReader, fdf.NewFromForm and Data.Write/WriteToFile, plus PdfAcroForm.AllFieldValues
  • US-1722 Form-field appearance generation for push buttons and signature fields with explicit clipping, and PdfAppender.SignWithAppearance

Improvements

  • US-1613 The sh operator shading fill now covers the clip region and honours axial/radial Extend
  • US-1717 The renderer honour the transparency group colorspace, isolation and knockout, so groups with a DeviceCMYK group colorspace no longer render nothing
  • US-1718 Replaced the Multiply blend mode alpha hack with real per-primitive compositing, adding the non-separable blend modes (Hue, Saturation, Color, Luminosity)
  • US-1807 Template strict mode reports a missing data key by name
  • US-1929 Upgraded github.com/unidoc/pkcs7 to v0.4.1, hardening BER-to-DER conversion against malformed and truncated input
  • US-1945 Upgraded golang.org/x/image, x/text, x/crypto and x/net to fix reachable advisories

Bug Fixes

  • US-1774 Fixed GetPreviousRevision and DocMDP revision sectioning disagreeing with RevisionEndOffsets
  • US-1775 Fixed the redactor refusing page-specific edits for forms nested inside other forms
  • US-1777 Fixed redaction Tj offsets under anisotropic scaling, now computed from text-space glyph advances, with TextMark.Tfs added for the Tf font size
  • US-1778 Fixed the auto-repair xref health check running before authentication on encrypted files; PdfWriter now encrypts object streams
  • US-1780 Fixed lazy stream encryption and reuse, Image.Crop alpha loss and Decode rescaling
  • US-1795 Fixed a panic when loading a nested trailer with a non-integer /Prev
  • US-1803 Fixed the ExtractPageText regression in v5.1.0 where form XObject text ignored the caller's color state
  • US-1805 Fixed template text on a component that cannot take text being silently dropped
  • US-1806 Fixed multiple children in a template table-cell or list-item silently keeping only the last one
  • US-1811 Fixed the user password never authenticating when EncryptOptions.Permissions is zero, and added security.Permissions.Normalized
  • US-1815 Fixed AES-256 (R6) passwords not being SASLprep-normalised before hashing
  • US-1827 Fixed template strict mode missing malformed gradients and a lone header-start-row, and a panic on a nil template reader
  • US-1833 Fixed a fatal stack overflow when rendering a self-referential form XObject
  • US-1837 Fixed table cell content overflow, so nested tables in table cells split across page breaks
  • US-1840 Fixed image extraction and grayscale conversion crashing on a self-referential form XObject
  • US-1843 Fixed signature validation reporting IsVerified for untrusted certificates (GHSA-h4pv-x6fp-rh2w): certificate trust and revocation are now checked with PdfReader.ValidateSignaturesWithOpts and reported through IsTrusted, TrustChain, TrustErrors and RevocationStatus
  • US-1844 Fixed stream decoding materializing unbounded decoded output (GHSA-2x38-rm6v-5hcj): decoding is now limited to 256 MiB per stream by default, configurable via ReaderOpts.MaxDecodedStreamSize, ReaderOpts.MaxDecodedTotalSize and core.SetDefaultMaxDecodedStreamSize
  • US-1855 Fixed the R5/R6 empty-user-password fallback deriving the file key from the wrong password
  • US-1860 Fixed a partial CRL revocation bypass in signature validation, with further trust and revocation fixes
  • US-1862 Fixed nested tables in Grid cells, List items and Divisions dropping content or hanging at page breaks
  • US-1885 Fixed AES-256 encryption with an empty owner password producing a file that opens without a password
  • US-1938 Fixed ResolveReferencesDeep overflowing the stack in NewPdfReader on deeply nested PDFs
  • US-1953 Fixed PubSec decryption revealing whether a recipient's RSA PKCS#1 v1.5 padding was valid (Bleichenbacher oracle)
1 days ago
pdfcpu
pdfcpu

v0.16.3

pdfcpu v0.16.3

This is a security update fixing configured decoded-byte limit bypasses and restricting local image access in create and form input.

Applications handling untrusted PDFs or create/form input should upgrade.

Decoded-byte limits — GHSA-jp42-qm45-2x6g:

Honor Limits.MaxDecodeBytes across stream decoding and combined page content, and stop cross-reference repair after limit failures. Strengthen Flate predictor, DCT and cached-content checks, with regression coverage for strict/relaxed validation and eager/deferred decoding.

The limit bounds individual decoded streams and combined page content, not total process memory.

Additive Go API change: Add StreamDict.DecodeWithLimit and StreamDict.DecodeLengthWithLimit to supply the configured decode limit explicitly.

Local image access — GHSA-44h9-p34h-2w4p:

Confine local images referenced by create, form fill, and JSON/CSV form multifill input to an allowed directory. Reject absolute paths, parent-directory components, symlink escapes and non-regular files, and report access denials as errors.

Compatibility change: API callers must set conf.LocalImageRoot to enable local images; an empty value disables them. The CLI defaults to its working directory; set localImageRoot in config.yml to select another root. Update image paths to be relative to that root. Confined local images are unavailable on js/wasm. See local image access for migration guidance and limitations.

Documentation: Updated security policy clarifies vulnerability scope, supported releases and guidance for AI-assisted reports and multiple findings. Updated pull request template clarifies contribution requirements. Added local image configuration and migration guidance to README and website.

Requires Go 1.26 or later, unchanged from v0.16.2.

Changelog

    • 35ea259eb27d5a607f797edd41fd8a9e50a1f818 bump version
    • 8befe54db401e8ed0ecb9d52aec700fa67b2972f confine local images in create and form input
    • c1db2d55c0826689a129012fbac5a25d5fd3a39f honor configured decode limits across stream consumers
1 days ago
wails
wailsapp

Wails v3.0.0-beta.33

Wails v3 Beta Release - v3.0.0-beta.33

Added

  • Binding generator now emits a bindings/events module exporting a typed name constant for every discoverable event registered with application.RegisterEvent using a compile-time constant name (e.g. UserLogin for user:login), usable with Events.On/Emit without the Vite plugin (#5645)

Fixed

  • Fix Windows question dialogs ignoring custom button labels and never firing button callbacks; custom buttons are now shown with a TaskDialog (falling back to MessageBox with positional callback mapping when comctl32 v6 is unavailable) (#5794)
  • Fix wails3 dev hanging for 60s against Vite: the automatic frontend readiness gate now uses a TCP probe instead of an HTTP GET that sent no Accept header and received a 404 (#6209)
  • Keep systray menus working when updated while open in PR by @taliesin-ai
  • Handle transient WebView2 COM errors gracefully in runtime operations in PR by @leaanthony

🤖 This is an automated nightly release generated from the latest changes on master.

Installation:

go install github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0-beta.33

⚠️ Beta Warning: This is pre-release software. The API is stable, but you may still encounter issues before the final 3.0 release.

2 days ago
decimal
shopspring

v1.6.0

What's Changed

New Contributors

Full Changelog: https://github.com/shopspring/decimal/compare/v1.5.0...v1.6.0

2 days ago
wails
wailsapp

Wails v3.0.0-beta.32

Wails v3 Beta Release - v3.0.0-beta.32

Added

  • Add native macOS menu section headers for macOS 14+ — see the documentation site (20 pages updated) in PR by @leaanthony

Fixed

  • Make SetRelativePosition relative to screen work area on macOS in PR by @leaanthony
  • Updater helper relaunches unchanged target after parent timeout or failed replacement in PR by @taliesin-ai
  • Pin pnpm to version 10 for versioned docs in PR by @taliesin-ai

🤖 This is an automated nightly release generated from the latest changes on master.

Installation:

go install github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0-beta.32

⚠️ Beta Warning: This is pre-release software. The API is stable, but you may still encounter issues before the final 3.0 release.

2 days ago
go-micro
micro

v6.15.1

What's Changed

Full Changelog: https://github.com/micro/go-micro/compare/v6.15.0...v6.15.1

3 days ago
fasthttp
valyala

v1.76.0

v1.76.0 strengthens HTTP message framing, static-file isolation, and server connection handling. It also improves HTTP compatibility, avoids quadratic work when parsing large trailer sets, and adds configurable TCP keep-alives to TCPDialer.

Security fixes and hardening

  • Multipart parsing consumes the entire declared body. Bytes after the closing multipart boundary are drained before the connection is reused, preventing a multipart epilogue from being interpreted as another request. #2336
  • Outgoing messages preserve framing. Raw Content-Length headers are synchronized with the outgoing body, duplicate or conflicting framing headers are rejected, and fixed-length request and response streams cannot write beyond their declared size. FS and SendFile also stop at the advertised Content-Length when a file grows during serving. #2470, #2462
  • Requests with both Content-Length and Transfer-Encoding close the connection. The connection is no longer reused after a request containing both framing headers. #2476
  • Virtual-host file serving preserves directory isolation. NewVHostPathRewriter avoids decoding the host and path twice and handles invalid hosts safely, preventing crafted requests from escaping the virtual-host directory and accessing files directly under FS.Root. This affects FS handlers using NewVHostPathRewriter. #2487
  • Rejected TLS connections no longer block the accept loop. Connections rejected by MaxConnsPerIP or Concurrency are closed without attempting an HTTP error response, which could otherwise trigger a TLS handshake and stall while waiting for a ClientHello. IPv6 clients are now also counted against MaxConnsPerIP. #2486, #2468

Performance improvements

  • Trailer parsing avoids quadratic work. Large sets of trailer names use indexed membership checks instead of repeatedly scanning all previously recorded names. This reduces CPU amplification from crafted Trailer headers and chunked trailer sections while preserving trailer order. #2465

HTTP compatibility and features

  • Static files handle range and conditional requests more accurately. Unsupported range units and multiple ranges are ignored instead of returning 416; invalid single byte ranges still return 416. Range is also ignored when If-Range does not match, and both Range and If-Modified-Since are ignored for methods other than GET and HEAD. #2467, #2473, #2474, #2475
  • Pipeline clients handle HEAD responses without reading a body. PipelineClient skips the response body for HEAD requests. #2469
  • HTTP parsing accepts valid legacy formats and matches tokens correctly. ParseHTTPDate accepts obsolete HTTP-date formats, cookies with an invalid Expires attribute remain parseable, Expect: 100-continue is matched case-insensitively, and Accept-Encoding matches complete tokens. Asterisk-form request targets are rejected for methods other than OPTIONS. #2466, #2481, #2482, #2479, #2463
  • TCP keep-alives are configurable. The new TCPDialer.KeepAlive field sets the keep-alive period for connections created by the dialer; a negative value disables keep-alives. #2484

What's Changed

Security and hardening

Performance

Features

Fixes

Documentation

Dependency updates

New Contributors

Full Changelog: https://github.com/valyala/fasthttp/compare/v1.75.0...v1.76.0

3 days ago
wails
wailsapp

Wails v2.17.0

Installation

go install github.com/wailsapp/wails/v2/cmd/wails@v2.17.0

Changes

Security

  • Windows notifications no longer fall back to PowerShell when the WinRT toast API fails; the error is returned instead
  • wails init now warns that remote templates are code: the frontend:* commands in wails.json and the scripts they call run during wails build and wails dev. The warning lists the commands found in the generated wails.json and is also shown with -q. The template docs now describe this trust boundary.
  • Hardened the wails dev server against cross-origin and DNS-rebinding attacks on the IPC WebSocket. It previously accepted any origin and forwarded straight to the bound-method dispatcher, so a malicious page in the developer's browser could connect to ws://localhost:34115/wails/ipc and invoke the entire bound Go API. Every request's Host header is now checked against an allowlist (localhost, IP literals, the configured bind address, plus any hosts named in WAILS_DEV_ALLOWED_HOSTS), the IPC upgrade requires a same-origin Origin header, and a per-launch capability cookie (HttpOnly, SameSite=Strict) is required on the upgrade as defense in depth; the cookie is named per dev server port and refreshed before each reconnect, so open browser tabs reconnect after wails dev restarts the app. This protects against browser-based attacks; other processes running as the developer's own user are outside the dev server's threat model by @nft

Changed

  • Replaced the github.com/wailsapp/mimetype fork with upstream github.com/gabriel-vasile/mimetype v1.4.16 for asset MIME type detection

The wails dev hardening comes from #6036 by @nft, merged as part of #6288.

Also includes v2.15.0 and v2.16.0

v2.15.0 and v2.16.0 were tagged without GitHub releases. Their changes are part of this release:

v2.16.0

  • Fixed a memory leak in the macOS and Linux frontends where Calloc never freed the C strings it allocated for dialogs, menus and window setup by @4RH1T3CT0R7

v2.15.0

  • Added EnableAutoplayWithoutUserAction macOS webview preference to allow HTML5 media to autoplay without a user gesture #5512 by @Eyalm321

What's Changed

3 days ago
wails
wailsapp

Wails v3.0.0-beta.31

Wails v3 Beta Release - v3.0.0-beta.31

Added

  • Expose the @wailsio/runtime/cancellable subpath export so CancellablePromise can be imported without evaluating the root runtime entry (#6153)

Changed

  • Require Go 1.26 or later: the v3 module now declares go 1.26.0, and projects generated by wails3 init and wails3 service init declare the same minimum

Fixed

  • Fix binding generator output changing when building with Go 1.27, where encoding/json types such as Marshaler, Unmarshaler and RawMessage became aliases of encoding/json/v2 and encoding/json/jsontext types: they are rendered as any again and no models are emitted for encoding/json/v2 (#6292)
  • Validate remote template URLs passed to wails3 init -t before cloning: only https://, http://, ssh://, git:// and user@host:path URLs are accepted, values are passed to git after --, and git is restricted to those transports during the clone
  • Reject out-of-range x-wails-window-id header values in the HTTP runtime transport instead of silently truncating them to another window's ID
  • Harden the updater's archive extraction against zip-slip: entry paths are now checked with filepath.IsLocal plus a containment check on the joined path, with tests for nested .., backslash, absolute-path and symlink write-through entries in zip and tar.gz archives
  • Fix AppImages from wails3 generate appimage crashing on start outside Debian and Ubuntu with "Unable to spawn a new child process: … WebKitNetworkProcess". The bundled WebKit now runs the helper processes shipped in the AppImage. WebKit's bubblewrap sandbox stays on
  • Fix -tags server builds failing to compile for Android and iOS, fixing #6271
  • Fix the updater failing to swap on Linux when the temp dir is on another filesystem (such as a tmpfs /tmp) by staging beside the installed binary and copying across filesystems
  • Fix the updater trying to replace the read-only mount of an AppImage instead of the .AppImage file
  • Fix reserved wails: window control messages being accepted from iframes on macOS and iOS. They are now only accepted from the window's main frame; other messages from iframes still reach RawMessageHandler with their origin info
  • Stop posting WindowDidUpdate and WindowWillUpdate on macOS: NSWindowDidUpdateNotification fires on every run-loop pass, so the page received ~120 empty evaluateJavaScript: calls per second, and on macOS 27.0 each of them consumed the transient activation of the user's click — navigator.clipboard.writeText() and other activation-gated APIs rejected with NotAllowedError from real clicks (#6170) by @APshenkin
  • Fix default Windows info.json language to en-US (0409) so Explorer shows version details (#6210)
  • Fix the Linux DMA-BUF renderer being turned off on laptops with an NVIDIA dGPU beside an AMD or Intel iGPU: on Wayland it is now turned off only when WebKit renders on NVIDIA (the app was offloaded to the dGPU, or the compositor runs on it), not whenever the nvidia module is loaded, which slowed rendering to a crawl on the iGPU; X11 sessions keep the old behaviour, since Xorg's render GPU is set by its configuration
  • Handle cross-device rename failures in Linux updater with staged copy fallback in PR by @john-okeefe
  • Fix WebviewWindow.SetMenu on Windows not redrawing the menu bar unless a menubar theme was configured, fixing #6103
  • Fix WebviewWindow.SetMenu(nil) panicking on Windows instead of being a no-op like on macOS, fixing #6104
  • Preserve changelog entries across competing pushes with retries in PR by @leaanthony
  • Fix go mod vendor failing with pattern arm64/WebView2Loader.dll: no matching files found on every platform, by removing the embeds that referenced binaries never shipped in the module, fixing #5782 and #5376, in PR by @Grantmartin2002
  • Prevent duplicate window teardown on macOS in PR by @charlesbalderson
  • Handle WM_CONTEXTMENU for systray menu to open on right-click in PR by @wzk2025
  • Fix all five InvokeSync* variants blocking their caller forever when the dispatched callback panics, fixing #6107, in PR by @RALIST
  • Rebuilds destroyed GTK3 submenus safely in PR by @leaanthony
  • Implement Windows worker forwarding shim for nested workers in PR by @taliesin-ai
  • Fix OpenFile() on Windows ignoring PromptForMultipleSelection() when CanChooseDirectories(true): users can now pick several folders at once, as on macOS and Linux (#6263)
  • Fix by-value double arguments to WebView2 COM methods on windows/arm64 — ZoomFactor, RasterizationScale, cookie Expires, and the print settings scale, page size and margins were affected there (the print-settings setters previously returned ErrDoubleArgUnsupported): affected calls now goes through a runtime.cgocall trampoline that loads d0, which Go's syscall path cannot (golang.org/issue/62583) by @APshenkin

Security

  • Server mode (-tags server) now accepts /wails/runtime calls only as POST requests from the server's own origin or an origin listed in ServerOptions.WebSocketOriginPatterns; other methods receive HTTP 405 and other browser origins HTTP 403. Deployments behind a reverse proxy that rewrites the Host header should add their public origin to WebSocketOriginPatterns
  • Server mode (-tags server) bound to a loopback address (the default localhost, 127.0.0.0/8 or ::1) now rejects requests with HTTP 403 unless the Host header is localhost, an IP literal, the bind host, or a host matching ServerOptions.WebSocketOriginPatterns, blocking DNS rebinding attacks against /wails/runtime and the WebSocket endpoints
  • Windows notifications no longer fall back to PowerShell when the WinRT toast API fails; the error is returned instead

🤖 This is an automated nightly release generated from the latest changes on master.

Installation:

go install github.com/wailsapp/wails/v3/cmd/wails3@v3.0.0-beta.31

⚠️ Beta Warning: This is pre-release software. The API is stable, but you may still encounter issues before the final 3.0 release.