JavaGolangJavaScriptSwiftAndroidRustMiddleware
14 hours ago
chromedp
chromedp

v0.23.1

Update cdproto to v0.160.1. The README section on termcast describes its new API: termcast has no flags, Start detects the terminal, and in kitty and Ghostty the stream draws with no flicker.

23 hours ago
iris
kataras

v14.0.1

Version 14 release notes and reference: https://github.com/kataras/iris/releases/tag/v14.0.0 (read this first).

In-short, all valid opened issues are fixed.

Changelog: https://github.com/kataras/iris/blob/v14.0.1/HISTORY.md#fri-13-november-2026--v1401

1 days ago
unioffice
unidoc

v2.15.0

Release notes - UniOffice v2.15.0

This release contains new features, improvements and bug fixes.

New Features

  • US-1713 Password protection and encryption for Office documents: open and save password-encrypted DOCX, XLSX and PPTX files through OpenWithOptions, ReadWithOptions, SaveWithOptions and SaveToFileWithOptions (reads agile and standard AES encryption, writes agile AES-256), salted SHA-512 hashes for spreadsheet sheet and workbook protection, and a Word Restrict Editing API on Settings.DocumentProtection(). Opening with a wrong password returns ErrIncorrectPassword, and an unsupported scheme returns ErrUnsupportedEncryption
  • US-1748 PPTX slide transitions API: Slide.SetTransition, Slide.Transition and Slide.RemoveTransition, covering 21 transition effects plus a timing-only transition, with direction, speed, automatic advance and click advance
  • US-1800 PPTX hyperlinks: external links on text runs, text boxes and images, slide-to-slide jumps (Slide.AddHyperlink, Slide.AddSlideJump), slide-show navigation jumps (first, last, next, previous, last viewed, end show) and tooltips
  • US-1799 Spreadsheet row and column grouping: Sheet.GroupRows/GroupColumns, SetOutlineLevel/SetCollapsed on rows and columns, and Sheet.SetSummaryBelow/SetSummaryRight. Also adds data validation prompt and error messages (SetPrompt, SetError), lock/unlock for each of the 14 sheet protection flags, strike and superscript/subscript for rich text, and hyperlink tooltips, display text and links within the workbook (Cell.AddInternalHyperlink)

Improvements

  • US-1836 PPTX slides, layouts and masters keep their mc:AlternateContent transitions through open and save, and animation timing values (dur, delay, repeatCount, tm, dir) are no longer blanked on save
  • US-1063 DOCX to PDF wrapping text around anchored images the way Word does, including images anchored later in the document than the text they overlap
  • US-1978 UniPDF dependency update to v5.2.0
  • US-1946 golang.org/x/image update to v0.45.0 and golang.org/x/text update to v0.41.0, fixing reachable security advisories (GO-2026-5032, GO-2026-5062, GO-2026-5066, GO-2026-5970). The minimum Go version stays at 1.25.0
  • US-1941 Test golden files are no longer rewritten when only zip metadata such as timestamps changes
  • US-1980 Render tests now detect changes in black content, and the OpenXML SDK validation gate runs and fails in CI
  • US-2057 CI test runs no longer fail because of too many license check-ins
  • US-2028 Release packaging fix for generic declarations the source obfuscator cannot handle, with a CI check that rejects new ones

Bug Fixes

  • US-1838 Metered license state file written in place, so parallel processes sharing an API key failed with "ciphertext too short" or "invalid data" and overwrote each other's document counts fix. The file is now written atomically and locked across processes
  • US-2041 SaveToFile, SaveToFileWithOptions and Presentation.SaveToFileAsTemplate ignoring the error from closing the written file, and Presentation.Save ignoring the zip writer's close error, so a truncated file was reported as saved fix
  • US-1801 Open and save corrupting packages whose media parts are renamed, leaving stale relationships and content types fix
  • US-1969 Chart parts renumbered on open and save losing their relationships and content type in DOCX, XLSX and PPTX fix
  • US-1970 DOCX image fixes: Open panicking on media parts without a file extension, AddImage with an uppercase format (for example "PNG") producing a broken image (also fixed for XLSX and PPTX), and GetImageByRelID not finding an image right after AddImage
  • US-1916 PPTX decks created with New() missing three presentation.xml.rels entries, so reopening and saving them produced a corrupt package fix. Decks saved by earlier releases are repaired on open
  • US-1959 PPTX open and save writing a notes master referenced from several parts more than once, producing a package the OpenXML SDK and LibreOffice reject, fix. PPTX to PDF conversion no longer panics on a deck without a slide master
  • US-1981 DOCX to PDF conversion modifying the Document, so converting the same document twice gave different output fix
  • US-1992 DOCX to PDF conversion writing resolved run and paragraph properties into styles, so output depended on document order (for example a paragraph mark color leaking into later paragraphs, or list levels taking another level's indent) fix
  • US-1978 DOCX to PDF fixes for Options.DefaultFontSize carrying over to later XLSX and PPTX conversions in the same process, and table cell paragraphs losing the Normal style
  • US-1802 _xlfn. function names fix: functions added after Excel 2007 (such as XOR, IFNA, UNICHAR and CEILING.MATH) now evaluate by their normal spelling, and SetFormulaRaw, SetFormulaArray and SetFormulaShared store them with the prefix Excel expects, so they no longer show #NAME? in Excel
  • US-1966 Spreadsheet stylesheet <font> children written in API-call order, which the OpenXML SDK rejects, fix. Chart data labels are written in schema order too
  • US-1957 RecalculateFormulas computing every cell of a shared formula from the anchor cell's inputs fix
  • US-2019 Shared formula recalculation overwriting cells inside the formula's range that are not part of the group, and leaving stale values in the other cells when the anchor cell evaluates to an error fix
  • US-2027 Shared formulas that read later cells of their own group evaluating to #VALUE!, slow recalculation of chained shared formula groups, CompressImages breaking images used by charts, and copied DOCX headers and footers keeping the source document's numbering definitions fix
  • US-1958 Sheet.Sort renumbering rows into index order and sorting the whole sheet when the first row does not exist, and RemoveColumn panicking on cells and rows without a reference fix
  • US-1911 Sheet operations (Sort, RemoveColumn, InsertRow, RecalculateFormulas, ExtractText and others) and formula evaluation filling empty cells into sparse rows fix. Inline rich-text cells are no longer read as empty
  • US-1799 CELL("width") panicking on sheets without column definitions fix

Breaking Changes

  • US-1713 SetPassword on spreadsheet sheet and workbook protection now writes a salted SHA-512 hash instead of the legacy 16-bit hash. Files that must be unlocked in Excel 2007 or earlier need SetLegacyPassword.
  • US-1911, US-1958 Sheet.Sort now matches Excel: the sort is stable, blank keys go last in both ascending and descending order, and rows keep their row numbers instead of being renumbered into index order. Code that relied on the previous order or numbering may see different results.
2 days ago
iris
kataras

v14.0.0

Iris v14 is the first new major version since v12. The module path is github.com/kataras/iris/v14 and it requires Go 1.27 or later.

go get github.com/kataras/iris/v14@v14.0.0
package main

import "github.com/kataras/iris/v14"

type Book struct {
	Title string `json:"title"`
}

func main() {
	app := iris.New()

	app.Get("/books/{id:uuid}", func(ctx iris.Context) {
		ctx.JSON(iris.Map{"id": ctx.Params().GetString("id")})
	})

	app.Post("/books", func(ctx iris.Context) {
		book, ok := ctx.BindJSON[Book]()
		if !ok {
			return
		}

		ctx.StatusCode(iris.StatusCreated)
		ctx.JSON(book)
	})

	app.Listen(":8080")
}

ctx.BindJSON[Book]() is a generic method, which is why v14 needs Go 1.27. It decodes the body, runs Validate() error when the type has one, and answers the client itself when either step fails.

What is new

  • iris.NewBuilder assembles an application in one compile-checked chain: CORS, compression, access logging, a health endpoint, error mapping, services and API groups.
  • Typed request binding on generic methods (ctx.BindJSON[T](), ctx.BindUpdate[T]()) replaces hand-written decode blocks.
  • rest/errors: handlers report errors and one central map turns them into canonical, machine-readable responses. Internal details go to the server log and never to the client.
  • A dependency injection container is built in and replaces hero. Constructors declare what they need, Initializer hooks run at startup and closers run at shutdown.
  • JSON runs on encoding/json/v2.
  • Thirty-one built-in middleware, API keys being the newest. Sessions, cache, i18n, versioning and websocket now live under middleware/.
  • Authentication at every scale: Basic Auth typed by your own user type, API keys, a generic JWT SDK, an identity server and an OAuth2 provider.
  • ai: renders and relays streamed model output over HTTP (text deltas, reasoning traces, tool-call fragments, usage). It is provider-agnostic and ships no vendor SDK.
  • client: an HTTP client for calling other services under the same JSON rules the server side uses.
  • Views are a middleware. middleware/view holds a one-method Engine interface. The HTML, Django, Handlebars, Jet, Pug and Ace engines moved to iris-contrib/views, and kataras/blocks works as it is.
  • Server options: app.Run(iris.ServerOptions{...}) replaces iris.Addr, iris.TLS and iris.AutoTLS. ngrok tunneling is opt-in through a blank import of core/server/ngrok.
  • MVC controllers on Go generics, in controller/mvc.

Upgrading from v12

Every removed v12 name fails at compile time, so the compiler's error list is your to-do list. MIGRATION.md maps each name to its replacement. It opens with a prompt that you can paste into a coding agent, which then does the mechanical part.

The replacements most applications meet first:

v12 v14
github.com/kataras/iris/v12 github.com/kataras/iris/v14
iris.Party, app.Party(prefix) iris.Router, app.Router(prefix)
iris.Configuration, iris.With... iris.Options
iris.Addr, iris.TLS, iris.AutoTLS app.Run(iris.ServerOptions{...})
ctx.URLParam("q") ctx.Query().Get("q")
ctx.Params().Get("id") ctx.Params().GetString("id")
ctx.Header(k, v) to set, ctx.GetHeader(k) to read ctx.SetHeader(k, v) to set, ctx.Header(k) to read
app.RegisterView(engine), ctx.View(...) app.Use(view.Handler(engine)), view.Render(ctx, ...)
hero the built-in DI container
middleware/logger middleware/accesslog
middleware/recover middleware/recovery
sessions, cache, websocket, i18n, view, versioning the same names under middleware/
mvc controller/mvc
x/errors, x/client, x/jsonx rest/errors, client, rest/types

Defaults that changed

The compiler does not flag these, so read them before you deploy:

  • Session cookies are Secure and SameSite=Lax.
  • JWT tokens are read from the Authorization header only.
  • CORS no longer advertises credentials together with a wildcard origin.
  • ctx.SetCookie replaces a cookie with the same name, path and domain, and ctx.AddCookie defaults to SameSite=Lax.
  • JSON is encoded and decoded by encoding/json/v2.

MIGRATION.md explains each one, and lists the v12 bugs whose fixes change what you observe.

v12

Nothing changes for an application that imports github.com/kataras/iris/v12. That code stays on the v12 branch, and v12.2.12 is its latest release.

Documentation

Related repositories

Found a problem? Open an issue.

2 days ago
iris
kataras

v12.2.12

This release tags everything that landed on main since v12.2.11. From now on the v12 code lives on the v12 branch, and main moves on to v14, which has its own import path. Nothing changes for your imports: v12 is still github.com/kataras/iris/v12.

Upgrade with go get github.com/kataras/iris/v12@latest.

What's new

  • The module now requires Go 1.26 (v12.2.11 required 1.22).
  • Dependencies are at their newest versions. golang.org/x/crypto goes from v0.31.0 to v0.59.0 and golang.org/x/net from v0.26.0 to v0.62.0, which brings in their security fixes.
  • sessions/sessiondb/badger moves from badger v2 to v4. Its import is now github.com/dgraph-io/badger/v4.
  • x/jsonx: ISO8601 parses timestamps with an unconventional offset, such as 2024-05-21T18:06:07.000000-04:01:19.
  • x/jsonx: new Season bitmask type and a GetSeasonByDate(SimpleDate) helper.
  • x/errors: when a response body cannot be encoded because of a NaN value, the error reports which field holds it.
  • macro/interpreter/token: Type has a String() method. A token type prints as its name (LBRACE) instead of a number.
  • New Arabic translation of the README: README_AR.md (#2539).
  • Documentation and example links point to the v12 branch, and CI runs on it.

Known issue

Keep github.com/kataras/golog at v0.1.12 and github.com/kataras/pio at v0.0.13 (#2587). Running go get -u in your app pulls golog v0.2.0 and pio v0.0.14, and Iris v12 does not compile against them. If your build breaks after an upgrade, run go get github.com/kataras/golog@v0.1.12 github.com/kataras/pio@v0.0.13.

Full changelog: https://github.com/kataras/iris/compare/v12.2.11...v12.2.12

2 days ago
echo
labstack

v5.4.5

Security

  • Redirect middleware: HTTPSRedirect, HTTPSWWWRedirect, HTTPSNonWWWRedirect, WWWRedirect and NonWWWRedirect now return 400 Bad Request instead of redirecting when the host is empty, starts with : or ., contains %, or is empty after removing www.. Before this change, such hosts could produce an open redirect. The middleware no longer redirects OPTIONS * requests, maps ws and wss to http and https in redirect targets, and matches the www. prefix case-insensitively. Fixes GHSA-3f6j-cw5h-qw9c (#3217) in #3220.

Fixes

  • Trailing slash middleware: AddTrailingSlash and RemoveTrailingSlash keep escaped path segments such as %2F in redirect and forward targets, so the request still matches its original route. Fixes #3206 in #3221.
  • IPv6 zones: ExtractIPFromXFFHeader and ExtractIPFromRealIPHeader trust zoned link-local proxy peers such as [fe80::1%eth0]:8080, with or without a port. Fixes #3179 in #3222.
  • Header binding: BindHeaders no longer panics on nil or empty header value slices. Fixes #3169 in #3223.

Behavior change

Context.RealIP() and ExtractIPDirect() now return a zoned link-local peer without its zone: fe80::1, not fe80::1%eth0. Update logs, allowlists or rate-limit keys that store the zoned form.

No public API, dependency or minimum Go-version changes.

2 days ago
echo
labstack

v4.16.4

Security

  • Redirect middleware: HTTPSRedirect, HTTPSWWWRedirect, HTTPSNonWWWRedirect, WWWRedirect and NonWWWRedirect now return 400 Bad Request instead of redirecting when the host is empty, starts with : or ., contains %, or is empty after removing www.. Before this change, such hosts could produce an open redirect. The middleware no longer redirects OPTIONS * requests, maps ws and wss to http and https in redirect targets, and matches the www. prefix case-insensitively. Fixes GHSA-3f6j-cw5h-qw9c (#3217) in #3224.

Fixes

  • Trailing slash middleware: AddTrailingSlash and RemoveTrailingSlash keep escaped path segments such as %2F in redirect and forward targets, so the request still matches its original route. Fixes #3206 in #3225.
  • IPv6 zones: ExtractIPFromXFFHeader and ExtractIPFromRealIPHeader trust zoned link-local proxy peers such as [fe80::1%eth0]:8080, with or without a port. Fixes #3179 in #3226.
  • Header binding: BindHeaders no longer panics on nil or empty header value slices. Fixes #3169 in #3227.

Behavior changes

  • Context.RealIP() and ExtractIPDirect() now return a zoned link-local peer without its zone: fe80::1, not fe80::1%eth0. Update logs, allowlists or rate-limit keys that store the zoned form.
  • HTTPSWWWRedirect keeps its v4 behavior: it does not redirect plain HTTP requests for hosts that already start with www.. v5 redirects these requests.

No public API, dependency or minimum Go-version changes; Go 1.26 or later remains required.

2 days ago
ini
go-ini

v2.0.0-beta.4

2 days ago
ini
go-ini

v1.68.0

What's Changed

New Contributors

Full Changelog: https://github.com/go-ini/ini/compare/v1.67.3...v1.68.0

2 days ago
ini
go-ini

v2.0.0-beta.3